Hi All, author of the article here. Happy to answer any questions you may have about the laptop ban, aviation security, TSA assholery, Trump's travel-related civil rights abuses (incl. the "Muslim ban"), or other such topics of interest.
And, thanks for the support... HN is always one of the first communities to upvote my work and help me share it with the world. As a computer scientist turned almost-lawyer, I definitely appreciate!
While it is perfectly possible that a scanning device disappeared somewhere, it is not the only way someone can study how to conceal hidden explosive in luggage.
I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours?
Does the same happen for all technicians that maintain/repair these devices?
Does the same happen for all designers of these devices?
Or if you prefer, do you believe that such a scanning machine cannot be re-built from commercial parts by someone who knows their innards?
Are ALL purchases of new scanners subject to governemnet approval (and even if yes, which government)?
> I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours?
No, although after-hours testing may set off some alarms. I'm sure their on-hours experience would be useful, though.
> Does the same happen for all technicians that maintain/repair these devices?
No.
> Does the same happen for all designers of these devices?
Nope.
> Or if you prefer, do you believe that such a scanning machine cannot be re-built from commercial parts by someone who knows their innards?
Yes, I do believe that rebuilding a modern, advanced x-ray system from scrap components is beyond the capabilities of ISIS at the moment.
> Are ALL purchases of new scanners subject to governemnet approval (and even if yes, which government)?
The modern, advanced x-ray systems are not available to the general public. As to how exactly they are controlled, I'm not sure.
See also my comments to other users regarding the differences between modern x-rays and old school ones.
My wife works in import/export compliance. There are many regulations associated with many types of technology requiring you to get licenses, "know your customer", etc. I would guess the latest and greatest of this tech for would be governed by EAR if not ITAR regulations.
If you fly into the US, it is more than likely that not only will you have to clear airport security provided by the host country, you will also have to go through security provided by the US. It will be US equipment and US citizens operating it.
So in that sense, if Whereveristan wants to sell the airport X-ray equipment they can get, it isn't going to be useful in determining what can pass US screening.
> If you fly into the US, it is more than likely that not only will you have to clear airport security provided by the host country, you will also have to go through security provided by the US. It will be US equipment and US citizens operating it.
How common is such an arrangement? I've only ever flown to the US from Australia, and while there was a pre-boarding security check at the gate, after the main security screening at the entrance to the airside of the terminal, the staff carrying it out appear to be Australian private security guards, not US citizens. (I haven't done it for about two years now, so someone who has done it more recently would have to tell me if anything has changed.)
That's highly unlikely for most places in the world. What is often required is additional screening at or near the gate to enforce US specific rules (for example liquids in carry-ons). But that's usually not US staff and US equipment but rather extra staff enforcing US specific rules (the same way the laptop ban is currently enforced in Dubai for example).
>The modern, advanced x-ray systems are not available to the general public. As to how exactly they are controlled, I'm not sure.
Sure they are not something that you can buy at the market around the corner, and surely they would not be cheap, but they can surely be bought by (say) financial institutions, banks, etc. (i.e. not only by airports, and public/international airports).
Now, if you can be sure that no bank (or other private financial institution) nor privately owned airport or port (or similar) worldwide may have some connections with the "bad guys" it's all fine and dandy, otherwise my previous note still stands.
I don't doubt that - as you report - the alarm may have been "triggered" by the stealing (or however vanishing) of the said machine, but from this to consider it "logic" there is a huge step.
At least the last few times I have flown (not to the US that may well have much different and more sophisticated devices) here in Europe I saw everywhere Gilardoni scanners (said to be among the best at least in Europe), like the ones published on their pages:
I'm certainly not arguing that DHS uses perfectly sound logic. I'm just explaining their reasoning, however flawed. I agree that this kind of "reactive" security is less than comforting.
> I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours?
If you have a confederate operating the machine, it would seem easier to arrange to pass through their security line than to use the knowledge to make an X-ray look-alike bomb-laden laptop.
>If you have a confederate operating the machine, it would seem easier to arrange to pass through their security line than to use the knowledge to make an X-ray look-alike bomb-laden laptop.
If you want to simply put a bomb on a single given flight from that particular airport surely yes (and with the risk that your accomplice is caught in the ensuing investigations), but having a general method is - allow me - more elegant, you can in theory embark as many such devices on as many flight as you have suicide volunteers available, leaving from any airport at any date/time.
Hey look, a security crisis that can only be fixed by requiring that we prove our devices are functional, most likely by turning them on, logging in, and showing that there are a few documents present. And in some cases, extra manual evaluation will be required, entailing taking that logged-in laptop into a back room for further inspection. They won't copy everything onto a disk of their own---honest!
I don't think this is true. If some government agent tells the pilot you are a "security risk" for any reason you are not going on that plane or if you are already in it they will drag you out.
The plane is a private property so you can be taken of for any reason.
For international travel the US doesn't have any say over who's flying to them from some other country. Though if you're a known terrorist or something be prepared to be arrested once you land. And once they've landed you can be dragged off the plane, but if you're a US citizen then cannot deport you. They can take you to prison, but not to another country.
Respectfully, you are mistaken. Private airlines are "common carriers" and are required to play nice with the public, and you're conflating "whether the private carrier wouldn't want to take you" with "whether US CBP wants to see the contents of your laptop."
