TSA: Fail

Here's my view. It's not just the TSA that is to blame. It's the fact that American politics is often driven by hysteria. As an American, I say the answer is teaching people about real security strategy.

The hard truth, and one the American people have not accepted is that any idea of security must be firmly conditioned on the idea of acceptable risk. No matter what we do, the risk will never reach zero, so we are better balancing risk with the intrusiveness of the effort to eliminate it. Any security professional in any field worth his or her salt will tell you that.

So the TSA folks on the ground are put in a bind. They are sold as the answer to security and told they must prevent all future attacks. But the TSA is not in a position to do that. What they are in a position to do is to make it hard enough to carry out an attack that the real security folks (FBI, etc) can stop the plot before the terrorists get to the airport. This means that the right screening measures are important because by the time a terrorist gets to the airport, having planned and prepared with airport security in mind, it's simply too late for airport security to stop them. Therefore you have to see airport security as an assist to security rather than as the mechanism as a whole.

In that regard, the TSA has failed miserably. The article lists a few points, but misses one of the biggest problems with the way the bodyscanners are currently implemented: they replace metal detectors.

Nobody has ever brought down a plane with a bomb detonated by a non-metalic detonator. There have been a few attempts (the shoe bomber, the underwear bomber, etc), but these require a lot more human intervention to set off, and therefore provide crew and passengers a better chance to react. In many cases they are also more difficult to get to work in the first place.

So the bodyscanners eliminate a small security hole but in the process create a much larger one. Metalic devices can be hidden in body cavities and are invisible to the scanners. And without metal detectors we don't even have a chance to detect the worst of them.

The TSA has shown that they are worried about this. They have repeatedly said they are concerned about, say, radio-controlled toys and cell phones, but they have created a situation where they can't do anything about it.

Security is a process and not a product. When it becomes a product, we see what happens. The TSA is both a product of the product mentality (pun intended), and a product that was sold to the American People after 9/11 as the answer to our security woes. Until we can get the American people to go through the security assessment process, we will be stuck with more of the same.

The thing is that's the wrong metric.

The TSA isn't in a vacuum. The metric is whether the security measures have made it hard enough to mount an attack that law enforcement could disrupt it before it began.

Right now, I don't see enough evidence to evaluate that either way. However I can say without a doubt that there are plenty of huge issues with the way the TSA is going about things and a lot of things, like body scanners, do not support an effort to score high on the above metric.

In Sea-tac for example, they try to pick out people more likely to be at risk and put them through the scanners. This would be correct except that they should be putting such people through metal detectors too. Defence in depth....

In LAX, I have seen separate lines for standard metal detectors vs AIT machines. This is just stupid and justifies so many jokes about LAZ security....

In Nashville TN, I haven't been there, but I understand from TSA employees that everyone goes through the bodyscanners.

I don't think it is just a question of public acceptance. Really you have different courts looking at how the 4th Amendment applies to metal detectors in airports, and although they all agree that metal detector requirements are Constitutional, they arrive at this for different reasons.

The 9th and 3rd circuits have adopted a balancing test (the most important case there in the third circuit was authored by none other than Samuel Alito btw), and this does not necessarily allow the TSA to get from the idea that metal detectors are per se Constitutional to the idea that bodyscanners are.

The 11th and 5th Circuits however, have adopted a view that when you travel you consent to be searched as a condition to that travel, and unlike other consensual searches, consent cannot be withdrawn. This is a very broad ruling and it makes it hard to argue that anything the TSA might do in the course of a search infringes the 4th Amendment rights of the traveller. In other words, in these circuits, airports are 4th Amendment-free zones.

So this varies quite a bit by region and even by airport culture. That doesn't make the use of the scanners any better on the whole, or change the fact that they should be reserved for individuals where there is a reasonable suspicion and that they should be used in tandem with metal detectors.

The problem is that the TSA is not responsible for any of them. Either they were discovered and apprehended before carrying out the act by intelligence agencies (that predate the TSA and DHS, and have been doing this for a long, long time), or they were stopped by passengers and bystanders, in which case the TSA has demonstrably already failed.

Either way the DHS is just an embarrassment.