Indeed. Here's what I posted on Facebook (mildly edited for clarity) about the TSA's response (btw one of my Facebook friends is a TSA screener):
Some thoughts about this.
The main defense that the TSA offers over the body scanners in this regard is that it is somehow better/harder to circumvent than the metal detectors, and that it's only one part of a larger program using layers of security.
We can argue about the specifics but the idea of layers of security is one thing the TSA is doing right. One of my complaints about the body scanners is that they are not implemented in a way that makes full use of this (tandem to a metal detector, as separate layers, ideally in conjunction with behavioral indicators). But that's neither here nor there. I want to talk about testing.
As a software engineer, I know there is testing, and there is testing. Extensive pre-deployment testing is important. There can't be any doubt of that. However, it is also by definition incomplete. Stuff will always get missed. Real testing in a security environment involves the sorts of things that this video involves--- many people looking for ways to circumvent a given technology and doing so. A few professional testers will miss stuff because everyone has blind spots. This has to be an ongoing thing, and it has to rely on independent individuals not beholden to the organization ordering the testing.
In the computer software field, while the stakes are lower, we deal with a level of constant attack unmatched in any physical security field. A firewall in the rural US is under more constant attack than any US troops on any battlefield and I have logs to prove this, so in my industry we have had to find better ways of dealing with these problems than we see with the Department of Homeland Security today. While my life may not depend on my firewall holding up, my livelihood very well might, as does all of your credit card data depend on firewalls of places like Amazon.
The video I linked to yesterday, while I don't agree with all of the political remedies proposed is a solid example of penetration testing, and the sort that makes us more secure. We should no more trust the TSA with securing our airports than we should trust Microsoft with securing our data. Microsoft can't get there without armies of white-hat hackers reporting vulnerabilities before the bad guys find and exploit them. The TSA shouldn't attempt this either.
Just this week we saw a massive security hole discovered at Github, which many open source projects use. This hole allowed anyone who had an account (and anyone can sign up!) the ability to commit software changes to any project on the system. The severity of this problem was just unbelievable. In all likelihood this would have gone at least partially unfixed (given past attempts to get the software fixed) had it not been for one daring individual breaking into the system in a reasonably responsible (as far as we know, but if you use github, audit your code!) way.
But imagine if a bad guy did this? What critical systems would be vulnerable for years because of malware planted? The fact that it was reported in a public way after a previous fix was attempted and fell flat was a good thing.
I have been on the receiving end of accusations of fearmongering for exposing security holes (in software). The fact though is that this is usually the first step to getting the problem fixed. Whatever else is discussed, we need to keep that in mind.
The correct response should have been, "We are evaluating this report and, once we are finished doing so, will institute whatever corrective steps appear to be necessary to solve the problem." This is not it.