I actually filed suit over the former back in 2015. AA told me they wouldn't let me fly home unless I answered their "security questions." The case was resolved quickly when everyone (AA and DHS) did an about-face and said whoever told me I wouldn't be allowed to fly was mistaken.
The US may not refuse entry to its own citizens, even if they insist on remaining silent. They can detain you to be searched on arrival, but they must, after completing that search, admit you to the country.
Even forcing people to turn on devices doesn't really fix it. Just keep three (for proper voltage so you don't have to add any boost circuitry) of the cells in your battery bomb and it'll be more than enough to pass their screening.
I've already had to do this on several occasions of flying into the US before the laptop ban. There were signs at the airport saying that all electronic devices being brought on board had to had sufficient power to be turned on to be checked. I've also seem similar signs at courtrooms in the US for checking cell phones when going through security. It seems like a more sensible approach than banning the entire laptop.
The premise is flawed. X-ray inspection equipment is easy to find - it's regularly offered for sale on EBay and you'll find a number of teardown videos of various models on Youtube. The stolen X-Ray equipment is not being reported probably because it isn't particularly interesting.
"Advantages of AT X-ray include a greatly enhanced image with the ability to target novel threat items resulting in fewer bag checks and faster throughput, and the ability to upgrade the system with enhanced algorithms."
...and that article describes the 2008 edition of the technology!
For a more technically-specific perspective, I can say that the newer machines take images from multiple angles and are closer to a medical CT scan than a old-school x-ray. Owning one would allow you to practice placing your items in a direction and location that would be least able to be seen by the operator.
>So why was the stolen x-ray equipment kept a secret? I asked my source if there was some security reason for keeping the stolen x-ray equipment from the public, and was told, unequivocally, no. “It’s because the mom from the midwest planning to fly her kids to Disney would freak out. They are worried that people would stop flying if they knew.”
Kind of ironic, because I've already stopped flying - not because I'm afraid, but because these sorts of measures have gotten to the point where traveling through an airport is an awful experience that I actively avoid.
If I absolutely must travel, I take a train or drive. The only reason I ever fly is if I have to cross an ocean or if I face an emergency that requires me to be present somewhere far away, very quickly.
And in the case of an ocean, honestly, renting a stateroom on a cargo ship seems like a very relaxing way to go if you have the time. I've got a HUGE backlog of books and games and writing and projects to design and you get the idea.
That is accurate; there are very very few non-crew berths available on cargo ships nowadays. I know because I've researched alternative means of travelling to see the 2017 Solar eclipse.
This doesn't seem to be true. This site [1] lists many agencies (based in the US, UK and other countries) that will sell you a passenger ticket for a cargo ship.
Availability is probably limited though, as each ship can only take a few passangers: "Cargo ships can carry a maximum of 12 passengers although most vessels only have accommodation for 4 to 6 passengers" [2].
You're right. Things seem to have opened up a bit. For a while, security was a big concern. CMA CGM will take passengers on some freighters. Maersk, the biggest line, won't.
They're offered as 'cruises' these days; you'd be looking at rates of ~$100-150/day, and they do single-day port calls wherever the ships' routes make a call. It looks like you do have to book fairly far in advance, though.
> They are worried that people would stop flying if they knew.
And that describes what the whole TSA thing is about. It is a theatre. There was no need to put laptop ban either because it is just as useless. One has to only check Quora answers on all sort of things people have taken through security which includes 2 full size Katana Swords, loaded guns, Fire starters, Ethanol bottles and various other items.
I understand government can not admit TSA is ineffective. But they can surely reduce the pain for us.
You could create a dust explosion out of almost anything containing small enough particles and you can learn how from YouTube videos. It's seriously that easy. Are they going to ban baby powder next? Sugar, flour, corn starch, whatnot?
A fair amount of the security isn't really adding anything useful anymore. 9/11 only worked because the passengers assumed it was a hijacking, and therefore, cooperating meant they would likely live. That's out the window now. Passengers now violently subdue anyone that even seems suspicious. Between that and the secure cockpit door, a bomb is about all they have left to do anything on a large scale. Even that is tricky. The size of bomb you can sneak on limits the effectiveness[1]. Basically, the "ROI" on attacking planes isn't what it once was.
[1] Yes, you can find examples where it worked. But you can also find examples where most passengers survive even extensive damage to the aircraft, like Aloha Airlines Flight 243 (not a bomb, but still). Or Daallo Airlines Flight 159, where the bomber only killed himself.
Next time I'd really appreciate it if folks didn't automatically disparage an entire REGION of the country as ignorant of the risks of a) living b) driving to the airport c) flying once at the airport.
As far as I can tell, DHS are the ones not properly managing risks here, not the mom traveling to Disney.
I will let my source know your feelings when I next speak with him or her. :)
I think the implication that he or she was trying to make is that statistically, those on the coasts travel by air more frequently. As someone with a mom who was very afraid of flying and terror related risks thereto, I know that fear largely dissipated when I finally got her to fly a few times. It's not an allegation of ignorance but that of relative inexperience (was my take, anyway).
The frequency argument is an interesting one. This recent survey seems to indicate that travel maps pretty closely (within a percent or three) to population of the area which I wasn't actually expecting (sure, lobbying group doing the research caveat caveat):
http://airlines.org/wp-content/uploads/2016/04/2016Survey.pd...
It also looks like there's a pretty significant difference between Midwest and Plains states in terms of numbers - less people, many fewer airports.
