Hacker News Reader

Comment by LukaAl | Hacker News Reader

The problem with this article is that it fails to recognize the real threat model. The objective of a terrorist is not to blow up a plane, it is to scary people and do this by killing and injuring the highest number of people while minimizing the risk of being detected.

If this is the threat model, why a rational terrorist should try to put the bomb on a plane? The Brussel Terror Attack has shown exactly this[0]. Terrorist killing themselves at the check-in counter (but they could have chosen the security lanes).

Obviously, we need airport security because the threat model is not only terrorists but also hijackers and smugglers (and non-rational terrorists?). Obviously, the risk of using the hijacked plane as a bomb, like in 11/9 is still a risk, but other measures like reinforced cabin doors are more effective for that.

So, basically, the TSA is a failure in making people safer and but a huge success in making traveler life miserable. TSA Pre-Check is nothing but them keeping on with their "good work".

[0] https://en.wikipedia.org/wiki/2016_Brussels_bombings#Brussel...

View on HN

If you want an even better example, try the Istanbul attack:

https://en.wikipedia.org/wiki/2016_Atat%C3%BCrk_Airport_atta...

3 Terrorists total. The attack went as follows : 2 terrorists queue up in an Xray machine line, and suddenly start shooting people. One of the terrorists is shot down and a few seconds later he detonated a suicide vest.

What does an airport security line do at that point ? Well, of course it fails open. Security abandoned their posts and none of the security guards responded for minutes to the second attacker in the line walking around and shooting people. He walked right through, got on an escalator and continued shooting people for ~2 minutes. Eventually a security officer (one wandering around by himself, not identified) shot him from a distance, looked up close at the attacker, and ran away (the terrorist exploded shortly after that, I hope the guy made it out). A third terrorist blew himself up in what was essentially a security pre-check line outside the airport.

Any chokepoint, of course, is a terrorist target at an airport. I've been to Istanbul airport. It's big, but not that big. In this attack 45 people died and 230 were wounded. There are plenty of far bigger airports where that number would have been way up. Thankfully I do think security personnel would not just immediately abandon their posts in the US when something like this happens.

That of course means that TSA makes things worse in some ways and provides a target for terrorists unless they avoid making lines. Heh. "Somehow" that doesn't seem to be the conclusion they're drawing from this. In fact I am unaware of any official responses to these attacks.

> Thankfully I do think security personnel would not just immediately abandon their posts in the US when something like this happens.

I hope you don't mean the unarmed minimally trained TSA staff that earn next to minimum wage. I highly doubt they'll protect you over themselves. Hell, many of them are obese (this is America) and physically unable to engage in such a scenario.

The ones who idley stood by while that guy attacked people with a machete last year?

To be fair they don't even have non-lethal armaments, but it does again point to how useless the operation is in the face of a person who isn't just mad because their flight is delayed.

Core problem: how do you measure effectiveness of deterrent methods. Actual or avoided incidents? Feeling of safety of the public? Most likely how happy the insurance companies are afaict

Well us who like the scientific approach would have incrementally added layers to the security onion, but in the real world, that kind of trial and error costs human lives.

Makes testing expensive

The way I heard it, the TSA was created by an accenture proposal. GWB's administration told the airline companies they needed to step up security for people admitted into airports, in response to 9/11. The airlines used the aforementioned proposal to suggest that instead of the airlines paying for individual security, the government do so for everyone, standardized, and pay for it as well. For god knows what reason, the government agreed.

The end result, is the airlines have no desire to improve the process. If you get angry at the security theatre, you think to blame the government, not the airline. The government and DHS has no desire to improve the process, they just want to keep costs down, while simultaneously making sure they are publicly notable to justify their existence.

Want to fix it? What if we: made the airlines pay for and run their own security. And make the DHS audit those security practices, instead of implementing them. Just one of many possible ideas.

> The end result, is the airlines have no desire to improve the process.

That is not entirely true. Delta have spent money to improve the TSA process in Atlanta (I believe mostly by adding automation and more areas for people to unload their belongings) and have also spent money at other airports to relieve TSA congestion.

I work for an airport and have heard many times that the airlines have considerable frustration with the process - it's not uncommon to hear people say that they would rather drive than fly due to the hassle of security. Airlines are usually very aware of lost revenue due to these kinds of factors.

I completely agree re where the blame lays.... my understanding is that the TSA have actually asked for additional funding to have more staff on the lines but Congress has denied this. The TSA is not actually a requirement either - airports can run their own security but my understanding is that they would still require TSA oversight so any cost savings are negligible.

I will only fly my 1h fligth if I am alone. if I have others with me, I always try to convince everyone to drive 6h each way instead.

