TSA: Terrible At Security But Finally Willing To Work On Its Problems

from the failing-forward dept

The TSA's inability to live up to the "S" in its acronym is on display again. The agency's Inspector General recently testified before a Congressional oversight committee. Fortunately, no one stepped forward to shoot the messenger -- seeing as the message was more bad news about TSA incompetence. I imagine TSA Administrator Peter Neffenger would have jumped at the chance to be the triggerman, but was fortunately limited to delivering his own prepared remarks in response.

After speaking to the "difficulty" (apparently insurmountable) of the TSA's "mission," Inspector General John Roth referred to the difficult nature (in the parental sense) of the agency itself.

My remarks were described as “unusually blunt testimony from a government witness,” and I will confess that it was. However, those remarks were born of frustration that TSA was assessing risk inappropriately and did not have the ability to perform basic management functions in order to meet the mission the American people expect of it. These issues were exacerbated, in my judgment, by a culture, developed over time, which resisted oversight and was unwilling to accept the need for change in the face of an evolving and serious threat. We have been writing reports highlighting some of these problems for years without an acknowledgment by TSA of the need to correct its deficiencies.

Is the TSA willing to change now? Possibly. But some things haven't changed, like its ability to do its job. Roth's office has performed another round of covert testing. Last time this testing was performed, the IG's fake terrorists nearly aced the test.

However, the latest covert testing wasn't nearly as "covert," as Lowering the Bar's Kevin Underhill points out. But it didn't go much better.

“In September 2015, we completed and distributed our report on our most recent round of covert testing.” This is where undercover DHS inspectors do stuff like try to smuggle bomb parts through checkpoints, and succeed … let’s see … 96% of the time. Or at least that’s how it’s gone in the past. How about now?

“While I cannot talk about the specifics in this setting [it’s classified, y’all], I am able to say that … the test results were disappointing and troubling,” and were “consistent across every airport” tested. Roth also noted that the tests were conducted by personnel “without any special knowledge or training,” which might seem odd unless you know that the TSA reacted to the earlier 96-percent-failure-rate findings partly by complaining that the IG had used personnel who were specially trained to defeat TSA’s efforts. (You know, sort of like an actual terrorist might be.) So this time, the IG deliberately chose people with no special knowledge or training to carry out its audits. I interpret this to mean that people who basically had no real idea what they were doing consistently and successfully breached security at every airport tested.

While the nuances of transportation security continue to elude the Transportation Security Agency, one thing has changed: an actual reaction from the TSA's parent agency, the DHS.

The Department’s response to our most recent findings has been swift and definite. For example, within 24 hours of receiving preliminary results of OIG covert penetration testing, the Secretary summoned senior TSA leadership and directed that an immediate plan of action be created to correct deficiencies uncovered by our testing. Moreover, DHS has initiated a program — led by members of Secretary Johnson’s leadership team — to conduct a focused analysis on issues that the OIG has uncovered, as well as other matters. These efforts have already resulted in significant changes to TSA leadership, operations, training, and policy…

You know, the sort of thing the DHS and TSA should have done when similar failings were found in 2014. And 2012. And 2011...

The testimony/rebuttal offered by TSA Administrator Neffenger opens with statements ranging from "factually" to "laughably" false.

We remain deeply committed to ensuring that TSA remains a high-performing, risk-based intelligence-driven counterterrorism organization. We are working diligently to ensure we recruit, train, develop, and lead a mission-ready and highly-capable workforce, placing a premium on professional values and personal accountability.

Or this, which makes the claim that failing nearly 100% of the time proves the system is still effective.

It is important to acknowledge that the OIG covert tests, as a part of their design and execution, focused on only a discrete segment of TSA’s myriad capabilities of detecting and disrupting threats to aviation security. This was not a deliberate test of the entire system and while there were areas for improvement noted by the Inspector General – with which we concurred -- that the system as a whole remains effective and, as a result of this series of tests, has only gotten stronger.

Scoring higher against an opponent of a lower skill level (the Average Joe Bomb Carrier "operatives" deployed by the OIG in 2015, rather than the "covert operatives" who performed the 2014 test) doesn't exactly signal systemic strength. But whatever, it's the system we have -- one we neither want nor deserve.

And then there's this part of the statement, which could easily support a full-fledged buzzword-based drinking game all on its own.

Solutions to the challenges facing TSA will require a renewed focus on the agency’s security mission, a commitment to right-sizing and resourcing TSA to effectively secure the aviation enterprise, and an industry commitment to incentivizing vetting of passengers as well as creating conditions that can decrease the volume and contents of bags presented for screening in airports.

"Incentivizing vetting of passengers?" Isn't that pretty much the only task the TSA performs? (I mean, when not running its Instagram account or helping the DEA walk off with a traveler's money…) After 15 years on the job, you'd think the TSA's vetting incentive program would be humming away like a well-funded machine. Apparently not, though. As the Inspector General points out, the TSA still approaches airport security in a disturbingly haphazard fashion.

