January 9, 2010

Asymmetric Security

Posted by stackunderflow under Uncategorized | Tags: , , , , , , , , , , , , , , , , , |
[2] Comments 

I’m sitting nearby Gate B11 at McCarran International Airport in Las Vegas.  I’ve had a great day, and enjoyed a wonderful steak dinner with some genuinely interesting lads.  But once again, I’ve observed some bizarre happenings at the airport.

First, a confession.  I know what happens in Vegas is supposed to stay in Vegas, but this is wearing heavily on me:  I didn’t gamble at all, and I’m up 1 beer thanks to the nice young cocktail waitress who brought me a beer, at no charge, as I was watching the Leafs & Raptors play (I did tip her though).  Ok, that’s off my chest.

So, back to Airport Sekuritee.

As you may recall from my previous post, the spectacle that US-bound travellers go through when flying out of Canada is something to behold.  Utterly bereft of logic, and full of drama and exciting visuals.  But let’s step back a second and look at the basic mechanics of the transaction:

  1. A Canadian Airliner
  2. A mix of Canadian and American passengers
  3. A flight between Toronto and Las Vegas

Now you could argue that the To/From is relevant, but I’d argue that the value of a plane to a terrorist is not based on the direction it’s nose is pointing.  So I believe these assets are of similar value.

Do you think these similar assets are provided with equal protection?  Well, after tonight, I can confidently say that only really stupid, inattentive terrorists would attack a US bound plane.  Instead, wait for the return flight.  You can get to the airport much later, enjoy another Vegas show, and have a couple more cocktails.  Why go through the drama, delay and risk that some fellow passenger will go postal and beat you to ‘heaven’.

So now the details.

The check-in process was very, very long.  I waited over an hour just to get my boarding pass.  This was not however due to increased security.  It can only be attributed to WestJet having ‘a bad day’.  I’ll be charitable, since I’ve only ever heard good things about them.  Perhaps they just hired a new executive from Air Canada. Or maybe everyone was out late at the Penn and Teller show last night.  In any event, I was starting to fear for my departure time.

Off to the security check-point.

Well, it was no different from the hundreds of other ones I’ve been through post-911 and pre-undie-bomber.  Well, one difference.  The TSA agent who screened my boarding pass and passport prior to admitting me to the x-ray/magnetometer made a little scribble instead of a letter.  Apparently my last rant on cryptographically secure symbols to ensure nobody ‘black-pens an X’ has had an effect.

Off with my shoes, out with the MacBook, jacket and sweater in a box and off we go.  No beeps through the magnetometer and I’m now bracing myself for the Broadway Proctological Exam.  But what to my wondering eyes should appear, but an empty hallway.

No more checks.  No groping, no fondling, no tearing everything out of my backpack.  Just plain old ‘what we did before’.

Not having the ability to inquire about this process (without introducing the inevitable ‘why do you want to know, and drop your pants’ reaction), I’m left to try and figure out what can explain this big difference between the Vegas outbound, and Vegas inbound security.

Here’s some initial thoughts:

  1. Any terrorist who spent a few days in Vegas would have ‘gone native’.  There’s no way he’d blow up himself and an aircraft that brings people to this city.  Vegas would turn him.  Especially given what these twisted guys are promised.
  2. Canada has over-reacted, and wants to make sure it looks like it’s doing ‘important things’ to improve security for US travel
  3. The fax machine at the TSA office in Vegas is out paper, and Outlook put the ‘Important Undie-Bomber Script Changes’ email in the Junk folder
  4. It’s what we would call a ‘continuity problem’ if this were a movie or TV show (you know, when in one scene the male lead is holding a full beer in his left hand, then magically, it’s half empty and in his right hand)
  5. Stephen Harper prorogued inbound security
  6. This approach to security doesn’t work, and even Vegas has called bullshit on this horrid show.  And remember, they had Celine Dion for over a year.  And Carrot Top.

I am certainly not arguing that what is being done in Toronto is ‘Best in Class’ and should be replicated in Las Vegas.  Quite the opposite.  But the fact that the system is self-contradicting should be analysed.  Am I less safe flying to Toronto than I was flying to Las Vegas?  No.  Am I less annoyed and delayed? Yes.