I totally get why the stereotype kinda makes sense given a certain view of a large swath of the country (though I've generally found these to be poor guides) but the statement would've worked without the regional or gender modifier :)
This is also a bit raw for me because I JUST flew my kids to Disney haha
"If I absolutely must travel, I take a train or drive. "
The problem with train is it is expensive and time consuming in the States. I could take a train from Chicago to Orlando and it would take around 30 hours and cost just as much, if not more, than a plane ticket. Not only that, the 19 hour second leg of the ride has no food car.
It is definitely not a saving on cost or time, but I don't have to travel too much and the vastly improved experience is worthwhile for me, especially within a 2-3 state radius. Amtrak tickets will rival a plane in cost while taking longer, but they tend to be less crowded. They often have designated quiet cars. There's far less invasive security theater. The seats are comfortable. It's an environment that I can actually relax or work in, unlike a plane, which I find makes up for the extra time.
The one time I took a train (Amtrak) I found it was nearly impossible to work due to the swaying of the train. The other down side was the return train was a few hours late (Amtrak does not own the track where I was traveling).
On the plus side, the seats were large and comfortable, and the food was surprisingly good.
This is exactly the thought that occurred to me, except for New York to Atlanta.
I've looked into taking the train a couple of times and balked each time at the idea of paying the same price for 10-15x the transit time. 40 hours in transit is going to be a non-starter for so many kinds of trips, unless you're specifically doing something like [1] where the transit is the whole point of the trip.
The thing is it is way more expensive to provide a train for 40 hours than a plane for 2. The plane could do 20 journeys in that time, for 20x the nominal revenue.
This is why high speed rail is so good: it can actually really decrease operational costs Vs normal rail as your train, crew, station etc does 2-3x the volume of passengers, and therefore revenue, compared to slower alternatives.
Passenger train is just generally severely crippled in the US.
From Louisville, KY you get to factor in the greyhound bus to Chicago, as the nearest passenger train station, because the passenger trains haven't run to Louisville in more than a decade. So far as I can tell, that's the most direct route via train: northwest by bus to go southeast by train, eventually.
You could do it somewhat more directly using a sequence of bus transfers instead, but that's also entirely inconvenient in its own way.
Q for the author: how valuable would an actual proprietary airport X-ray be, in terms of designing devices (as compared to another X-ray of similar spec)? Does having access to the actual X-ray for purposes of product testing really make that much of a difference to a technically gifted bomb-maker?
Yes. See my comment below to djmdjm, but also, I'll add one more thing. Take a knife out of your kitchen drawer and hold it in your hand in front of you such that the sharp side of the blade is on the left and the dull side is on the right. Easy to see. Now rotate it 90 degrees such that the sharp side is facing you and the dull side is facing away. Much harder to see, especially if you can imagine what it would look like on an x-ray, and how you could further conceal it by carefully placing other items between the "camera" and the item.
Angle-shifting units make this harder, but the obvious blindspot is the conveyor belt entrance/exit holes (they cannot have imaging equipment in them).
As lithium batteries are opaque to X-Rays, perhaps a ban on laptops with batteries should be considered. This will surely push for standard swappable batteries and standard power supplies so the laptops could be used on board without batteries.
What? No, that's a wholly unnecessary solution (though more standardization of batteries would certainly be nice). Swab the outside of the laptop for bomb residue, which would be especially difficult to clean from a laptop because the stronger solvents to clean with (like acetone) would mark the plastic. Or hire more dogs. Or make a "puffer machine" for laptops (blasts with air and then samples the air for explosive trace). Or come up with another solution -- this is HN! :)
Does swabbing work? I can imagine that the "batteries" (ie bomb) would be prepared, sealed and cleaned by one person, and then inserted into the laptop by another person so there's no contamination.
It's hard to remove all trace, but yes, in theory you could avoid it by being really careful. Then again, if you work in a "bomb factory," there's trace everywhere, so it may be quite difficult.
Also, the "turn on your device" thing they sometimes do offers some mitigation against this. Obviously, you can think of ways that may defeat this too, but to defeat all of the security, accurately, in one small package that doesn't look sketchy, is not easy. Fortunately, most terrorists are not the brightest people in the world.
That would already cut the amount of explosives in half. Modern laptop batteries are not exactly huge to start with. So it is much less likely to do big damage to the airplane. Add to that, it is not trivial to make a battery half the size which still has enough voltage to power the laptop - you would need cells half the size for that. And all bombings of airplanes have been done with bombs in the cargo bay.
They had puffer machines for people in 2006. They stopped using them because they required regular maintenance. Then they replaced them with the body scanners, which cost more than the puffer machine and a full time maintenance person in every airport in the country combined.
> The machine operates by releasing multiple puffs of air at a passenger who is standing upright within the machine. This will flush out any particles on the person inside the machine then analyze and identify them in seconds.[6] According to an article in the 16 June, 2005, New York Times, it is capable of screening up to 180 passengers an hour.[7] This sample is then analyzed using IMS or MS technology to search for specific explosive or narcotic compounds. If a substance of concern is detected, the security personnel are notified by a visible and/or audible alarm.
They are not opaque to X-Rays, much less the ludicrous penetrating power used in baggage inspection. Baggage X-rays can happily penetrate inches of metal, nothing short of lead brick will obscure contents and that's going to raise other questions. Where did you get that nonsense from?
X-ray machines have to be calibrated. While you could turn up the power to see through metal, you would then be unable to see the less dense items. This makes it difficult to do a full inspection in the few seconds that the screener has.
