[Infowarrior] - TSA: Smoke Screening (with Schneier)

[Richard Forno]

December 20, 2011
Smoke Screening
http://www.vanityfair.com/culture/features/2011/12/tsa-insanity-201112.print

As you stand in endless lines this holiday season, here’s a comforting thought: all those security measures accomplish nothing, at enormous cost. That’s the conclusion of Charles C. Mann, who put the T.S.A. to the test with the help of one of America’s top security experts.

By Charles C. Mann

Not until I walked with Bruce Schneier toward the mass of people unloading their laptops did it occur to me that it might not be possible for us to hang around unnoticed near Reagan National Airport’s security line. Much as upscale restaurants hang mug shots of local food writers in their kitchens, I realized, the Transportation Security Administration might post photographs of Schneier, a 48-year-old cryptographer and security technologist who is probably its most relentless critic. In addition to writing books and articles, Schneier has a popular blog; a recent search for “TSA” in its archives elicited about 2,000 results, the vast majority of which refer to some aspect of the agency that he finds to be ineffective, invasive, incompetent, inexcusably costly, or all four.

As we came by the checkpoint line, Schneier described one of these aspects: the ease with which people can pass through airport security with fake boarding passes. First, scan an old boarding pass, he said—more loudly than necessary, it seemed to me. Alter it with Photoshop, then print the result with a laser printer. In his hand was an example, complete with the little squiggle the T.S.A. agent had drawn on it to indicate that it had been checked. “Feeling safer?” he asked.

Ten years ago, 19 men armed with utility knives hijacked four airplanes and within a few hours killed nearly 3,000 people. At a stroke, Americans were thrust into a menacing new world. “They are coming after us,” C.I.A. director George Tenet said of al-Qaeda. “They intend to strike this homeland again, and we better get about the business of putting the right structure in place as fast as we can.”

The United States tried to do just that. Federal and state governments embarked on a nationwide safety upgrade. Checkpoints proliferated in airports, train stations, and office buildings. A digital panopticon of radiation scanners, chemical sensors, and closed-circuit television cameras audited the movements of shipping containers, airborne chemicals, and ordinary Americans. None of this was or will be cheap. Since 9/11, the U.S. has spent more than $1.1 trillion on homeland security.

To a large number of security analysts, this expenditure makes no sense. The vast cost is not worth the infinitesimal benefit. Not only has the actual threat from terror been exaggerated, they say, but the great bulk of the post-9/11 measures to contain it are little more than what Schneier mocks as “security theater”: actions that accomplish nothing but are designed to make the government look like it is on the job. In fact, the continuing expenditure on security may actually have made the United States less safe.

The first time I met Schneier, a few months after 9/11, he wanted to bet me a very expensive dinner that the United States would not be hit by a major terrorist attack in the next 10 years. We were in Washington, D.C., visiting one of the offices of Counterpane Internet Security, the company he had co-founded in 1999. (BT, the former British Telecom, bought Counterpane seven years later; officially, Schneier is now BT’s chief security technology officer.) The bet seemed foolhardy to me. Defense Secretary Donald Rumsfeld had just told The Washington Times that al-Qaeda was dispersing its killers all over the world.

From an airplane-hijacking point of view, Schneier said, al-Qaeda had used up its luck. Passengers on the first three 9/11 flights didn’t resist their captors, because in the past the typical consequence of a plane seizure had been “a week in Havana.” When the people on the fourth hijacked plane learned by cell phone that the previous flights had been turned into airborne bombs, they attacked their attackers. The hijackers were forced to crash Flight 93 into a field. “No big plane will ever be taken that way again, because the passengers will fight back,” Schneier said. Events have borne him out. The instigators of the two most serious post-9/11 incidents involving airplanes— the “shoe bomber” in 2001 and the “underwear bomber” in 2009, both of whom managed to get onto an airplane with explosives—were subdued by angry passengers.