I will also point out that a man in his 60’s left 2 bags in line for about 10 minutes.  People kept walking around them.  I approached them and asked the people in front of me if they knew who’s bags these were.  Nobody knew.  I kept asking down the line until somebody said ‘some old guy’.  Now, those bags were almost certainly not a real threat, but they were much more of a real threat than everything the rest of the passengers on my flight presented.  It’s interesting that even in a time of ‘heightened alert’ regular travellers take no note of things like this.  The grumpy old guy showed up a couple of minutes after I asked, and when I suggested he not leave his bags unattended, he looked at me like I just stole his wallet.

We have a long way to go.

That’s all from Sin City.  When I get home, I’ll post my observations from CES.

mJm

Advertisement
 

January 6, 2010

“You have to put an ‘X’ on the boarding pass”

Posted by stackunderflow under Uncategorized | Tags: , , , , , , , , , , , , , , , , , |
[2] Comments 

Well, I have completed my first post Christmas Undie-Bomber flight into the US.  I was headed to Las Vegas to attend the annual Consumer Electronics Show.  I have to be honest, I really, really, REALLY wasn’t looking forward to the changes the TSA/CATSA has made to the pre-flight security process.  But, I decided to channel this energy in a positive way, and instead focus on the Canadian Junior’s hockey gold medal game against the Americans.  Because I was flying WestJet, I would be able to watch the game in-flight because each seat has it’s own TV running Bell Satellite TV.  Game On!

But first, I had to get to the plane.  And that meant security checkpoints.  And more.

My initial check-in with WestJet was pretty quick.  A short wait, and I was at the front of the line.  I told the nice young lady that this was my first flight ever with WestJet, and that I’d heard wonderful things about it.  I realized as I was saying it that there was no schmoozing my way into an upgrade, because there is only 1 class on their 737s.  How communist.  That said, the service I received at check-in, and in-flight on WestJet far surpassed the general apathy and occasional eye rolls and scowls I’ve endured at Air Canada.

With my boarding pass in-hand, I headed to the US Customs/Immigration checkpoint.  I had expected to see thousands of rotting bodies lying in the hall waiting for their opportunity to be interrogated, scanned, photographed, blood typed, politically assessed, psychologically assessed and genome decoded.  But, to my pleasant wonder, there were only 6 people ahead of me.  BTW, I have a NEXUS pass, but can’t use it going into the US until I head over to the NEXUS office in Terminal 1.  Their office closes at 3pm.  Government work has great hours, and a wonderful pension, and …oh, never mind.

So with my papers in order, and an act honed over many hundreds of shows throughout the years, I was through US Immigration and Customs, and on my way to the CATSA security screening area.  Hmmm, this really hasn’t taken very long, so far.  This is probably where things get messy.

Once again, there were very few people in line for the x-ray/magnetometers.  I kept my boarding pass/passport in my pocket, and took off my coat, shoes and took out my MacBook and sent everything through the x-ray machine.  Now, as I’ve mentioned in my previous post, carry-on roller bags are as welcome in airports as George W Bush is anywhere outside Texas (and possibly West Virginia).  Because of this baggage restriction, I have my Targus Laptop knapsack with me, and in it is my camera gear and MacBook accessories, and everything else I don’t want lost, stolen or broken.

I breeze through the magnetometer with nary a beep, unlike the bozo in front of me who kept pulling change, metal rulers, copper pipe and a wrench out of his pants.  Why do I always get stuck behind morons like this.  I say that if you are incapable of identifying metallic objects on your person, then you cannot be trusted to ensure your luggage has not been compromised by Al Qaeda, and you have to take the bus instead.  These people are also the reason we have to have the seatbelt explained to us every time we get on a plane.

As I’m putting my shoes back on (they apparently did not have PETN inside them), I hear the dreaded words no traveller wants to hear: “Sir, is this your bag?”.  Ok, here we go.  Now previously when I would hear that, it meant that the chemical engineer in the white CATSA shirt was going to do a spectrum chromatographic test of my carry-on to ensure it doesn’t have trace amounts of volatile, dangerous compounds.  Actually, the lad in the white CATSA shirt says he just rubs this plastic stick with a bit of kleenex on the end of it on random parts of my bag, and then he puts the swab in the machine that goes ‘bing’.  I recall from my long-ago chemistry labs at UW that controlling the environment and calibration of the test equipment is critical to generating reliable data.  Judging by the colour of that swab, I’d say it’s been in use since mid-September, 2001. And I think I saw a placard on the machine that says “lick once to calibrate”.  Anyhow, I distract myself with happy thoughts, realizing the ‘bing’ test should only take a minute.