> my understanding is that the TSA have actually asked for additional funding to have more staff on the lines but Congress has denied this.

This wouldn't help my complaint, fwiw.

My complaint isn't the lines.. i experience long lines all the time, i'm used to it. My problem is this feeling like suddenly, we're all criminals.

We're cattle, on the verge of being violated, and all it will take is a sneeze or an awkward look.[1]

To me, they are like "bad cops". You can meet a good cop and even if you did wrong (speeding ticket/etc), you feel comfortable and at ease (hopefully) around his/her professional attitude and behavior. The bad cops though, they just have this aura of unwarranted power, and you just hope they don't desire to spend some of it on you. That is TSA in the majority of cases to me.

The line isn't the problem for me.

[1]: edit, this isn't true of course, but it's how i feel.

The TSA is the closest I've felt like basic training since I've left the military.

All of Congress no doubt use PreCheck or Clear or equivalent to spend as little time as possible in lines. If it were a level playing field, rather than thinking it's valid to buy trust as if it's a product to sell, I'm convinced we'd see improvements however incremental.

> Airlines are usually very aware of lost revenue due to these kinds of factors

Good to know. My own point at which airlines are worth the hassle has increased from a 6 hour one-way drive to 14 since the security "improvements" began. Which means that I'm regularly spending ~6-8 additional hours on the road simply to avoid an ~2 hours of airport security unpleasantness[1]. Driving > 6hrs generally costs more too. And it's still worth it to avoid the security process.

[1] even better - once through security I can look forward to a cramped, unpleasant experience for the duration of the flight (6'2" guarantees miserable - the $20/inch of legroom option notwithstanding).

If the government is setting the requirements and doing the implementation then it would seem appropriate to blame them.

> The end result, is the airlines have no desire to improve the process.

Airlines are competing against other forms of travel (I, for example, mostly just drive everywhere I can these days, though this is only in part due to the TSA checkpoints: there's tons of stuff to hate about air travel if you can avoid it) and travel as a concept is competing against other activities (whether leisure or business: if you don't enjoy travel, you are less likely to just randomly hop on a plane and go somewhere; you take more phone calls and watch more television).

Airports are also competing against other airports, and usage of TSA employees is optional: when I was still bothering to fly in and out of the Bay Area I chose SFO over SJC because I preferred the private SFO security guard over real TSA employees. The incentives might be mild (as again, there are tons of other things for them to optimize), but they definitely do exist; if nothing else, "correctly optimize the number of employees to manage long lines" seems like a big win.

https://skift.com/2016/05/27/more-airports-may-ditch-the-tsa...

> Still, airports that have switched to private firms say they consider the contractors more responsive and better able to adjust staffing to address traffic surges and lulls.

> Delta and United airlines will spend as much as $4 million each hiring extra workers to manage the lines at this busiest airports.

>when I was still bothering to fly in and out of the Bay Area I chose SFO over SJC because I preferred the private SFO security guard over real TSA employees.

This seems crazy to me - the security line at SJC takes about four minutes to get through and you can park about a hundred feet away from the checkpoint. SFO takes FOREVER to get through.

The choke points are definitely an issue at airports but also at sporting events, where masses of hundreds of people are crowded around a gate getting in to the stadium.

I think they need to setup a maze system where passengers/fans queue in to a system where can be scanned as they go through and directed to lower and higher risk areas something bullet/blast resistant where people can be physically isolated from each other (and from gaining access) as they pass through security and everyone can be locked down (or automatically directed to exit the facility) if an event happens so there isn't a free run through security. And make it large enough where people can get in to the system quickly so you don't have large groups of people standing waiting outside. Something with lots of angled areas as you enter and get you isolated, scanned directed in to the facility or over to higher security area for further processing.

You can't engineer away this problem. Too many places humans gather in large numbers. This is just throwing away money.

Can every church and store and mall and stadium in the world do this? If not it won't do anything. And if so, then we move on to other ways.

Calling most TSA workers "security personnel" is fundamentally inaccurate. They aren't hired to provide security; they're hired to organize queues and identity things in X-ray scans.

This has been the thing that always confuses me about the TSA. They create bottle necks that essentially concentrate people to a small area. Forget a major airport like LAX or LaGuardia, medium sized airports have more people in those lines than on a flight. If the threat level was anywhere above basically nil this would have to change. Plus if you want to get in it's easier to fly a small plane in. All I can think is that TSA in its current form has caused more danger than it has prevented. It's security theater if red team almost always wins.

The bottleneck being a top target is the elephant in the room, that's why they don't mention it. And it's a grossly classist system that makes most people sitting ducks by virtue of being in that line much longer, than people who are willing to pay to be trusted more and spend less time in line.

