GAO Report: TSA Has No Idea How Effective Its Suspicionless Surveillance Program Is

from the results-to-be-reported-the-moment-there-are-actually-any-results dept

The TSA's "Quiet Skies" program continues and it doesn't appear to be making flying any safer. The program first exposed last year by the Boston Globe involved the surveillance of travelers for doing things like looking in shop windows or changing direction while walking through airports.

None of the people surveilled were on any terrorist watchlists. According to the TSA, it was hoping to find "unknown terrorists" by using a broad list of "suspicious" behavior to subject a greater number of travelers to additional screening and the apparent company of a flying air marshal (FAM).

The TSA thought it was great. The air marshals tasked with surveilling random people thought it was a waste of time and resources, if not an unconstitutional use of their powers. Backlash from the public and the air marshals themselves led the TSA to curtail the program. It promised not to surveill people for engaging in normal behavior the TSA had unilaterally deemed suspicious. There was also evidence the program was completely useless, as none of the 5,000 people targeted by "Quiet Skies" over a 6-month period in 2018 had gone on to do anything that air marshals deemed suspicious or worthy of further scrutiny.

The program lives on, unfortunately. The TSA may have scaled back its long list of "suspicious" behaviors, but it's still subjecting an unknown number of travelers to additional screening and surveillance, even if they're not tied to known terrorists or anyone on the government's multiple terrorist databases.

And it still doesn't work. It's still operational, I suppose, but the Government Accountability Office says the TSA doesn't know whether the program is effective. The program -- which has been running for nearly a decade now -- still hasn't been examined by the TSA to see whether it's actually doing anything to improve air security. From the report [PDF]:

We found that TSA coordinates reviews of Silent Partner and Quiet Skies through quarterly meetings and notifies an expanded set of DHS and TSA stakeholders—including DHS Traveler Redress Inquiry Program and the Federal Air Marshal Service—of rule changes as required under the Act. We also found that TSA has not identified a means to comprehensively measure rule effectiveness.

The TSA's reason for not following up on the program's effectiveness? It's just too much work.

TSA officials explained that they had not yet fully assessed the rules’ effectiveness because it was difficult to measure.

Difficult? Maybe. Impossible? No, says the GAO.

TSA has access to data—such as the outcomes of enhanced screening of Silent Partner and Quiet Skies passengers at airport checkpoints—that could be explored to better assess rule effectiveness. Exploring additional data sources could help TSA refine and supplement the agency’s existing efforts to measure program effectiveness.

The TSA may move forward with the GAO's recommendation it start actually measuring effectiveness. Then again, it's spent nine years not measuring it, so any progress will be on the same timescale.

TSA is currently reviewing the draft report and is scheduled to provide any comments by early November 2019.

At which point the TSA is free to reject the GAO's suggestion and continue to perform presumably useless screening and surveillance for the rest of forever.

That's not the only thing the TSA isn't following up on. The agency likes spending tax dollars on new security gear, whether it's needed or not.

Our review of TSA acquisition documents found that TSA considers risk at the beginning of the screening technologies acquisition process. However, TSA officials could not provide an example of when risk information for specific airports had directly influenced decisions about where and in what order to deploy screening technologies to airports in the recent past.

Then the agency deploys the tech and promptly forgets about it.

We also found that TSA does not ensure that screening technologies continue to meet detection requirements after they have been deployed to airports, when performance can degrade over time.

The TSA's process involves certifying the equipment prior to deployment and periodic calibration to ensure the tech is in "minimally operational." The GAO says this misses the point: the tech should be tested more frequently and, more importantly, assessed periodically to see if the deployed equipment still addresses the perceived risks present at that location as those may also change over time.

The TSA is mostly a reactive agency, one that responds to each attempted attack it's failed to thwart by subjecting travelers to another layer of screening annoyance. Its proactive efforts -- "Quiet Skies" and behavioral detection teams -- are somehow even worse. The TSA doesn't know what it's looking for because it hasn't prevented a terrorist attack yet. Its shotgun approach to screening and surveillance isn't likely to head off future attacks but the TSA seems content to settle for collateral damage.

