GPS as a weapon | Just thinking...by Mark J. McArdle

Well, I have completed my first post Christmas Undie-Bomber flight into the US. I was headed to Las Vegas to attend the annual Consumer Electronics Show. I have to be honest, I really, really, REALLY wasn’t looking forward to the changes the TSA/CATSA has made to the pre-flight security process. But, I decided to channel this energy in a positive way, and instead focus on the Canadian Junior’s hockey gold medal game against the Americans. Because I was flying WestJet, I would be able to watch the game in-flight because each seat has it’s own TV running Bell Satellite TV. Game On!

But first, I had to get to the plane. And that meant security checkpoints. And more.

My initial check-in with WestJet was pretty quick. A short wait, and I was at the front of the line. I told the nice young lady that this was my first flight ever with WestJet, and that I’d heard wonderful things about it. I realized as I was saying it that there was no schmoozing my way into an upgrade, because there is only 1 class on their 737s. How communist. That said, the service I received at check-in, and in-flight on WestJet far surpassed the general apathy and occasional eye rolls and scowls I’ve endured at Air Canada.

With my boarding pass in-hand, I headed to the US Customs/Immigration checkpoint. I had expected to see thousands of rotting bodies lying in the hall waiting for their opportunity to be interrogated, scanned, photographed, blood typed, politically assessed, psychologically assessed and genome decoded. But, to my pleasant wonder, there were only 6 people ahead of me. BTW, I have a NEXUS pass, but can’t use it going into the US until I head over to the NEXUS office in Terminal 1. Their office closes at 3pm. Government work has great hours, and a wonderful pension, and …oh, never mind.

So with my papers in order, and an act honed over many hundreds of shows throughout the years, I was through US Immigration and Customs, and on my way to the CATSA security screening area. Hmmm, this really hasn’t taken very long, so far. This is probably where things get messy.

Once again, there were very few people in line for the x-ray/magnetometers. I kept my boarding pass/passport in my pocket, and took off my coat, shoes and took out my MacBook and sent everything through the x-ray machine. Now, as I’ve mentioned in my previous post, carry-on roller bags are as welcome in airports as George W Bush is anywhere outside Texas (and possibly West Virginia). Because of this baggage restriction, I have my Targus Laptop knapsack with me, and in it is my camera gear and MacBook accessories, and everything else I don’t want lost, stolen or broken.

I breeze through the magnetometer with nary a beep, unlike the bozo in front of me who kept pulling change, metal rulers, copper pipe and a wrench out of his pants. Why do I always get stuck behind morons like this. I say that if you are incapable of identifying metallic objects on your person, then you cannot be trusted to ensure your luggage has not been compromised by Al Qaeda, and you have to take the bus instead. These people are also the reason we have to have the seatbelt explained to us every time we get on a plane.

As I’m putting my shoes back on (they apparently did not have PETN inside them), I hear the dreaded words no traveller wants to hear: “Sir, is this your bag?”. Ok, here we go. Now previously when I would hear that, it meant that the chemical engineer in the white CATSA shirt was going to do a spectrum chromatographic test of my carry-on to ensure it doesn’t have trace amounts of volatile, dangerous compounds. Actually, the lad in the white CATSA shirt says he just rubs this plastic stick with a bit of kleenex on the end of it on random parts of my bag, and then he puts the swab in the machine that goes ‘bing’. I recall from my long-ago chemistry labs at UW that controlling the environment and calibration of the test equipment is critical to generating reliable data. Judging by the colour of that swab, I’d say it’s been in use since mid-September, 2001. And I think I saw a placard on the machine that says “lick once to calibrate”. Anyhow, I distract myself with happy thoughts, realizing the ‘bing’ test should only take a minute.