Uh, oh.  Now he wants to completely empty my bag.  Uhm, ok.  So I take out the MacBook, extra battery, power supply, notebook, travel docs, DSLR camera, lens, headphones and assorted pens and mechanical pencils.  It looks like a yard sale, and I’m thinking “I carefully packed this stuff so it would all fit the smallest volume”.  So Igor, (I have spent so much time with him, I feel it now appropriate to take notice of his name tag), starts swabbing my notebook, and anything else he can find.  When the ‘bing’ machine says “he’s clean, Danno'” he starts to give additional scrutiny to my belongings.  He picks up my mechanical pencil, and makes sure there’s lead in there.  I was going to point out that it’s graphite, but thought better of it.  With a million smart-ass remarks flying through my mind, I realize there’s a special room nearby for wise asses, where their wise asses get special attention.  After Igor is happy with the pencil, he says “ok, you can put everything back”.  I hand him my pen, and say “you didn’t check this”.  He seems momentarily confused, then says “no, it’s ok”.  So apparently CATSA training contains a session on ‘Visual Identification Of Weaponized INkS’ (VIOWINS).

One interesting side note.  I don’t know if this happens to others, but as Igor was scrutinizing my belongings, I started playing a game of  ‘where would I put the contraband’? I made a mental list of all kinds of ways to get naughty things past these inspections.  This would be called penetration testing in the IT Security world.  The ‘bad guys’ try to get past the ‘good guys’.  The fact that I came up with a handful of ways to do this while watching them was of some concern.  Alas, I made myself feel better by realizing once again that this isn’t actual security, it’s theatre.  I decide I’m in the middle of Act I, just before the funny guy does his song.

Off I go, my belongings carefully re-packed, and start thinking about getting a bite to eat.  I look ahead of me, and there’s a big queue of people about 150′ away.  My first thought was, wow, that’s a strange place for those people to line up for boarding’, but as I get closer, I realize there’s a new roadblock.  We have more screening to go through.  Oh dear, now I’m thinking I should start taking notes.

There are no signs, just a CATSA agent at the front, and as I look ahead I can see armed RCMP officers doing pat-down searches of everyone.  I overhear someone say “females on the right, males on the left”.  A guy in front of me jokes aloud about whether he could be searched by a female agent.  Apparently that’s not allowed.  More silly rules.

It’s now my turn.  I walk towards the highly trained, capable, and expensive RCMP officer and he smiles and politely asks me to take off my jacket.  I feel like we both know this is a farce, but neither of us wants to demean the dignity of the other by saying so.  I ask him if we could get to know each other over a glass of wine first, but he says no.  He’s not looking for a long relationship.  He asks me to make a ‘T’ with my arms, and I wonder if I’m going to be allowed to spell a word with my body as part of a peaceful protest of this performance art called airport security.  No time for that, he starts high, and briskly grabs me all over from behind.  “Turn around, please” he says.  Now he checks me from the front.  I almost can’t prevent myself from laughing.  This whole scene is ridiculous.  He is satisfied now (that makes one of us) and writes a “C” on my boarding pass.  I quickly determine “C” means “Table C” for the carry-on bag inspection.

Let’s now review what’s happened this far.

1) Nobody asks me any meaningful questions about my trip at the WestJet check-in, or US Immigration.  Perhaps that’s negative profiling, but I’m certainly not willing to cede that the process used is that sophisticated.  It’s village idiot simple.  Do the same thing to everyone, and look very serious when you do it.

2) I’ve been through a magnetometer and my bag has been x-rayed and completely emptied and searched.

3) Me, and everyone else flying that night, was physically patted down.  I was told by a woman in line that they are even doing this to children.  I found that hard to believe but was busy with my own pat-down and didn’t see how they handled children.

4) If I was a radical, and used the same approach as the Christmas Day bomber, I would have made it through these checks with exactly the same ease.  Nobody tested me in a meaningful way.  Me and my explosive tighty whities would be heading for the magazine shop for some pre-terror reading material.  Perhaps a Steven King novel, or something from Dr. Phil.