Filed Under: airport security, gao, quiet skies, surveillance, tsa

Irish Airport Security Bravely Defends Plane From Toddler's Fart-Gun

from the heroes dept

Here at Techdirt, we've had a great deal of fun at the expense of the TSA and the agency's wonderful brand of security theater masquerading as actual airport security. Yes, the government putting on a kind of clinic in the simultaneous overreach into civil liberties for false security and the kind of wasteful government spending that makes the conservative talkshow hosts of the world dip back into the Oxy has been an ongoing source of entertainment. But the TSA can take the same kind of heart that thousands of purported UFO abductees do: you are not alone.

No, as it turns out, foreign airport security agencies can be just as laughable as we can be. Witness the Irish, for instance, and the way they bravely disarmed a three year old of a toy fart-gun.

Can't believe that a minion fart gun was taken from friends toddler, security felt it posed a threat @UniversalPics pic.twitter.com/iAPLlmdTv3 — Paula (@NursepollyRgn) August 16, 2015

As Paula pointed out, this is a replica of the "Fart Blaster" wielded by the minions in "Despicable Me." So I guess it does have a track record of being used for evil purposes. But in real life it doesn't do anything except make noise and apparently emit an odor that thankfully is said to be banana-scented. Do I want a kid to wield one of these on a plane? No. Does it need to be confiscated by security personnel? No.

Well, I do want a kid wielding one of these delightful toys on an airplane, sirs. The very idea of a three year old tumbling down the aisle spraying a bunch of uptight, too-stiff adults with insufficient senses of humor in the face with banana-farts is exactly the kind of life, liberty and happiness no government ought be denying my right to pursue. What's far less funny - kind of - was the Irish authorities' insistence that they confiscated the "weapon" because it violated the rules against replica guns. Replica guns typically refer to realistic representations of actual firearms that don't work. The fart gun is not a representation of a real gun at all. And it most certainly works as intended.

The spokesperson noted that the toy was "being kept safe at the airport" so the child can get it back when the family returns, so that's nice.

It's not nice; it's exceptionally stupid. The Irish authorities are sitting on a children's toy that they absolutely know is not a weapon over a ham-fisted attempt to play by bureaucratic rules. I think it's time these lads went and had a Guinness and let the kid have his toy back.

Filed Under: airport security, fart gun, ireland, minions, security theater, tsa

Another Batch Of Baggage Handlers Accused Of Stealing From Luggage; Because Airport 'Security' Isn't

from the shopping-for-your-goods dept

Just last week I flew into JFK airport's terminal 4, and thankfully I only had carry-on luggage, because this morning I read that seven baggage handlers from JFK -- working in terminals 4 and 7 -- have been arrested for stealing stuff from people's luggage. And doing so without much fear of getting caught (even if they were, eventually):

According to the criminal complaints, between March 2012 and June 2014, the defendants stole Apple iPads, iPhones and MacBook computers; Samsung Galaxy phones and tablets; Dell, Toshiba and ASUS laptops; and other electronic items, as well as a pair of two-carat diamond-and-gold earrings. The complaint said the items were taken from passengers' checked luggage, and all but two of the defendants are alleged to have contacted a "fence," who actually was an undercover police officer.

The defendants named their prices, set up meetings on airport grounds or nearby, and even made promises about other items that they could steal, the complaint said.

Now, if this were a one time thing, it might not even be that noteworthy. But this seems like fairly common practice at airports. A few years ago, we wrote about TSA agents stealing iPads and stories of TSA agents and baggage handlers stealing stuff from luggage are not at all hard to find. In fact, reports from a few years ago noted that over 400 TSA employees have been fired for stealing from passnegers in the past decade.