If the goal of terrorist organizations was to kill the most people, they would target critical infrastructure, like drinking water reservoirs or perhaps air traffic control towers, if they have a thing for airplanes.

They will say they are trying to kill people to help their cause, but it's more likely that they operate as any other 'business'. They try to impress the 'investors' (e.g. Wahhabis with oil money), so they can get more resources and expand into other 'markets'.

The real error is that it assumes the primary role of TSA screening is to prevent attacks. Looking at the record, their primary job is to catch really stupid drug dealers, drunks, and people subject to federal warrants. That's the vast magority of arrests and is little damaged by pre-screening. Enforcement of terminal drink/food monopolies is just a bonus.

This is security theatre. Trying to apply logic doesnt work. There was a report a few years ago, accidentally leaked, by TSA showing that 911-style hijacking was no longer possible. Nobody with small knives could ever take a cockpit, not with 100 post-911 passengers watching.

I've been very critical of the TSA, but if (since) that's the threat model, that actually highlights the benefit of security theater. As Schneier points out, there are essentially no terrorists. It's like trying to find a needle in a haystack, and it's arguably better to just let the needle go through than to screw up all the hay.

But if the terrorists are mainly just causing fear instead of harm, doesn't it make sense to counter it by making people feel safer instead of actually making them safer, especially if you practically can't do the latter?

Food for thought...

I thought about that. But if finding a terrorist is like trying to find a needle in the haystack, Schneier suggestion (as well as any other expert in security will tell you), the best solution is truly random search. If it is truly random, the terrorists have no way to predict if they will be checked and if it is frequent enough, it will be sufficient to change their behavior.

As for the point of sense of safety vs. real safety (impossible) is a well taken one. But this false safety could be dispensed with much lower costs for the citizens (both in terms of money and inconvenience).

> random search

Or in other words, ignore concerns about profiling and implement an Israeli style security operation.

I think it has a lot to be said for it. Profiling + politeness + a firm boundary on mandate (e.g. no drug convictions by airport security) doesn't seem that bad. Especially compared to what amounts to the same thing except with a vast security army of more poorly trained agents.

Ethnically profiling selection without ethnically profiling assumption isn't a nuance I'd trust the average TSA agent to perform well.

I think by "truly random" he means uniformly random, i.e. the exact opposite of profiling.

Racial profiling is the opposite of a random search.

If we want to be technical, it's a weighted random search based on historical observations.

It would be the exact opposite if 100% of the ethnically profiled individuals were terrorists.

Well the Israelis profile single white european women in their 20's and 30's as one of the highest risk threat actors because historically they are been the ones that knowingly or unknowingly been used to smuggle munitions or explosives pass security.

Being brown skinned an arab or a muslim isn't what would put you on top of their threat ranking.

>If it is truly random, the terrorists have no way to predict if they will be checked and if it is frequent enough, it will be sufficient to change their behavior.

If we are talking about suicide bombings, I don't see how this changes anything. If they don't get through, they will just blow themselves up as soon as they get randomly selected.

Agreed. To reinforce the comment I just made above to the parent. Someone willing to blow him/her self up will take any odds pretty much, and then kill whoever he can in the line once he/she is selected. I guess some kind of protocol can isolate individuals from the rest while the decision of being selected or not is made? that could just slow things down anyways though, so not sure how would something like that would look like.

I'm curious on your reasoning here. What makes you think truly random search will be sufficient to change their behaviour? frequent enough means not always, hence, they can simply send multiple parties and then odds might be good enough that not all of them will be caught by the random search (again, depends on the frequency of search you left undetermined). What kind of odds do you think will stop a person willing to blow him/herself up?

To be fair to the TSA, they have requested that they are armed.

I said this the moment TSA was created. "Wow fedgov! Thanks! You just made my job as a terrorist exponentially easier! Now instead of having to get through security to get on a plane and blow it up, you corralled all the people on multiple flights into a single file line in one place for me before security. Thanks! Now I can wait in line with my bomb on my body until I'm the next one to go through the scanners, then detonate as o take my shoe off. Taking out the security checkpoint, all your useless equipment, TSA personnel, and innocents. Thanks!"

I love how the receiving end's security works as well. You stuff everybody into a big room, hot, humid, badly ventilated (presumably that was the local climate, but still). You mix everyone from everywhere, and make them wait in line for hours, VERY close to one another. Breathing on eachother. Some passengers obviously ill, coughing and sneezing. You make everyone stand around like this for hours.

