top | item 13263153

Security Risks of TSA PreCheck

116 points| CapitalistCartr | 9 years ago |schneier.com | reply

128 comments

order
[+] LukaAl|9 years ago|reply
The problem with this article is that it fails to recognize the real threat model. The objective of a terrorist is not to blow up a plane, it is to scary people and do this by killing and injuring the highest number of people while minimizing the risk of being detected.

If this is the threat model, why a rational terrorist should try to put the bomb on a plane? The Brussel Terror Attack has shown exactly this[0]. Terrorist killing themselves at the check-in counter (but they could have chosen the security lanes).

Obviously, we need airport security because the threat model is not only terrorists but also hijackers and smugglers (and non-rational terrorists?). Obviously, the risk of using the hijacked plane as a bomb, like in 11/9 is still a risk, but other measures like reinforced cabin doors are more effective for that.

So, basically, the TSA is a failure in making people safer and but a huge success in making traveler life miserable. TSA Pre-Check is nothing but them keeping on with their "good work".

[0] https://en.wikipedia.org/wiki/2016_Brussels_bombings#Brussel...

[+] candiodari|9 years ago|reply
If you want an even better example, try the Istanbul attack:

https://en.wikipedia.org/wiki/2016_Atat%C3%BCrk_Airport_atta...

3 Terrorists total. The attack went as follows : 2 terrorists queue up in an Xray machine line, and suddenly start shooting people. One of the terrorists is shot down and a few seconds later he detonated a suicide vest.

What does an airport security line do at that point ? Well, of course it fails open. Security abandoned their posts and none of the security guards responded for minutes to the second attacker in the line walking around and shooting people. He walked right through, got on an escalator and continued shooting people for ~2 minutes. Eventually a security officer (one wandering around by himself, not identified) shot him from a distance, looked up close at the attacker, and ran away (the terrorist exploded shortly after that, I hope the guy made it out). A third terrorist blew himself up in what was essentially a security pre-check line outside the airport.

Any chokepoint, of course, is a terrorist target at an airport. I've been to Istanbul airport. It's big, but not that big. In this attack 45 people died and 230 were wounded. There are plenty of far bigger airports where that number would have been way up. Thankfully I do think security personnel would not just immediately abandon their posts in the US when something like this happens.

That of course means that TSA makes things worse in some ways and provides a target for terrorists unless they avoid making lines. Heh. "Somehow" that doesn't seem to be the conclusion they're drawing from this. In fact I am unaware of any official responses to these attacks.

[+] literallycancer|9 years ago|reply
If the goal of terrorist organizations was to kill the most people, they would target critical infrastructure, like drinking water reservoirs or perhaps air traffic control towers, if they have a thing for airplanes.

They will say they are trying to kill people to help their cause, but it's more likely that they operate as any other 'business'. They try to impress the 'investors' (e.g. Wahhabis with oil money), so they can get more resources and expand into other 'markets'.

[+] sandworm101|9 years ago|reply
The real error is that it assumes the primary role of TSA screening is to prevent attacks. Looking at the record, their primary job is to catch really stupid drug dealers, drunks, and people subject to federal warrants. That's the vast magority of arrests and is little damaged by pre-screening. Enforcement of terminal drink/food monopolies is just a bonus.

This is security theatre. Trying to apply logic doesnt work. There was a report a few years ago, accidentally leaked, by TSA showing that 911-style hijacking was no longer possible. Nobody with small knives could ever take a cockpit, not with 100 post-911 passengers watching.

[+] TallGuyShort|9 years ago|reply
I've been very critical of the TSA, but if (since) that's the threat model, that actually highlights the benefit of security theater. As Schneier points out, there are essentially no terrorists. It's like trying to find a needle in a haystack, and it's arguably better to just let the needle go through than to screw up all the hay.

But if the terrorists are mainly just causing fear instead of harm, doesn't it make sense to counter it by making people feel safer instead of actually making them safer, especially if you practically can't do the latter?

Food for thought...

[+] X86BSD|9 years ago|reply
I said this the moment TSA was created. "Wow fedgov! Thanks! You just made my job as a terrorist exponentially easier! Now instead of having to get through security to get on a plane and blow it up, you corralled all the people on multiple flights into a single file line in one place for me before security. Thanks! Now I can wait in line with my bomb on my body until I'm the next one to go through the scanners, then detonate as o take my shoe off. Taking out the security checkpoint, all your useless equipment, TSA personnel, and innocents. Thanks!"
[+] kapitza|9 years ago|reply
Because the goal (or rather the means) of terrorists is to scare people. And it's much scarier to imagine your plane being blown up in the air.

