Airport Insecurity

Posted: August 12, 2008 in News
Tags: ,

There’s been a lot of speculation among security professionals regarding TSA’s policies, since so much of it is shrouded in secret. Last month, TSA announced a change of policy: passengers who “willfully refuse to provide identification at security checkpoint will be denied access… This new procedure will not affect passengers that may have misplaced, lost or otherwise do not have ID but are cooperative with officers.”

I was curious to learn more about the TSA’s new practices for ID-less travelers. As a security professional, I decided to research TSA’s latest security screening procedures. Below is a recounting of my experiment.

 


  

What Happened

[Names have been changed. This account was written an hour after the events, and is accurate within the limits of my memory.]

I last saw my wallet on Monday, August 4, 2008 at the FedEx counter in Cambridge, where I dropped it into the envelope marked “Las Vegas, Nevada.” On Wednesday around 4PM, I arrived at Boston Logan airport without my wallet.

Without an ID, JetBlue’s All Services line was my only hope for checking bags. The long line moved interminably slowly. A JetBlue representative with long blonde hair moved down the line, talking to
each passenger.

“Boarding pass? Anyone have a boarding pass?” She stopped at me. “Ah! You have a boarding pass.”

“I don’t have my wallet,” I looked at her, wide-eyed. “Is there any way I can get on the plane?”

“Oh, don’t worry,” she said. “They’ll just send you through special screening. It’ll be fine. ”

“Really?” I said. “Am I in the right line?”

“Yup, this is the right line. You’ll be fine.”

After about a half hour, I got up to the JetBlue counter. I handed my boarding pass to the woman behind the counter and explained, “I don’t have my wallet. Do you think I’ll make it on the plane?”

“Oh,” she said. “You’ll make it. But go to the gate right away, because now they have to make a phone call.”

“A phone call?”

“They call someone in Washington, I think.”

“Washington?”

“To check your identity.” She conferred with the woman next to her. “Yes, Washington. CIA or FBI or something, I guess. So you want to go through right away. Could take a while.”

I checked my bag, thanked her, and headed to the security screening.

At the end of the roped-off walkway, two TSA officers stood at a wooden podium, checking IDs and boarding passes. I handed one TSA officer my boarding pass. “ID?” he said.

“I don’t have my ID.”

He looked me in the eye. “You have to have ID to get through security.”

“I don’t have my wallet.”

“You need to have ID to go through security.”

“I really don’t have it.” I said.

Pause. “Well,” the officer said, “Hold on.”

Another white-uniformed TSA officer approached with a clipboard. He was a short, middle-aged man with a badge that read “Andrew,” followed by a number. He led me a few feet away, to a shiny metal table just next to the entrance, and put the clipboard down.

“You don’t have your ID?”

“No, I don’t have my wallet,” I said.

“You know, you need to have ID to fly,” he said.

There was another awkward silence.

“I really don’t have it,” I said.

“What happened to it?” he asked.

“I don’t know where it is,” I said.

“Do you have anything with your name on it?” he asked.

I thought a moment. “Nope. Everything I have was in my wallet.”

“Are you sure?” he asked. “Credit cards, anything?”

I poked through my purse, and flipped through my journal. “No… I’m sorry. It was all in my wallet.”

The officer looked at me sternly. “You know, two and a half months ago TSA took over this, and now our policy is that you have to have identification to get through security. Either a passport, if you’re a foreigner, or federal identification.”

“Ah,” I said. “Passport. That would have been a good idea.”

Another awkward silence.

“They’re going to have to interview you to verify your identity. I can’t guarantee that you’ll get through. It depends on your situation, and,” he emphasized, “your reasons for not having identification.” He looked me straight in the eye. “It could take a while. You may not get
on the plane.”

Silence. I nodded.

After a moment, he gestured to the clipboard. “You’ll need to fill out this form.”

There was a stack of white single-sided forms on the clipboard. I bent down to fill out the top one. It was very simple, and looked something like this:

Full Name:

Current Address:

Previous address (if no current address):

Signature:

Date:

Then there was a block of legalese which indicated that my disclosure of this information was voluntary, but failure to disclose it might prevent me from being granted access to the secured area. Finally, there was a block of text which indicated that falsifying information was
punishable by imprisonment or fines.

I printed my name and address, read the block of text carefully, and then signed the document.

A man in a dark suit with a TSA pin approached. The name on his badge was Peters. He introduced himself as John Peters.

“How old are you?” he asked.

“Twenty-seven.”

“And you don’t have identification?”

I shook my head. “I don’t have my wallet.”

“What happened to it?”

“I’m not sure where it is.”

“You need to have identification to pass through security.”

“I’m sorry,” I said. “I really don’t have it.”

At that point a large woman tried to walk past us, between the security workers and the silver table. Mr. Peters turned around and stopped her. “I’m sorry, ma’am, are you a passenger?”

“No,” said the woman, “I just dropped off my 90-year-old parents, and I need to go back there to help my mother find her cell phone.”

“I’m afraid I can’t let you through,” he said. “You’ll have to talk to the JetBlue staff.”

She argued with him for a little while, but he politely insisted, each time becoming visibly more frazzled. Finally, she repeated, “Go to the JetBlue counter.” He nodded. She left.

He returned. I smiled wanly. “Busy day.”

Mr. Peters nodded, and then looked down at the sheet which I had filled out and signed. “I’m going to have to make some calls to verify your identity.”

