Security Analysis of TSA PreCheck

Interesting research: Mark G. Stewart and John Mueller, “Risk-based passenger screening: risk and economic assessment of TSA PreCheck increased security at reduced cost?”

Executive Summary: The Transportation Security Administration’s PreCheck program is risk-based screening that allows passengers assessed as low risk to be directed to expedited, or PreCheck, screening. We begin by modelling the overall system of aviation security by considering all layers of security designed to deter or disrupt a terrorist plot to down an airliner with a passenger-borne bomb. Our analysis suggests that these measures reduce the risk of such an attack by at least 98%. Assuming that the accuracy of Secure Flight may be less than 100% when identifying low and high risk passengers, we then assess the effect of enhanced and expedited (or regular and PreCheck) screening on deterrence and disruption rates. We also evaluate programs that randomly redirect passengers from the PreCheck to the regular lines (random exclusion) and ones that redirect some passengers from regular to PreCheck lines (managed inclusion). We find that, if 50% of passengers are cleared for PreCheck, the additional risk reduction (benefit) due to PreCheck is 0.021% for attacks by lone wolves, and 0.056% for ones by terrorist organisations. If 75% of passengers rather than 50% go through PreCheck, these numbers are 0.017% and 0.044%, still providing a benefit in risk reduction. Under most realistic combinations of parameter values PreCheck actually increases risk reduction, perhaps up to 1%, while under the worst assumptions, it lowers risk reduction only by some 0.1%. Extensive sensitivity analyses suggests that, overall, PreCheck is most likely to have an increase in overall benefit.

The report also finds that adding random exclusion and managed inclusion to the PreCheck program has little effect on the risk reducing capability of PreCheck one way or the other. For example, if 10% of non-PreCheck passengers are randomly sent to the PreCheck line, the program still is delivers a benefit in risk reduction, and provides an additional savings for TSA of $11 million per year by reducing screening costs—while at the same time improving security outcomes.

There are also other co-benefits, and these are very substantial. Reducing checkpoint queuing times improves in the passenger experience, which would lead to higher airline revenues, can exceed several billion dollars per year. TSA PreCheck thus seems likely to bring considerable efficiencies to the screening process and great benefits to passengers, airports, and airlines while actually enhancing security a bit.

Tags: , , ,

Posted on June 28, 2016 at 2:10 PM • 31 Comments

Comments

PreCheck Vulnerability • June 28, 2016 2:59 PM

Interesting event (possible security vulnerability?) that occurred when my significant other was on business trip:

1)His/Her colleague, cleared via TSA Pre Check and accompanying my significant other, purchased my significant other’s tickets for the trip.

2)My significant other’s boarding passes were printed with “TSA PreCheck” appearing on the boarding passes.

3)My significant other is NOT yet TSA PreCheck and made no attempt to enter the TSA PreCheck lines.

4)Repeatedly, my significant other was asked by TSA officers, “Why aren’t going through TSA PreCheck line(s)? They’re a lot faster.”

Fnord • June 28, 2016 3:16 PM

This “analysis” is not based on any actual evaluation of effectiveness of the TSA’s Pre-Check screening at detecting terrorists. It just assumes a specific (high) rate of screening effectiveness, and analyzes the effect of Pre-Check based on that number.

tim • June 28, 2016 3:17 PM

PreCheck Vulnerability

No. Airlines are allowed to give people TSA Precheck on a case by case basis. Usually if you have some sort of status. My partner has been given it twice this year (about a 10% rate) and no status.

Pete • June 28, 2016 3:57 PM

I don’t think there’s a general vulnerability in PreCheck for travel partners. I’m PreCheck certified; my spouse is not. They often get PreCheck when we make reservations together, but we’ve experienced trips where I was granted PreCheck status and they were not.

Jack • June 28, 2016 4:10 PM

Very good executive summary of TSA Pre-check. However, most of the analysis was published a few years ago in a Master’s thesis at the Naval Post Graduate School where, in my opinion, that author did a much better job in explaining the statistical framework of how the practice would work. Unfortunately, being brilliant that individual never advanced much further in TSA and random exclusion was abandoned once political pressure was put on TSA over leaked Red Team test results showing TSA doing poorly at checkpoint screening. If the model had been followed, and TSA actually spent more time training its front line screeners (currently most fast food counter workers and Apple Genius employees receive more training than a TSA security screener does) the system would have worked and the long lines you see at airports this summer would have been avoided all the while providing better security.