There's beyond HDR, you can switch between multiple penetration levels and do automatic detection of materials even with ones made 2 decades ago. None of this is really new, insightful, or particularly revolutionary.
I probably should have been more clear that they are completely opaque to the x-ray systems commonly in use in airports for carry-on screenings at their standard intensity setting(s). But that's a mouthful.
Correct me if I'm wrong, but wouldn't a relatively benign way to fix this simply be that the TSA agents randomly reorient/flop some carry on luggage items in the bins before they go through the scanner?
That would definitely help. Or, simply re-run bags where there is opaque stuff that the screener is unsure about, oriented in a new direction. But, that wouldn't necessarily solve all the problems, as laptop batteries are opaque in all directions, and so if you got a lead metal box and filled it with explosives, it may look much the same.
One of the sad things about airport security is that there is no scope for private innovation. It is a military industrial complex of using substandard solutions for potentially non existent problems while wasting insane amount of money.
May be there is a need for the security theatre but then we can at least get good at it. Can Elon Musk design a better airport security ?
Fuck Elon Musk, can you design a tool that would make airport security better? I bet in 15 minutes, most HN readers could come up with something that would be cheaper, more effective, and faster to use than the current tool set. There's indeed money to be made here (and good to be done), even if the easiest way would be to patent your idea and sell it to the military industrial complex you speak of.
Fun fact: the parent company of the company that makes the TSA body scanners (L-3) also owns the company that made "waterboarding" famous. It is, indeed, the military industrial complex.
There is a model that we already know works in practice but it's not cheaper or faster and it would generate a lot of income for security/airport renovation companies at the cost of much higher ticket costs to pay for it - the Israeli model. https://www.schneier.com/blog/archives/2010/01/adopting_the_...
There is an easier model called "less stringent security". Flying is incredibly safe. There is little evidence that the TSA's onerous security processes safe enough lives to be worth their massive costs.
The classic military view of secrecy is time-limited. "Where the ship was last week is unclassified. Where the ship was yesterday is confidential. Where the ship is now is secret. Where the ship will be tomorrow is top secret." The opposition will eventually find out what you're planning on doing. The goal is for them to find out the hard way, when incoming fire starts hitting them.
The intelligence community has a longer-term view. "We know, and they know. We think they don't know that we know they know. We hope they don't know how we found out that they know." This protection of sources mindset leads to things being kept secret long after all involved parties know.
The anti-terrrorism community has adopted the intelligence community mindset. This is a problem.
> The anti-terrrorism community has adopted the intelligence community mindset. This is a problem.
Wonder how much that has to do with overlap between the two.
Today's terrorist may well have been yesterday's informat, and may well be an informant again tomorrow.
After all, the CIA was deeply involved in Afghanistan back when the USSR was fighting there. And many of the people that the CIA supported then later turned against USA.
They didn't 'ally with Al Qaeda', they just both happened to be opposed to the same guy while also being opposed to each other. It's a complicated situation out there. Even at the height of the Cold War, sometimes the CIA and KGB would share information of mutual benefit. That didn't mean the CIA was allying with communism. Even Trump has learned this when his 'bombing Syria is the wrong thing to do, what Assad gets up to is non America's business anymore' policy lead to Assad feeling free to start nerve gassing civilians again. Oops. Turns out him being against Islamic State doesn't make him our friend either. It's a horrible nasty mess, but even trying to stay out of it just makes you even more vulnerable to even greater problems in the long run.
And yet, the press has done an about-face on Al Qaeda's, referring to its Syrian branch as 'Al-Nusra, a moderate rebel group.'
If I didn't know any better, I'd say that we are being primed for the CIA getting into bed with Islamist terrorists, in order to combat Russian influence in the Middle East. Again.
"And yet, the press has done an about-face on Al Qaeda's, referring to its Syrian branch as 'Al-Nusra, a moderate rebel group."
Substantiate your claim.
"CIA getting into bed with Islamist terrorists"
This is tiresome, just because US govt allies with Muslims that Russia calls terrorists doesn't make them so. In fact, last time I checked Russia works on the ground with Hezbollah, a designated terrorist group. This argument can easily go sideways for people hoisting it up as a mantra.
"The other areas listed are largely dominated by moderate rebel factions or Islamist groups, such as Ahrar al-Sham and the al Qaeda-affiliated Nusra Front." [1]
Right. They aren't bad dudes like ISIS, they are just, ah, al-Qaeda's Syrian arm. They are totally on the level.
> This is tiresome, just because US govt allies with Muslims that Russia calls terrorists doesn't make them so.
That's true. Just because Russia says they are terrorists doesn't make them terrorists. And, perhaps, using car bombs, suicide attacks, assassinations, and forced conscription of child soldiers doesn't make them terrorists either.
Strangely enough, all of this seems to be sufficient for the the United States to also designate them to be an islamic terrorist organization. [2] (And then issue diplomatic protests when Russia bombs them.)
"(And then issue diplomatic protests when Russia bombs them.)"
US has literally never complained when Russia has bombed Nusra. People complain when Russia bombs people then calls them ISIS/AQ. Inanimate grain silos? IS oil facilities according to RU MoD. Hospitals? Nusra strongholds according to RU MoD.
This is what people complain about. If you want to say otherwise please substantiate your claim.