[W]e believe that TSA’s use of risk assessment rules, which granted expedited screening to broad categories of individuals unrelated to an individual assessment of risk, but rather on some questionable assumptions about relative risk based on other factors, created an unacceptable risk to aviation security. Additionally, TSA used “managed inclusion” for the general public, allowing random passengers access to Precheck lanes with no assessment of risk. Additional layers of security TSA intended to provide, which were meant to compensate for the lack of risk assessment, were often simply not present.

While I am still of the belief that a majority of the TSA's actions are a perversely expensive and intrusive form of pantomime, the least the agency could do is maintain consistency across its security "offerings." If PreCheck is only "safe" because of the vetting process, then limit it only to those who have been pre-cleared. If 99% of travelers are no threat and can be waved through expeditiously, then do that and ditch the stupid "please throw out your breast milk while your TSA-friendly locks are broken" playacting that keeps lines backed up at security checkpoints.

The TSA has proven it's far better at officiousness and bureaucracy than security. And for years, it's been more interested in making excuses than fixing its problems. IG John Roth hopes this is the beginning of the end of the TSA's abysmal track record. In his comments to the Congressional committee, he expresses his support for the Inspector General Empowerment Act which would, among other things, maintain the office's independence and force agencies to cough up documents and information in a more timely fashion.

But it's hard to believe the culture will change. At the TSA, aviation security is just a job -- something that only deserves a minimal level of attention or competence. And that's all we'll get, for years and years to come: government-mandated harassment that hassles far more travelers than terrorists.

Filed Under: congress, john roth, security, security theater, tsa

Why Backdoors Always Suck: The TSA Travel Locks Were Hacked And The TSA Doesn't Care

from the locks-with-scare-quotes dept

The TSA, it appears, is just simply bad at everything. The nation's most useless government agency has already made it clear that it is bad at knowing if it groped you, bad at even have a modicum of sense when it comes to keeping the traveling luggage of citizens private, and the TSA is especially super-mega-bad at TSA-ing, failing to catch more than a fraction of illicit material as it passes by agents upturned noses. And now, it appears, the TSA has demonstrated that it is also bad at pretending to give a shit.

In case you missed the recent news, the TSA's specially designed master key to open all of the specially designed TSA-recognized luggage locks were especially super-hacked by someone with access to such privileged information and equipment as a newspaper subscription and a 3D printer. By using a picture in the Washington Post of a TSA agent's master key and some documents from Travel Sentry, a group that generates and enforces TSA protocols, one security researcher was able to create 3D printer files to create his own master key.

Steven Knuchel, a hacker/security researcher who goes by Xylitol or Xyl2k, used the detailed images obtained from the Travel Sentry website to create the kind of files that 3D printers use to produce models. Since the files were first published, several people have demonstrated that they work, using inexpensive 3D printing plastic called PLA.

So, hey, that's probably bad, right? I mean, here we have the TSA recommending passengers lock their luggage with locks designed with a TSA-backdoor in the form of a master key, and now anyone can make the master key. That would seem to leave thousands (millions?) of passengers' luggage vulnerable to break-in. Not a great look for an agency designed with no other goal beyond security. The TSA response?

“The reported ability to create keys for TSA-approved suitcase locks from a digital image does not create a threat to aviation security,” wrote TSA spokesperson Mike England in an email to The Intercept. “These consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime,” England wrote.

Yes, that's correct. Upon being informed of the TSA lock master key hack, the TSA essentially went with the "we don't give a shit" approach. I will say, at the very least, that it's somewhat refreshing to hear a government representative admit that at least some part of aiport and passenger security boils down to the feel-goods, but I'm of the opinion that a security agency unconcerned about security probably shouldn't be allowed to exist any longer. Especially when that same agency has been touting those same useless locks for years to passengers.

The larger point, of course, is that this is inevitable when you build security with backdoor access.

Nicholas Weaver, a computer security researcher at Berkeley, wrote on the Lawfare blog about the TSA locks and how they are “similar in spirit to what [FBI] Director [James] Comey desires for encrypted phones.”

Xylitol, the GitHub user who published the blueprint of the keys, said that was his point. “This is actually the perfect example for why we shouldn’t trust a government with secret backdoor keys (or any kind of other backdoors),” he wrote in an email to The Intercept. “Security with backdoor[s] is not security and inevitably exposes everyone.”

That's an axiom that other government agencies might want to pay attention to. The breaking of TSA locks wasn't even particularly difficult. If the government truly wants security on the networks of the American people, be the computer, phone, or otherwise, building in government backdoors provides the perfect entry point for bad-actors. If they actually want security, leave the backdoors out, or they risk looking every bit as dumb as the TSA.

Filed Under: backdoors, privacy, security, tsa, tsa key

'We Should Put A Metal Detector On The Other Side': The Laughable Waste Of TSA Body Scanners

from the common-sense dept

If anyone needed the perfect example of the giant waste, fraud, and abuse a government emboldened by fear and ineptitude can achieve, that example absolutely has to be the TSA's body scanners. These glorious devices that didn't work in catching weapons or explosives but did let TSA agents see you naked, and which are administered by the TSA, an agency so perfectly unable to do its job properly that all us Techdirt writers now have carpel tunnel syndrome from writing up posts on its exploits, now have a detailed price tag associated with them. So, what did the public pay for all of this fail?