I nodded.

He pulled out a cell phone. I had assumed that we would be going to some separate screening room, but that wasn’t the case. He stood facing the silver table, and I leaned back against it. So this was the dreaded interview. People walked past us with bags and luggage.

“Hello,” he said. “Security.” Long pause. It sounded like he was transferred. He said a number that I think had the same number of digits as a phone number. Then he said a shorter number. “No, she
doesn’t.” He wrote something in small letters on the form. Then he spelled my name over the phone. “D-A-V-I-D-O-F-F. That’s Indigo Delta… yes.”

He looked at me. “What’s the name of a street that you lived on prior to your current address?”

“Inman.”

“Inman,” he repeated. There was a pause. “Where did you live in 2004?”

“Hmm…” I said. “New Mexico? I think? Maybe Massachusetts.”

He conferred with the person on the phone. “That’s fine.” He hung up.

“All right,” he said. “You’re going to go through full security screening.” He wrote “SSSS” in red marker on my printed boarding pass. He handed my form to one of the officers at the podium, and then gestured to the first screening line. “Right here.”

Almost through. I got into the security screening line as usual, pulled my laptop out and placed it into the gray bin. Instead of my usual hacker stickers, this time a sickeningly cute picture of puppy dogs gazed up at me. I had hurridly taped it over the hacker stickers before leaving for the airport, figuring I shouldn’t push my luck. I placed my flip flops and purse in the other gray bins and walked beside them down the conveyor belt.

When I got up to the metal detectors, I handed my red-scribbled boarding pass to the TSA employee. The big officer looked down at me and said something like, “Female assist, full screening, no alarm.”

A female officer named Menendez brought me to the end of the line, and another male officer carried my backpack, purse and laptop along with us. He placed my belongings on a counter next to explosives detection equipment.

Officer Menendez politely indicated that I should place my feet right on top of the painted yellow footprints, and then raise my arms straight out. She patted down my torso, legs and ran a detector over my body. Meanwhile, I watched the other officer check each of my bags for explosives. He used metal tongs to pick up a small white square which looked like paper, and then he ran the square it across the inside pocket of my backpack. Then he put it in the machine. The machine said, “Analyzing….” and then, in yellow, “Passed.” He did the same thing for my purse, and finally, my computer.

Apparently my computer was filled with explosives. The officers conferred with an older man who seemed to be the explosives machine expert, and then they picked up my laptop and it back to the X-ray machine a second time.

The puppy dogs looked a little sad rolling down the conveyor belt a second time. “Does it alert for computers a lot?” I asked officer Menendez.

“Oh, different things,” she said. “Computers, backpacks. We just run it through a second time.” The male officer brought my computer to the back counter. “You’re done.”

I stepped forward to pick up my stuff. The older explosives machine gentleman was standing next to me, tinkering with the machine.

“So what happened?” I said. “Why did my computer alert?”

He shrugged. “It happens. As long as it’s clean the second time, you’re fine.” I wasn’t sure he realized that they hadn’t run it through the explosives machine a second time, only the X-ray
machine. Not that it really mattered.

“Well, thanks!” I said.

“Have a wonderful evening.”

 


  

Analysis

  • Recall that to indicate that I required extra screening, staff wrote in red Sharpie on my boarding pass. If I had simply printed off a second boarding pass at home, I could have presented that instead of the marked one, and gone through the metal detector as usual. In other words, passengers without ID can travel without undergoing any extra screening other than “identity verification.” A lawyer friend of mine commented that “if TSA marked ‘SSSS’ on a person’s hand rather than a piece if paper…the airport’s security would at least be as good as a bar’s.”
  • Since the answers to the identification verification questions are so widely known, someone could easily have impersonated me and traveled under my name. Many people know that I lived in New Mexico, and the name of the street where I used to live.  As a private citizen, I would much rather that the TSA allow anonymous travel than create a system where identity “verification” is required, but it is very easy to impersonate other people.
  • Real attackers will just use fake IDs or identities and pass through unnoticed. Thanks to the age restrictions on alcohol, America has a flourishing ID forgery and resale industry, and faking federal identification is not difficult.
  • It’s interesting to know that there’s an on-call system which TSA agents can use to do a quick background check on passengers. What information is in this system? If an attacker were to remember or record the numbers used by the TSA officer during the call, could they later gain access?

Rather than increasing security, the new policy change merely ensures that private citizens who express the wish to travel anonymously are punished for doing so. As Bruce Schneier says, “I don’t think any further proof is needed that the ID requirement has nothing to do with security, and everything to do with control.”

It’s important for private citizens to be able to travel without being tracked if they wish. I am not a criminal. I just don’t believe it’s anybody’s business where I go. I understand the need for ensuring the safety of our transportation infrastructure, and as such, searching passengers before boarding makes sense.

The freedom to travel anonymously also underlies our right to peacefully assemble.  When a government tracks its citizens and can arbitrarily decide to limit or cut off travel, that threatens our democracy. This is especially true in our global society, where many people rely on air travel, trains and the highway just to see their families.

TSA’s new policy, which is to focus on finding “dangerous people” rather than objects, poses enormous challenges. It requires that the agency make sweeping judgments about travelers with very little information, and in a very short amount of time. It is simply not feasible to accomplish this accurately.

We need to make sure our airports are safe, but at the same time, we have to be very careful not to destroy the very thing we are trying to protect: our free country.

Link.

About these ads

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s