Hi! Lead author here. We'll be giving a talk on this work tomorrow at the USENIX Security, but I'm happy to answer any questions you have here before then.
Theoretically, how many of these (or similar) techniques would work against the millimeter wave scanners currently deployed in US airports?
Security Analysis of a Full-Body Scanner
31–40 of 65 posts
Re: Security Analysis of a Full-Body Scanner
#32Earlier quoted context omitted.
Backscatter x-ray technology was removed from airports. [1] All airports now use millimeter wave technology. [2] [1] https://en.wikipedia.org/wiki/Backscatter_X-ray [2] https://en.wikipedia.org/wiki/Millimeter_wave_scanner
Millimeter wave scanners still subject the body to radiation, even though they don't have the work "X-Ray" in the name. Radiation damage to your body is cumulative throughout your life, so if you care about your longevity, you'd be wise to opt-out of subjecting your body to this radiation whenever possible.
The word "radiation" just means that something radiates -- it travels off to infinity. In this case we're talking about electromagnetic radiation, which spans a vast continuum from radio waves through microwaves to infrared and red, across the visible spectrum to deep blue, then on into ultraviolet, X-ray, and gamma light. It turns out that this radiation is quantized -- meaning it comes in lumps of a certain energy E = hf where h is a fundamental constant and f is the frequency of the light (equivalently, f = c / L where L is the wavelength). Light also comes with a certain "kick" or momentum p = E / c. We knew the latter formula from classical electromagnetism but the former formula was awarded two Nobel prizes, one to Max Planck and one three years later to Albert Einstein.
It is presently thought that the blue side of the non-visible electromagnetic radiation spectrum (UV, X-rays, Gamma rays) is cancer-causing, while the visible and red-side of nonvisible is not. This comports with the Planck/Einstein law for the energy of the photons, which approaches the bond energies for several common atomic bonds in the visible spectrum and exceeds it as we go into the ultraviolet. (We essentially see light by having the light excite these bonds, but not so much that it tears them apart, so as they "relax" to their starting configuration they release the energy and activate neurons.)
Microwaves are about 1mm or 1cm long, on the red side. They are emitted by microwave ovens, cell phones, wifi hotspots, and millimeter-wave detectors. Right now it's not thought that these are "dangerous" radiation any more than white light is, because their "kicks" don't excite the atomic bonds but are instead absorbed by proteins as a whole, in a process we presently think is indistinguishable from any other sort of heat transfer. That is, they heat you up, but don't do much else.
If they did something else, probably very large changes would have to be made to our modern scientific understanding, which I of course would totally support if experiments bore it out. At present there are no good experiments which show any other effects of microwaves on biological tissue, other than the heating thing.
Re: Security Analysis of a Full-Body Scanner
#33Earlier quoted context omitted.
Sorry for the US-centric comment. All people are created equal with unalienable rights, so we shouldn't be trampling the human rights of foreigners either. It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing.
> It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing. Can you explain what part of it is unconstitutional? Because while I'm totally against it, I think it is pretty much entirely constitutional because airlines are a private business that no one is being forced to go through. But I clearly don't know much about this and would…
Link: http://www.washingtonpost.com/wp-dyn/content/article/2009/06...
Re: Security Analysis of a Full-Body Scanner
#34Earlier quoted context omitted.
The TSA is a government agency, not a private organization. Options for flying without undergoing a grope down or subjecting oneself to the nudie photo maker are limited to those wealthy enough to fly private.
> The TSA is a government agency, not a private organization. Right, but the airlines are private and you are choosing to enter into a contract with them out of your own volition. The TSA is a regulator, but is not requiring that you fly. > Options for flying without undergoing a grope down or subjecting oneself to the nudie photo maker are limited to those wealthy enough to fly private. Which sucks, but doesn't soun…
However, my understand is these are only added to major airports to avoid encountering such a situation. As you don't need to fly to get from Chicago or NY to just about anywhere.
Which creates another issue. Your not re-screened after traveling from a minor to a major airport which renders these precautions practically useless vs an intelligent advisory.
Re: Security Analysis of a Full-Body Scanner
#35Earlier quoted context omitted.
Sorry for the US-centric comment. All people are created equal with unalienable rights, so we shouldn't be trampling the human rights of foreigners either. It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing.