And related stories are all over the place. Hell, back in March, another group of JFK baggage handlers were arrested. On nearly the same day, it looks like a similar theft ring involving baggage handlers at LAX was broken up. Even more recently, a similar theft ring at New Orleans' Louis Armstrong International Airport. Amateur sleuths were needed to bust up a baggage handler theft ring in Charleston, South Carolina. A WSJ article from a few years ago details a long list of baggage handler thefts from a wide range of airports.

And it's not just baggage handlers, but the TSA itself, who (we're told) is supposed to be protecting us from bad people. Here's $8,500 stolen from a bag. Here's a TSA officer stealing a computer. Here's a TSA agent swiping $36 from a passenger. A few years ago, a convicted TSA agent, who admitted to stealing $800,000 from passengers at Newark Airport in New Jersey, spoke out about just how common theft was among the TSA:

"It was very commonplace, very," said Pythias Brown, a former TSA officer at Newark Liberty International Airport in New Jersey who admits he stole more than $800,000 worth of items from luggage and security checkpoints over a four-year period.

"It was very convenient to steal," he said.

Speaking publicly for the first time after being released from prison, Brown told ABC News his four-year-long crime spree came to an end only because he tried to sell a camera he stole from the luggage of a CNN producer on E-bay but forgot to remove all of the news networks' identifying stickers.

"It became so easy, I got complacent," Brown said.

All of this should raise a variety of questions about airport security. We're told that these people are there to protect us, but it seems that they're not able to do that. At all. Hell, as Amy Alkon points out, if it's so damn easy to take stuff out of people's bags, you know it's pretty easy to put stuff in as well. And, of course, this has been going on for years. Many of those links above are more recent, but plenty are from years past and it doesn't seem like anything has changed very much. Airport "security" remains security theater at the best of times, but it's even worse when it's actually putting people at more risk.

Filed Under: airport security, baggage handlers, jfk, security, security theater, stealing, theft, tsa

Oblivious Man Staring At iPad Causes Security Meltdown Conga Line

from the iTerrorist dept

We've often discussed the complete farce that airport security has become since 9/11. Security theater that appears to be a performance art piece on how dumb government can get isn't something we should be looking to export, but it seems like many countries throughout the planet have incorporated many of the reactionary tactics you can find in the States.

Take, for instance, the story about how a guy in Australia who accidentally walked in the wrong direction while paying too much attention to his iPad shut down a terminal and delayed flights for an hour.

On Saturday morning, a man got off a plane at Sydney Airport in Australia and was so enchanted by the fascinating content on his iPad that he walked into a domestic terminal without bothering to go through security. This event was captured on CCTV and unnerved officials so much that they evacuated passengers.

Flights were delayed for around an hour. One also wonders about security at Sydney Airport. Australia is currently under high alert after its prime minister, Tony Abbott, declared that a terrorist attack on his country was "likely," even though his security services hadn't discovered any "particular plots."

Terrorism is an issue that should be taken seriously, but if the civilized world is going to simply give up so much sense as to let a guy accidentally walking the wrong direction to essentially shut down an airport for an hour, then we might as well just admit defeat in our own minds. I see people pulling this oblivious move on my city's streets every damn day. It's annoying, sure, but it's fairly easy to determine that these people aren't going to be blowing up any buildings any time soon.

Well, maybe after they beat that Candy Crush level, but certainly not before. In the meantime, it's been over a decade, so we can all just calm down a bit when it comes to pretending to do airport security?

Filed Under: airport security, australia, ipad, security, walking

The TSA's Mental 'Coin Flip' That May Keep You From Traveling

from the because-highly-trained-detection-officers-work-for-$10/hr dept

I am (TSA Behavioral Detection Officer) Jack's self-delusion.

Like the rest of us, airport security screeners like to think they can read body language. TheTransportation Security Administration has spent some $1 billion training thousands of “behavior detection officers” to look for facial expressions and other nonverbal clues that would identify terrorists.

