Kip Hawley: "No, the TSA is Necessary Because This is War!"

CBS News did a story a few days ago on the Transportation Security Administration (TSA). Basically it was a tit-for-tat between Bruce Schneier, security pontificator extraordinaire, and Kip Hawley, the administrator of the TSA. Mr. Hawley's maintans that the TSA provides a necessary service because we are at war, and the obvious battleground, apparently, is airplanes. Surely, we must all realize that just because the terrorists used airplanes once, they can't possibly have enough imagination to go for another target next time. Mr. Schneier, wisely, disagrees, points out all the flaws in what the TSA does, and calls the whole thing "Security Theater;" a term whose origins are not entirely undisputed, but that is beside the point.

The interesting thing with this story is that neither of Messrs. Schneier and Hawley were quoted as addressing the currently most glaring flaw in the entire air transportation security apparatus. If one of our enemies actually wanted to terrorize the populace, why take on the risk of blowing up another plane? Just for fun, head on down to your local airport this week. Walk into the terminal area and take a look at the security line. At Dulles (IAD), Los Angeles (LAX), Chicago (ORD), Denver (DEN), Atlanta (ATL), John F. Kennedy (JFK), etc, the picture is the same. There will, at any given moment, be 500 to 1,000 people in line.

It took 5 terrorists per plane (four on one plane) to blow up the planes on September 11, 2001. Together, they managed to kill 2,751 people. That's  145 victims per attacker. Take those 19 terrorists, strap them full of explosives, and position them strategically in the lines the TSA has created leading up to the security checkpoints. I guarantee you that each one of them will kill 145 people, or more. Better still, have them get in line with a bag full of explosives, then leave the bag and step out of line. They will probably have two to three minutes to make a get-away before the bag explodes before anyone even so much as looks at those bags. One might even have more if one chats up the people next to oneself in line to watch the bag while the attacker runs to the restroom. Suddenly, we have the prospect of a devastating, coordinated attack that is far more insidious, far more deadly, and far more difficult to prevent, than the attacks of September 11. This one you can't inspect away. You can't put a security checkpoint to get into the security checkpoint.

The TSA, single-handedly, created this vulnerability by making the airport security checkpoints so incredibly inefficient (and, one might add, ineffective) that the lines leading up to them back up with hundreds, or, in the case of Dulles, even thousands, of people. If the terrorists really wanted to erode confidence in our transportation infrastructure, why not make the security checkpoints the most dangerous part of it?

Mr. Hawley, in your final few weeks, how are you going to protect the public you are sworn to protect from this attack? How are you going to prioritize our safety while we are waiting in line so that your spiffily dressed officers can declare us as posing no risk to the traveling public?

Published Wed, Dec 24 2008 2:44 AM by jesper

Comments

# Micah said on 24 December, 2008 06:20 AM

Great article, that asks great questions. "Security Theater;" is the best way to describe it too. We are sitting ducks just waiting to get attacked again and there is nothing we can do about it. Next time we get attacked we will just run to uncle Sam for more protection and he will take away more of our rights.

- Insanity: doing the same thing over and over again and expecting different result Albert Einstein

# Jeff Martin said on 24 December, 2008 07:44 AM

I'm no expert so possibly I am wrong, but I doubt anyone could strap on enough explosives to kill 145+ people in line at the airport. Wound maybe, but not kill. They got that ratio before by flying an airplane into a building, not from a strap-on explosion. Look at the suicide bombers in the mideast now, I can't credit that there aren't crowds in the middle east that bombers in Iraq or Israel could target. But the numbers of dead per attack that we see are 10, maybe 30. But it is still a good point. The numbers of dead aren't really that important, the real attack is from the terror such an attack would cause. Hence the term 'terrorist.' But why should they bother attacking an airport, we are already doing exactly what they want: bankrupting and oppressing our own country for a ridiculous "war" against a tactic used by a small gang of criminals.

# Aaron Margosis said on 25 December, 2008 01:48 AM

Schneier and Johansson (and I) know some stuff about computer security.  To my knowledge, none of us have any *real* experience in anti-terrorism.  He might be right about shoe removal and liquids, but I wouldn't consider him an authority.  In CS, we continually defend against yesterday's attacks and today's attacks, and try to have some defenses to mitigate or even prevent what might happen tomorrow.  I've seen video demos of what the radicals in the UK intended to do to those trans-atlantic flights, so I don't object to any of the screening I have to go through.  It might not be the most efficient process.  Oh, and believe it or not I always make a point to THANK the TSA people after they're done going through my stuff.  (No emoticon here because I am serious.)

# Neal said on 04 January, 2009 01:18 PM

You just know that the TSA will now create a security check to check you aren't carrying a bomb before you get into the security check line right?

# jersey said on 06 January, 2009 04:54 PM

I agree and disagree.

I think the statement "The TSA, single-handedly, created this vulnerability" is completely bogus. The TSA, as a side effect, created another line in an airport. If we're looking for a huge group of people in an airport forget the security line. Instead look at the check-in counters, especially on bad weather days.

Having said that, I agree 100% that an easier (and just as terror-generating) attack would be to simply blow up bombs on the "insecure" side of the airport.

Aaron is correct. Nobody here is an expert in air security. While things could certainly be more efficient and likely safer, to call it "security theatre" is incorrect and insulting.

# Yuri said on 13 January, 2009 12:00 AM

Hey Jesper,

Have you and Steve thought about updating your "Protect your windows network" book? It is one of the best Windows Network books on security that I have ever read, and I just thought that an update would be awesome.

Please post a blog if so. = )

I will buy the book for sure!

Blessings,

Yuri