They've been Al Nusra since 2013 and while they did affiliate with Al Qaeda for a while they split with them about a year ago. They're no angels, for sure, and I wouldn't describe them as moderate, but let's at least get the facts straight. If they can provide intelligence and tactical support against ISIS why turn it down? Don't let the perfect be the enemy of the better-than-nothing.
Even Trump is beginning to understand some of this. It's just a shame so many people in Khan Sheikhoun had to die first.
CIA allied with groups that have died fighting al-Qaeda. Just because theft and corruption means material aid given to the groups ended up in AQ's hands doesn't mean CIA allied with al-Qaeda, it shows quite the opposite. SAA goods end up in ISIS's hands by the tons but that doesn't mean they allied with them either.
There is no political benefit to open-ness. If the information is used to kill your country's citizens, the politicians who allowed it's release will have their careers ended. It doesn't matter that you have a right to know, or that incidents will happen regardless, or that flying would still be safer than 40 years ago if a dozen planes blew up.
The classification level of information is determined by confidentiality of the information's source. This is done to protect deeply embedded or highly technical means of information gathering.
For example, information that could have only come from the second in command of some organization would require the highest of security classifications whereas information that could have come from any dozens of members of that organization would only require a confidential or secret classification.
Information is required to be classified at the lowest possible level, a guideline that is both taught and enforced throughout most if not all of the Intelligence Community.
source: I was an intelligence analyst for 6+ years.
It is certainly correct that DHS, and to some extent our government generally, is known for over-classifying things either out of laziness, desire to avoid embarrassment, or because they believe that anything remotely security related needs to be hidden. As an intelligence analyst, you likely didn't see the misclassified things (I'd imagine roughly everything you did was classified for good reason). It's the political officials who are more likely to over-classify.
That's a fair accusation - you're responsible for increasing the classification of material if you find it to be under-classified, or request a review in the opposite case. So, it wouldn't be surprising if something came across the desk of a decision-maker or the IC's version of middle-management and they selfishly raised its classification hoping it'd be lost in a blackhole for fear of embarrassment, etc.
Depends of objective of classification. What you say is applicable when the objective is national security. When the objective is to hide incompetence it makes sense to make everything classified.
This article seems to miss the fact ISIS took over Mosul international airport in 2014. Surely they got luggage screening machines in hand by then already.
Well, for whatever reason, they stole more equipment more recently. Could be that the new stuff is more advanced, or maybe we bombed the gear they took from Mosul. I don't have more details that would provide insight.
Not sure, because the destinations countries for the planes departing from there have some interest (a bit like the US forcing some theater on Europe), and there is some international help for military and security theater gear.
Everyone seem to have missed the opportunity here to push for standard power connector/polarity/voltage/maxcurrent requirement for all laptops while fitting a power cable (with short circuit protection in every seat. That will also discourage from producing laptops not working if a battery isn't plugged in.
Having say a 12VDC/3A plug in every seat will force most manufacturers to make at least one airline-friendly laptop, and/or implement on faster models things such as turning off cores and keeping CPU speed low to stay within that current limit.
edit- and push to get a standard for battery pack sizes to reduce the number of form factors, then implement a service where you give your used one at departure and get a new one at arrival.
Regulations like that one stink badly, but necessities drive progress and I see an opportunity here.
> edit- and push to get a standard for battery pack sizes to reduce the number of form factors, then implement a service where you give your used one at departure and get a new one at arrival.
Or we could implement the Indian system, where you turn in your new batteries at departure and are given used ones on arrival. (Mysteriously, despite the assurance that they are the same batteries, they have sometimes changed brand, too.)
Read this paper as well https://www.usenix.org/system/files/conference/usenixsecurit... -- the researchers who wrote it obtained (on the surplus market) the same model of backscatter X-ray body scanner that was deployed in US airports and proceeded to evaluate and validate various schemes for undetectable concealment of firearms, knives, and explosives. Other research was done, including a software implant that would selectively strip indications of contraband from the image (when a specific signal pattern was in the image), and a firmware implant that would disable all interlocks and deliver an elevated radiation dose. If it is possible for a few university researchers to obtain this sort of security scanner without resorting to crimes, it is folly to assume that actual adversaries cannot.
We need better methods for detecting energetic materials (and not just suspicious shapes) in luggage (detecting it concealed inside humans is harder and would require transmission x-ray which is not currently acceptable for airport security screening) that don't crumble when the adversary has unlimited access to the security scanner to test concealment methods.
Concealing knives is kinda easier than concealing energetic materials -- it is, for example, possible to machine a blade that fits perfectly inside a blunt, innocuous "sheath" so precisely (hi, wire EDM) that they appear as a single piece of metal. However, this is not so much of an issue nowadays, as no amount of threatening or stabbing with a knife will make a pilot open the cockpit door.
Ceramic, glass and plastic knives can be extremely dangerous and yet they probably don't show up on these machines at all. The utility of these machines is questionable to say the least.
Bruce Schneier observed, like you did, that the heavily secured cockpit door is one of the only real improvements made to airplane security in the last few decades.
> and yet they probably don't show up on these machines at all
Uh, yeah, they do. Have read anything about backscatter xray machines?
The real way to defeat these machines is to hide things in folds of your flesh. It can see through clothes, but not too much skin. In staged demonstrations, fat people have gotten a metal pistol through, no problem.