But critics say there’s no evidence that these efforts have stopped a single terrorist or accomplished much beyond inconveniencing tens of thousands of passengers a year. The T.S.A. seems to have fallen for a classic form of self-deception: the belief that you can read liars’ minds by watching their bodies.

$1 billion in taxpayer funds spent, and nothing's safer. The only "positive" seems to be that TSA's officials have improved their own morale.

The T.S.A.’s administrator, John S. Pistole, defended its behavior-detection program last year by saying it identified “high-risk passengers at a significantly higher rate than random screening.”

Pistole likely believes this to be true because the human brain is will betray its owner to make it happy. People generally tend to believe they're smarter than other people and that their skills are more finely honed -- whether or not the skills they claim have in fact been honed or are even possible.

The GAO (Government Accountability Office) came to an entirely different conclusion when it applied science, rather than belief, to the TSA's expensive Behavioral Detection program.

Peer-reviewed, published research does not support whether the use of nonverbal behavioral indicators by human observers can accurately identify deception. Our review of meta-analyses and other studies related to detecting deception conducted over the past 60 years, and interviews with experts in the field, question the use of behavior observation techniques, that is, human observation unaided by technology, as a means for reliably detecting deception. The meta-analyses, or reviews that synthesize the findings of other studies, we reviewed collectively included research from more than 400 separate studies on detecting deception, and found that the ability of human observers to accurately identify deceptive behavior based on behavioral cues or indicators is the same as or slightly better than chance (54 percent).

$1 billion thrown at something as useful as a coinflip to apprehending terroists. Or rather, would be as useful as a coin flip, if it only came up heads once in one hundred coin tosses.

It noted that fewer than 1 percent of the more than 30,000 passengers a year who are identified as suspicious end up being arrested, and that the offenses (like carrying drugs or undeclared currency) have not been linked to terrorist plots.

Pistole still believes in the program, though, and there won't be much that can convince him otherwise. For one thing, there's a whole lot of money riding on it. For another, there's the natural biases of the human brain. Of course, it's protected by the DHS, the same government entity that feels so confident in its employees' imaginary "abilities" that it argued CBP agents' "hunches" should supersede the "reasonable suspicion" demands of the Fourth Amendment.

And, as if the human's innate ability to convince itself it possesses skills it can't scientifically have isn't bad enough, the millions of dollars being poured into behavioral detection training is only making things worse. (While there were numerous sources for this information, I feel it's most enjoyably explained by Cracked.)

[P]olice officers have to go through rigorous training to make sure they pick up on the common tells people exhibit when they lie, but all of that training is actually worse for them than no training at all. The problem is that the training focuses on signs of nervousness, like twitching and discomfort, when twitching and discomfort are also known side effects of an innocent person sitting in an interrogation room. So as you can imagine, there are a lot of false positives. There are also countless other factors that determine how much someone squirms -- like their cultural background, what kind of lie they're telling, and whether the suspect is generally a noddy, hand-and-feet-movey kind of person (how many of you reading this are fidgeting at a desk right now, tapping your foot or bouncing your knee?)

A grizzled old police officer might say, "Yeah, that training is BS! I can spot a lie thanks to my 20 years on the streets."

Nope, sorry. They did a study on officers who'd been on the force for anywhere between three and 26 years and found that, incredibly, the longer someone's been an officer, the worse he or she is at telling when someone's lying.

When you base an entire program on a delusion that only gets worse with experience and training, you've got a nightmare on your hands. The TSA detained 30,000 people, found no terrorists, nailed a few people on ancillary charges, and when asked about it, claimed it was an amazing success.

There's no magic ability to detect liars and the cursory conversations deployed by TSA agents to sniff out would-be terrorists aren't nearly enough to qualify as "behavioral detection." Some things can be learned by observing people, but there's always going to be a ton of false positives to sift through.

