Security Risks of TSA PreCheck | Hacker News Reader

Security Risks of TSA PreCheck

schneier.com

The problem with this article is that it fails to recognize the real threat model. The objective of a terrorist is not to blow up a plane, it is to scary people and do this by killing and injuring the highest number of people while minimizing the risk of being detected.

If this is the threat model, why a rational terrorist should try to put the bomb on a plane? The Brussel Terror Attack has shown exactly this[0]. Terrorist killing themselves at the check-in counter (but they could have chosen the security lanes).

Obviously, we need airport security because the threat model is not only terrorists but also hijackers and smugglers (and non-rational terrorists?). Obviously, the risk of using the hijacked plane as a bomb, like in 11/9 is still a risk, but other measures like reinforced cabin doors are more effective for that.

So, basically, the TSA is a failure in making people safer and but a huge success in making traveler life miserable. TSA Pre-Check is nothing but them keeping on with their "good work".

[0] https://en.wikipedia.org/wiki/2016_Brussels_bombings#Brussel...

I said this the moment TSA was created. "Wow fedgov! Thanks! You just made my job as a terrorist exponentially easier! Now instead of having to get through security to get on a plane and blow it up, you corralled all the people on multiple flights into a single file line in one place for me before security. Thanks! Now I can wait in line with my bomb on my body until I'm the next one to go through the scanners, then detonate as o take my shoe off. Taking out the security checkpoint, all your useless equipment, TSA personnel, and innocents. Thanks!"

I love how the receiving end's security works as well. You stuff everybody into a big room, hot, humid, badly ventilated (presumably that was the local climate, but still). You mix everyone from everywhere, and make them wait in line for hours, VERY close to one another. Breathing on eachother. Some passengers obviously ill, coughing and sneezing. You make everyone stand around like this for hours.

The video playing ? "we are working so you won't get hit by diseases"

There must be some real sadists working at government airport regulators.

and to add insult, everyone will die barefoot while the dammed terrorist can have their shoes on still.

Now I can wait in line with my bomb on my body...

No need to carry around all of that extra bulk and weight on your body when when you can pack it into a wheeled carryon bag. You don't even need to keep it under carryon size since the airlines don't (usually) screen for size until you get to the gate.

Why not go for broke and do both?

It seems harder to be inconspicuous with 40 lbs of explosives taped to your body than to wheel it around in a carry-on bag.

Have you seen the size of the average American? Throw on a staypuff marshmallow parka and you'd look like 40% of travelers this past week

Sure, you won't look larger than the average American, but they grew that size over months or years and move naturally with the extra weight.

Strap on 20 - 40 lbs of extra weight and you won't move naturally anymore, at least without lots of training.

If your goal is just to kill as many people as possible (rather than, e.g., needing the plane for smuggling or hijacking), surely there are enough events where people are packed together that it could be done with or without TSA lines? Take any music event for instance - the standing area will be packed, and security will be minimal if any (last time I went to Wembley Arena the bag search was pointless - I had a jacket in mine that completely obscured the bag contents, and there could easily have been an explosive device concealed below. FWIW, this was only a few months after the Bataclan attack, and the venue had specifically said to arrive early due to increased security).

The security lines are definitely a softer target than needing to get on the plane, but soft targets are easy to find anyway.

I've been very critical of the TSA, but if (since) that's the threat model, that actually highlights the benefit of security theater. As Schneier points out, there are essentially no terrorists. It's like trying to find a needle in a haystack, and it's arguably better to just let the needle go through than to screw up all the hay.

But if the terrorists are mainly just causing fear instead of harm, doesn't it make sense to counter it by making people feel safer instead of actually making them safer, especially if you practically can't do the latter?

Food for thought...

I thought about that. But if finding a terrorist is like trying to find a needle in the haystack, Schneier suggestion (as well as any other expert in security will tell you), the best solution is truly random search. If it is truly random, the terrorists have no way to predict if they will be checked and if it is frequent enough, it will be sufficient to change their behavior.

As for the point of sense of safety vs. real safety (impossible) is a well taken one. But this false safety could be dispensed with much lower costs for the citizens (both in terms of money and inconvenience).

> random search

Or in other words, ignore concerns about profiling and implement an Israeli style security operation.

I think it has a lot to be said for it. Profiling + politeness + a firm boundary on mandate (e.g. no drug convictions by airport security) doesn't seem that bad. Especially compared to what amounts to the same thing except with a vast security army of more poorly trained agents.

Ethnically profiling selection without ethnically profiling assumption isn't a nuance I'd trust the average TSA agent to perform well.

I think by "truly random" he means uniformly random, i.e. the exact opposite of profiling.

Racial profiling is the opposite of a random search.

If we want to be technical, it's a weighted random search based on historical observations.

It would be the exact opposite if 100% of the ethnically profiled individuals were terrorists.

Well the Israelis profile single white european women in their 20's and 30's as one of the highest risk threat actors because historically they are been the ones that knowingly or unknowingly been used to smuggle munitions or explosives pass security.