Oh, only $160 million of taxpayer money, according to Politico.

The cost breakdown, which the TSA recently turned over to some members of Congress, provides the latest look at the agency’s investment in body imaging technology since it decided to make the scanners the centerpiece of the checkpoint screening process. The price tag averages more than $150,000 per unit since the agency bought the first batch of 45 devices in 2008.

And for that money, lawmakers privy to classified reports say, the TSA has gotten a woeful failure rate. Senate Homeland Security Chairman Ron Johnson has such low confidence in the scanners’ ability to catch explosives and weapons that he says the agency should make fliers walk through metal detectors after passing through the body imaging machines.

Yes, dear sirs and madams, full body scanners, so inept that esteemed government officials are suggesting people exiting them should immediately go through a traditional metal detector, come at a $150k/ea price tag. But the danger of a program like body scanners, when it comes to government malfeasance, isn't solely in the primary failure of the program. Rather, the danger is in the way the failure then begins to infect everyone around it, like some kind of IQ-deteriorating brain bacteria. For example, the esteemed SHS Chairman mentioned above, who suggested metal detectors be used immediately after the body scanner, begged pardon if you had thought he meant that the body scanners weren't still needed.

“If you really want to keep using those, and I’m not saying we shouldn’t, at a minimum we should put a metal detector on the other side,” the Wisconsin Republican said in an interview. “Why not go through two? You’ve just gotta use common sense.”

Ah, yes, common sense. Well, Senator, let me try some of this common sense thing you speak of for myself. My common sense suggests that any procedure about which the following can be written ought be permanently done away with:

A recent security audit found that TSA had failed to find fake explosives and weapons in 96 percent of covert tests. And members of Congress familiar with the classified details say the body scanners are to blame for much of the problem.

Common sense does not inform me that, rather than removal of these devices, our best bet is to simply stack devices upon devices through which we should walk, all while being uncertain of their efficacy. The problem isn't a lack of devices to walk through; the problem is there are too many.

Homeland Security Secretary Jeh Johnson has said he has received assurances from L-3’s CEO that the company will work with the department to improve the technology.

Ah, yes, an assurance that this next go 'round they'll get it right, from a company that screwed it up the first time. You'll excuse me, sirs, if I am laughing. The point is that it's time to give up the game. The security we get at our airports is mere theater and we know it. The devices that didn't work the first time around while costing American taxpayers a hundred and sixty million dollars shouldn't get another bite at the apple. 9/11 is far enough in the rearview mirror that we can't use fear as an excuse any longer. It's time to end the masquerade and get on with it.

Filed Under: body scanners, metal detectors, security theater, tsa
Companies: l-3

TSA At The Movies: Theater Chain Looks To Bring Security Theater To The Movie Theater

from the more-hassle,-same-safety dept

Thanks to a string of theater-related tragedies, going to the theater is about to become as enjoyable as going to the airport.

Following two recent deadly incidents at movie theatres in the US, the Regal Entertainment Group – the nation’s largest movie theater chain – this week added a bag and purse check policy as a security measure in some of the 569 theaters it operates.

“Security issues have become a daily part of our lives in America. Regal Entertainment Group wants our customers and staff to feel comfortable and safe when visiting or working in our theatres,” the chain said in a statement.

This may sound like a harmless bit of "doing something" in response to a few tragic incidents, but there's nothing really harmless about it.

First off, it subjects everyone to the same level of scrutiny -- provided they're carrying a bag of some sort. If you have a purse or backpack or (god forbid) a fanny pack, you're a potential threat. Everyone else? Free to go. Weapons tucked into waistbands or shoved into pockets will go undetected.

And, like the TSA its emulating, the security measures will be easily thwarted and ultimately useless. For every weapon the TSA brags about seizing, many more end up on planes. A recent audit of the TSA's security efforts found it missed 95% of smuggled weapons and explosives. Anyone thinking Regal's security force is going to be better trained and more thorough than the TSA is kidding themselves.

Like the TSA's efforts, this will give moviegoers the illusion of safety, rather than actual safety. An illusion might be comforting enough for most moviegoers and it's all Regal can actually offer. This move is more about PR than reality.

According to a new survey conducted by consumer research film C4, following the Nashville incident, 48% of moviegoers are willing to pay $1 or more per ticket for the additional measures. Nineteen per cent of respondents said they would pay $3 or more.

And I'm sure Regal will be more than happy to take $1-3 more from every moviegoer in exchange for a hassling a few moviegoers. But Regal's move -- while good-intentioned -- is ill-advised. Offering your customers mostly-theoretical protection places responsibility for any future shootings almost solely on each individual theater. Now, if anyone shoots up a theater, Regal will very likely be successfully targeted in wrongful death suits. After all, it instituted additional measures to prevent further shootings... and then failed to prevent a shooting from happening. The additional measures seem unlikely to dissuade anyone but the most easily-deterred shooters from following through with their plans. In exchange for little more than a temporary bump in goodwill, Regal is assuming a great deal of liability.