Not only that, but no one wants to participate in faux-small talk with a person who wields an inordinate amount of power. Their recalcitrance can easily be "hunched" into "reasonable suspicion" by a BDO. Nearly everyone caught in these little "behavioral detection" chats is going to be nervous, because they know one simple misplaced word or action is the difference between them boarding their flight unmolested or potentially spending a few hours attempting to prove a negative to a bunch of TSA agents suffering from the delusion that they can determine suspicious behavior "just by looking."

Filed Under: airport security, behavioral detection, tsa

TSA Bad At Security; Leaves Security Status Data On Boarding Passes Unencrypted

from the these-people-are-supposed-to-make-us-feel-safe dept

You would think, given that "Security" is literally the organization's middle name, that the Transportation Security Administration (TSA) would actually have some sort of clue about the basics of security. Apparently not. This week, someone noticed a ridiculous security flaw in the TSA's pre-screening process for "expedited" lines. This is the program where frequent travelers can pay extra to get them in special faster security lines, and where they can skip some of the worst aspects of airport screening: they don't have to take their laptop out, or take off their shoes or belt, and they can bring more liquid than mere peons.

Of course, security experts long ago pointed out that any such system now becomes a target for terrorists, who can focus on getting into that special line and use that lesser security to cause trouble. One response to this is that, even for passengers who qualify for such a program, they're still subject to "random" conventional screenings. However, aviation blogger John Butler realized that the bar code printing on your boarding pass reveals whether or not you'll be "selected" for further scrutiny, and that it's not difficult to check ahead of time to see if you'll have to go through stricter security because the TSA has apparently never heard of encryption.

As Chris Soghoian pointed out, knowing this info ahead of time could allow plotters to plan accordingly:

“If you have a team of four people [planning an attack], the day before the operation when you print the boarding passes, whichever guy is going to have the least screening is going to be the one who’ll take potentially problematic items through security,” said Soghoian, now a senior policy analyst at the American Civil Liberties Union. “If you know who’s getting screened before you walk into the airport, you can make sure the right guy is carrying the right bags.

“The entire security system depends on the randomness,” he said. “If people can do these dry runs, the system is vulnerable."

I guess, when you've always been in the business of "security theater" rather than actual security, it shouldn't come as a surprise that you don't know the first thing about basic security.

Filed Under: airport security, boarding passes, encryption, expedited security, security, tsa

British Air Boss Points Out That Removing Your Shoes At Airport Security Is Silly

from the um,-duh dept

For years now, we've put up with absolutely ridiculous security theater in airports around the globe, and while almost everyone who flies knows it's a joke, you never seem to hear anyone who actually works in the airliner business point this out. However, the head of British Airways apparently is now pointing out how ridiculous these security measures are, most of which are driven by US demands (even though the US doesn't always follow the demands it makes on foreign airport security within the US). He's hoping that foreign airports will start pushing back on these demands:

There was no need to "kowtow to the Americans every time they wanted something done", said Broughton. "America does not do internally a lot of the things they demand that we do. We shouldn't stand for that. We should say 'we'll only do things which we consider to be essential and that you Americans also consider essential'."

The remarks, reported in the Financial Times, were not disputed by BA. No one wanted weak security, Broughton said, but added: "We all know there's quite a number of elements in the security programme which are completely redundant and they should be sorted out."

These included the requirement to remove footwear, brought in after British "shoe bomber" Richard Reid hid explosives in his trainers on a flight from Paris to Miami in December 2001, and differing approaches to checking laptops and other equipment.

"Take the iPad, they still haven't decided if it is a laptop or it isn't a laptop. So some airports think you should take it out and some think you shouldn't," Broughton said.

It would be nice if others started speaking up as well, and maybe we can actually move away from such wasteful security theater.