Coyne Tibbets • June 28, 2016 7:25 PM

I’m not an aviation security expert, but I was reading along:

“[…] Our analysis suggests that these measures reduce the risk of such an attack by at least 98%.”

…and that was when I realized the study intro was written by a snake-oil salesman. The only way risk is being reduced by 98% is if you lock all the passengers in the terminal and the plane leaves without them; and even then I’m afraid the captain or crew will do something untoward and blow out the risk matrix.

This reads like political salesmanship to me: trying to sell Congress that everyone needs to be forced into pre-check. Only for our own safety of course…

Where have we heard a refrain like that? Oh, right, our surveillance-hungry government.

Your 10th Grade English Teacher • June 28, 2016 7:39 PM

“the program still is delivers”

and

“Reducing checkpoint queuing times improves in the passenger experience, which would lead to higher airline revenues, can exceed several billion dollars per year.”

Does anybody proofread ANYTHING anymore?

Guvvermint are good.

65535 • June 29, 2016 2:07 AM

@ Pete
“They often get PreCheck when we make reservations together…”

I suspect that when traveling together one person could act as a witness to abuse by the TSA. When traveling apart – single people – there is no second person as a witness to abuse. Thus, a huge number of single travelers don’t get “prechecked.”

I also think it depends upon the airport location and legal jurisdiction. Some jurisdictions probably get a high number of expensive lawsuits and the airport in that jurisdiction is more likely to hand out more “prechecks” to individuals.

As pointed out in prior blog entries the TSA lines are “target rich” for killers thus making the whole risk profile less safe. A gunman with a high number of magazines or hand grenades could kill a lot of people in those TSA lines.

Herman • June 29, 2016 4:27 AM

The latest crop of bombers did not go through security. It is sufficient to threaten the throng before the checkpoint.

David M • June 29, 2016 7:59 AM

@PreCheck Vulnerability

I think that they are still using the managed inclusion model to randomly put people in the PreCheck group. We were flying on vacation with a family friend who is 13 and he got PreCheck both ways (my wife didn’t). This could just be a case of coincident timing.

@Tim

“Airlines are allowed to give people TSA Precheck on a case by case basis.”

I thought they (TSA) eliminated this last year. The original PreCheck test groupings were sponsored by the airlines out of their FF pools (I was in the first United IAH group) Once TSA started collecting fees from travelers that gig was up (or so I believe.)

FWIW
DLM

Bumble Bee • June 29, 2016 8:40 AM

I fly infrequently, (it’s much too expensive for me,) but last time I did fly, I was on PreCheck. I assume it’s because I’ve already been very thoroughly checked out and they wanted to usher me through without a scene.

arthur • June 29, 2016 11:52 AM

The entire paper rests on the dubious claim that directing some number of passengers through Precheck measures enhances security by producing additional vigilance in the non-precheck line – it would seem the more likely result is that staffing is reduced.

david shayer • June 29, 2016 12:12 PM

The main purpose of TSA Pre-Check is obviously political. Everyone hates airport security lines, but the top 1% of government and business who fly a lot get really annoyed at the wasted time. They support “security” (theater), they object to inefficient long lines, but they’re not willing to fund the TSA sufficiently to have short lines.

So the obvious capitalist solution is short lines for those willing to pay. Pony up $75, and you too can get in the short line. For those in the top 1%, $75 is nothing. In fact, their business probably covered the expense. The rest of you, wait in line!

Congress loves it. It’s one less thing that campaign contributors complain about, since anyone with enough money to be contributing to a political campaign can afford TSA Pre-Check. And congressmen ignore anyone who doesn’t contribute to their campaign.

Hay Seed • June 29, 2016 3:42 PM

TSA Pre-check requires the target to be fingerprinted, produce several kinds of ID, investigated, submit to an in person interrogation and pay a tribute.

No wonder it works. Bad guys wouldn’t do that.

My question though, is why should good guys submit to that kind of over the top, intrusive and abusive scrutiny merely to slightly more easily exercise their former Constitutional right to internal travel without government interference?

That no one questions this fundamental liberty, lends support to my belief we have transcended to a post constitutional era and any pretense otherwise is simply to placate the rubes back in Peoria.

“Papers…please comrade”. It’s sounds so polite doesn’t it?

I suppose the reason everyone isn’t required to submit to precheck is DHS doesn’t have staff and infrastructure to mandate it,…yet.