Uh, oh. Now he wants to completely empty my bag. Uhm, ok. So I take out the MacBook, extra battery, power supply, notebook, travel docs, DSLR camera, lens, headphones and assorted pens and mechanical pencils. It looks like a yard sale, and I’m thinking “I carefully packed this stuff so it would all fit the smallest volume”. So Igor, (I have spent so much time with him, I feel it now appropriate to take notice of his name tag), starts swabbing my notebook, and anything else he can find. When the ‘bing’ machine says “he’s clean, Danno'” he starts to give additional scrutiny to my belongings. He picks up my mechanical pencil, and makes sure there’s lead in there. I was going to point out that it’s graphite, but thought better of it. With a million smart-ass remarks flying through my mind, I realize there’s a special room nearby for wise asses, where their wise asses get special attention. After Igor is happy with the pencil, he says “ok, you can put everything back”. I hand him my pen, and say “you didn’t check this”. He seems momentarily confused, then says “no, it’s ok”. So apparently CATSA training contains a session on ‘Visual Identification Of Weaponized INkS’ (VIOWINS).

One interesting side note. I don’t know if this happens to others, but as Igor was scrutinizing my belongings, I started playing a game of ‘where would I put the contraband’? I made a mental list of all kinds of ways to get naughty things past these inspections. This would be called penetration testing in the IT Security world. The ‘bad guys’ try to get past the ‘good guys’. The fact that I came up with a handful of ways to do this while watching them was of some concern. Alas, I made myself feel better by realizing once again that this isn’t actual security, it’s theatre. I decide I’m in the middle of Act I, just before the funny guy does his song.

Off I go, my belongings carefully re-packed, and start thinking about getting a bite to eat. I look ahead of me, and there’s a big queue of people about 150′ away. My first thought was, wow, that’s a strange place for those people to line up for boarding’, but as I get closer, I realize there’s a new roadblock. We have more screening to go through. Oh dear, now I’m thinking I should start taking notes.

There are no signs, just a CATSA agent at the front, and as I look ahead I can see armed RCMP officers doing pat-down searches of everyone. I overhear someone say “females on the right, males on the left”. A guy in front of me jokes aloud about whether he could be searched by a female agent. Apparently that’s not allowed. More silly rules.

It’s now my turn. I walk towards the highly trained, capable, and expensive RCMP officer and he smiles and politely asks me to take off my jacket. I feel like we both know this is a farce, but neither of us wants to demean the dignity of the other by saying so. I ask him if we could get to know each other over a glass of wine first, but he says no. He’s not looking for a long relationship. He asks me to make a ‘T’ with my arms, and I wonder if I’m going to be allowed to spell a word with my body as part of a peaceful protest of this performance art called airport security. No time for that, he starts high, and briskly grabs me all over from behind. “Turn around, please” he says. Now he checks me from the front. I almost can’t prevent myself from laughing. This whole scene is ridiculous. He is satisfied now (that makes one of us) and writes a “C” on my boarding pass. I quickly determine “C” means “Table C” for the carry-on bag inspection.

Let’s now review what’s happened this far.

1) Nobody asks me any meaningful questions about my trip at the WestJet check-in, or US Immigration. Perhaps that’s negative profiling, but I’m certainly not willing to cede that the process used is that sophisticated. It’s village idiot simple. Do the same thing to everyone, and look very serious when you do it.

2) I’ve been through a magnetometer and my bag has been x-rayed and completely emptied and searched.

3) Me, and everyone else flying that night, was physically patted down. I was told by a woman in line that they are even doing this to children. I found that hard to believe but was busy with my own pat-down and didn’t see how they handled children.

4) If I was a radical, and used the same approach as the Christmas Day bomber, I would have made it through these checks with exactly the same ease. Nobody tested me in a meaningful way. Me and my explosive tighty whities would be heading for the magazine shop for some pre-terror reading material. Perhaps a Steven King novel, or something from Dr. Phil.