> Ceramic, glass and plastic knives can be extremely dangerous
Yes, but not more so on aircraft. Passengers (who tend to not want to die in a suicide hijacking) will fight for their lives against hijackers who use knives. Sometimes the attempted hijackers die from the injuries sustained by the passengers fighting back: https://en.wikipedia.org/wiki/Tianjin_Airlines_Flight_7554
I really don't worry about knives on airplanes, what's scary is energetic materials (explosives or gunpowder) or someone tampering with electrical/avionics equipment.
It seems to me that if an X-Ray scanner was stolen from an airport, that information would reasonably be considered SSI due to its relation to screening passenger luggage. I wouldn't be comfortable spreading news that stolen equipment is available, that there's a security vulnerability allowing equipment to be stolen, that ISIS is in possession of the stolen equipment, or any vulnerability assessments of the equipment. The unnamed source seemed convinced that any security decision was made to avoid scaring "mom from the midwest," but that comment appears short-sighted if anything more than conjecture.
Hi Everyone, author of post here with an update for you. The most modern x-ray systems in use by the TSA at airports to screen carry-on bags can indeed see through lithium batteries. It also differentiates densities, and it seems to me that the latest tech should therefore be able to indicate the difference between a battery and C4 in a battery-shaped box. So is it that the airports subject to the laptop ban have the older tech? Well...
>By forcing all these batteries into the cargo hold where a fire cannot be rapidly detected and contained, DHS would be countering any deceased risk of terror with an increased risk of fire.
Everyones always been telling me that if I want to bring down a plane I should set the cabin on fire, not the cargo hold. Have I been living a lie?
123 comments
[ 3.0 ms ] story [ 191 ms ] threadAnd, thanks for the support... HN is always one of the first communities to upvote my work and help me share it with the world. As a computer scientist turned almost-lawyer, I definitely appreciate!
I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours?
Does the same happen for all technicians that maintain/repair these devices?
Does the same happen for all designers of these devices?
Or if you prefer, do you believe that such a scanning machine cannot be re-built from commercial parts by someone who knows their innards?
Are ALL purchases of new scanners subject to governemnet approval (and even if yes, which government)?
> I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours?
No, although after-hours testing may set off some alarms. I'm sure their on-hours experience would be useful, though.
> Does the same happen for all technicians that maintain/repair these devices?
No.
> Does the same happen for all designers of these devices?
Nope.
> Or if you prefer, do you believe that such a scanning machine cannot be re-built from commercial parts by someone who knows their innards?
Yes, I do believe that rebuilding a modern, advanced x-ray system from scrap components is beyond the capabilities of ISIS at the moment.
> Are ALL purchases of new scanners subject to governemnet approval (and even if yes, which government)?
The modern, advanced x-ray systems are not available to the general public. As to how exactly they are controlled, I'm not sure.
See also my comments to other users regarding the differences between modern x-rays and old school ones.
ref: http://ooc.usc.edu/overview-ear-and-itar
What about any other country, for the sake of the example, Wherevereristan?
Do they have the same rules?
So in that sense, if Whereveristan wants to sell the airport X-ray equipment they can get, it isn't going to be useful in determining what can pass US screening.
How common is such an arrangement? I've only ever flown to the US from Australia, and while there was a pre-boarding security check at the gate, after the main security screening at the entrance to the airside of the terminal, the staff carrying it out appear to be Australian private security guards, not US citizens. (I haven't done it for about two years now, so someone who has done it more recently would have to tell me if anything has changed.)
https://www.gov.uk/hand-luggage-restrictions
Sure they are not something that you can buy at the market around the corner, and surely they would not be cheap, but they can surely be bought by (say) financial institutions, banks, etc. (i.e. not only by airports, and public/international airports).
Now, if you can be sure that no bank (or other private financial institution) nor privately owned airport or port (or similar) worldwide may have some connections with the "bad guys" it's all fine and dandy, otherwise my previous note still stands.
I don't doubt that - as you report - the alarm may have been "triggered" by the stealing (or however vanishing) of the said machine, but from this to consider it "logic" there is a huge step.
At least the last few times I have flown (not to the US that may well have much different and more sophisticated devices) here in Europe I saw everywhere Gilardoni scanners (said to be among the best at least in Europe), like the ones published on their pages:
http://www.gilardoni.it/en_scanner-a-raggi-x.asp
And are you really sure-sure that all the scanners you can find on alibaba are tat much oudated?
https://www.alibaba.com/trade/search?SearchText=x-ray+scanne...
It doesn't seem to me like shopping for cruise missiles or the like ...
If you have a confederate operating the machine, it would seem easier to arrange to pass through their security line than to use the knowledge to make an X-ray look-alike bomb-laden laptop.
If you want to simply put a bomb on a single given flight from that particular airport surely yes (and with the risk that your accomplice is caught in the ensuing investigations), but having a general method is - allow me - more elegant, you can in theory embark as many such devices on as many flight as you have suicide volunteers available, leaving from any airport at any date/time.
No matter where you are, the U.S.government cannot force you to speak as a condition of flying home. Just be quiet rather than deceitful.
The plane is a private property so you can be taken of for any reason.
I actually filed suit over the former back in 2015. AA told me they wouldn't let me fly home unless I answered their "security questions." The case was resolved quickly when everyone (AA and DHS) did an about-face and said whoever told me I wouldn't be allowed to fly was mistaken.
https://professional-troublemaker.com/2015/02/23/corbett-sue...
The US may not refuse entry to its own citizens, even if they insist on remaining silent. They can detain you to be searched on arrival, but they must, after completing that search, admit you to the country.