Certainly an internal passport is in the works and won’t be limited to travel by air.

jon • June 29, 2016 6:47 PM

Confidence and risk reduction factored to three significant figures? I highly doubt that. I don’t there have been enough positives found to possibly get further than a single significant figure. Which might call the study into question.

It’s on par with my claim that my rhinocerous repellent is 100% effective, having never seen one.

I agree with those above finding the 98% reduction factor to border on specious, at best.

Looked at another way, it might be more reliable to say that having a person in uniform watching people walk down a corridor, or a gate attendant asking flyers if they were terrorists, intent on harm, might have a success rate of over ninety percent.

MrC • June 29, 2016 7:04 PM

@ 10th Grade English Teacher:

“Does anybody proofread ANYTHING anymore?”

It was pre-checked.

Mark J • June 29, 2016 9:38 PM

=TSA Pre-check requires the target to be fingerprinted, produce several kinds of ID, investigated, submit to an in person interrogation and pay a tribute.=

Not quite as melodramatic as all that. My 15 minute Pre-check experience was quite painless. I showed just my passport, not “several kinds of ID.” I was not interrogated or even asked questions other than to verify I was the person I claimed to be. I did provide fingerprints, which is the 5th time in my life I’ve had to do so for one reason or another, including for my current job. And if I was investigated, it wasn’t while I was there. Most likely their “investigation” showed that my wife and I have been in our current careers for over a decade and have lived in the same house for all that time and most likely have no reason whatsoever to cause mayhem on an airplane. The $85 fee is about what I’d spend on a good bottle of Scotch, so easily worth it to avoid the hassles of the usual security lines.

That said, I’m not a believer that all the BS security theater does squat to increase security at the airport. It just shifts the point of vulnerability. All the more reason to want to get through that vulnerable point more quickly.

Hay Seed • June 30, 2016 7:10 AM

Regarding the very friendly TSA pre-check process, I found on the internet the wait time for the interview is weeks and months, followed by weeks and months waiting to see if the honest citizen has been deemed honest. In other words, replacing one line for a longer line.

I repeat only honest citizens would avail themselves to this kind of intrusion and abuse. Only.

Essentially, Pre-check would be familiar to any criminal being booked in a jail for a criminal offenses: picture, prints, computer check, submissiveness rating…

All that’s absent is committing a crime.

Honest people shouldn’t be treated like criminals so they can keep their shoes on, computer in luggage and have a bottle of water.

I guess it’s useless to harp on our former unalienable rights, no one cares anymore.

Freedom to travel was our right. Not anymore.

Jane • June 30, 2016 11:00 AM

I hate to come off sounding as if I support the TSA in any way, but I guess I never learned to keep quiet.

We have not (yet) reached the “papers, please” restriction on travel here. You can still cross state and county lines. Although if you drive instead of walk, you could still be selected (theoretically self-selected) to provide your license and proof of insurance.

Your 10th Grade English Teacher • June 30, 2016 2:19 PM

@MrC:
“It was pre-checked.”

^o^ You win the internet, dude! ^o^

Seriously, though, I’m so glad my ever-growing taxes are being used to hire the very best and brighCHOKECOUGHCHOKE(thud)

An American • June 30, 2016 4:47 PM

I’ve got an idea that would create immense benefit at the cost of a significantly small increase in risk: abolish the TSA.

Simple to implement, 100% reduction in costs, extremely high passenger satisfaction… we all know it’s the right thing to do.

An American • June 30, 2016 4:53 PM

@ Herman

The latest crop of bombers did not go through security. It is sufficient to threaten the throng before the checkpoint.

Obviously we need checkpoints before the checkpoints.

Shoot… I better shut up before some be-urry-crat sees this and thinks I’m serious…

Clive Robinson • June 30, 2016 6:54 PM

@ An American, Herman,

The latest crop of bombers did not go through security. It is sufficient to threaten the throng before the checkpoint.

A long time ago in an age we have near forgot, @Bruce made a joke about “A55 bombers” and others made serious comments about the risk of security check choke points and land side attacks.

If I were a betting man at that time I would have put money on the land side attacks happening before someone stiched a bomb up their butt.

As history now shows I would have lost such a bet, somebody did indeed sew a bomb up their butt and tried to kill a Saudi Prince. The plot failed even though it was not just the brown stuff hitting the fan. And for a short while Bruce nervously joked about getting a visit etc, whilst the rest of us worried about TSA staff with size 14 black rubber elbow gloves and flashlights doing a PR number on us at the check point.