Being brown skinned an arab or a muslim isn't what would put you on top of their threat ranking.

>If it is truly random, the terrorists have no way to predict if they will be checked and if it is frequent enough, it will be sufficient to change their behavior.

If we are talking about suicide bombings, I don't see how this changes anything. If they don't get through, they will just blow themselves up as soon as they get randomly selected.

Agreed. To reinforce the comment I just made above to the parent. Someone willing to blow him/her self up will take any odds pretty much, and then kill whoever he can in the line once he/she is selected. I guess some kind of protocol can isolate individuals from the rest while the decision of being selected or not is made? that could just slow things down anyways though, so not sure how would something like that would look like.

I'm curious on your reasoning here. What makes you think truly random search will be sufficient to change their behaviour? frequent enough means not always, hence, they can simply send multiple parties and then odds might be good enough that not all of them will be caught by the random search (again, depends on the frequency of search you left undetermined). What kind of odds do you think will stop a person willing to blow him/herself up?

To be fair to the TSA, they have requested that they are armed.

If you want an even better example, try the Istanbul attack:

https://en.wikipedia.org/wiki/2016_Atat%C3%BCrk_Airport_atta...

3 Terrorists total. The attack went as follows : 2 terrorists queue up in an Xray machine line, and suddenly start shooting people. One of the terrorists is shot down and a few seconds later he detonated a suicide vest.

What does an airport security line do at that point ? Well, of course it fails open. Security abandoned their posts and none of the security guards responded for minutes to the second attacker in the line walking around and shooting people. He walked right through, got on an escalator and continued shooting people for ~2 minutes. Eventually a security officer (one wandering around by himself, not identified) shot him from a distance, looked up close at the attacker, and ran away (the terrorist exploded shortly after that, I hope the guy made it out). A third terrorist blew himself up in what was essentially a security pre-check line outside the airport.

Any chokepoint, of course, is a terrorist target at an airport. I've been to Istanbul airport. It's big, but not that big. In this attack 45 people died and 230 were wounded. There are plenty of far bigger airports where that number would have been way up. Thankfully I do think security personnel would not just immediately abandon their posts in the US when something like this happens.

That of course means that TSA makes things worse in some ways and provides a target for terrorists unless they avoid making lines. Heh. "Somehow" that doesn't seem to be the conclusion they're drawing from this. In fact I am unaware of any official responses to these attacks.

> Thankfully I do think security personnel would not just immediately abandon their posts in the US when something like this happens.

I hope you don't mean the unarmed minimally trained TSA staff that earn next to minimum wage. I highly doubt they'll protect you over themselves. Hell, many of them are obese (this is America) and physically unable to engage in such a scenario.

The ones who idley stood by while that guy attacked people with a machete last year?

To be fair they don't even have non-lethal armaments, but it does again point to how useless the operation is in the face of a person who isn't just mad because their flight is delayed.

Core problem: how do you measure effectiveness of deterrent methods. Actual or avoided incidents? Feeling of safety of the public? Most likely how happy the insurance companies are afaict

Well us who like the scientific approach would have incrementally added layers to the security onion, but in the real world, that kind of trial and error costs human lives.

Makes testing expensive

The way I heard it, the TSA was created by an accenture proposal. GWB's administration told the airline companies they needed to step up security for people admitted into airports, in response to 9/11. The airlines used the aforementioned proposal to suggest that instead of the airlines paying for individual security, the government do so for everyone, standardized, and pay for it as well. For god knows what reason, the government agreed.

The end result, is the airlines have no desire to improve the process. If you get angry at the security theatre, you think to blame the government, not the airline. The government and DHS has no desire to improve the process, they just want to keep costs down, while simultaneously making sure they are publicly notable to justify their existence.

Want to fix it? What if we: made the airlines pay for and run their own security. And make the DHS audit those security practices, instead of implementing them. Just one of many possible ideas.

> The end result, is the airlines have no desire to improve the process.

That is not entirely true. Delta have spent money to improve the TSA process in Atlanta (I believe mostly by adding automation and more areas for people to unload their belongings) and have also spent money at other airports to relieve TSA congestion.

I work for an airport and have heard many times that the airlines have considerable frustration with the process - it's not uncommon to hear people say that they would rather drive than fly due to the hassle of security. Airlines are usually very aware of lost revenue due to these kinds of factors.

I completely agree re where the blame lays.... my understanding is that the TSA have actually asked for additional funding to have more staff on the lines but Congress has denied this. The TSA is not actually a requirement either - airports can run their own security but my understanding is that they would still require TSA oversight so any cost savings are negligible.

I will only fly my 1h fligth if I am alone. if I have others with me, I always try to convince everyone to drive 6h each way instead.

> my understanding is that the TSA have actually asked for additional funding to have more staff on the lines but Congress has denied this.

This wouldn't help my complaint, fwiw.

My complaint isn't the lines.. i experience long lines all the time, i'm used to it. My problem is this feeling like suddenly, we're all criminals.