They have more guns than you do. That means that any statement beginning with the words above is wrong, no matter what comes after those words.
https://securitytoday.com/articles/2008/07/30/tsa-to-expand....
"Advantages of AT X-ray include a greatly enhanced image with the ability to target novel threat items resulting in fewer bag checks and faster throughput, and the ability to upgrade the system with enhanced algorithms."
...and that article describes the 2008 edition of the technology!
For a more technically-specific perspective, I can say that the newer machines take images from multiple angles and are closer to a medical CT scan than a old-school x-ray. Owning one would allow you to practice placing your items in a direction and location that would be least able to be seen by the operator.
Kind of ironic, because I've already stopped flying - not because I'm afraid, but because these sorts of measures have gotten to the point where traveling through an airport is an awful experience that I actively avoid.
If I absolutely must travel, I take a train or drive. The only reason I ever fly is if I have to cross an ocean or if I face an emergency that requires me to be present somewhere far away, very quickly.
And in the case of an ocean, honestly, renting a stateroom on a cargo ship seems like a very relaxing way to go if you have the time. I've got a HUGE backlog of books and games and writing and projects to design and you get the idea.
Availability is probably limited though, as each ship can only take a few passangers: "Cargo ships can carry a maximum of 12 passengers although most vessels only have accommodation for 4 to 6 passengers" [2].
[1]: http://flightlesstravel.com/plan/cargo-ships/
[2]: http://www.cargoshipvoyages.com/WhatToExpect/
And that describes what the whole TSA thing is about. It is a theatre. There was no need to put laptop ban either because it is just as useless. One has to only check Quora answers on all sort of things people have taken through security which includes 2 full size Katana Swords, loaded guns, Fire starters, Ethanol bottles and various other items.
I understand government can not admit TSA is ineffective. But they can surely reduce the pain for us.
But all you have achieved is a hole in the fuselage. That sucks but it's nowhere near enough to take a plane down. https://en.wikipedia.org/wiki/Southwest_Airlines_Flight_812 for example.
[1] Yes, you can find examples where it worked. But you can also find examples where most passengers survive even extensive damage to the aircraft, like Aloha Airlines Flight 243 (not a bomb, but still). Or Daallo Airlines Flight 159, where the bomber only killed himself.
As far as I can tell, DHS are the ones not properly managing risks here, not the mom traveling to Disney.
I think the implication that he or she was trying to make is that statistically, those on the coasts travel by air more frequently. As someone with a mom who was very afraid of flying and terror related risks thereto, I know that fear largely dissipated when I finally got her to fly a few times. It's not an allegation of ignorance but that of relative inexperience (was my take, anyway).
The frequency argument is an interesting one. This recent survey seems to indicate that travel maps pretty closely (within a percent or three) to population of the area which I wasn't actually expecting (sure, lobbying group doing the research caveat caveat): http://airlines.org/wp-content/uploads/2016/04/2016Survey.pd...
It also looks like there's a pretty significant difference between Midwest and Plains states in terms of numbers - less people, many fewer airports.
I totally get why the stereotype kinda makes sense given a certain view of a large swath of the country (though I've generally found these to be poor guides) but the statement would've worked without the regional or gender modifier :)
This is also a bit raw for me because I JUST flew my kids to Disney haha
Clearly you've never been in a storm at sea. Or did I mis-interpret your meaning of 'to go'?
The problem with train is it is expensive and time consuming in the States. I could take a train from Chicago to Orlando and it would take around 30 hours and cost just as much, if not more, than a plane ticket. Not only that, the 19 hour second leg of the ride has no food car.
On the plus side, the seats were large and comfortable, and the food was surprisingly good.
I've looked into taking the train a couple of times and balked each time at the idea of paying the same price for 10-15x the transit time. 40 hours in transit is going to be a non-starter for so many kinds of trips, unless you're specifically doing something like [1] where the transit is the whole point of the trip.
[1]: http://www.viarail.ca/en/explore-our-destinations/trains/roc...
This is why high speed rail is so good: it can actually really decrease operational costs Vs normal rail as your train, crew, station etc does 2-3x the volume of passengers, and therefore revenue, compared to slower alternatives.
From Louisville, KY you get to factor in the greyhound bus to Chicago, as the nearest passenger train station, because the passenger trains haven't run to Louisville in more than a decade. So far as I can tell, that's the most direct route via train: northwest by bus to go southeast by train, eventually.
You could do it somewhat more directly using a sequence of bus transfers instead, but that's also entirely inconvenient in its own way.
Also, the "turn on your device" thing they sometimes do offers some mitigation against this. Obviously, you can think of ways that may defeat this too, but to defeat all of the security, accurately, in one small package that doesn't look sketchy, is not easy. Fortunately, most terrorists are not the brightest people in the world.
https://en.wikipedia.org/wiki/Puffer_machine
> The machine operates by releasing multiple puffs of air at a passenger who is standing upright within the machine. This will flush out any particles on the person inside the machine then analyze and identify them in seconds.[6] According to an article in the 16 June, 2005, New York Times, it is capable of screening up to 180 passengers an hour.[7] This sample is then analyzed using IMS or MS technology to search for specific explosive or narcotic compounds. If a substance of concern is detected, the security personnel are notified by a visible and/or audible alarm.
From the article: "since lithium batteries are completely opaque to x-rays"
Everyone can go around with battery-less laptops so they can't use them in the few planes that get retrofit, and no other place without plugs.
May be there is a need for the security theatre but then we can at least get good at it. Can Elon Musk design a better airport security ?