Ok, almost there.  But I have to go through yet another tear-everything-out bag check.  So I’m think that perhaps this is a ‘defence in depth’ approach.  Overkill, but when you’re going for dramatic effect, the more the better.  I think they actually need some flashing red lights, some sirens and  a smoke machine.  And maybe a fireman.  I initially think playing the theme music from ’24’ would be a good effect, but then decide that this would set expectations that this entire charade would be over in ‘1 day’.

The CATSA agent looks at my coded boarding pass, and directs me to Table C.  I walk up, and place my bag on the table, and guess who’s there?  It’s my old friend Igor!  Well, isn’t this nice.  Igor gets to test his own thoroughness.

I can’t resist.  As he’s taking everything out of my bag, I say to him, ‘doesn’t this look familiar’.  He doesn’t appear to understand what I’m talking about.  Is he ignoring me, or does he genuinely not recognize the MacBook, Canon camera/lens and mechanical pencil from 15minutes earlier?  At this point, I’m looking for the director to yell ‘Cut!, Who the hell put this guy back on bag-check? You’re ruining the whole effect!  Ok, people, back to your marks, and ACTION!”

Igor finishes his work, and says I can go.  I look at him quizzically and say ‘that’s it’?  He says ‘yes’.  I’m wondering, shouldn’t you write a special cryptographically secure symbol or code on my boarding pass to indicate that Igor has confirmed (again) that my bag is safe?  So, not overthinking this, I turn and head to the final CATSA agent.  She looks at my boarding pass, and stops me saying “Was your bag checked?”  Uhm, do you trust me enough to want my answer?  I tell her yes, and point to my friend Igor.  She yells “You have to put an X on the boarding pass”. An “X”! Dammit, that’s so simple and so perfect.  Who’d crack that code?  You can’t pass through this final rigorous final security checkpoint until you have a black ‘X’ on your boarding pass.  Perhaps black ball point pens should be banned in airports as well.  Igor sheepishly acknowledges that he’s not following the script, and is likely to get a call from his talent agent telling him he’s back to community theatre after this show runs its course.  But if this show has the longevity of Cats, we’re all screwed.

So, after 45+ minutes of additional screening, I’m free.  And I’ll point out that the airport was as empty as I’ve ever seen it.  I can only imagine what it is like when it’s full.  That explains why WestJet says you should show up 3 HOURS before your flight to the US.  Imagine flying to New York (1.5 hour flight) and have to show up 3 hours early.  Sure, that’s sustainable.

Well, that’s my report.

It’s like one of those really bad sci-fi movies where the science is so incredibly weak that you find yourself cheering for the asteroid to wipe out the Earth.  When we use highly trained law enforcement in this way, it demeans their skills, and clearly takes them away from more important societal tasks.  Shouldn’t we be identifying anomalous behaviours? It isn’t profiling if you select people based on stress responses.  The more I learn about the Israeli approach to aviation security, the more impressed I am with it.  If we’re going to have to spend Billions of dollars, can we at least attempt to do it intelligently.  “Sir, please take off your shoes” is not basis for airline security.

We need a much more intelligent approach to identifying threats.  The model being used by the aviation world makes me appreciate how well Internet security works.  Yes, it’s that bad.

mJm

 

December 30, 2009

The Airline Security Goat Rodeo

Posted by stackunderflow under Uncategorized | Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , |
[2] Comments 

I used to fly. A lot. And the recent near-miss by yet another radicalized terrorist has me happier than ever that I’m not flying much.

But that’s not because I’m worried about being killed in a terrorist attack in the air.  I’m worried that my head will explode while I’m going through the performance art that is labeled by the government as “security”.

Let’s recap what happened on Christmas Day.

  1. a young Muslim man from a 3rd world country is radicalized
  2. his concerned parents contact the US Embassy, and this information eventually goes to the CIA
  3. he pays $2831 cash for a ticket from Laos->Amsterdam->Detroit, travels alone, and checks no bags on this cross the globe trip
  4. he hides some highly explosive PETN in his tighty whities.
  5. a Dutch passenger comes to the rescue when he tries to ignite the explosives

The response by the various security agencies has been quite interesting.  Initially, in-flight entertainment systems were shut down because they showed where the aircraft’s location.  Let’s think about that for a minute.  Somebody in a position of authority (let’s call him Mr. Beane) believed we were better protected on a flight if a terrorist doesn’t have a GPS map telling him where he is.