We're cattle, on the verge of being violated, and all it will take is a sneeze or an awkward look.[1]

To me, they are like "bad cops". You can meet a good cop and even if you did wrong (speeding ticket/etc), you feel comfortable and at ease (hopefully) around his/her professional attitude and behavior. The bad cops though, they just have this aura of unwarranted power, and you just hope they don't desire to spend some of it on you. That is TSA in the majority of cases to me.

The line isn't the problem for me.

[1]: edit, this isn't true of course, but it's how i feel.

The TSA is the closest I've felt like basic training since I've left the military.

All of Congress no doubt use PreCheck or Clear or equivalent to spend as little time as possible in lines. If it were a level playing field, rather than thinking it's valid to buy trust as if it's a product to sell, I'm convinced we'd see improvements however incremental.

> Airlines are usually very aware of lost revenue due to these kinds of factors

Good to know. My own point at which airlines are worth the hassle has increased from a 6 hour one-way drive to 14 since the security "improvements" began. Which means that I'm regularly spending ~6-8 additional hours on the road simply to avoid an ~2 hours of airport security unpleasantness[1]. Driving > 6hrs generally costs more too. And it's still worth it to avoid the security process.

[1] even better - once through security I can look forward to a cramped, unpleasant experience for the duration of the flight (6'2" guarantees miserable - the $20/inch of legroom option notwithstanding).

If the government is setting the requirements and doing the implementation then it would seem appropriate to blame them.

> The end result, is the airlines have no desire to improve the process.

Airlines are competing against other forms of travel (I, for example, mostly just drive everywhere I can these days, though this is only in part due to the TSA checkpoints: there's tons of stuff to hate about air travel if you can avoid it) and travel as a concept is competing against other activities (whether leisure or business: if you don't enjoy travel, you are less likely to just randomly hop on a plane and go somewhere; you take more phone calls and watch more television).

Airports are also competing against other airports, and usage of TSA employees is optional: when I was still bothering to fly in and out of the Bay Area I chose SFO over SJC because I preferred the private SFO security guard over real TSA employees. The incentives might be mild (as again, there are tons of other things for them to optimize), but they definitely do exist; if nothing else, "correctly optimize the number of employees to manage long lines" seems like a big win.

https://skift.com/2016/05/27/more-airports-may-ditch-the-tsa...

> Still, airports that have switched to private firms say they consider the contractors more responsive and better able to adjust staffing to address traffic surges and lulls.

> Delta and United airlines will spend as much as $4 million each hiring extra workers to manage the lines at this busiest airports.

>when I was still bothering to fly in and out of the Bay Area I chose SFO over SJC because I preferred the private SFO security guard over real TSA employees.

This seems crazy to me - the security line at SJC takes about four minutes to get through and you can park about a hundred feet away from the checkpoint. SFO takes FOREVER to get through.

The choke points are definitely an issue at airports but also at sporting events, where masses of hundreds of people are crowded around a gate getting in to the stadium.

I think they need to setup a maze system where passengers/fans queue in to a system where can be scanned as they go through and directed to lower and higher risk areas something bullet/blast resistant where people can be physically isolated from each other (and from gaining access) as they pass through security and everyone can be locked down (or automatically directed to exit the facility) if an event happens so there isn't a free run through security. And make it large enough where people can get in to the system quickly so you don't have large groups of people standing waiting outside. Something with lots of angled areas as you enter and get you isolated, scanned directed in to the facility or over to higher security area for further processing.

You can't engineer away this problem. Too many places humans gather in large numbers. This is just throwing away money.

Can every church and store and mall and stadium in the world do this? If not it won't do anything. And if so, then we move on to other ways.

Calling most TSA workers "security personnel" is fundamentally inaccurate. They aren't hired to provide security; they're hired to organize queues and identity things in X-ray scans.

This has been the thing that always confuses me about the TSA. They create bottle necks that essentially concentrate people to a small area. Forget a major airport like LAX or LaGuardia, medium sized airports have more people in those lines than on a flight. If the threat level was anywhere above basically nil this would have to change. Plus if you want to get in it's easier to fly a small plane in. All I can think is that TSA in its current form has caused more danger than it has prevented. It's security theater if red team almost always wins.

The bottleneck being a top target is the elephant in the room, that's why they don't mention it. And it's a grossly classist system that makes most people sitting ducks by virtue of being in that line much longer, than people who are willing to pay to be trusted more and spend less time in line.

>The objective of a terrorist is not to blow up a plane, it is to scare people and do this by killing and injuring the highest number of people while minimizing the risk of being detected.

Let's talk about this.

What kind of objective is this? For insight into the psychology of terrorists can I consider the psychology of "trolls"? (i.e. mostly harmless Internet trolls). Or people just generally trying to wreak havoc "for the lolz"?

Or is it different? What I mean is that people like Chomsky accuse the United States of being "terrorists" in whenever he thinks the United States meets some technical definition -- but the United States has some kind of political goals and it's not an end in itself to just have a bunch of people "scared" or "killed and injured". The U.S. doesn't say, "hey could we scare a billion people!! Yeah let's do it!!" Which is precisely what you quoted as the terrorist's objective: "it is to scare people".