Reason has nothing to do with it. The number of deaths due to car accidents, even falling down the stairs, is much greater. The main impact of terrorism is the irrational fear, not the rational risk aversion. But it's much easier to stamp out terrorism by force, hard as that may be, than to convert human beings into rational animals.

The goal of terrorists is to achieve power through violence. The gold standard would be the PLO, now the PA. The ANC also did extremely well with this strategy.

There are two effective ways to combat terrorism. One is to surrender to the terrorists. Neither the PLO, nor the ANC, nor the IRA, is setting off any bombs these days. Works great especially if surrounded by a cloud of euphemisms.

The other is to treat the terrorism as an isolated incident and counterattack on the political front. Consider the response to Timothy McVeigh or especially Dylann Roof -- textbook. Great stuff, America still knows how to do it.

If terrorism is committed in the name of the Confederate flag, ban the Confederate flag and crack down on white nationalists everywhere. Even the peaceful ones. Especially the peaceful ones. No one ever said that the best way to defeat racist terrorism is to satisfy the legitimate grievances of moderate racists. But if the USG adopted this strategy, the GOP would probably grow a "militant wing" in well under a decade...

[+] logicallee|9 years ago|reply
>The objective of a terrorist is not to blow up a plane, it is to scare people and do this by killing and injuring the highest number of people while minimizing the risk of being detected.

Let's talk about this.

What kind of objective is this? For insight into the psychology of terrorists can I consider the psychology of "trolls"? (i.e. mostly harmless Internet trolls). Or people just generally trying to wreak havoc "for the lolz"?

Or is it different? What I mean is that people like Chomsky accuse the United States of being "terrorists" in whenever he thinks the United States meets some technical definition -- but the United States has some kind of political goals and it's not an end in itself to just have a bunch of people "scared" or "killed and injured". The U.S. doesn't say, "hey could we scare a billion people!! Yeah let's do it!!" Which is precisely what you quoted as the terrorist's objective: "it is to scare people".

So what is the actual motivation of terrorists? Why is it motivating to "scare people"? (For the same reason as trolls are motivated?) Some people ascribe religious motivations for it, but I read through the Koran (you can read it easily here[1], it should take you under an hour, it's very repetitive. Copied into a Word document in 10-point single-spaced font it's 180 pages but you can scroll through it very quickly) and I did not once see anything like "Thou shalt scare people" or "Thou shalt wreak havoc by killing and injuring the highest number of people." I searched for "scare" and did not see that word. So in effect I don't understand why you say the primary rational objective of terrorists is to scare people.

It doesn't really make sense unless it's the same as Internet trolls. I'd like more insight.

[1] http://www.archive.org/stream/thekoranalquran02800gut/koran1...

If you want to get it down to 181 pages to read quickly 1) open the above link 2) select all of it and copy it 3) In word select 10-point font, single (1.0 spacing), 3) paste it into word using the Paste dropdown button in the ribbon, to paste as text only which is the third dropdown option (alternatively you could paste it into some plain text editor and then select all and copy it again and then paste it into Word or I guess since it's .txt you could just download it). This will just paste the text but have a bunch of extraneous line breaks. Next do a search and replace for every instance of "^p" (without the quotes, which means new paragraph) with nothing or even better as a single space (since replaced with nothing, some words run together but this didn't bother me). this will substantially reduce the thing. If you did the single-spacing right you will get 181 dense but highly repepetitive and readable pages of the Qu'ran. I next used the scroll wheel (by pressing down on it) to begin scrolling through all of it and attempted to alight my eyes on each section enough to read it "at a glance" (like speed reading.)

At 24 seconds per page (I timed it and this is what I considered a readable scroll speed) the whole thing should take you about 1 hour 16 minutes. I encourage you to do it! Just focus. Stop if you really need to focus on something.

I read War and Peace this way. It's about some Russians. (I'm kidding, this last part is a woody allen joke.)

[+] feld|9 years ago|reply
My TSA PreCheck experience:

- no removing shoes - never bothered about my computer gear, screwdriver set, razor blades - completely through security in a few minutes

Then I look at the people in he regular line while waiting for my friend and see everyone's personal space being invaded, bags rifled through, electronics and cables strewn about, harassed over the stupidest items

It's a joke. PreCheck is proof they aren't serious about security. Anyone could pay the $75 and walk through with dangerous items.

That said, I'll gladly continue to use PreCheck because if someone wants to attack an airport they'll attack the long security line which I won't be stuck in.

[+] CWuestefeld|9 years ago|reply
So it looks like what we're building here is the beginnings of a travel tax. If the "service" they're providing isn't necessary - and indeed, PreCheck is really just a protection racket, where you pay them to avoid the shakedown - then what else can we call it?

