Schneier on Security

Richard Steven Hack • July 6, 2011 1:39 PM

Bruce is just wrong on this one.

This guy managed to defeat various layers of airport security just by being a good con artist. He had numerous boarding passes in his possession. He flew transcontinental at least once and was only caught the second time because of his SMELL. NO ONE knows how many times he has done this in the past BY DEFINITION because they never checked his ID!

“one still needs to smuggle one’s
weaponry/bombs/etc. past security.”

And you really think that is a problem? As someone above pointed out, what if he had confederates who could smuggle a weapon onto the plane? There are numerous ways this could be done. Airport security is a joke, as Richard Marcinko proved when he got his Red Cell SEAL Team next to Air Force One. Granted, that was pre-9/11 but that doesn’t matter. I’m quite certain he could do it again, especially against a simple commercial airliner.

Also, anyone who says this is just “one failure” simply can’t back that up. This is “one failure” that got some press. We don’t know and can’t know how many other times this has occurred. There are thousands of con artists and other types who fake IDs and can easily fake boarding passes.

Bottom line: If you don’t know who is getting on the plane – and frankly, you can’t – you have no security.

Anyone who thinks someone couldn’t physically get on a plane – with weapons – by completely bypassing the security checkpoints simply isn’t being realistic. There’s absolutely no doubt in my mind that it could be done. It would be a multi-staged plan that required some insider knowledge – but in computer security we know that is not difficult to come by.

THIS guy wasn’t a threat. But someone using similar techniques as part of a multi-stage plan certainly could be.

Richard Steven Hack • July 6, 2011 2:54 PM

Dragonfrog: “Well, if indeed he had confederates do all the work of smuggling him a weapon onto the plane, he would surely have bought a ticket and brought his own ID.”

Why do you believe that? I definitely wouldn’t. I would be using a false ID for sure. Even if I thought I was a suicide case – why give away information to the enemy?

Also, I’m not only talking about confederates smuggling the weapons aboard the plane. I’m talking about confederates who can either 1) get him aboard the plane without passing the security checks, or 2) can provide him with the information he needs to do either.

Remember “Casino Royale”? The terrorist got into Miami airport, switched into a security uniform, used information provided by a confederate (we don’t know how that was done, but clearly there are various ways) to access a secure area, retrieved an unsecured firearm from the security area, caused a security incident and used that to access the field and the aircraft area.

There’s no reason to believe something similar couldn’t be done just to get someone on a plane with weapons or explosives.

The person involved in this incident slept overnight in a secure area of the airport, according to the report. Who knows what he may have done or learned during that time?

What if he planted surveillance devices poised to discover important security information such as the key code to access a secure area as the guy in the movie did? ATM hackers plant surveillance devices next to ATMs to do precisely that. Are airports regularly swept for rogue surveillance devices that might be used to compromise security protocols? I suspect not.

Airport security is another area where “complexity” is the enemy of “security”. There are just too many things going on and too many people to ever have “security” in such an environment. It’s not a prison where people are watching and movement is totally controlled.

And even in prison, I can tell you from experience that things the controllers don’t want to happen do happen every day despite all the controls in place to prevent them from happening.

It’s IMPOSSIBLE to secure an airport. Period.

Richard Steven Hack • July 6, 2011 3:17 PM

People in security need to read Richard Marcinko’s Red Cell book. His Red Cell SEAL Team made mincemeat of military security all over the world. They got within twenty meters of the President’s cottage at Camp David, got on to Air Force One, penetrated Point Magu Naval Air Station nuclear weapons lockers, US Naval Intelligence headquarters, on to nuclear subs tied up at Groton Naval Base, and much more.

The time when they reduced Point Magu to utter chaos is a hilarious look at how “security” is a joke.

Examples:

“It was child’s play to get someone over the fence—even in broad daylight and right next to the main gate. How? Horseface drove by the gate,
honking and cursing at the guards, tossing a couple of cartons of milk in their direction as he went past. Yoo-hoo—everybody watch Horseface.
Meanwhile, ten feet away, Ho-Ho-Ho and Doc Tremblay were vaulting over the eight-foot chain-link fence and jogging away. Doom on you, gate guards.”