So what is the actual motivation of terrorists? Why is it motivating to "scare people"? (For the same reason as trolls are motivated?) Some people ascribe religious motivations for it, but I read through the Koran (you can read it easily here[1], it should take you under an hour, it's very repetitive. Copied into a Word document in 10-point single-spaced font it's 180 pages but you can scroll through it very quickly) and I did not once see anything like "Thou shalt scare people" or "Thou shalt wreak havoc by killing and injuring the highest number of people." I searched for "scare" and did not see that word. So in effect I don't understand why you say the primary rational objective of terrorists is to scare people.

It doesn't really make sense unless it's the same as Internet trolls. I'd like more insight.

[1] http://www.archive.org/stream/thekoranalquran02800gut/koran1...

If you want to get it down to 181 pages to read quickly 1) open the above link 2) select all of it and copy it 3) In word select 10-point font, single (1.0 spacing), 3) paste it into word using the Paste dropdown button in the ribbon, to paste as text only which is the third dropdown option (alternatively you could paste it into some plain text editor and then select all and copy it again and then paste it into Word or I guess since it's .txt you could just download it). This will just paste the text but have a bunch of extraneous line breaks. Next do a search and replace for every instance of "^p" (without the quotes, which means new paragraph) with nothing or even better as a single space (since replaced with nothing, some words run together but this didn't bother me). this will substantially reduce the thing. If you did the single-spacing right you will get 181 dense but highly repepetitive and readable pages of the Qu'ran. I next used the scroll wheel (by pressing down on it) to begin scrolling through all of it and attempted to alight my eyes on each section enough to read it "at a glance" (like speed reading.)

At 24 seconds per page (I timed it and this is what I considered a readable scroll speed) the whole thing should take you about 1 hour 16 minutes. I encourage you to do it! Just focus. Stop if you really need to focus on something.

I read War and Peace this way. It's about some Russians. (I'm kidding, this last part is a woody allen joke.)

I don't see why the Koran (quran, cough cough) should tell you something about terrorism. It is the Muslim's holy book, not the terrorist's holy book.

For my discussion, I simply used the Merriam-Webster dictionary[0]. It says "the systematic use of terror especially as a means of coercion". You are correct, their final objective is not to just scare people but to get something else. But I believe the immediate objective of the terror action is to scare people so to get to their final objective.

[0] https://www.merriam-webster.com/dictionary/terrorism

>the immediate objective of the terror action is to scare people so to get to their final objective.

I would like to understand this train of thinking because I don't see any consequence to scaring people. Online trolls don't accomplish any larger objective, for example. What do terrorists have in mind?

I am inclined to just think of them as trolls.

- prod US (and friends) into ongoing military engagements in the middle east

- foster Islamophobic sentiments in neighboring regions

- destabilize local power structures

these people are getting exactly what they want.

Scared people demand their government does something to address the issue. One of the things the government can do is to give the terrorists what they want. It can work, if other solutions are too costly.[1]

1 - https://en.wikipedia.org/wiki/1989_California_medfly_attack

The goal of terrorism isn't to scare people it is to scare the other side into doing what they want. The terrorists themselves are little more than foot soldiers in guerrilla warfare. There job is to have maximum impact with minimal force. Example, the LTTE in Sri Lanka, with a much smaller force 30k vs 150k, was able to inflict an equally high loss to the Sri Lankan Army 27k vs 23k casualties. They were the originators of suicide attacks and use it devastatingly. There goal was an independent, Tamil state.

You won't find "scare" as the objective for any terrorist. After 9/11 OBL made a statement on their attacks and what he hoped would happen. He also included his long, rambling list of objectives AQ was after.

But if this is calculated surely it doesn't work at all?

Why would any country say, "Oh hey so those 12 civilians your foot soldiers just killed with that truck attack in Berlin really got us thinking. So anyhoo what do you want we'll gift you whatever. We know you don't celebrate it but consider it our Christmas gift. Merry Christmas. :)"

I mean who reacts that way? It seems the stupidest possible way to accomplish anyone's goals of any kind. It just seems like a much worse form of pointless trolling, except with real casualties. It just gets a rise out of people.

So I essentially don't get the cause and effect that you seem to describe. It just seems like a bunch of trolls, not actual people meeting actual political goals. It seems stupid and unconstructive. We know there are stupid and unconstructive Internet places (thankfully Hacker News isn't one of them) - so isn't it just the same thing on a much larger level? Just toxic stuff?

Is it logical to give in? No, especially not if you're a capable government.

Is it illogical that someone would react that way though? Not at all. Here is the logic: "Someone killed people in my country. I like people in my country. I happen to be a leader for my country. I'm responsible for their protection. I should prevent more people dying. Why are they dying? People are killing them. How do I make them stop? Give them what they want? What is it they want (now listening to them)?" etc.

This is why there is a "we will not negotiate with terrorists" rule. If not for that rule I think it'd work pretty well.

