News for hackers. Stuff that matters.
Re:TSA: Fail by DanielBMarkham on Wednesday February 29, 2012 @05:40PM (#3650072)
As this terrific article says in many different ways: the TSA is a fundamentally flawed institution. It's an example of something that anybody who has spent too much on consultants will recognize: if you have money, there are people who will gladly say they will solve a problem, even if the problem doesn't make sense and there is no solution. It's like that old demotivator image says about consulting "if you're not part of the solution, there's good money to be made in prolonging the problem" (http://www.despair.com/consulting.html)

Don't get me wrong, the agency can be full of the most wonderful and talented dedicated intelligent people imaginable. I kind of doubt it, but it doesn't make a difference. If the paradigm of the agency is seriously broken, it'll never do anything but prolong the problem. If anything, it'll make the problem of terrorism worse (for many reasons too involved to go into here.)

After 9-11 we overreacted and created a monster. We've created a system where the general public is the "enemy". Is the system so broken that even after this is obvious to 90% of the public we still can't get rid of the TSA? </rant>

I know when I go on like this about the TSA that I sound like somebody running around with their hair on fire, but dammit, out of the dozen or so major intrusions on my privacy and life by the security state and corporate system over the last 20 years, the TSA is like a poster child for what's went wrong. Good intentions, a real (but very small) threat, bipartisan support, a mission to support air travel safety (something everybody is for). The problem is although it's great at getting votes, it's just not worth the trade-off. And it's such a political football that nobody can touch it. We're giving up too much for way too little in return. And it looks from here like the change is going to be permanent, no matter what we say or do about it.

Re:TSA: Fail by BigTigger on Wednesday February 29, 2012 @06:02PM (#3650168)
Great post, I do however much prefer the quote,

"If you can see the light at the end of the tunnel, order more tunnel"

Re:TSA: Fail by einhverfr on Wednesday February 29, 2012 @06:47PM (#3650308)
I have a friend who works for the TSA. We argue about the value of the organization a lot. And about airport security a lot.

Here's my view. It's not just the TSA that is to blame. It's the fact that American politics is often driven by hysteria. As an American, I say the answer is teaching people about real security strategy.

The hard truth, and one the American people have not accepted is that any idea of security must be firmly conditioned on the idea of acceptable risk. No matter what we do, the risk will never reach zero, so we are better balancing risk with the intrusiveness of the effort to eliminate it. Any security professional in any field worth his or her salt will tell you that.

So the TSA folks on the ground are put in a bind. They are sold as the answer to security and told they must prevent all future attacks. But the TSA is not in a position to do that. What they are in a position to do is to make it hard enough to carry out an attack that the real security folks (FBI, etc) can stop the plot before the terrorists get to the airport. This means that the right screening measures are important because by the time a terrorist gets to the airport, having planned and prepared with airport security in mind, it's simply too late for airport security to stop them. Therefore you have to see airport security as an assist to security rather than as the mechanism as a whole.

In that regard, the TSA has failed miserably. The article lists a few points, but misses one of the biggest problems with the way the bodyscanners are currently implemented: they replace metal detectors.

Nobody has ever brought down a plane with a bomb detonated by a non-metalic detonator. There have been a few attempts (the shoe bomber, the underwear bomber, etc), but these require a lot more human intervention to set off, and therefore provide crew and passengers a better chance to react. In many cases they are also more difficult to get to work in the first place.

So the bodyscanners eliminate a small security hole but in the process create a much larger one. Metalic devices can be hidden in body cavities and are invisible to the scanners. And without metal detectors we don't even have a chance to detect the worst of them.

The TSA has shown that they are worried about this. They have repeatedly said they are concerned about, say, radio-controlled toys and cell phones, but they have created a situation where they can't do anything about it.

Security is a process and not a product. When it becomes a product, we see what happens. The TSA is both a product of the product mentality (pun intended), and a product that was sold to the American People after 9/11 as the answer to our security woes. Until we can get the American people to go through the security assessment process, we will be stuck with more of the same.