
Security Risks of TSA PreCheck - CapitalistCartr
https://www.schneier.com/blog/archives/2016/12/security_risks_12.html
======
LukaAl
The problem with this article is that it fails to recognize the real threat
model. The objective of a terrorist is not to blow up a plane, it is to scary
people and do this by killing and injuring the highest number of people while
minimizing the risk of being detected.

If this is the threat model, why a rational terrorist should try to put the
bomb on a plane? The Brussel Terror Attack has shown exactly this[0].
Terrorist killing themselves at the check-in counter (but they could have
chosen the security lanes).

Obviously, we need airport security because the threat model is not only
terrorists but also hijackers and smugglers (and non-rational terrorists?).
Obviously, the risk of using the hijacked plane as a bomb, like in 11/9 is
still a risk, but other measures like reinforced cabin doors are more
effective for that.

So, basically, the TSA is a failure in making people safer and but a huge
success in making traveler life miserable. TSA Pre-Check is nothing but them
keeping on with their "good work".

[0]
[https://en.wikipedia.org/wiki/2016_Brussels_bombings#Brussel...](https://en.wikipedia.org/wiki/2016_Brussels_bombings#Brussels_Airport)

~~~
candiodari
If you want an even better example, try the Istanbul attack:

[https://en.wikipedia.org/wiki/2016_Atat%C3%BCrk_Airport_atta...](https://en.wikipedia.org/wiki/2016_Atat%C3%BCrk_Airport_attack)

3 Terrorists total. The attack went as follows : 2 terrorists queue up in an
Xray machine line, and suddenly start shooting people. One of the terrorists
is shot down and a few seconds later he detonated a suicide vest.

What does an airport security line do at that point ? Well, of course it fails
open. Security abandoned their posts and none of the security guards responded
for minutes to the second attacker in the line walking around and shooting
people. He walked right through, got on an escalator and continued shooting
people for ~2 minutes. Eventually a security officer (one wandering around by
himself, not identified) shot him from a distance, looked up close at the
attacker, and ran away (the terrorist exploded shortly after that, I hope the
guy made it out). A third terrorist blew himself up in what was essentially a
security pre-check line outside the airport.

Any chokepoint, of course, is a terrorist target at an airport. I've been to
Istanbul airport. It's big, but not that big. In this attack 45 people died
and 230 were wounded. There are plenty of far bigger airports where that
number would have been way up. Thankfully I do think security personnel would
not just immediately abandon their posts in the US when something like this
happens.

That of course means that TSA makes things worse in some ways and provides a
target for terrorists unless they avoid making lines. Heh. "Somehow" that
doesn't seem to be the conclusion they're drawing from this. In fact I am
unaware of any official responses to these attacks.

~~~
ep103
The way I heard it, the TSA was created by an accenture proposal. GWB's
administration told the airline companies they needed to step up security for
people admitted into airports, in response to 9/11\. The airlines used the
aforementioned proposal to suggest that instead of the airlines paying for
individual security, the government do so for everyone, standardized, and pay
for it as well. For god knows what reason, the government agreed.

The end result, is the airlines have no desire to improve the process. If you
get angry at the security theatre, you think to blame the government, not the
airline. The government and DHS has no desire to improve the process, they
just want to keep costs down, while simultaneously making sure they are
publicly notable to justify their existence.

Want to fix it? What if we: made the airlines pay for and run their own
security. And make the DHS audit those security practices, instead of
implementing them. Just one of many possible ideas.

~~~
knz
> The end result, is the airlines have no desire to improve the process.

That is not entirely true. Delta have spent money to improve the TSA process
in Atlanta (I believe mostly by adding automation and more areas for people to
unload their belongings) and have also spent money at other airports to
relieve TSA congestion.

I work for an airport and have heard many times that the airlines have
considerable frustration with the process - it's not uncommon to hear people
say that they would rather drive than fly due to the hassle of security.
Airlines are usually very aware of lost revenue due to these kinds of factors.

I completely agree re where the blame lays.... my understanding is that the
TSA have actually asked for additional funding to have more staff on the lines
but Congress has denied this. The TSA is not actually a requirement either -
airports can run their own security but my understanding is that they would
still require TSA oversight so any cost savings are negligible.

~~~
notheguyouthink
> my understanding is that the TSA have actually asked for additional funding
> to have more staff on the lines but Congress has denied this.

This wouldn't help my complaint, fwiw.