It worked against the French in the Algerian war. It worked against the British in the creation of modern Israel. The US is out of Iraq because of sustained terrorists attacks after "Missions Accomplished"

The point of those attacks in western countries is to force their hand and make them withdraw their occupying forces. To rethink their foreign policy and make sure they don't see it as worth it anymore.

The biggest hawks were for the Iraq War before they were against. Then the troop body count was getting higher from sniper and IED attacks. A few years later a new president and electorate doesn't see the cost as worth staying and the withdrawal occurs. Terrorists mission accomplished!

I'll add that under the current definition of terrorism, the Sons of Liberty would be classified as a terrorist organization as well, given some of their violent acts / economic terrorism.

The colonial forces largely employed guerrilla tactics as well, out of necessity when facing a larger, better financed and trained British army. https://en.wikipedia.org/wiki/Asymmetric_warfare#American_Re...

If the goal of terrorist organizations was to kill the most people, they would target critical infrastructure, like drinking water reservoirs or perhaps air traffic control towers, if they have a thing for airplanes.

They will say they are trying to kill people to help their cause, but it's more likely that they operate as any other 'business'. They try to impress the 'investors' (e.g. Wahhabis with oil money), so they can get more resources and expand into other 'markets'.

Because the goal (or rather the means) of terrorists is to scare people. And it's much scarier to imagine your plane being blown up in the air.

Reason has nothing to do with it. The number of deaths due to car accidents, even falling down the stairs, is much greater. The main impact of terrorism is the irrational fear, not the rational risk aversion. But it's much easier to stamp out terrorism by force, hard as that may be, than to convert human beings into rational animals.

The goal of terrorists is to achieve power through violence. The gold standard would be the PLO, now the PA. The ANC also did extremely well with this strategy.

There are two effective ways to combat terrorism. One is to surrender to the terrorists. Neither the PLO, nor the ANC, nor the IRA, is setting off any bombs these days. Works great especially if surrounded by a cloud of euphemisms.

The other is to treat the terrorism as an isolated incident and counterattack on the political front. Consider the response to Timothy McVeigh or especially Dylann Roof -- textbook. Great stuff, America still knows how to do it.

If terrorism is committed in the name of the Confederate flag, ban the Confederate flag and crack down on white nationalists everywhere. Even the peaceful ones. Especially the peaceful ones. No one ever said that the best way to defeat racist terrorism is to satisfy the legitimate grievances of moderate racists. But if the USG adopted this strategy, the GOP would probably grow a "militant wing" in well under a decade...

The real error is that it assumes the primary role of TSA screening is to prevent attacks. Looking at the record, their primary job is to catch really stupid drug dealers, drunks, and people subject to federal warrants. That's the vast magority of arrests and is little damaged by pre-screening. Enforcement of terminal drink/food monopolies is just a bonus.

This is security theatre. Trying to apply logic doesnt work. There was a report a few years ago, accidentally leaked, by TSA showing that 911-style hijacking was no longer possible. Nobody with small knives could ever take a cockpit, not with 100 post-911 passengers watching.

My TSA PreCheck experience:

- no removing shoes - never bothered about my computer gear, screwdriver set, razor blades - completely through security in a few minutes

Then I look at the people in he regular line while waiting for my friend and see everyone's personal space being invaded, bags rifled through, electronics and cables strewn about, harassed over the stupidest items

It's a joke. PreCheck is proof they aren't serious about security. Anyone could pay the $75 and walk through with dangerous items.

That said, I'll gladly continue to use PreCheck because if someone wants to attack an airport they'll attack the long security line which I won't be stuck in.

So it looks like what we're building here is the beginnings of a travel tax. If the "service" they're providing isn't necessary - and indeed, PreCheck is really just a protection racket, where you pay them to avoid the shakedown - then what else can we call it?

And by going along with it, we're really just buttressing the whole TSA program. When there's revenue being generated they'll never let it go. (yes, I know that the net is overwhelmingly negative, but when that's just looked at as a jobs program for barely-skilled workers, it's easy to write that off and focus on the income)

It was already a protection racket, just used against your taxpayer money. Now it will also tax travelers. "Win-win" for the racketeers.

And now you get to hand over biometrics to them for the privilege. It's a win-win-win!

Fingerprints for PreCheck, but if you sign up for Clear they also get your retina scan. Clear isn't gov't, but in sure they share data.

Not sure what is required for Global Entry

I personally don't buy into pre-check because I know how artificial scarcity works. It's not about being safer, it's about inconveniencing those that don't want to wait in the "slow line" enough to make them pay for it.

> So it looks like what we're building here is the beginnings of a travel tax

We already have a travel tax, every airline ticket you buy you pay 5.60 per one-way flight directly to the TSA. It was never about security, the TSA is a government funded employment program.

But isn't the point of signing up for pre-check that you give away your fingerprints and extra identifiable information and let the government run a security threat profile check on you to determine the risk factor for you?