> It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing. Can you explain what part of it is unconstitutional? Because while I'm totally against it, I think it is pretty much entirely constitutional because airlines are a private business that no one is being forced to go through. But I clearly don't know much about this and would…
Relevant quote:
"Accordingly, the Court concludes on this record that Plaintiffs have a constitutionally-protected liberty interest in traveling internationally by air, which is affected by being placed on the No Fly List." [2]
[1] - https://www.aclu.org/national-security/latif-et-al-v-holder-...
[2] - https://www.aclu.org/sites/default/files/assets/latif_v_hold...
Re: Security Analysis of a Full-Body Scanner
#36Earlier quoted context omitted.
> It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing. Can you explain what part of it is unconstitutional? Because while I'm totally against it, I think it is pretty much entirely constitutional because airlines are a private business that no one is being forced to go through. But I clearly don't know much about this and would…
The supreme court ruled 8-1 that strip searches in schools are unconstitutional. How are technology-enabled strip searches at the airport any different? Link: http://www.washingtonpost.com/wp-dyn/content/article/2009/06...
They have not. You'll have to point to a specific case because they have ruled for strip searches to be constitutional under essentially what amounts to probable cause.
Edit: you added the link. If the girl in that story had been using or distributing an illegal drug it would've been a (legally) reasonable search: http://en.wikipedia.org/wiki/New_Jersey_v._T._L._O.
> How are technology-enabled strip searches at the airport any different?
Putting aside the question of whether or not MMW scans are actually legally equivalent to strip searches, the government forces you to show up to school. It does not force you to show up to the airport.
Re: Security Analysis of a Full-Body Scanner
#37Earlier quoted context omitted.
> The TSA is a government agency, not a private organization. Right, but the airlines are private and you are choosing to enter into a contract with them out of your own volition. The TSA is a regulator, but is not requiring that you fly. > Options for flying without undergoing a grope down or subjecting oneself to the nudie photo maker are limited to those wealthy enough to fly private. Which sucks, but doesn't soun…
Freedom of movement is considered a constitutional right. http://en.wikipedia.org/wiki/Freedom_of_movement_under_Unite... If you live in a remote area where the only option is to fly commercial you may have a strong case. However, my understand is these are only added to major airports to avoid encountering such a situation. As you don't need to fly to get from Chicago or NY to just about anywhere. Which creates anot…
This doesn't sound like guaranteed use of commercial airports/airlines, it sounds like you'd have the right to fly yourself from your own airstrip, but not necessarily from an airport.
> Which creates another issue. As your not re-screened after traveling from a minor to a major airport which renders these precautions practically useless vs an intelligent advisory.
That is interesting.
Re: Security Analysis of a Full-Body Scanner
#38Earlier quoted context omitted.
> It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing. Can you explain what part of it is unconstitutional? Because while I'm totally against it, I think it is pretty much entirely constitutional because airlines are a private business that no one is being forced to go through. But I clearly don't know much about this and would…
Earlier this year, the ACLU won a case regarding the constitutionally of the no-fly list[1]. Basically, their argument was that you can't give up your Fifth Amendment rights (due process) when you travel internationally. Since this argument won, it implies that Fourth Amendment rights (probable cause searches) also cannot be forfeited. Relevant quote: "Accordingly, the Court concludes on this record that Plaintiffs h…
Re: Security Analysis of a Full-Body Scanner
#39Earlier quoted context omitted.
Millimeter wave scanners still subject the body to radiation, even though they don't have the work "X-Ray" in the name. Radiation damage to your body is cumulative throughout your life, so if you care about your longevity, you'd be wise to opt-out of subjecting your body to this radiation whenever possible.
So you've got a bunch of responses, but as a guy with a Master's in applied physics I wanted to chime in with a bit more of a long explanation. The word "radiation" just means that something radiates -- it travels off to infinity. In this case we're talking about electromagnetic radiation, which spans a vast continuum from radio waves through microwaves to infrared and red, across the visible spectrum to deep blue, t…
The concept of wavelength as the sole distinction between these types of radiation is probably abstract to most non-science-educated people. Can you (or anyone else) think of a good concrete real-world analogy of different types of X that vary only in Y and some X are harmless but those with Y are not? Maybe an analogy of throwing sand at someone vs. shooting a bullet?
Re: Security Analysis of a Full-Body Scanner
#40From the paper: "To a degree that surprised us, our attacks benefited from testing on the device itself. Our first attempts at implementing a new attack strategy were often visible to the scanner, and reliable concealment was made possible only by iteration and refinement. [...] The effectiveness of such a strategy depends critically on the difficulty of obtaining access to the machine. In addition to the device we p…