PerryD • June 30, 2016 9:36 PM

@Hay Seed et al; I travel with relative frequency, about 15 domestic US trips per year. When the PreCheck program was first introduced several years ago, I was enrolled by USAir without any action on my part…no interviews, documentation, or any other corroborating evidence from me.

Over those several years, the only time that I -haven’t- had a PreCheck boarding pass was during the month in 2014 that I was running a public Tor bridge. I (or rather my home IP) was blocked…couldn’t log into bank accounts, renew my driver’s license, etc, and my PreCheck status ‘mysteriously’ was suspended. Ever since, I am ‘totally randomly’ (their words) selected for additional screening every single time I travel by air. I’ve been put up against a wall spread-eagle while a dog goes through my car when entering military bases ‘totally randomly’ (their words).

Once I move the Tor bridge to a private, unpublished IP the restrictions on banking, DMV transactions and such were dropped, but I still get pulled aside for extra screening, even when in the PreCheck line.

Dirk Praet • July 1, 2016 5:18 AM

@ Clive, @ An American, @ Herman

The latest crop of bombers did not go through security. It is sufficient to threaten the throng before the checkpoint.

From what I’ve read it would seem that one of the perpetrators upon airport entry created a diversion by blowing himself up, allowing the two others to get inside. It doesn’t take a tactical genius to go about an attack this way. I remember using similar tactics overtaking the opposite camp during my time at the boy scouts. The only way to mitigate against this is by having multiple perimeters and avoiding choke points.

To the credit of Turkish LE and customs, they did spot that the three men were unusually overdressed, which forced them to split up early on. If they had gone unchecked, the carnage would probably even have been bigger.

mrpizzaman • July 1, 2016 7:02 AM

Still not flying to any TSA infested airport. And I make it a point to always react to invitations for coming to the US.

The TSA is (almost) useless from a security pov and a pest from a business pov. Millions of people are avoiding anything in the US as they, rightly so in my opinion, do not want to be sexually assaulted (because that is what it is, if you do not believe me, as any legal professional on what the charges would be if you did it – don’t sexually harass people, not for any reason, not even if you are a government – bad idea).

By comparison, a country like Israel, does not engage in any of these practices.

As fas as the ID and fingerprinting is concerned: anyone thinking that this is proof of anything should probably not work in security: the Japanese system some time ago (google it) has been beaten on several occasions with counterfeit passports and a piece of tape (like in 10 $ special tape) by foreign workers … and for those who do not know, about 200-300m from the airport boats dock with no checks whatsoever … security is a framework and global concept, not a theatre like in the US.

The US has put me and many other of from travelling there – good luck with your (declining) holiday market and increasing security problems.

Barbara Chustz • July 1, 2016 7:51 AM

I paid $100.00 and waited approx. a month for my Global Pass Card. I recently traveled by Southwest Airline from New Orleans. I was pre-checked on the flight there but was not on the flight from New Orleans.
I wrote a complaint to TSA explaining that I have had a Global Pass for a year and I wanted to know why I was not pre-checked. They sent me a form letter telling me that I should apply for TSA or Global Pre-check. The obviously did not read my complaint and didn’t respond appropriately to my question. I am fed up with TSA and don’t think they provide any security as they have not stopped a single terrorist attack anywhere! The personnel are rude and and there is not consistent
procedures from airport to airport especially in regard to medical equipment.

Chris Gomez • July 1, 2016 1:09 PM

Crowds are a great target. Long lines to get through security are just where you move the attack to. Sure, getting a hold of an aircraft and flying it into a key landmark make for good TV news, but imagine the effectiveness of attacking more targets, more often. People would be afraid to go anywhere or do anything.

The DC sniper(s) had people walking through parking lots in zig zag patterns.

Why haven’t terrorists begun attacking so frequently and randomly in the US? They could either be incompetent or not here in large numbers. There could be some effectiveness in law enforcement, but I suspect these would be released as big news stories.

A related NY Times article does point out overall questioning of security theater:

“Perhaps the most cost-effective measure is policing and intelligence — to stop them before they reach the target,” Mr. Stewart said.

anon • July 1, 2016 6:14 PM

You are not allowed in the USA to grant privileges to an elite, in a publicly funded system.All must be treated to same access to govt funded programs or eqpt, unless legislatively accredited.

Same with having conserved metal detector lines for frequent fliers.

How can they legally do this at all?

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.