And given what we know about the most recent theater shootings, a bag check wouldn't have stopped anything. James Holmes, who killed 12 and wounded 70 in Aurora, CO, stashed his weapons in his vehicle. The shooter in Louisiana may have had a backpack (reports are inconclusive), but it wasn't on or near him when police got to him, and a controlled detonation later proved there was nothing harmful inside it. The shooter at the Antioch, TN theater was carrying two backpacks -- one of which was strapped across his chest. When police engaged him, he was also wearing a surgical mask. Most of what was in his bags weren't actually weapons, though. Pepper spray, a hatchet and an Airsoft gun were used in the theater attack. Only one of these is an actual weapon, and Regal's new policy doesn't make it clear what will happen to those who bring in legal items that aren't weapons but the theater decides could be deployed as one.

This focus on bags also makes it clear to potential attackers that security will be looking out for one thing -- backpacks and bags. Avoiding scrutiny simply means not doing that one thing. So, while some moviegoers will be comforted by this security charade being performed on their behalf, many more will be irritated that attending a movie will be nearly as annoying as boarding a plane.

Filed Under: bag checks, movie theaters, movies, security, security theater, tsa
Companies: regal entertainment

Irish Airport Security Bravely Defends Plane From Toddler's Fart-Gun

from the heroes dept

Here at Techdirt, we've had a great deal of fun at the expense of the TSA and the agency's wonderful brand of security theater masquerading as actual airport security. Yes, the government putting on a kind of clinic in the simultaneous overreach into civil liberties for false security and the kind of wasteful government spending that makes the conservative talkshow hosts of the world dip back into the Oxy has been an ongoing source of entertainment. But the TSA can take the same kind of heart that thousands of purported UFO abductees do: you are not alone.

No, as it turns out, foreign airport security agencies can be just as laughable as we can be. Witness the Irish, for instance, and the way they bravely disarmed a three year old of a toy fart-gun.

Can't believe that a minion fart gun was taken from friends toddler, security felt it posed a threat @UniversalPics pic.twitter.com/iAPLlmdTv3 — Paula (@NursepollyRgn) August 16, 2015

As Paula pointed out, this is a replica of the "Fart Blaster" wielded by the minions in "Despicable Me." So I guess it does have a track record of being used for evil purposes. But in real life it doesn't do anything except make noise and apparently emit an odor that thankfully is said to be banana-scented. Do I want a kid to wield one of these on a plane? No. Does it need to be confiscated by security personnel? No.

Well, I do want a kid wielding one of these delightful toys on an airplane, sirs. The very idea of a three year old tumbling down the aisle spraying a bunch of uptight, too-stiff adults with insufficient senses of humor in the face with banana-farts is exactly the kind of life, liberty and happiness no government ought be denying my right to pursue. What's far less funny - kind of - was the Irish authorities' insistence that they confiscated the "weapon" because it violated the rules against replica guns. Replica guns typically refer to realistic representations of actual firearms that don't work. The fart gun is not a representation of a real gun at all. And it most certainly works as intended.

The spokesperson noted that the toy was "being kept safe at the airport" so the child can get it back when the family returns, so that's nice.

It's not nice; it's exceptionally stupid. The Irish authorities are sitting on a children's toy that they absolutely know is not a weapon over a ham-fisted attempt to play by bureaucratic rules. I think it's time these lads went and had a Guinness and let the kid have his toy back.

Filed Under: airport security, fart gun, ireland, minions, security theater, tsa

Feds Still Shrugging People Onto Terrorist Watchlists Based On Hunches

from the you-might-be-a-terrorist-IF...-we-decide-you-might-be-a-terrorist-WHEN dept

The US government's desire to keep terrorists off airplanes has resulted in heavily-populated "watchlists" -- lists short on due process and long on hunches.

The TSA, in particular, has embraced a mixture of borrowed ideas and junk science to staff airports with Behavioral Detection Officers, who attempt to keep terrorists from boarding planes by looking for any number of vague indicators. The end result is a billion-dollar program with the accuracy of a coin flip.

That's the physical version of the government's "predictive policing" security efforts. The same sort of vague quasi-science is used to populate its "no fly" list.

The U.S. government’s reliance on “predictive judgments” to deprive Americans of their constitutionally protected liberties is no fiction. It’s now central to the government’s defense of its no-fly list—a secretive watch list that bans people from flying to or from the United States or over American airspace—in a challenge brought by the American Civil Liberties Union.

Court filings show that the government is trying to predict whether people who have never been charged, let alone convicted, of any violent crime might nevertheless commit a violent terrorist act. Because the government predicts that our clients—all innocent U.S. citizens—might engage in violence at some unknown point in the future, it has grounded them indefinitely.

The court itself found the "no fly" list's redress processes (or lack thereof) to be unconstitutional, as it was basically unchallengeable by listed travelers. (And the only sure way for a person to discover they were on the "no fly" list was to buy a ticket to somewhere and attempt to board a plane.) According to the court, the list and its lack of proper redress was a perfect storm of civil liberties violations.