My complaint isn't the lines.. i experience long lines all the time, i'm used
to it. My problem is this feeling like suddenly, we're all criminals.

We're cattle, on the verge of being violated, and all it will take is a sneeze
or an awkward look.[1]

To me, they are like "bad cops". You can meet a good cop and even if you did
wrong _(speeding ticket /etc)_, you feel comfortable and at ease _(hopefully)_
around his/her professional attitude and behavior. The bad cops though, they
just have this aura of unwarranted power, and you just hope they don't desire
to spend some of it on you. That is TSA in the majority of cases to me.

The line isn't the problem for me.

[1]: _edit_ , this isn't true of course, but it's how i feel.

~~~
ZanyProgrammer
The TSA is the closest I've felt like basic training since I've left the
military.

------
feld
My TSA PreCheck experience:

\- no removing shoes \- never bothered about my computer gear, screwdriver
set, razor blades \- completely through security in a few minutes

Then I look at the people in he regular line while waiting for my friend and
see everyone's personal space being invaded, bags rifled through, electronics
and cables strewn about, harassed over the stupidest items

It's a joke. PreCheck is proof they aren't serious about security. Anyone
could pay the $75 and walk through with dangerous items.

That said, I'll gladly continue to use PreCheck because if someone wants to
attack an airport they'll attack the long security line which I won't be stuck
in.

~~~
CWuestefeld
So it looks like what we're building here is the beginnings of a travel tax.
If the "service" they're providing isn't necessary - and indeed, PreCheck is
really just a protection racket, where you pay them to avoid the shakedown -
then what else can we call it?

And by going along with it, we're really just buttressing the whole TSA
program. When there's revenue being generated they'll never let it go. (yes, I
know that the net is overwhelmingly negative, but when that's just looked at
as a jobs program for barely-skilled workers, it's easy to write that off and
focus on the income)

~~~
mtgx
It was already a protection racket, just used against your taxpayer money. Now
it will also tax travelers. "Win-win" for the racketeers.

~~~
leesalminen
And now you get to hand over biometrics to them for the privilege. It's a win-
win-win!

~~~
feld
Fingerprints for PreCheck, but if you sign up for Clear they also get your
retina scan. Clear isn't gov't, but in sure they share data.

Not sure what is required for Global Entry

------
tristor
Thankfully, Amex Platinum benefits include a credit for Global Entry which
automatically gets you TSA Pre-Check, so I've been whizzing through border
patrol and TSA for a long time now. Unfortunately, it's a protection racket
that requires participants to turn over their fingerprints into a national
database, so it has all sorts of ethical and philosophical murkiness around
it. In the end though, if you're traveling for business its one of those
things you can't afford not to have because of how stupid the process for
regular joes is.

As a frequent traveler I can only agree with Bruce's conclusion here. TSA Pre-
check is a failure, not because it doesn't provide enough security, but
because the existing process for regular travelers is completely pointless. As
any frequent traveler is already fully aware, the TSA is a big joke, and going
back more or less to how we did airport security pre-9/11 with the better
scanning technology is more than good enough for the realistic threat level
and would greatly reduce traveler stress and increase airport throughput. The
TSA is failed jobs program which has threatened the civil liberties of the
average traveler for no gain whatsoever in national security. It's time to cut
it back to something realistic.

~~~
sebleon
TSA pre-check is actually a good honeypot for finding bad people. Regular TSA
is a joke, so having these people skip it is fine. But coming up with a
shortened list including most evil doers is golden.

I'm sure they scrutinize the heck out of anyone that's trying to avoid
detection.

~~~
Johnny555
Someone that doesn't think it's worth paying the $85 fee for PreCheck is now
an "evildoer"? There are a _lot_ of people in this country that fly very
rarely and for whom $85 is a lot of money.

~~~
UnoriginalGuy
Not agreeing with them, but you misread what they said. They said that
PreCheck itself was a self-selecting list of "evildoers" (i.e. the only people
who pay for it are up to no good).

As I said, I don't agree, but that's what they posted.

~~~
sebleon
To clarify, I meant that vast majority of evil doers would pay $85 for less
screening (alongside a lot of normal people).

While doing thorough background checks on all travelers is an impossible task,
it might possible to do thorough checks on all Pre-Check members. This could
be worth it for the TSA, even if 99% of PreCheck members are good.

~~~
Johnny555
I read it that way at first, but then went the other way because it makes no
sense -- there's so little difference in screening between lines, why would a
terrorist invite more scrutiny months before they are ready to act?