Or, are you saying it's easy to forge the TSA-pre check for people to get through it?

we live in amazing times. now you can simply read the article and find out!

you are already paying a tsa fee on each ticket. and you not only accept the crappy and ineffective service you paid for, but you pay extra just to not be subject to what you paid for in the first place.

you are a genius!

California should try this model for the next drought.

I always took the precheck to be a clever setup for a useless organization. They have the completing concerns that they both need to A) screen enough people that our looks like they're doing something and, B) minimize inconveniencing the kind of people that Representatives actually listen to. By adding that fee to skip the line, they add a de facto class distinction on who gets screened.

Only minor differences. Your carryons are still xrayed and yout body scanned. The shoes and belts were obsessive.

Thankfully, Amex Platinum benefits include a credit for Global Entry which automatically gets you TSA Pre-Check, so I've been whizzing through border patrol and TSA for a long time now. Unfortunately, it's a protection racket that requires participants to turn over their fingerprints into a national database, so it has all sorts of ethical and philosophical murkiness around it. In the end though, if you're traveling for business its one of those things you can't afford not to have because of how stupid the process for regular joes is.

As a frequent traveler I can only agree with Bruce's conclusion here. TSA Pre-check is a failure, not because it doesn't provide enough security, but because the existing process for regular travelers is completely pointless. As any frequent traveler is already fully aware, the TSA is a big joke, and going back more or less to how we did airport security pre-9/11 with the better scanning technology is more than good enough for the realistic threat level and would greatly reduce traveler stress and increase airport throughput. The TSA is failed jobs program which has threatened the civil liberties of the average traveler for no gain whatsoever in national security. It's time to cut it back to something realistic.

TSA pre-check is actually a good honeypot for finding bad people. Regular TSA is a joke, so having these people skip it is fine. But coming up with a shortened list including most evil doers is golden.

I'm sure they scrutinize the heck out of anyone that's trying to avoid detection.

Someone that doesn't think it's worth paying the $85 fee for PreCheck is now an "evildoer"? There are a lot of people in this country that fly very rarely and for whom $85 is a lot of money.

Not agreeing with them, but you misread what they said. They said that PreCheck itself was a self-selecting list of "evildoers" (i.e. the only people who pay for it are up to no good).

As I said, I don't agree, but that's what they posted.

To clarify, I meant that vast majority of evil doers would pay $85 for less screening (alongside a lot of normal people).

While doing thorough background checks on all travelers is an impossible task, it might possible to do thorough checks on all Pre-Check members. This could be worth it for the TSA, even if 99% of PreCheck members are good.

I read it that way at first, but then went the other way because it makes no sense -- there's so little difference in screening between lines, why would a terrorist invite more scrutiny months before they are ready to act?

Besides, an organized terrorist cell is not going to bring their bomb through security anyway, they are going to bring it in on a catering truck or one of the other thousand service vehicles that enter the poorly secured airport perimeter every day. There's no way to "body scan" a truck.

"There's no way to "body scan" a truck."

I've seen something similar on a show in the past and found this clip: https://www.youtube.com/watch?v=rPfUSPVH6oQ

Up for debate is how reliable these scanners are.

I signed up for TSA PreCheck recently and have taken 3 trips with it so far, all to different locations. One thing that has stood out to me is that the security agents that check IDs REALLY check ID's. There's a notable difference in the length of time and scrutiny they put into it, and some even asked follow up questions like where I was born and where I was going, which just about never happens in regular security.

It made me think that they were maybe taking advantage of the lower volume and lower stress environment and using behavior based analysis like the Israeli's (http://www.telegraph.co.uk/news/2016/05/20/israels-risk-base...)

> some even asked follow up questions like where I was born

Why? Your ID doesn't have that information.

I'd guess the parent has a "weird" last name. My significant other appears "white" but has an Arabic last name and is frequently asked these kinds of questions.

Passports do.

To see if you hesitate.

like others have said, I assume it's a combination of my hispanic last name and as a general interview technique to see how I react.

I have also had PreCheck for many years, and have not noticed this. In fact, when the regular lines are long, they just bring people out of those lines and into the PreCheck lines. The big kicker is that they have PreCheck at SFO, whose security isn't even run by the TSA. It's just some random private company.

PreCheck is basically the government admitting that nobody is interested in blowing up planes and that it's not worth the effort to thoroughly screen people (which they do not do in the regular lines either). Heart disease or a car accident is what's going to kill you. There will always be terrorist attacks. They don't matter in aggregate.

Earlier this summer when I flew from West to East coasts in the US I was bumped out of the main TSA line for my ID not matching my ticket. I never use my real first name, but it's still on my ID. In the years since 9/11, this is the first time I've been pulled aside.

I had to show 2 more IDs with the name on my ticket, which I had. I was traveling with a 15 yr old and wife.

To me, the base assumption that the TSA has anything to do with security is just wrong. The TSA did the following.

1. It let the people feel better post 911

2. It created low skill minimum wage jobs to boost employment numbers.

3. It increased Gov. control over traveling with increased internal data on the movement of legitimate citizens.

4.surved to create the most intricate theater around.