The video playing ? "we are working so you won't get hit by diseases"

There must be some real sadists working at government airport regulators.

and to add insult, everyone will die barefoot while the dammed terrorist can have their shoes on still.

Now I can wait in line with my bomb on my body...

No need to carry around all of that extra bulk and weight on your body when when you can pack it into a wheeled carryon bag. You don't even need to keep it under carryon size since the airlines don't (usually) screen for size until you get to the gate.

Why not go for broke and do both?

It seems harder to be inconspicuous with 40 lbs of explosives taped to your body than to wheel it around in a carry-on bag.

Have you seen the size of the average American? Throw on a staypuff marshmallow parka and you'd look like 40% of travelers this past week

Sure, you won't look larger than the average American, but they grew that size over months or years and move naturally with the extra weight.

Strap on 20 - 40 lbs of extra weight and you won't move naturally anymore, at least without lots of training.

If your goal is just to kill as many people as possible (rather than, e.g., needing the plane for smuggling or hijacking), surely there are enough events where people are packed together that it could be done with or without TSA lines? Take any music event for instance - the standing area will be packed, and security will be minimal if any (last time I went to Wembley Arena the bag search was pointless - I had a jacket in mine that completely obscured the bag contents, and there could easily have been an explosive device concealed below. FWIW, this was only a few months after the Bataclan attack, and the venue had specifically said to arrive early due to increased security).

The security lines are definitely a softer target than needing to get on the plane, but soft targets are easy to find anyway.

Because the goal (or rather the means) of terrorists is to scare people. And it's much scarier to imagine your plane being blown up in the air.

Reason has nothing to do with it. The number of deaths due to car accidents, even falling down the stairs, is much greater. The main impact of terrorism is the irrational fear, not the rational risk aversion. But it's much easier to stamp out terrorism by force, hard as that may be, than to convert human beings into rational animals.

The goal of terrorists is to achieve power through violence. The gold standard would be the PLO, now the PA. The ANC also did extremely well with this strategy.

There are two effective ways to combat terrorism. One is to surrender to the terrorists. Neither the PLO, nor the ANC, nor the IRA, is setting off any bombs these days. Works great especially if surrounded by a cloud of euphemisms.

The other is to treat the terrorism as an isolated incident and counterattack on the political front. Consider the response to Timothy McVeigh or especially Dylann Roof -- textbook. Great stuff, America still knows how to do it.

If terrorism is committed in the name of the Confederate flag, ban the Confederate flag and crack down on white nationalists everywhere. Even the peaceful ones. Especially the peaceful ones. No one ever said that the best way to defeat racist terrorism is to satisfy the legitimate grievances of moderate racists. But if the USG adopted this strategy, the GOP would probably grow a "militant wing" in well under a decade...

>The objective of a terrorist is not to blow up a plane, it is to scare people and do this by killing and injuring the highest number of people while minimizing the risk of being detected.

Let's talk about this.

What kind of objective is this? For insight into the psychology of terrorists can I consider the psychology of "trolls"? (i.e. mostly harmless Internet trolls). Or people just generally trying to wreak havoc "for the lolz"?

Or is it different? What I mean is that people like Chomsky accuse the United States of being "terrorists" in whenever he thinks the United States meets some technical definition -- but the United States has some kind of political goals and it's not an end in itself to just have a bunch of people "scared" or "killed and injured". The U.S. doesn't say, "hey could we scare a billion people!! Yeah let's do it!!" Which is precisely what you quoted as the terrorist's objective: "it is to scare people".

So what is the actual motivation of terrorists? Why is it motivating to "scare people"? (For the same reason as trolls are motivated?) Some people ascribe religious motivations for it, but I read through the Koran (you can read it easily here[1], it should take you under an hour, it's very repetitive. Copied into a Word document in 10-point single-spaced font it's 180 pages but you can scroll through it very quickly) and I did not once see anything like "Thou shalt scare people" or "Thou shalt wreak havoc by killing and injuring the highest number of people." I searched for "scare" and did not see that word. So in effect I don't understand why you say the primary rational objective of terrorists is to scare people.

It doesn't really make sense unless it's the same as Internet trolls. I'd like more insight.

[1] http://www.archive.org/stream/thekoranalquran02800gut/koran1...

If you want to get it down to 181 pages to read quickly 1) open the above link 2) select all of it and copy it 3) In word select 10-point font, single (1.0 spacing), 3) paste it into word using the Paste dropdown button in the ribbon, to paste as text only which is the third dropdown option (alternatively you could paste it into some plain text editor and then select all and copy it again and then paste it into Word or I guess since it's .txt you could just download it). This will just paste the text but have a bunch of extraneous line breaks. Next do a search and replace for every instance of "^p" (without the quotes, which means new paragraph) with nothing or even better as a single space (since replaced with nothing, some words run together but this didn't bother me). this will substantially reduce the thing. If you did the single-spacing right you will get 181 dense but highly repepetitive and readable pages of the Qu'ran. I next used the scroll wheel (by pressing down on it) to begin scrolling through all of it and attempted to alight my eyes on each section enough to read it "at a glance" (like speed reading.)