“Which is precisely why my very own MEP guerrilla, Lieutenant Trailer Court, wearing a purloined commander’s uniform instead of black pajamas and a kaffiyeh, checked in at 1900 Friday evening. He drove up to the gate and explained to the guards he was supposed to report for work Tuesday, but had arrived early so he could spend the weekend at the BOQ and not pay a motel bill. Trailer carried an ID card we’d stolen at a bar two nights before, but it wasn’t necessary: the screwups in Navy Security let him in without checking a thing.

He went straight to the BOQ, jimmied his way into an unused room, and unpacked the weapons, night-vision goggles, radio equipment, and
explosive devices we’d had him smuggle onto the base for us. Then he used his vest-pocket scrambler to call us on the phone in his room to
report the coast was clear. Great. I dispatched Ho-Ho-Ho, Horserace, and Baby Rich, dressed in fashionable basic black, over the fence. No one
saw or stopped them. They went to Trailer’s room, changed into work clothes, picked up their explosives equipment, and went out to steal a
weapons carrier we’d spied sitting by the motor pool the previous day.

The trio drove the WC to the ordnance warehouse, broke in. Jump-started a forklift, and stacked the truck with a palletload of bright blue,
dummy 500-pound bombs they found there. They rigged the bombs with remote-controlled detonating devices and booby traps, covered the bulky load with a camouflage tarp, and drove the whole consignment back to the BOO parking lot where Trailer could keep an eye on it.

Then, looking as innocent as Huey, Louie, and Dewey, they ambled out through the main gate, waving at the rent-a-cops as they went.”

“The DOD police caught up with Cheeks and Minister just as they were “planting” explosives. They’d given themselves away by purposely walking across a sensor-rich area. The cops surrounded my boys and took ‘em down. Then, they were quickly frisked, cuffed, thrown into the back of a car, and taken to the DOD police station, which was located outside the Pt- Mugu base perimeter.

Except, they hadn’t been frisked very carefully. Cheeks had a handcuff key in his pocket, and a pistol in a crotch holster.

He was frisked by a female, who was understandably reticent about giving his groin a businesslike grope, especially when Cheeks ragged her about it—“Hey, baby, how about a lube job—come on, just put your hand down
there where it’s hot and hard.”

Big Mistake One. Cheeks was armed and he was dangerous.

He used both key and gun to good advantage once he was inside the station. First, he freed the Minkster. Then, the pair of them took all
the rent-a-cops, as well as their station, hostage. The rent-a-cops now had to call the SWAT team for help.”

“On Sunday, we played “Chester Chester Child Molester” with the local police. Horserace, Doc Tremblay, and Ho-HoHo went scrambling through the hallways of an enlisted family housing complex about half a mile outside the main gate. The appearance of three evil-looking guys in black
T-shirts, jeans, and balaclavas, carrying machine guns, brought real screams from mommies and daddies. Dozens of people called 911 to report
the incident. We used the complaints to tie down the local police, a crew of FBI agents who’d shown up to play, the DOD police, and two jeeps
of Bob Laser’s Rambos/Rambettes. It looked like a police convention outside the housing complex: a dozen cars with gum-ball lights flashing, while the quartet of law-enforcement organizations argued long and loud about who the hell was in charge here.

We, of course, didn’t give a rat’s ass who they thought was in charge. We knew who was in charge—us. So, while the cops argued, we set off
smoke-grenade explosives in the main HO building, the power generating station, Gordy Nakagawa’s prized weapons locker, and the fuel depot.

Doom on you, cops.”