The only thing that, since 911 has stopped anything, has been onboard citizen action and stronger doors to the cockpit.

Regrettably we found that the doors are as sturdy as promised in the real world last year with the suicide of that German pilot.

Allow liquids to stay in the carry-on since TSA scanners can detect threat liquids.

Wait a minute - is Hawley admitting here that the whole thing with throwing out all liquids before entering is a sham? Does anyone have more information on this?

Anyone who has traveled with a baby knows they can easily scan liquids inside the bag (e.g. formula and a gallon of distilled water). There is no need to even put them in a separate plastic bag. Sometimes they do a bomb residue test, however.

I suspect throwing out liquids was a scam to sell you more drinks at higher prices after the checkpoint.

I travelled through the US from Mexico to Europe last year. Bought a nice bottle of Mezcal at the airport in Mexico, had it in a sealed bag to enable travel. TSA agent didn't trust the travel seal, so he took it out of the bag, scanned bottle with some cotton swabs put into a device (my guess is HPLC), it was OK so he re-sealed my bag with TSA tape so I could carry it on multiple flights in Europe.

According to TSA PreCheck page[1] the same liquid limitations still apply, you just don't have to put them on the belt. I don't think this is about them being able to detect the threat liquids.

For the security checkpoint throughput it is important to avoid having to stop people and dig into their bags. I believe the reason for picking the liquids out of bag is just to make it faster for the security person to check you are not carrying too much. For PreCheck flyers this is not needed, since most of them are seasoned travelers and now the limits.

[1] https://www.tsa.gov/precheck

Pre-Check is nothing but a fund-raising scheme by the TSA. They have an incentive to further slow down the usual screening lanes, so more people will buy into PreCheck! How is this not a bad incentive??

Potential acts of terror stopped at the checkpoint by the TSA since 2001: 0

---Edit---

Knitting needles confiscated and grannies fondled: Classified as it pertains to Homeland Security

It's there a source for this? I find it hard to believe that some idiot hadn't tried to bring something onboard in the past 15 years.

They have and they succeeded, the shoe bomber guy and the guy who set his scrotum on fire.

How is the shoe-bomber-guy a TSA success story?

He's not. Those two are really the only AQ tied incidents since 9/11 and they waltzed right past the TSA.

FWIW the shoe-bomber boarded his flight in Paris. Hard to blame the TSA for not stopping him.

People have forgotten guns and knives in their luggage that TSA has confiscated, and TSA proudly advertises those numbers. What is noticeably absent is information about any attacks TSA has thwarted. Of course it's possible some attacks have been prevented by deterrence but I doubt that as TSA has a 95℅ failure rate detecting explosives and other weapons[1].

[1] http://www.nbcnews.com/news/us-news/investigation-breaches-u...

Slate has another article from 2010 you might enjoy http://www.slate.com/articles/news_and_politics/explainer/20...

I don't get why we hold TSA to a higher standard than what they are: security guards.

Security guards don't go trumpeting how many bank robberies they've thwarted, because they simply don't know.

However, they will tell you about all the contraband they've confiscated simply because that's measurable.

The TSA has to justify its obscene budget and perpetual scandal.

Their justification is that they stop hundreds of bits of contraband (of which they control the definition) daily in the ongoing war on terror.

No actually when the department of Homeland security conducted an undercover test, TSA detected the whopping number of 3 undercover agents...

They failed to detect the other 67 who were able to embark planes with weapons end explosives[0]. But that's just a detail... You know, these agents were instructed to avoid TSA screening. Who trains to do that in the real world, right? [sarcasm]

[0] http://abcnews.go.com/US/exclusive-undercover-dhs-tests-find...

Idiots bringing things on planes, by accident or on purpose, doesn't make them terrorists.

Unfortunately, we don't know how many attacks were not even attempted because of the existence and actions of the TSA. Them merely being there and doing these checks in these ways may very well have stopped many attempts to smuggle things on board.

A person with truly bad intentions would just set off his demo kit in line at the checkpoint.

Pick the right time and you get a few hundred casualties and shutdown US air travel for a few days.

Reminds me of the Tiger preventing rock from an old Simpsons episode - if you don't see any tigers, it must be working :)

Surely if terrorists had wanted to undertake an airline attack and were put off by the TSA presence, they would simply have hit an easier target? There are plenty of public spaces with a lot of people around, malls etc, or even inside the airport itself?

The fact that we don't see attacks is surely more likely to mean that there just aren't many such people on US soil with the means and motive?

I find it difficult to believe that the bureaucrats that came up with this couldn't recognize the gaping hole and inconvenience that TSA PreCheck is. This could be interpreted as some acknowledgement of the security theater they're putting on, indicative of poor management/internal lack of faith at the TSA, or some combination of both.

