Some of the people criticizing the TSA (like Bruce Schneier) are absolutely experts on security.
You're also right, the analogy of IT vs the users is a valid one. In this case, the IT department has told the users that they are no longer allowed to browse the web between the hours of 3:30 and 3:38 because it was during this time that somebody downloaded and installed a virus.
Instead of actually addressing the root of the problem (our users can download and install viruses), the IT department has put a band-aid over it so that they can say that it has been fixed.
Should I care what the head of the TSA has to say about RockYou's password data theft, too?
There are scads of targets that ought to be attractive to terrorists: sports arenas, various tunnels and bridges, power generation and transmission, etc. None of these get anything like the security attention, despite their potential to cause far greater harm than the WTC attacks did.
I have the mental picture of a building with many doors. We're putting solid steel doors, deadbolts, triple padlocks, etc., on one door, while the other entries are nothing but screen doors. This is ridiculously ineffective in cost and freedom.
So to the extent that the TSA can efficiently and effectively scan for weapons, explosives and known terrorists, they should. To the extent that they can't detect certain explosives (the theoretical binary liquid concern), it's reasonable to take measures to mitigate risk. (E.g. limit quantities when feasible)
Beyond that? Nothing.
Screen everyone carefully. Careful tests of everything brought aboard, if any is allowed at all. Require background checks upon passport application (or application for plane tickets). Also, have a security officer on board, with orders to shoot to kill if anyone tries any funny stuff.
Of course, organizations like local police forces are in a far better position to make a difference. Better detective work, with the goal of breaking up terrorist rings and locating individuals, would certainly be an effective step to combat terrorism. As this article points out - these people are often already suspects.
A reasonable solution would be to give up on complete security. Put in the obvious deterrents - a security officer on board the plane, and reinforced cabin doors that don't open for the duration of the flight. Other than that, don't worry about it. When you look at other threats like drunk driving or heart disease you should realize that our panic is misplaced.
Bruce is dead-on right in this case. Fighting the previous war won't prevent the next one.
I've started to call the bizarre new TSA rules "magical thinking": if we somehow protect against the specific tactic of the previous terrorist, we make ourselves safe from the next terrorist. http://www.schneier.com/blog/archives/2009/12/me_and_the_chr...
Only two things have made flying safer [since 9/11]: the reinforcement of cockpit doors, and the fact that passengers know now to resist hijackers.
As to the current 'articles about how stupid airline security is' I'll quote again:
And what sort of magical thinking is behind the rumored TSA rule about keeping passengers seated during the last hour of flight? Do we really think the terrorist won't think of blowing up their improvised explosive devices during the first hour of flight?
Only one carry on? No electronics for the first hour of flight? I wish that, just once, some terrorist would try something that you can only foil by upgrading the passengers to first class and giving them free drinks.
http://www.schneier.com/blog/archives/2009/12/separating_exp...
Joel Johnson at Gizmodo has a good argument about all of this: http://gizmodo.com/5435675/president-obama-its-time-to-fire-...
A. I don't think anyone has seen a reason to believe that the TSA really are experts. For example, everyone I know has some experience in accidentally carrying contraband onto an airplane, and has seen countless ways to do so intentionally based on gaping holes in the processes.
B. We don't live in a Platonic republic, governed by experts. Our government is of, by, and for the people. Even in instances when we the people have decided to delegate some authority to an expert, it's still inherently the responsibility of that expert to prove to us that they're doing the right thing. TSA has failed dismally at that.
I actually do it intentionally in the sense that if I know my sunblock is more than 3oz and I don't want to throw it out, I just hope they don't find it. I get it on the plane about 50% of the time.
When I flew out of SJC on the 24th, they weren't even reminding people to take their liquids out; I left mine in my luggage with no issues.
When I flew back from BWI on the 29th, there was a guy a little bit in front of me who walked through the metal detector with his coat on. The machine went off, and they had him go back and take his belt off and empty his pockets... but said nothing about the coat, despite the facts that the signs along the line specifically say to take off your coat and put it in a bin.
If the TSA doesn't even enforce their own policies, what's the point?
How can they deny that this is security theater, when they're only reacting to the most recent threats, while older attack vectors just scroll off the regulations?
Question for you, what's the airline with best security record in the world? El Al, who have been under constant terrorist threat for 40 years. Yet no-one mocks them for their boneheaded ideas (e.g. let's confiscate everyone's liquids based on volume alone and toss them all into a big bin right near the checkpoint) because they really do know what they're doing. No bullshit, no security theatre, just a track record.
TSA and Homeland Security are amateurs. Both the shoebomber and now the pantsbomber (both of whom were utterly incompetent themselves) breezed through all their security measures. Ordinary passengers dealt with it, the old fashioned way. There's a lesson there.
The fact is that we have had a history of ignoring early warning signs, and that when we have taken action, we have been succesful. Terrorists make mistakes, and when we ignore them (like the Bojinka plot), it has directly led to disaster (9/11). On the other hand, since lugagge scanning has improved, we rarely see bombings like Lockerby or Air India any longer.
I think the end-user vs. IT department analogy is one anyone who agreed with this article should ponder on. When a low-level employee causes a security breach, he's not the one who has to deal with the effects. The experts have to come in and fix the problem, andm management has to bear the responsibility.
Similarly, in the event of an airline catasrophe, it's the emergency services who have to pick through the wreckage andook for bodies; the airlines and their employees who suffer financially. Pilots and flight attendants who know they are at highest risk, due to the ime the spend in the air. And leaders of countries, who can have their entire presidency redefined in a single day.
I'd rather hear their opinions than those of a professional troll lime Hitchens.