“It was almost time to go home. But one succulent, irresistible target remained—Air Force One, which was scheduled to depart about midday. It was just too tempting to ignore. Dressed in mechanic’s covecalls, Frank and Cheeks climbed into the weapons carrier that had remained parked all weekend in-the BOO lot and drove it over to the far corner of the field, where the president’s 707 was being fueled and serviced. They climbed out and activated the explosives rigged to the pallet-load of 500-pound
bombs. Just to be extra thoughtful. Cheeks set another charge: he booby-trapped the weapons carrier’s driver’s seat.

Their job completed, Frank and Cheeks sauntered back to the BOQ and changed clothes in Trailer’s room. The three of them packed the car and
got ready to leave. Then they went up onto the roof of the BOQ to watch the results of their handiwork.

As a parting gesture of friendship, we’d also rigged explosives in the SWAT team’s emergency response truck. When Minkster telephoned our
threat against Air Force One to Bob Laser, virtually every one of Bob’s Rambos and Rambettes headed for the truck, which “exploded” in a cloud of smoke.

The umpires ruled ten dead, ten injured. Doom on you. Rambos and Rambettes.

When the SWAT survivors finally discovered the weapons carrier (it took them more than an hour to work their way onto the lot adjacent to Air
Force One), they approached it with great caution. You could see the apprehensive looks in our long-lens video shots. They were going to do
this by the book.

They sealed off the area. They called for EOD — the demolition team. It arrived and there were fifteen minutes of consultation. Then, carefully,
the explosives in the rear were disarmed wire by wire. With the bombs safely defused, a Rambo climbed into the cab to drive the vehicle away.

Ka-boom—our smoke-grenade booby trap went off and exploded the whole pallet-load of 500-pound bombs. It was a Frogman’s dream come true—a living centerfold from the Blaster’s Handbook. Trailer radioed me that the view from the BOQ roof was spectacular.

‘Skipper, the only thing missing was the caption ”The End—a Dick Marcinko Production of a Red Cell Scenario.‘ “

Richard Steven Hack • July 7, 2011 1:44 PM

GreenSquirrel: And I re-iterate that it’s more than the ID. It’s the fact that he got on the plane after spending the night in a secure area of the airport without supervision, and that his possession of multiple boarding passes that were not his own clearly show that he has done this multiple times.

In short, who he was may not be relevant but THAT he was is very relevant.

And yes, IF you are going to maintain a “terrorism watch list” – which means checking IDs BY DEFINITION – then you bloody well better be checking them right along from entry into the airport to the plane, on the plane and out the other end of the flight.

I say again, IF you are going to maintain a “watch list” which is stupid primarily because of the inability to establish who is who with paper in the first place.

Richard Steven Hack • July 9, 2011 12:37 AM

Green Squirrel: I agree with averros above.

You’re focusing on the lack of a weapon. I’m focusing on the lack of control of the individual. If you can’t control the individual, whether he has a weapon or not is irrelevant.

You can drop a plane without a weapon, if you’re smart enough and knowledgeable enough. All you need to do is get into that cockpit. Alternatively all you need to do is get into the avionics compartments. To do either, all you need is smarts, muscle and maybe a tool probably obtainable on the plane.

Grab a stewardess or one or more civilians, threaten to break their necks unless you get into the cockpit. Most of the time that will work, even if the pilots expect a suicide attack. That is because an immediate death threat is likely to sway someone immediately, on the notion that perhaps the end result will be a hijack rather than a suicide attack.

The result of such a tactic, even post-9/11 when passengers may fight back, will be at least one death other than that of the hostage taker. Do this enough times and people will not fly. Even air marshals on every plane can’t prevent this sort of attack.

“The most you can do is verify that the person is the person who is supposed to be sitting in that seat – something that hits at the airline revenue model rather than national security.”

No, it hits at airline security directly. Again, if you don’t know who is in that seat, you can’t know if there is a threat to the plane. It’s that simple. The fact that there is no way to insure who is in that seat does not change that fact.

Mind you, I’m not saying preventing this is DOABLE. It’s not. We agree in that. I’m saying if the government wants to CLAIM their security systems are adequate, they need to prevent precisely this sort of thing as well as preventing weapons from getting aboard.