As an aside - I've never had the opportunity to rant about this before - the Dane County Regional Airport is laid out in such a way that there are two escalators that go up to the security checkpoints on the upper level, one on each side of the ticketing counters. One is TSA PreCheck, the other is not (yes, entirely 1/2 of the locations they have available are TSA PreCheck, and there are always lines at the other side). The signage is very poor and many, many people end up going to the PreCheck side, get turned away, and then need to walk 10 minutes to the other side of the airport to go through the regular lane. Of course this could be avoided if you enroll in that program, but for people who travel by plane infrequently, the cost/benefit ratio just isn't there.

Oh, come on. 10 minutes? BS. If you're shuffling behind a walker, dragging unwheeled luggage, and have to stop and take a dump in the men's room, maybe that's 10 at most. Any able adult can walk that stretch in Madison's tiny little femto-airport in a couple of minutes. It's not even a long frisbee toss.

(I had to live there for six years and got to know those dozen horrible bus-station-ish gates all too well.)

>> Timothy McVeigh was an upstanding US citizen before he blew up the Oklahoma City Federal Building

He was a paranoid, transient psychopath, anti-government activist, with more emotional and psychological problems than you could shake a stick at. He would be on all kinds of lists today.

And, to pick another lone wolf, which lists might Brevik be on if he were at-large today?

Would he?

I mean, the people that blew up the airport in France had formal training at the Al'Qaeda camps. The guy that tried to explode his underwear had most of those traits, and his father calling the authorities on him before the event.

It shouldn't be hard for a police force to keep control of everybody that gets enough tools to make a bomb that passes the older airport scanners. Instead, we get the government reading our email and that joke of security.

> What the Trusted Traveler program does is create two different access paths into the airport: high security and low security

They're both low security. PreCheck just admits that and creates a low-hassle, low-volume lane.

It’s so strange to read a TSA person make some reasonable criticisms on the one hand, and to then come up with ridiculous proposals such as adding REMOVAL OF SHOES to the pre-check lane?!? Heck, removal of shoes and other items is probably 75% of the entire travel delay (they should just sit there for a few minutes and watch people stumbling around).

Just about the only sensible measure at this point is to return to a bullshit-rules list of length zero, and just say “right this way, please”.

I just don't get how the TSA manages to be so much worse than other country's border checks. Its like they've made it their mission in life to be as much of a pain as possible.

FWIW, Munich is just as bad as major American airports, or at least it was this past September.

Edinburg and Dublin both seem to be doing it well. Minimal hassle. Plus, the US "border" check in Dublin is smoother than (non-pre-screened) checks at IAD.

The US checkpoint in Sydney didn't strike me as too bad, especially considering they have to process an A380-load all at once.

Auckland is just terrible though. You get off a plane from the US and they put you through an undersized security chokepoint before allowing you to move to another terminal.

>FWIW, Munich is just as bad as major American airports, or at least it was this past September.

Strange - I was in Munich during September as well - Oktoberfest. You could see security staff was a little on edge but was fine otherwise. Just the usual strip everything metal & go through scanner.

I've spoken to a few people who work for dod/dia et al as it relates to DHS/TSA. They say they employ 3 types of people: 1) those that need a job and don't care 2) those that like having authority over others but couldn't cut it in other jobs, and 3) those with bad grades, bad pedigree, etc who are trying to work their way up DHS and transfer to another agency from within.

So pretty much the kind of people you wouldn't want to interact with. Wonderful.

One thing I've noticed recently at SEA is that there appears to be some sort of privatized PreCheck. I've had some guy come around with brochures for the company offering minimal lines/waiting to get through security if you signup for whatever the program is. Unfortunately, I'm having a hard time finding the company online.

These guys https://www.clearme.com/ ? Seems weird to me, and quite expensive for what they offer...

Maybe next adminstration will introduce profiling, which seems an absurbs oversight after spending tens of billions on security, not to mention the time cost. Yoing Arab men should get more ecrutiny than old ladies in wheel chairs.

schneier is discounting the possibility that terrorists hate standing on lines.

TSA seems like a government make-work project.

Not that there's necessarily anything wrong with make-work; but surely it could be accomplished without an accompanying make-miserable?

If you're planning to spend money on make-work, then you might as well make a go at basic income. But in fact there's plenty of real work that could usefully be done instead. Fixing some of that crumbling infrastructure, perhaps?

...this is just grousing. None of us disagree, and nothing we say here will help. sigh

I wouldn't want TSA employees reallocated towards rebuilding our bridges and tunnels. That would cause extreme anxiety for me, at the very least.

It is funny how HN comes across as both pro basic income and anti government jobs programs.

It's almost as if different people have different opinions. If anything, that's a great reason to read HN :)

Why's that funny? Jobs programs and basic income are completely different animals.

I'm sure many people take issue with the various externalities associated with job programs, e.g. In this case making all of our lives more difficult and wasting our time while travelling. If we simply gave all TSA employees a basic income and told them to stay out of the way (i.e., fired them) the end goal of giving them money would be achieved but without the additional drain on everyone else's resources.

Paying people is acceptable.

Paying people to make me miserable is not acceptable.

Basic income doesn't hassle me at the airport for no discernible reason

Reply on news.ycombinator.com