In summary, on this record the Court concludes the DHS TRIP process presently carries with it a high risk of erroneous deprivation in light of the low evidentiary standard required for placement on the No-Fly List together with the lack of a meaningful opportunity for individuals on the No-Fly List to provide exculpatory evidence in an effort to be taken off of the List.

While the DHS has slightly improved its redress process for those who find themselves on the list, it hasn't made any changes to its dubious selection standards. In fact, it's made this part of the process worse.

[T]he U.S. government launched its predictive judgment model without offering any evidence whatsoever about its accuracy, any scientific basis or methodology that might justify it, or the extent to which it results in errors.

In our case, we turned to two independent experts to evaluate the government’s predictive method: Marc Sageman, a former longtime intelligence community professional and forensic psychologist with expertise in terrorism research, and James Austin, an expert in risk assessment in the criminal justice system. Neither found any indication that the government’s predictive model even tries to use basic scientific methods to make and test its predictions.

As Sageman says, despite years of research, no one inside or outside the government has devised a model that can predict with any reliability if a person will commit an act of terrorism.

And there go any redress improvements. To get off the list, a person must convince the government he or she won't commit a criminal act that its "predictive model" has determined they might. At least in the FBI's terrorist "investigations," there's a minimum of intent and activity. In the case of would-be travelers like the ACLU's clients, there's nothing more than a predictive model spitting out probabilities.

In all likelihood, the predictive model used by the US government is based on more than faulty science. It's also based on faulty reasoning. As Doug Saunders at the Globe and Mail points out, analysts researching tracking and surveillance of would-be terrorists are finding the usual presumptions are mostly wrong.

Analysts began looking at the work of Paul Gill, a criminologist at the University College of London. In a highly influential 2014 paper titled “Bombing Alone: Tracing the Motivations and Antecedent Behaviours of Lone-Actor Terrorists,” Dr. Gill and his colleagues analyzed known terrorists not by what they thought or where they came from, but by what they did.

In the weeks before an attack, terrorists tend to change address (one in five) or adopt a new religion (40 per cent of Islamic terrorists and many right-wing terrorists did so). And they start talking about violence: 82 per cent told others about their grievance; almost seven in 10 told friends or family that they “intended to hurt others.”

A huge proportion had recently become unemployed, experienced a heightened level of stress or had family breakdowns. And most had done things that looked like planning – including contacting known violent groups.

Predictive modeling often looks like "thought policing," but that is of little use, apparently. There are other indicators that are far more telling, but these factors aren't being given proper weight by the models in use. Saunders notes that there has been a shift in modeling over the past couple of years, thanks to research from analysts like Paul Gill, but that shift in predictive factors hasn't slowed legislators from demanding even more futile, invasive "thought policing."

Unfortunately, governments, including Canada’s, are behind the curve: Just as their terrorism experts and security employees have abandoned policies which resemble the policing of thoughts, they're passing disturbing laws to make such obsolete practices easier.

The DHS may be using smarter modeling now, but it's not as though it's been examining its existing list to remove those who don't match the vague criteria. Instead, it's only responding to challenges made by travelers who find themselves on the list, and even then, it may still withhold information a listed flyer could use to challenge their status if the agency deems the release of such info a threat to national security. The nod to due process leads to an exchange of information and paperwork with the government, but there's nothing adversarial about the redress procedure. It's your word against theirs, with the agency -- not a court -- making the final determination as to whether a person can ever board an airplane.

Filed Under: behavioral targeting, doj, hunch, junk science, no fly list, terrorist watchlist, tsa

Agency Watchdogs Ask Congress To Roll Back Decision Allowing Agencies To Withhold Documents From Oversight Entities

from the a-new-low-in-sensitivity-training dept

FBI. DEA. NSA. CIA. DHS. TSA. All these acronyms (and more) participate in activities that can (and do) have negative effects on Americans' civil liberties. But that's OK, says the government, because we have oversight. This assertion just simply isn't true. The Snowden leaks proved what oversight existed was beholden to the NSA and frequently put itself between the agency and legislators on the outside of the inner circle in order to keep its secrets protected.

Elsewhere, the entities charged with providing oversight for government agencies -- the various Inspector General's offices -- were finding themselves unable to pursue their duties because the agencies they watched refused to cooperate with their investigations. Michael Horowitz, the DOJ Inspector General, frequently expressed his displeasure with the DEA and FBI, both of which refused to provide him with the documents he was seeking.

Over at the CIA, Inspector General David Buckley performed his investigation of the alleged hacking of Senate staffers' computers. He found the allegations to be true. The CIA responded by discrediting his report and performing its own internal audit, which naturally found the agency to be blameless and the Senate at fault for supposedly abusing its access to CIA documents. Buckley retired. The CIA has yet to replace him.

As if things couldn't get any worse, the Office of Legal Counsel decided the best route for effective oversight was to hand over control to the agencies being overseen. On July 20th, it issued a decision that said Inspectors General needed to seek permission from the agencies under their purview for access to sensitive documents. If the agencies turned them down, too bad. They'd just have to do without.