Ok, almost there. But I have to go through yet another tear-everything-out bag check. So I’m think that perhaps this is a ‘defence in depth’ approach. Overkill, but when you’re going for dramatic effect, the more the better. I think they actually need some flashing red lights, some sirens and a smoke machine. And maybe a fireman. I initially think playing the theme music from ’24’ would be a good effect, but then decide that this would set expectations that this entire charade would be over in ‘1 day’.

The CATSA agent looks at my coded boarding pass, and directs me to Table C. I walk up, and place my bag on the table, and guess who’s there? It’s my old friend Igor! Well, isn’t this nice. Igor gets to test his own thoroughness.

I can’t resist. As he’s taking everything out of my bag, I say to him, ‘doesn’t this look familiar’. He doesn’t appear to understand what I’m talking about. Is he ignoring me, or does he genuinely not recognize the MacBook, Canon camera/lens and mechanical pencil from 15minutes earlier? At this point, I’m looking for the director to yell ‘Cut!, Who the hell put this guy back on bag-check? You’re ruining the whole effect! Ok, people, back to your marks, and ACTION!”

Igor finishes his work, and says I can go. I look at him quizzically and say ‘that’s it’? He says ‘yes’. I’m wondering, shouldn’t you write a special cryptographically secure symbol or code on my boarding pass to indicate that Igor has confirmed (again) that my bag is safe? So, not overthinking this, I turn and head to the final CATSA agent. She looks at my boarding pass, and stops me saying “Was your bag checked?” Uhm, do you trust me enough to want my answer? I tell her yes, and point to my friend Igor. She yells “You have to put an X on the boarding pass”. An “X”! Dammit, that’s so simple and so perfect. Who’d crack that code? You can’t pass through this final rigorous final security checkpoint until you have a black ‘X’ on your boarding pass. Perhaps black ball point pens should be banned in airports as well. Igor sheepishly acknowledges that he’s not following the script, and is likely to get a call from his talent agent telling him he’s back to community theatre after this show runs its course. But if this show has the longevity of Cats, we’re all screwed.

So, after 45+ minutes of additional screening, I’m free. And I’ll point out that the airport was as empty as I’ve ever seen it. I can only imagine what it is like when it’s full. That explains why WestJet says you should show up 3 HOURS before your flight to the US. Imagine flying to New York (1.5 hour flight) and have to show up 3 hours early. Sure, that’s sustainable.

Well, that’s my report.

It’s like one of those really bad sci-fi movies where the science is so incredibly weak that you find yourself cheering for the asteroid to wipe out the Earth. When we use highly trained law enforcement in this way, it demeans their skills, and clearly takes them away from more important societal tasks. Shouldn’t we be identifying anomalous behaviours? It isn’t profiling if you select people based on stress responses. The more I learn about the Israeli approach to aviation security, the more impressed I am with it. If we’re going to have to spend Billions of dollars, can we at least attempt to do it intelligently. “Sir, please take off your shoes” is not basis for airline security.

We need a much more intelligent approach to identifying threats. The model being used by the aviation world makes me appreciate how well Internet security works. Yes, it’s that bad.

mJm

I used to fly. A lot. And the recent near-miss by yet another radicalized terrorist has me happier than ever that I’m not flying much.

But that’s not because I’m worried about being killed in a terrorist attack in the air. I’m worried that my head will explode while I’m going through the performance art that is labeled by the government as “security”.

Let’s recap what happened on Christmas Day.

a young Muslim man from a 3rd world country is radicalized
his concerned parents contact the US Embassy, and this information eventually goes to the CIA
he pays $2831 cash for a ticket from Laos->Amsterdam->Detroit, travels alone, and checks no bags on this cross the globe trip
he hides some highly explosive PETN in his tighty whities.
a Dutch passenger comes to the rescue when he tries to ignite the explosives

The response by the various security agencies has been quite interesting. Initially, in-flight entertainment systems were shut down because they showed where the aircraft’s location. Let’s think about that for a minute. Somebody in a position of authority (let’s call him Mr. Beane) believed we were better protected on a flight if a terrorist doesn’t have a GPS map telling him where he is.