Besides, an organized terrorist cell is not going to bring their bomb through
security anyway, they are going to bring it in on a catering truck or one of
the other thousand service vehicles that enter the poorly secured airport
perimeter every day. There's no way to "body scan" a truck.

~~~
calvano915
"There's no way to "body scan" a truck."

I've seen something similar on a show in the past and found this clip:
[https://www.youtube.com/watch?v=rPfUSPVH6oQ](https://www.youtube.com/watch?v=rPfUSPVH6oQ)

Up for debate is how reliable these scanners are.

------
danvasquez29
I signed up for TSA PreCheck recently and have taken 3 trips with it so far,
all to different locations. One thing that has stood out to me is that the
security agents that check IDs REALLY check ID's. There's a notable difference
in the length of time and scrutiny they put into it, and some even asked
follow up questions like where I was born and where I was going, which just
about never happens in regular security.

It made me think that they were maybe taking advantage of the lower volume and
lower stress environment and using behavior based analysis like the Israeli's
([http://www.telegraph.co.uk/news/2016/05/20/israels-risk-
base...](http://www.telegraph.co.uk/news/2016/05/20/israels-risk-based-
approach-to-airport-security-impossible-for-e/))

~~~
pavel_lishin
> _some even asked follow up questions like where I was born_

Why? Your ID doesn't have that information.

~~~
leesalminen
I'd guess the parent has a "weird" last name. My significant other appears
"white" but has an Arabic last name and is frequently asked these kinds of
questions.

------
endtheshow
To me, the base assumption that the TSA has anything to do with security is
just wrong. The TSA did the following.

1\. It let the people feel better post 911

2\. It created low skill minimum wage jobs to boost employment numbers.

3\. It increased Gov. control over traveling with increased internal data on
the movement of legitimate citizens.

4.surved to create the most intricate theater around.

The only thing that, since 911 has stopped anything, has been onboard citizen
action and stronger doors to the cockpit.

~~~
huffmsa
Regrettably we found that the doors are as sturdy as promised in the real
world last year with the suicide of that German pilot.

------
CWuestefeld
_Allow liquids to stay in the carry-on since TSA scanners can detect threat
liquids._

Wait a minute - is Hawley _admitting_ here that the whole thing with throwing
out all liquids before entering is a sham? Does anyone have more information
on this?

~~~
byoung2
Anyone who has traveled with a baby knows they can easily scan liquids inside
the bag (e.g. formula and a gallon of distilled water). There is no need to
even put them in a separate plastic bag. Sometimes they do a bomb residue
test, however.

I suspect throwing out liquids was a scam to sell you more drinks at higher
prices after the checkpoint.

~~~
semi-extrinsic
I travelled through the US from Mexico to Europe last year. Bought a nice
bottle of Mezcal at the airport in Mexico, had it in a sealed bag to enable
travel. TSA agent didn't trust the travel seal, so he took it out of the bag,
scanned bottle with some cotton swabs put into a device (my guess is HPLC), it
was OK so he re-sealed my bag with TSA tape so I could carry it on multiple
flights in Europe.

------
1024core
Pre-Check is nothing but a fund-raising scheme by the TSA. They have an
incentive to further slow down the usual screening lanes, so more people will
buy into PreCheck! How is this not a bad incentive??

------
huffmsa
Potential acts of terror stopped at the checkpoint by the TSA since 2001: 0

\---Edit---

Knitting needles confiscated and grannies fondled: Classified as it pertains
to Homeland Security

~~~
niij
It's there a source for this? I find it hard to believe that some idiot hadn't
tried to bring something onboard in the past 15 years.

~~~
huffmsa
They have and they succeeded, the shoe bomber guy and the guy who set his
scrotum on fire.

~~~
pavel_lishin
How is the shoe-bomber-guy a TSA success story?