The IGs -- representing 72 government agencies -- have sent a letter to Congress asking them to overturn the OLC's decision. (via Unredacted)

Despite the unequivocal language of Section 6(a) of the IG Act, the OLC opinion concludes that it does not entitle the DOJ-IG to obtain independent access to grand jury, wiretap, and credit information in the DOJ’s possession that is necessary for the DOJ-IG to perform its work. Indeed, the OLC opinion concludes that such records cannot be obtained by the DOJ-IG pursuant to the IG Act, and can only be obtained in certain – but not all – circumstances through provisions in the specific laws related to those records. Further, the opinion provides that only the Department of Justice itself decides whether access by the DOJ-IG is warranted – placing the agency that the DOJ-IG oversees in the position of deciding whether to grant the Inspector General access to information necessary to conduct effective and independent oversight. Requiring an Inspector General to obtain permission from agency staff in order to access agency information turns the principle of independent oversight that is enshrined in the IG Act on its head.

The OLC opinion’s restrictive reading of the IG Act represents a potentially serious challenge to the authority of every Inspector General and our collective ability to conduct our work thoroughly, independently, and in a timely manner. Our concern is that, as a result of the OLC opinion, agencies other than DOJ may likewise withhold crucial records from their Inspectors General, adversely impacting their work. Even absent this opinion, agencies such as the Peace Corps and the U.S. Chemical Safety and Hazard Investigation Board (CSB) have restricted or denied their OIGs access to agency records on claims of common law privileges or assertions that other laws prohibit access. Similarly, the Department of Commerce denied its Inspector General (Commerce-IG) access to agency records that were needed for the Commerce-IG to complete an audit of agency operations because agency counsel had concluded, based on guidance that agency counsel said came from OLC, that it might be a violation of another federal statute to make the records available to its Inspector General. As a result, the Commerce-IG could not complete its audit.

In other words, things were already bad. Now, they're impossible. These agencies were already doing everything they could to thwart their oversight. Now, the OLC has given them permission to stonewall every single investigation that requires the access to "sensitive" agency documents -- which would be a great majority of them.

The letter goes on to point out that the OLC's decision creates a smokescreen that will have serious repercussions for years to come.

Without timely and unfettered access to all necessary information, Inspectors General cannot ensure that all government programs and operations are subject to exacting and independent scrutiny. Refusing, restricting, or delaying an Inspector General's independent access may lead to incomplete, inaccurate, or significantly delayed findings and recommendations, which in turn may prevent the agency from promptly correcting serious problems and pursuing recoveries that benefit taxpayers, and deprive Congress of timely information regarding the agency's activities. It also may impede or otherwise inhibit investigations and prosecutions related to agency programs and operations.

The OLC's decision is astounding, and should be undone as swiftly as possible. There's a lot of room for abuse in many agencies, and one of the only things acting as a check against this are the IGs. The assurances that there is sufficient oversight are hollow. There was very little oversight to begin with. With this determination in place, there's almost none. The denied access can likely be challenged, but time is often of the essence, and weeks or months of discussion over the release of documents can put a lot of space between badly-behaving agencies and whatever scandal they're attempting to ride out.

The OLC had decided government agencies shouldn't be accountable to the public, and its excuse is "security." It's being left up to agencies to decide what information is too "sensitive" to share with their overseers. And it will be evidence of screwups, quasi-legal activities and other abuses of power that receive this label first.

Filed Under: cia, dea, dhs, doj, fbi, inspector general, inspectors general, nsa, office of legal counsel, olc, transparency, tsa, watchdogs

TSA Decides Sorority Souvenir Book Carried By Dozens Of Travelers Probably A Bomb

from the some-sort-of-terrorist-convention...-even-the-letters-aren't-English dept

Hundreds of travelers attempting to fly out of Houston's Hobby Airport were delayed for hours as TSA agents confronted the massive security threat posed by a book. Actually, several books. Several identical books. Carried by several fliers leaving the same event. (via Lowering the Bar)

"We had a large group with a large number of bags to be checked and because of a certain item in those bags there was additional screening necessary," said Bill Begley with Hobby Airport.

A spokesman for the airport says the sorority members were apparently given thick booklets at the convention that could be mistaken for explosives when packed into checked bags. The booklets forced TSA officials to hand check most of the luggage.

Nice use of the word "forced." Even if the book appeared suspicious at first, perhaps the inference could have been drawn that other passengers wearing the sorority insignia on their almost-universally red clothing were carrying the same non-threatening book. Or does "Behavioral Detection" -- the TSA's mind-reading initiative that watches for suspicious patterns -- only detect suspicion, not the lack thereof?

Here's the "bomb," as displayed by one passenger during KHOU's televised report:






Better safe than sorry -- the TSA's strangulated way of thinking -- kept this from being pursued logically, as Kevin Underhill points out.

Of course, I suppose it's not impossible that ISIS coordinated an attack plan with the annual Delta Sigma Theta convention. But the chances of that are sufficiently close to zero that I'd feel safe waving these ladies through.

