Should I care what the head of the TSA has to say about RockYou's password data theft, too?
There are scads of targets that ought to be attractive to terrorists: sports arenas, various tunnels and bridges, power generation and transmission, etc. None of these get anything like the security attention, despite their potential to cause far greater harm than the WTC attacks did.
I have the mental picture of a building with many doors. We're putting solid steel doors, deadbolts, triple padlocks, etc., on one door, while the other entries are nothing but screen doors. This is ridiculously ineffective in cost and freedom.
So to the extent that the TSA can efficiently and effectively scan for weapons, explosives and known terrorists, they should. To the extent that they can't detect certain explosives (the theoretical binary liquid concern), it's reasonable to take measures to mitigate risk. (E.g. limit quantities when feasible)
Beyond that? Nothing.
Screen everyone carefully. Careful tests of everything brought aboard, if any is allowed at all. Require background checks upon passport application (or application for plane tickets). Also, have a security officer on board, with orders to shoot to kill if anyone tries any funny stuff.
Of course, organizations like local police forces are in a far better position to make a difference. Better detective work, with the goal of breaking up terrorist rings and locating individuals, would certainly be an effective step to combat terrorism. As this article points out - these people are often already suspects.
A reasonable solution would be to give up on complete security. Put in the obvious deterrents - a security officer on board the plane, and reinforced cabin doors that don't open for the duration of the flight. Other than that, don't worry about it. When you look at other threats like drunk driving or heart disease you should realize that our panic is misplaced.
Bruce is dead-on right in this case. Fighting the previous war won't prevent the next one.
Some of the people criticizing the TSA (like Bruce Schneier) are absolutely experts on security.
You're also right, the analogy of IT vs the users is a valid one. In this case, the IT department has told the users that they are no longer allowed to browse the web between the hours of 3:30 and 3:38 because it was during this time that somebody downloaded and installed a virus.
Instead of actually addressing the root of the problem (our users can download and install viruses), the IT department has put a band-aid over it so that they can say that it has been fixed.