Is Mr. Beane aware that there are windows on a plane?  Did he take high school physics and learn that you can derive distance by multiplying speed (airliner flies ~ 450mph) x time.  Does he know that we’re still allowed (as of today, anyway), to have timing devices on our person.  Insane.  So we all miss the movies that make the horrid, cramped and squalid service a little less tortuous because some “security expert” decides that it’s too dangerous.

Next, Mr. Beane decided that it’s safest if we all sit on our bums for the last 60 minutes of a flight.  This one was very familiar to me, because I flew on the first non-US originating flight into Washington’s Reagan National Airport after 9/11.  I went through 4 different security checkpoints in Toronto, and there was an Air Marshall on that flight.  We were instructed at the start of the flight that due to the sensitive route this flight takes down the Potomac, that we must remain seated for the last 45 minutes of the flight.  No biggie, I thought.  Especially since it was only an hour and a half long flight.  I was certainly in a heightened emotional state on that flight, and watched every passenger around me for any signs of mischief.  In this specific flight’s case, the assumption is that an attacker would want to do harm to a major US government facility, thus having people stuck in their seats as we’re approaching those makes more sense.

So after Christmas day,  we weren’t allowed to have anything on our laps for those remaining 60 minutes either.  Why didn’t they just have the captain announce, “Ladies and Gentlemen, this is your captain speaking.  It is now 60 minutes to our landing in Newark, so you are all now required to remain in your seats with your hands on your heads.  Flight attendants will be coming down the aisle and affixing blindfolds and ball gags to you for the remainder of the flight.  We recognize you have choices when you fly, and we want you to know that we appreciate your business.”

However, in the general case, terrorists just want to inflict terror.  Does it really matter if a plane blows up over the Atlantic, over a field or over a city.  Yes, there will be more damage, and possibly more media coverage if it’s over land, but you don’t need specific locations to assure that.  And you sure don’t need a GPS.  So they asked terrorists to kindly remain in their seats for the remaining 60 minutes of the flight.  But please feel free to get up 62 minutes before the end of the flight and blow things up.

This approach to security is akin to the famous Maginot Line.  Set the fence up at 60 minutes, and the bad guys just walk around it at 62 minutes.  Wow, who saw that coming?  I pity those folks who drank too much in 1st class and need a bathroom break. Oh wait, 1st class was exempt from this restriction.  Oh crap, now the terrorists know that.  “Wow, this security stuff is hard” mumbles Mr. Beane.

Let’s turn to another one of Mr. Beane’s security brainstorms.  No more roller-bag carry ons.  In fact, nothing more than a small laptop bag or purse.  Let’s reflect back on this and identify what security benefit there is in this action.

Terrorists will not be able to bring on board roller bags.  Yes, that’s right.  We’ve won.  The code has been cracked.  Perhaps the theory behind this one is that terrorists will be so pissed off with the crappy service they get from the airlines that they start attacking trains again.  Well played, Mr. Beane.

Noted Security expert Bruce Schneier has correctly stated that the government focuses on the “last attack” and not the “next one”.  This is very true, but I think it is important that you try to make it as difficult as possible to replay the last attack.  Doing nothing is akin to leaving your car door unlocked after repeated thefts.  Wise up, and lock the door. But don’t order all cars to be painted yellow.  That might look like action, but we clearly don’t all want yellow cars.

However, the actions being taken now don’t address the last attack, or the next one.  They are a complete replay of the goat rodeo we went through after 9/11, whose sole purpose was to put bums back in seats and keep the airline industry from complete collapse.

If we were serious about security, we’d have a much greater pre-screening process, that starts well before people check in, or even buy a ticket.  And it wouldn’t depend on me taking off my shoes and not bringing on board a roller bag.

In any event, these actions have frustrated me, and I don’t have to fly very often now.  And when I do, it’s generally for pleasure.  That’s ironic.  Flying for pleasure.  Who does that any more?

Oh, and by the way Mr. Beane – YOU’RE FIRED.