Is Mr. Beane aware that there are windows on a plane? Did he take high school physics and learn that you can derive distance by multiplying speed (airliner flies ~ 450mph) x time. Does he know that we’re still allowed (as of today, anyway), to have timing devices on our person. Insane. So we all miss the movies that make the horrid, cramped and squalid service a little less tortuous because some “security expert” decides that it’s too dangerous.

Next, Mr. Beane decided that it’s safest if we all sit on our bums for the last 60 minutes of a flight. This one was very familiar to me, because I flew on the first non-US originating flight into Washington’s Reagan National Airport after 9/11. I went through 4 different security checkpoints in Toronto, and there was an Air Marshall on that flight. We were instructed at the start of the flight that due to the sensitive route this flight takes down the Potomac, that we must remain seated for the last 45 minutes of the flight. No biggie, I thought. Especially since it was only an hour and a half long flight. I was certainly in a heightened emotional state on that flight, and watched every passenger around me for any signs of mischief. In this specific flight’s case, the assumption is that an attacker would want to do harm to a major US government facility, thus having people stuck in their seats as we’re approaching those makes more sense.

So after Christmas day, we weren’t allowed to have anything on our laps for those remaining 60 minutes either. Why didn’t they just have the captain announce, “Ladies and Gentlemen, this is your captain speaking. It is now 60 minutes to our landing in Newark, so you are all now required to remain in your seats with your hands on your heads. Flight attendants will be coming down the aisle and affixing blindfolds and ball gags to you for the remainder of the flight. We recognize you have choices when you fly, and we want you to know that we appreciate your business.”

However, in the general case, terrorists just want to inflict terror. Does it really matter if a plane blows up over the Atlantic, over a field or over a city. Yes, there will be more damage, and possibly more media coverage if it’s over land, but you don’t need specific locations to assure that. And you sure don’t need a GPS. So they asked terrorists to kindly remain in their seats for the remaining 60 minutes of the flight. But please feel free to get up 62 minutes before the end of the flight and blow things up.

This approach to security is akin to the famous Maginot Line. Set the fence up at 60 minutes, and the bad guys just walk around it at 62 minutes. Wow, who saw that coming? I pity those folks who drank too much in 1st class and need a bathroom break. Oh wait, 1st class was exempt from this restriction. Oh crap, now the terrorists know that. “Wow, this security stuff is hard” mumbles Mr. Beane.

Let’s turn to another one of Mr. Beane’s security brainstorms. No more roller-bag carry ons. In fact, nothing more than a small laptop bag or purse. Let’s reflect back on this and identify what security benefit there is in this action.

Terrorists will not be able to bring on board roller bags. Yes, that’s right. We’ve won. The code has been cracked. Perhaps the theory behind this one is that terrorists will be so pissed off with the crappy service they get from the airlines that they start attacking trains again. Well played, Mr. Beane.

Noted Security expert Bruce Schneier has correctly stated that the government focuses on the “last attack” and not the “next one”. This is very true, but I think it is important that you try to make it as difficult as possible to replay the last attack. Doing nothing is akin to leaving your car door unlocked after repeated thefts. Wise up, and lock the door. But don’t order all cars to be painted yellow. That might look like action, but we clearly don’t all want yellow cars.

However, the actions being taken now don’t address the last attack, or the next one. They are a complete replay of the goat rodeo we went through after 9/11, whose sole purpose was to put bums back in seats and keep the airline industry from complete collapse.

If we were serious about security, we’d have a much greater pre-screening process, that starts well before people check in, or even buy a ticket. And it wouldn’t depend on me taking off my shoes and not bringing on board a roller bag.

In any event, these actions have frustrated me, and I don’t have to fly very often now. And when I do, it’s generally for pleasure. That’s ironic. Flying for pleasure. Who does that any more?

Oh, and by the way Mr. Beane – YOU’RE FIRED.