And by going along with it, we're really just buttressing the whole TSA program. When there's revenue being generated they'll never let it go. (yes, I know that the net is overwhelmingly negative, but when that's just looked at as a jobs program for barely-skilled workers, it's easy to write that off and focus on the income)

[+] monocasa|9 years ago|reply
I always took the precheck to be a clever setup for a useless organization. They have the completing concerns that they both need to A) screen enough people that our looks like they're doing something and, B) minimize inconveniencing the kind of people that Representatives actually listen to. By adding that fee to skip the line, they add a de facto class distinction on who gets screened.
[+] taude|9 years ago|reply
But isn't the point of signing up for pre-check that you give away your fingerprints and extra identifiable information and let the government run a security threat profile check on you to determine the risk factor for you?

Or, are you saying it's easy to forge the TSA-pre check for people to get through it?

[+] gcb0|9 years ago|reply
you are already paying a tsa fee on each ticket. and you not only accept the crappy and ineffective service you paid for, but you pay extra just to not be subject to what you paid for in the first place.

you are a genius!

California should try this model for the next drought.

[+] peter303|9 years ago|reply
Only minor differences. Your carryons are still xrayed and yout body scanned. The shoes and belts were obsessive.
[+] tristor|9 years ago|reply
Thankfully, Amex Platinum benefits include a credit for Global Entry which automatically gets you TSA Pre-Check, so I've been whizzing through border patrol and TSA for a long time now. Unfortunately, it's a protection racket that requires participants to turn over their fingerprints into a national database, so it has all sorts of ethical and philosophical murkiness around it. In the end though, if you're traveling for business its one of those things you can't afford not to have because of how stupid the process for regular joes is.

As a frequent traveler I can only agree with Bruce's conclusion here. TSA Pre-check is a failure, not because it doesn't provide enough security, but because the existing process for regular travelers is completely pointless. As any frequent traveler is already fully aware, the TSA is a big joke, and going back more or less to how we did airport security pre-9/11 with the better scanning technology is more than good enough for the realistic threat level and would greatly reduce traveler stress and increase airport throughput. The TSA is failed jobs program which has threatened the civil liberties of the average traveler for no gain whatsoever in national security. It's time to cut it back to something realistic.

[+] danvasquez29|9 years ago|reply
I signed up for TSA PreCheck recently and have taken 3 trips with it so far, all to different locations. One thing that has stood out to me is that the security agents that check IDs REALLY check ID's. There's a notable difference in the length of time and scrutiny they put into it, and some even asked follow up questions like where I was born and where I was going, which just about never happens in regular security.

It made me think that they were maybe taking advantage of the lower volume and lower stress environment and using behavior based analysis like the Israeli's (http://www.telegraph.co.uk/news/2016/05/20/israels-risk-base...)

[+] jrockway|9 years ago|reply
I have also had PreCheck for many years, and have not noticed this. In fact, when the regular lines are long, they just bring people out of those lines and into the PreCheck lines. The big kicker is that they have PreCheck at SFO, whose security isn't even run by the TSA. It's just some random private company.

PreCheck is basically the government admitting that nobody is interested in blowing up planes and that it's not worth the effort to thoroughly screen people (which they do not do in the regular lines either). Heart disease or a car accident is what's going to kill you. There will always be terrorist attacks. They don't matter in aggregate.

[+] e40|9 years ago|reply
Earlier this summer when I flew from West to East coasts in the US I was bumped out of the main TSA line for my ID not matching my ticket. I never use my real first name, but it's still on my ID. In the years since 9/11, this is the first time I've been pulled aside.

I had to show 2 more IDs with the name on my ticket, which I had. I was traveling with a 15 yr old and wife.

[+] pavel_lishin|9 years ago|reply
> some even asked follow up questions like where I was born

Why? Your ID doesn't have that information.

[+] endtheshow|9 years ago|reply
To me, the base assumption that the TSA has anything to do with security is just wrong. The TSA did the following.

1. It let the people feel better post 911

2. It created low skill minimum wage jobs to boost employment numbers.

3. It increased Gov. control over traveling with increased internal data on the movement of legitimate citizens.

4.surved to create the most intricate theater around.

The only thing that, since 911 has stopped anything, has been onboard citizen action and stronger doors to the cockpit.

[+] huffmsa|9 years ago|reply
Regrettably we found that the doors are as sturdy as promised in the real world last year with the suicide of that German pilot.
[+] CWuestefeld|9 years ago|reply
Allow liquids to stay in the carry-on since TSA scanners can detect threat liquids.

Wait a minute - is Hawley admitting here that the whole thing with throwing out all liquids before entering is a sham? Does anyone have more information on this?