Schneier’s sanguine views had little resonance at a time when the fall of the twin towers was being replayed nightly on the news. Two months after 9/11, the Bush administration created the Transportation Security Agency, ordering it to hire and train enough security officers to staff the nation’s 450 airports within a year. Six months after that, the government vastly expanded the federal sky-marshal program, sending thousands of armed lawmen to ride planes undercover. Meanwhile, the T.S.A. steadily ratcheted up the existing baggage-screening program, banning cigarette lighters from carry-on bags, then all liquids (even, briefly, breast milk from some nursing mothers). Signs were put up in airports warning passengers about specifically prohibited items: snow globes, printer cartridges. A color-coded alert system was devised; the nation was placed on “orange alert” for five consecutive years. Washington assembled a list of potential terror targets that soon swelled to 80,000 places, including local libraries and miniature-golf courses. Accompanying the target list was a watch list of potential suspects that had grown to 1.1 million names by 2008, the most recent date for which figures are available. Last year, the Department of Homeland Security, which absorbed the T.S.A. in 2003, began deploying full-body scanners, which peer through clothing to produce nearly nude images of air passengers.

Bruce Schneier’s exasperation is informed by his job-related need to spend a lot of time in Airportland. He has 10 million frequent-flier miles and takes about 170 flights a year; his average speed, he has calculated, is 32 miles and hour. “The only useful airport security measures since 9/11,” he says, “were locking and reinforcing the cockpit doors, so terrorists can’t break in, positive baggage matching”—ensuring that people can’t put luggage on planes, and then not board them —“and teaching the passengers to fight back. The rest is security theater.”

Remember the fake boarding pass that was in Schneier’s hand? Actually, it was mine. I had flown to meet Schneier at Reagan National Airport because I wanted to view the security there through his eyes. He landed on a Delta flight in the next terminal over. To reach him, I would have to pass through security. The day before, I had downloaded an image of a boarding pass from the Delta Web site, copied and pasted the letters with Photoshop, and printed the results with a laser printer. I am not a photo-doctoring expert, so the work took me nearly an hour. The T.S.A. agent waved me through without a word. A few minutes later, Schneier deplaned, compact and lithe, in a purple shirt and with a floppy cap drooping over a graying ponytail.

The boarding-pass problem is hardly the only problem with the checkpoints. Taking off your shoes is next to useless. “It’s like saying, Last time the terrorists wore red shirts, so now we’re going to ban red shirts,” Schneier says. If the T.S.A. focuses on shoes, terrorists will put their explosives elsewhere. “Focusing on specific threats like shoe bombs or snow-globe bombs simply induces the bad guys to do something else. You end up spending a lot on the screening and you haven’t reduced the total threat.”

As I waited at security with my fake boarding pass, a T.S.A. agent had darted out and swabbed my hands with a damp, chemically impregnated cloth: a test for explosives. Schneier said, “Apparently the idea is that al-Qaeda has never heard of latex gloves and wiping down with alcohol.” The uselessness of the swab, in his view, exemplifies why Americans should dismiss the T.S.A.’s frequent claim that it relies on “multiple levels” of security. For the extra levels of protection to be useful, each would have to test some factor that is independent of the others. But anyone with the intelligence and savvy to use a laser printer to forge a boarding pass can also pick up a stash of latex gloves to wear while making a bomb. From the standpoint of security, Schneier said, examining boarding passes and swabbing hands are tantamount to performing the same test twice because the person you miss with one test is the same person you'll miss with the other.

After a public outcry, T.S.A. officers began waving through medical supplies that happen to be liquid, including bottles of saline solution. “You fill one of them up with liquid explosive,” Schneier said, “then get a shrink-wrap gun and seal it. The T.S.A. doesn’t open shrink-wrapped packages.” I asked Schneier if he thought terrorists would in fact try this approach. Not really, he said. Quite likely, they wouldn’t go through the checkpoint at all. The security bottlenecks are regularly bypassed by large numbers of people—airport workers, concession-stand employees, airline personnel, and T.S.A. agents themselves (though in 2008 the T.S.A. launched an employee-screening pilot study at seven airports). “Almost all of those jobs are crappy, low-paid jobs,” Schneier says. “They have high turnover. If you’re a serious plotter, don’t you think you could get one of those jobs?”


---
Just because i'm near the punchbowl doesn't mean I'm also drinking from it.