~~~
huffmsa
He's not. Those two are really the only AQ tied incidents since 9/11 and they
waltzed right past the TSA.

~~~
realityking
FWIW the shoe-bomber boarded his flight in Paris. Hard to blame the TSA for
not stopping him.

------
goodells
I find it difficult to believe that the bureaucrats that came up with this
couldn't recognize the gaping hole and inconvenience that TSA PreCheck is.
This could be interpreted as some acknowledgement of the security theater
they're putting on, indicative of poor management/internal lack of faith at
the TSA, or some combination of both.

As an aside - I've never had the opportunity to rant about this before - the
Dane County Regional Airport is laid out in such a way that there are two
escalators that go up to the security checkpoints on the upper level, one on
each side of the ticketing counters. One is TSA PreCheck, the other is not
(yes, entirely 1/2 of the locations they have available are TSA PreCheck, and
there are always lines at the other side). The signage is very poor and many,
many people end up going to the PreCheck side, get turned away, and then need
to walk 10 minutes to the other side of the airport to go through the regular
lane. Of course this could be avoided if you enroll in that program, but for
people who travel by plane infrequently, the cost/benefit ratio just isn't
there.

~~~
pklausler
Oh, come on. 10 minutes? BS. If you're shuffling behind a walker, dragging
unwheeled luggage, and have to stop and take a dump in the men's room, maybe
that's 10 at most. Any able adult can walk that stretch in Madison's tiny
little femto-airport in a couple of minutes. It's not even a long frisbee
toss.

(I had to live there for six years and got to know those dozen horrible bus-
station-ish gates all too well.)

------
bluedino
>> Timothy McVeigh was an upstanding US citizen before he blew up the Oklahoma
City Federal Building

He was a paranoid, transient psychopath, anti-government activist, with more
emotional and psychological problems than you could shake a stick at. He would
be on all kinds of lists today.

~~~
marcosdumay
Would he?

I mean, the people that blew up the airport in France had formal training at
the Al'Qaeda camps. The guy that tried to explode his underwear had most of
those traits, and his father calling the authorities on him before the event.

It shouldn't be hard for a police force to keep control of everybody that gets
enough tools to make a bomb that passes the older airport scanners. Instead,
we get the government reading our email and that joke of security.

------
JumpCrisscross
> _What the Trusted Traveler program does is create two different access paths
> into the airport: high security and low security_

They're both low security. PreCheck just admits that and creates a low-hassle,
low-volume lane.

------
makecheck
It’s so strange to read a TSA person make some reasonable criticisms on the
one hand, and to then come up with _ridiculous_ proposals such as adding
REMOVAL OF SHOES to the pre-check lane?!? Heck, removal of shoes and other
items is probably 75% of the _entire_ travel delay (they should just sit there
for a few minutes and watch people stumbling around).

Just about the only sensible measure at this point is to return to a bullshit-
rules list of length zero, and just say “right this way, please”.

------
Havoc
I just don't get how the TSA manages to be so much worse than other country's
border checks. Its like they've made it their mission in life to be as much of
a pain as possible.

~~~
alistairSH
FWIW, Munich is just as bad as major American airports, or at least it was
this past September.

Edinburg and Dublin both seem to be doing it well. Minimal hassle. Plus, the
US "border" check in Dublin is smoother than (non-pre-screened) checks at IAD.

~~~
Havoc
>FWIW, Munich is just as bad as major American airports, or at least it was
this past September.

Strange - I was in Munich during September as well - Oktoberfest. You could
see security staff was a little on edge but was fine otherwise. Just the usual
strip everything metal & go through scanner.

------
themckman
One thing I've noticed recently at SEA is that there appears to be some sort
of privatized PreCheck. I've had some guy come around with brochures for the
company offering minimal lines/waiting to get through security if you signup
for whatever the program is. Unfortunately, I'm having a hard time finding the
company online.

~~~
kristjansson
These guys [https://www.clearme.com/](https://www.clearme.com/) ? Seems weird
to me, and quite expensive for what they offer...

------
peter303
Maybe next adminstration will introduce profiling, which seems an absurbs
oversight after spending tens of billions on security, not to mention the time
cost. Yoing Arab men should get more ecrutiny than old ladies in wheel chairs.

------
awinter-py
schneier is discounting the possibility that terrorists hate standing on
lines.

------
na85
TSA seems like a government make-work project.

~~~
JadeNB
Not that there's necessarily anything wrong with make-work; but surely it
could be accomplished without an accompanying make-miserable?

~~~
panzagl
It is funny how HN comes across as both pro basic income and anti government
jobs programs.

~~~
obstacle1
Why's that funny? Jobs programs and basic income are completely different
animals.

I'm sure many people take issue with the various externalities associated with
job programs, e.g. In this case making all of our lives more difficult and
wasting our time while travelling. If we simply gave all TSA employees a basic
income and told them to stay out of the way (i.e., fired them) the end goal of
giving them money would be achieved but without the additional drain on
everyone else's resources.