Maybe it wasn't ISIS. Maybe it was hundreds of "lone wolves," all wearing red and white clothing and all carrying the same bomb/book!

Instead of seeing this common element as something non-suspicious after the first thorough search, the TSA apparently treated every repeat "incident" as its own particularized threat. Flights were delayed, but not a single one was made any safer by these extra inspection efforts.

So far, the TSA has yet to comment on its actions, leaving that unenviable task to airport officials. Meanwhile, travelers continue to give the TSA more credit than it deserves.

"I'm sure they were doing their best that they could, but it just wasn't enough it wasn't enough," [sorority alumus Cassandra] Tomes said.

Their "best" is routinely terrible. And for all the talk about becoming a smarter, more responsive security agency, the TSA continues to brute force its way through the day-to-day business of keeping up appearances.

Filed Under: book, delta sigma theta, hobby airport, houston, security, security theater, sorority, tsa

Laura Poitras Sues US Government To Find Out Why She Was Detained Every Time She Flew

from the time-for-some-answers dept

These days, Laura Poitras is known as the Oscar-winning director of the Ed Snowden documentary CITIZENFOUR, and with it, one of the reporters who helped break Snowden's story in the first place. Pre-Snowden, she was a not-as-widely-known-but-still-celebrated documentary filmmaker, who also got some attention after her future colleague Glenn Greenwald wrote an article about how she was detained at the border every time she flew into the country (which was frequently, as she had made a documentary, My Country, My Country, concerning the Iraq War, along with The Oath, which reported on two Yemenis who had worked with Osama bin Laden). As Greenwald wrote back in 2012:

But Poitras’ work has been hampered, and continues to be hampered, by the constant harassment, invasive searches, and intimidation tactics to which she is routinely subjected whenever she re-enters her own country. Since the 2006 release of “My Country, My Country,” Poitras has left and re-entered the U.S. roughly 40 times. Virtually every time during that six-year-period that she has returned to the U.S., her plane has been met by DHS agents who stand at the airplane door or tarmac and inspect the passports of every de-planing passenger until they find her (on the handful of occasions where they did not meet her at the plane, agents were called when she arrived at immigration). Each time, they detain her, and then interrogate her at length about where she went and with whom she met or spoke. They have exhibited a particular interest in finding out for whom she works.

She has had her laptop, camera and cellphone seized, and not returned for weeks, with the contents presumably copied. On several occasions, her reporter’s notebooks were seized and their contents copied, even as she objected that doing so would invade her journalist-source relationship. Her credit cards and receipts have been copied on numerous occasions. In many instances, DHS agents also detain and interrogate her in the foreign airport before her return, on one trip telling her that she would be barred from boarding her flight back home, only to let her board at the last minute. When she arrived at JFK Airport on Thanksgiving weekend of 2010, she was told by one DHS agent — after she asserted her privileges as a journalist to refuse to answer questions about the individuals with whom she met on her trip — that he “finds it very suspicious that you’re not willing to help your country by answering our questions.” They sometimes keep her detained for three to four hours (all while telling her that she will be released more quickly if she answers all their questions and consents to full searches).

It wasn't only at the border that she was subject to such searches. Often, even when flying domestically within the US, she was called out for further scrutiny and searches.

After Greenwald's article, a bunch of documentary filmmakers signed a petition protesting the treatment of Poitras, and between the press coverage and the petition, the harassment of Poitras suddenly stopped.

After this, she filed some FOIA requests to find out why she had been supposedly given a high threat rating in the DHS database, causing such detentions. Not surprisingly, the government refused to reveal any such information. And that brings us to the latest, where Poitras, with help from the EFF, has now sued the US government (specifically the Departments of Homeland Security and Justice) to get them to reveal why she was considered a threat.

As the filing itself explains, Poitras filed FOIA requests with basically every part of the government that might have information on her detentions, and basically got nothing in response from any of them, either by mostly ignoring the requests or rejecting them.

As the lawsuit also notes, Poitras took detailed records of her detentions (when she could -- in at least one instance she was denied the use of a pen to take notes after being told she might use it as a weapon). And the lawsuit includes some detailed descriptions. Here's just a snippet from a much longer list.

On or around August 22, 2006, while traveling from Sarajevo, the capital of Bosnia and Herzegovina, to John F. Kennedy International Airport (“JFK”) in New York City after attending the Sarajevo Film Festival, Plaintiff was paged to security while transiting through the Vienna International Airport in Vienna, Austria. Plaintiff was thereafter taken into a van and driven to a security inspection area. All of Plaintiff’s bags were searched and xrayed. The head of airport security at the Vienna International Airport told Plaintiff that her “Threat Score” was 400 out of 400 points. Plaintiff was eventually allowed to board a plane to the United States. Upon her arrival at JFK, CBP agents again met her at the gate. Plaintiff was thereafter escorted to a holding room, where she was detained and questioned for roughly two (2) hours, and where her bags were searched for a second time, before being allowed to enter the United States.