[+] byoung2|9 years ago|reply
Anyone who has traveled with a baby knows they can easily scan liquids inside the bag (e.g. formula and a gallon of distilled water). There is no need to even put them in a separate plastic bag. Sometimes they do a bomb residue test, however.

I suspect throwing out liquids was a scam to sell you more drinks at higher prices after the checkpoint.

[+] 1024core|9 years ago|reply
Pre-Check is nothing but a fund-raising scheme by the TSA. They have an incentive to further slow down the usual screening lanes, so more people will buy into PreCheck! How is this not a bad incentive??
[+] huffmsa|9 years ago|reply
Potential acts of terror stopped at the checkpoint by the TSA since 2001: 0

---Edit---

Knitting needles confiscated and grannies fondled: Classified as it pertains to Homeland Security

[+] goodells|9 years ago|reply
I find it difficult to believe that the bureaucrats that came up with this couldn't recognize the gaping hole and inconvenience that TSA PreCheck is. This could be interpreted as some acknowledgement of the security theater they're putting on, indicative of poor management/internal lack of faith at the TSA, or some combination of both.

As an aside - I've never had the opportunity to rant about this before - the Dane County Regional Airport is laid out in such a way that there are two escalators that go up to the security checkpoints on the upper level, one on each side of the ticketing counters. One is TSA PreCheck, the other is not (yes, entirely 1/2 of the locations they have available are TSA PreCheck, and there are always lines at the other side). The signage is very poor and many, many people end up going to the PreCheck side, get turned away, and then need to walk 10 minutes to the other side of the airport to go through the regular lane. Of course this could be avoided if you enroll in that program, but for people who travel by plane infrequently, the cost/benefit ratio just isn't there.

[+] pklausler|9 years ago|reply
Oh, come on. 10 minutes? BS. If you're shuffling behind a walker, dragging unwheeled luggage, and have to stop and take a dump in the men's room, maybe that's 10 at most. Any able adult can walk that stretch in Madison's tiny little femto-airport in a couple of minutes. It's not even a long frisbee toss.

(I had to live there for six years and got to know those dozen horrible bus-station-ish gates all too well.)

[+] bluedino|9 years ago|reply
>> Timothy McVeigh was an upstanding US citizen before he blew up the Oklahoma City Federal Building

He was a paranoid, transient psychopath, anti-government activist, with more emotional and psychological problems than you could shake a stick at. He would be on all kinds of lists today.

[+] JumpCrisscross|9 years ago|reply
> What the Trusted Traveler program does is create two different access paths into the airport: high security and low security

They're both low security. PreCheck just admits that and creates a low-hassle, low-volume lane.

[+] makecheck|9 years ago|reply
It’s so strange to read a TSA person make some reasonable criticisms on the one hand, and to then come up with ridiculous proposals such as adding REMOVAL OF SHOES to the pre-check lane?!? Heck, removal of shoes and other items is probably 75% of the entire travel delay (they should just sit there for a few minutes and watch people stumbling around).

Just about the only sensible measure at this point is to return to a bullshit-rules list of length zero, and just say “right this way, please”.

[+] Havoc|9 years ago|reply
I just don't get how the TSA manages to be so much worse than other country's border checks. Its like they've made it their mission in life to be as much of a pain as possible.
[+] ChrisBland|9 years ago|reply
I've spoken to a few people who work for dod/dia et al as it relates to DHS/TSA. They say they employ 3 types of people: 1) those that need a job and don't care 2) those that like having authority over others but couldn't cut it in other jobs, and 3) those with bad grades, bad pedigree, etc who are trying to work their way up DHS and transfer to another agency from within.
[+] alistairSH|9 years ago|reply
FWIW, Munich is just as bad as major American airports, or at least it was this past September.

Edinburg and Dublin both seem to be doing it well. Minimal hassle. Plus, the US "border" check in Dublin is smoother than (non-pre-screened) checks at IAD.

[+] themckman|9 years ago|reply
One thing I've noticed recently at SEA is that there appears to be some sort of privatized PreCheck. I've had some guy come around with brochures for the company offering minimal lines/waiting to get through security if you signup for whatever the program is. Unfortunately, I'm having a hard time finding the company online.
[+] peter303|9 years ago|reply
Maybe next adminstration will introduce profiling, which seems an absurbs oversight after spending tens of billions on security, not to mention the time cost. Yoing Arab men should get more ecrutiny than old ladies in wheel chairs.
[+] awinter-py|9 years ago|reply
schneier is discounting the possibility that terrorists hate standing on lines.
[+] na85|9 years ago|reply
TSA seems like a government make-work project.
[+] JadeNB|9 years ago|reply
Not that there's necessarily anything wrong with make-work; but surely it could be accomplished without an accompanying make-miserable?