At 24 seconds per page (I timed it and this is what I considered a readable scroll speed) the whole thing should take you about 1 hour 16 minutes. I encourage you to do it! Just focus. Stop if you really need to focus on something.

I read War and Peace this way. It's about some Russians. (I'm kidding, this last part is a woody allen joke.)

I don't see why the Koran (quran, cough cough) should tell you something about terrorism. It is the Muslim's holy book, not the terrorist's holy book.

For my discussion, I simply used the Merriam-Webster dictionary[0]. It says "the systematic use of terror especially as a means of coercion". You are correct, their final objective is not to just scare people but to get something else. But I believe the immediate objective of the terror action is to scare people so to get to their final objective.

[0] https://www.merriam-webster.com/dictionary/terrorism

>the immediate objective of the terror action is to scare people so to get to their final objective.

I would like to understand this train of thinking because I don't see any consequence to scaring people. Online trolls don't accomplish any larger objective, for example. What do terrorists have in mind?

I am inclined to just think of them as trolls.

- prod US (and friends) into ongoing military engagements in the middle east

- foster Islamophobic sentiments in neighboring regions

- destabilize local power structures

these people are getting exactly what they want.

Scared people demand their government does something to address the issue. One of the things the government can do is to give the terrorists what they want. It can work, if other solutions are too costly.[1]

1 - https://en.wikipedia.org/wiki/1989_California_medfly_attack

The goal of terrorism isn't to scare people it is to scare the other side into doing what they want. The terrorists themselves are little more than foot soldiers in guerrilla warfare. There job is to have maximum impact with minimal force. Example, the LTTE in Sri Lanka, with a much smaller force 30k vs 150k, was able to inflict an equally high loss to the Sri Lankan Army 27k vs 23k casualties. They were the originators of suicide attacks and use it devastatingly. There goal was an independent, Tamil state.

You won't find "scare" as the objective for any terrorist. After 9/11 OBL made a statement on their attacks and what he hoped would happen. He also included his long, rambling list of objectives AQ was after.

But if this is calculated surely it doesn't work at all?

Why would any country say, "Oh hey so those 12 civilians your foot soldiers just killed with that truck attack in Berlin really got us thinking. So anyhoo what do you want we'll gift you whatever. We know you don't celebrate it but consider it our Christmas gift. Merry Christmas. :)"

I mean who reacts that way? It seems the stupidest possible way to accomplish anyone's goals of any kind. It just seems like a much worse form of pointless trolling, except with real casualties. It just gets a rise out of people.

So I essentially don't get the cause and effect that you seem to describe. It just seems like a bunch of trolls, not actual people meeting actual political goals. It seems stupid and unconstructive. We know there are stupid and unconstructive Internet places (thankfully Hacker News isn't one of them) - so isn't it just the same thing on a much larger level? Just toxic stuff?

Is it logical to give in? No, especially not if you're a capable government.

Is it illogical that someone would react that way though? Not at all. Here is the logic: "Someone killed people in my country. I like people in my country. I happen to be a leader for my country. I'm responsible for their protection. I should prevent more people dying. Why are they dying? People are killing them. How do I make them stop? Give them what they want? What is it they want (now listening to them)?" etc.

This is why there is a "we will not negotiate with terrorists" rule. If not for that rule I think it'd work pretty well.

It worked against the French in the Algerian war. It worked against the British in the creation of modern Israel. The US is out of Iraq because of sustained terrorists attacks after "Missions Accomplished"

The point of those attacks in western countries is to force their hand and make them withdraw their occupying forces. To rethink their foreign policy and make sure they don't see it as worth it anymore.

The biggest hawks were for the Iraq War before they were against. Then the troop body count was getting higher from sniper and IED attacks. A few years later a new president and electorate doesn't see the cost as worth staying and the withdrawal occurs. Terrorists mission accomplished!

I'll add that under the current definition of terrorism, the Sons of Liberty would be classified as a terrorist organization as well, given some of their violent acts / economic terrorism.

The colonial forces largely employed guerrilla tactics as well, out of necessity when facing a larger, better financed and trained British army. https://en.wikipedia.org/wiki/Asymmetric_warfare#American_Re...

Reply on news.ycombinator.com