On or around November 26, 2006, while traveling from Paris, France to Newark on her way home from a vacation, Plaintiff was met by boarder agents upon her arrival at Newark. She was detained and questioned for 30 minutes.

On or around December 17, 2006, while traveling from Dubai, United Arab Emirates to JFK after attending the Dubai Film Festival, Plaintiff was met by border agents upon her arrival at JFK. She was again detained and questioned before being allowed entry into the United States. The CBP agents asked Plaintiff when she had last been to Atlanta, Georgia and told her that she had a criminal record, despite that she had never been arrested.

Unfortunately, the courts have been pretty deferential to the government concerning things like the "no fly" list and the terrorist database, which means this lawsuit might be a long shot. However, one hopes that a judge will see both the clear ridiculousness of the treatment and the rather obvious fact that it was designed to intimidate Poitras and chill her First Amendment rights, and consider forcing the government into releasing these documents.

Filed Under: border patrol, cbp, chilling effects, detained, dhs, laura poitras, travel, tsa
Companies: eff

TSA Blows Off Inspector General's Suggestion Boarding Pass Information Be Encrypted

from the more-business-as-usual dept

The TSA's Secure Flight system apparently isn't all that secure, according to the barely-readable portions of the recently-released Inspector General's report. The TSA has a Pre-Check program that requires a ton of personal information and $85 to participate in. It also has "Secure Flight," which grants Pre-Check privileges on a case-by-case basis, for which travelers pay nothing. This simply means they won't always find themselves in the short line, but it does call into question the need to provide a ton of information up front, much less $85 for an experience others are getting for free.

Much like everything else the TSA is nominally in charge of, it has flaws. A whistleblower report to the TSA and the Office of the Inspector General claimed that the use of a "risk-based rule" led to a "vulnerability in aviation security" back in early 2014. (This would be before the Pre-Check system allowed a convicted murder with explosives experience to bypass more rigorous screening, simply because the boarding pass included the "wave me through" checkmark.)

What this "vulnerability" was is never openly explained. There's plenty of text in the report (28 pages of it, in fact), but everything specific is hidden under a thick layer of black ink. What we do know is that it involved boarding passes and the TSA's "risk-based assessment" program.

As a result of the report, the TSA suspended the redacted Secure Flight "rule". This rule was apparently linked to passengers' ability to print out their own boarding passes with the handy Pre-Check checkmark on them. Apparently, someone used someone else's ticket or found a way to print boarding passes without providing proper ID verification. Either way, this mysterious "rule" went away, and along with it, some Pre-Check passenger privileges.

Now, the TSA is planning to add additional layers of verification to the Pre-Check/Secure Flight system. But this won't fully go into effect until later this year. In the meantime, the "rule" remains suspended.

As a result of this redacted breach, the OIG's office made three recommendations -- which are also mostly redacted.

The first suggests the nature of the breach (or the problem with the rule) [or both].

Explore the feasibility of encrypting commercial aircraft carrier boarding passes [rest of sentence redacted].

The other two recommendations target the TSA's upgraded credential authentication program.

The TSA pretty much disagrees with the entirety of the OIG's assessment. Scattered between heavy redactions are various punchy odes to its pretty-much-infallible coin toss it calls "risk assessment." Scattered between other redactions are assertions that the TSA is pretty good about assessing threats and has been steadily improving for years without the OIG's constant nagging.

But before it heads into that, the OIG declares the TSA to be "responsive" to its first recommendation, even though it didn't do anything more than declare the recommendation too expensive and too difficult.

Management Response to Recommendation #1: TSA officials did not concur with Recommendation 1. In its response, TSA said in 2012 it explored the cost and feasibility of encrypting commercial aircraft carrier boarding passes [redacted]. After engaging industry stakeholders, TSA decided not to adopt this approach because of limited data fields in some air carrier systems and encrypting boarding pass barcodes is cost prohibitive. TSA said it decided to pursue a more practical and affordable solution using a digital signature.

Nothing's too good for the USofA! I mean, nothing's too practical and affordable. So, let's just use a "digital signature" because it's pretty much just as secure, right?

Now, we just have to assess the wisdom of the TSA's estimation of itself in light of this new (but very limited) information. It thinks it's doing a bang-up job making flying more secure. TSA head John Pistole frequently mentions the many programs it uses in addition to pre-flight scanning/screening, most of which have been determined by others to have a 50% hit rate.

On one hand, its screeners managed to miss 95 out 100 prohibited items during a recent assessment of its screening protocols. (But, man, it was all over that bag of cash, wasn't it!) On the other hand, its long-running ineptitude has yet to result in mass hijackings. It fails at the thing it does the most of (patdowns, screenings) and its more intangible efforts (risk assessment) haven't proven to be any more accurate than its in-person patdowns. In totality, we have a self-important entity whose presence is hardly justified. It appears air travel would be roughly as safe without the TSA's multiple encroachments. What it argues works well actually doesn't, and new issues are dismissed as not being worth the effort/expense to fix.

Filed Under: boarding passes, encryption, pre-check, secure flight, tsa