Filed Under: airport security, security theater
Companies: british airways

Is Elvis Dead? Who Knows, But His Passport Made It Through Airport Security In Amsterdam

from the biometrics? dept

There's been a big push lately to use "biometrics" at airports -- especially in light of the well publicized attack attempt last Christmas. But biometrics -- especially chips in passports -- can easily be fooled, and can create a false sense of security. JJ sent over the news of two hackers who were able to get past the security check-in with a passport claiming to be Elvis Presley -- they even included an Elvis photo. Now, there certainly are some limitations with what they did, and even they admit that this sort of hacking wouldn't work in a lot of cases. However, just the fact that they were able to get past the machine with a faked biometric Elvis chip suggests that the whole focus on biometrics is a bit of a red herring, as the data can be faked.

Filed Under: airport security, elvis, security

Movie Star Claims Heathrow Airport Staff Printed Out, Circulated, His Naked Body Images

from the privacy? dept

There's been a big push over the last couple months to get those full body scanners installed in more airports. These scanners, if you don't recall, basically create a "naked" image of the person in them. This has resulted in all sorts of (mostly reasonable) concerns about privacy (well, and dignity) of those passing through the devices. Defenders of these systems insist that the images are seen by someone remotely who can't see the person, so there's no way to connect the image to the person, and the scans are deleted immediately.

Except... perhaps that's not always true. Eric points us to the news that Indian movie star Shahrukh Khan (oddly, I just saw one of his movies) is claiming that the staff at London's Heathrow airport had not just connected his scan to who he was, but also printed it out and circulated it among some staff.

I have to admit, this one could use a bit more proof, because my understanding was that the scan itself is done in a remote location, but Khan seems to indicate that staff had the printouts almost immediately:

"I was a little scared. Something happens [inside the scans], and I came out. Then I saw these girls -- they had these printouts. I looked at them. I thought they were some forms you had to fill. I said 'give them to me' -- and you could see everything inside. So I autographed them for them," stated Khan.

I could definitely see how another security or airport staffer might alert whoever was watching the remote scans of who was passing through the scanner. The last few times I've seen these devices used in airports the other security staff had radio contact with the person watching the scans (for obvious reasons). But having multiple printouts immediately distributed? It's not clear how that would happen.

Update: Yup, as we suspected, this story appears to be bogus. Security officials are denying it ever happened, and apparently Khan has some movie coming out about being detained by airport security... so... yeah, PR stunt.

Filed Under: airport security, heathrow, privacy, scans, skahrukh khan

UK Man Arrested And Banned From Airport For Twitter Joke About Blowing Up An Airport

from the careful-who-you-joke-with dept

A few weeks ago, I was flying with my wife somewhere, and as we passed through security, a TSA agency took my wife's shoes and asked if he could run a separate test on them. A little while later, he came back and asked if she had another pair of shoes, saying that hers had "failed the test." It was around 5am, and neither of us were completely awake and we were both really confused, and trying to figure out how her shoes could have failed any sort of test (could she have stepped in some sort of mud that set off a test?!?) or if she had packed another pair of shoes, when the TSA guy started laughing, saying he was just joking and "you were supposed to protest!" Apparently, it was all a big joke. It wasn't that funny. And, of course, we've been told over and over again that this kind of joking is only allowed to go in one direction.

Krubuntu points us to the news of a guy in the UK who found himself arrested and banned for life from an airport after posting a message on Twitter that read: "Robin Hood airport is closed. You've got a week and a bit to get your shit together, otherwise I'm blowing the airport sky high!!" This was in response to the airport closing due to snow, and the guy realizing he was supposed to fly from there a week later. Now, clearly, this was an ill-advised Twitter message. And, at the very least, I don't begrudge police from at least doing a quick check to make sure that it wasn't serious, but to then arrest him under the Terror Act, interrogate him for seven hours, threaten him with further charges and ban him for life from the airport? At some point you have to think that the response has gone too far as well. Yes, the post was in poor taste, but at some point law enforcement people should recognize when it was just a frustrated person making an ill-advised joke and move on.

Filed Under: airport security, joking, terrorism, twitter