Fun fact: the parent company of the company that makes the TSA body scanners (L-3) also owns the company that made "waterboarding" famous. It is, indeed, the military industrial complex.
That's for them to decide.
The classic military view of secrecy is time-limited. "Where the ship was last week is unclassified. Where the ship was yesterday is confidential. Where the ship is now is secret. Where the ship will be tomorrow is top secret." The opposition will eventually find out what you're planning on doing. The goal is for them to find out the hard way, when incoming fire starts hitting them.
The intelligence community has a longer-term view. "We know, and they know. We think they don't know that we know they know. We hope they don't know how we found out that they know." This protection of sources mindset leads to things being kept secret long after all involved parties know.
The anti-terrrorism community has adopted the intelligence community mindset. This is a problem.
Wonder how much that has to do with overlap between the two.
Today's terrorist may well have been yesterday's informat, and may well be an informant again tomorrow.
After all, the CIA was deeply involved in Afghanistan back when the USSR was fighting there. And many of the people that the CIA supported then later turned against USA.
And round and round it goes. Too bad the public is made a to be a sucker every time.
If I didn't know any better, I'd say that we are being primed for the CIA getting into bed with Islamist terrorists, in order to combat Russian influence in the Middle East. Again.
Substantiate your claim.
"CIA getting into bed with Islamist terrorists"
This is tiresome, just because US govt allies with Muslims that Russia calls terrorists doesn't make them so. In fact, last time I checked Russia works on the ground with Hezbollah, a designated terrorist group. This argument can easily go sideways for people hoisting it up as a mantra.
Right. They aren't bad dudes like ISIS, they are just, ah, al-Qaeda's Syrian arm. They are totally on the level.
> This is tiresome, just because US govt allies with Muslims that Russia calls terrorists doesn't make them so.
That's true. Just because Russia says they are terrorists doesn't make them terrorists. And, perhaps, using car bombs, suicide attacks, assassinations, and forced conscription of child soldiers doesn't make them terrorists either.
Strangely enough, all of this seems to be sufficient for the the United States to also designate them to be an islamic terrorist organization. [2] (And then issue diplomatic protests when Russia bombs them.)
[1] https://www.wsj.com/articles/putin-seeks-parliaments-approva...
[2] https://en.wikipedia.org/wiki/Al-Nusra_Front
US has literally never complained when Russia has bombed Nusra. People complain when Russia bombs people then calls them ISIS/AQ. Inanimate grain silos? IS oil facilities according to RU MoD. Hospitals? Nusra strongholds according to RU MoD.
This is what people complain about. If you want to say otherwise please substantiate your claim.
Even Trump is beginning to understand some of this. It's just a shame so many people in Khan Sheikhoun had to die first.
"Too bad the public is made a to be a sucker"
Who is the sucker here?
The classification level of information is determined by confidentiality of the information's source. This is done to protect deeply embedded or highly technical means of information gathering.
For example, information that could have only come from the second in command of some organization would require the highest of security classifications whereas information that could have come from any dozens of members of that organization would only require a confidential or secret classification.
Information is required to be classified at the lowest possible level, a guideline that is both taught and enforced throughout most if not all of the Intelligence Community.
source: I was an intelligence analyst for 6+ years.
edit- and push to get a standard for battery pack sizes to reduce the number of form factors, then implement a service where you give your used one at departure and get a new one at arrival.
Regulations like that one stink badly, but necessities drive progress and I see an opportunity here.
Or we could implement the Indian system, where you turn in your new batteries at departure and are given used ones on arrival. (Mysteriously, despite the assurance that they are the same batteries, they have sometimes changed brand, too.)
We need better methods for detecting energetic materials (and not just suspicious shapes) in luggage (detecting it concealed inside humans is harder and would require transmission x-ray which is not currently acceptable for airport security screening) that don't crumble when the adversary has unlimited access to the security scanner to test concealment methods.
Concealing knives is kinda easier than concealing energetic materials -- it is, for example, possible to machine a blade that fits perfectly inside a blunt, innocuous "sheath" so precisely (hi, wire EDM) that they appear as a single piece of metal. However, this is not so much of an issue nowadays, as no amount of threatening or stabbing with a knife will make a pilot open the cockpit door.
Bruce Schneier observed, like you did, that the heavily secured cockpit door is one of the only real improvements made to airplane security in the last few decades.
Uh, yeah, they do. Have read anything about backscatter xray machines?
The real way to defeat these machines is to hide things in folds of your flesh. It can see through clothes, but not too much skin. In staged demonstrations, fat people have gotten a metal pistol through, no problem.
Quick examples: https://www.wired.com/2014/08/study-shows-how-easily-weapons...
A gun(!) is basically invisible in the scan. Is teflon tape enough to defeat these stupid machines?
Yes, but not more so on aircraft. Passengers (who tend to not want to die in a suicide hijacking) will fight for their lives against hijackers who use knives. Sometimes the attempted hijackers die from the injuries sustained by the passengers fighting back: https://en.wikipedia.org/wiki/Tianjin_Airlines_Flight_7554
I really don't worry about knives on airplanes, what's scary is energetic materials (explosives or gunpowder) or someone tampering with electrical/avionics equipment.
Read more: https://professional-troublemaker.com/2017/05/22/update-newe...
Everyones always been telling me that if I want to bring down a plane I should set the cabin on fire, not the cargo hold. Have I been living a lie?