Hacker News Reader

The effectiveness of a security program cannot solely be measured by penetration tests under controlled circumstances. Aspects of deterrence and standardization required by the program fundamentally changes the threat actors’ calculus.

This is the very fundamentals of mixed strategy calculations in game theory.

It is absolutely bonkers how many otherwise pretty reasonable people miss this glaringly obvious fact.

We are all vulnerable to confirmation bias

A common analogy is to think about traffic lights.

If you run a penetration test, asking an individual to run a red light. You will achieve near 100% success.

However, when the traffic lights change actors’ behaviors to stop (at some probability such that it results in less collisions), most actors will stop according to the traffic lights.

That's not a good analogy at all. The incentives and motivations are completely different. Many drivers would at one point or another consider running a red light in order to save some time. I don't think you can say the same about passengers wanting to hijack a flight.

"Aspects of deterrence and standardization required by the program fundamentally changes the threat actors’ calculus."

“By your logic I could claim that this rock keeps tigers away.”

“Oh, how does it work?”

“It doesn’t work.”

“Uh-huh.”

“It’s just a stupid rock.”

“Uh-huh.”

“But I don’t see any tigers around, do you?”

“Lisa, I want to buy your rock.”

Fear will keep the local systems in line. Fear of this battle station.

Do you believe there aren’t people who wish to use air travel for nefarious purposes?

Do you believe that none of those people are factoring in the presence of identity checks, x-rays, backscatters, bomb dogs, and metal detectors into their risk/reward calculation or the techniques by which they’d commit nefarious acts?

They're probably factoring in strengthened cockpit doors and passengers' willingness to fight back, because those actually work. The rest is security theater.

If you are going to resort to “it is because it is”, leave and let someone else argue your side.

And on the opposite side of the stupid-examples spectrum: any tech company that hasn't had a computer security breach should fire their security team. All they're doing is spending a lot of money to make their developer's lives a lot harder.

Anyone with clean floors should fire their janitors.

Etc...

Those don't mean every security spend is worthwhile and justified; but Simpsons quotes also don't mean that no security spend has any effect.

How do you propose measuring the effectiveness of the program?

I was going to suggest comparing it to other developed countries' practices vs their rate of high profile terrorist attacks, but then I realized it correlates the other way. Spain and Italy hustle you through an old-school metal detector, but going into Israel I thought I was about to be beaten down with a rubber truncheon when I forgot the piece of paper I had in my pocket.

China’s is surprisingly easy. Just a metal detector and an X ray of your carry on. Didn’t even take my shoes off.

Singapore’s is the best. The security is right at the gate so the timing is a lot more predictable and you don’t have to worry about missing your flight.

China’s is done as you’re transiting. My luggage was sniffed, my hands wiped for explosive residue, and I was x-rayed, all without having to stop for more than a few seconds.

Yeah, the number of people targeting you matters, too.

Israel’s methods are incredibly interesting and something that you just wouldn’t get away with in the US. I say this as a non-American non-US-resident, which I think is important because my comment sounds like American exceptionalism.

Truth, the primary impact was the ability to arbitrarily inflate the cost of soft goods dramatically inside the terminal.

It's such a good racket Hudson News...a little news stand company inside a few dozen terminals was able to go public on the NYSE...

The public perception that security is "doing it's job" is non-existent since everyone knows it's at best a jobs program and in practice another group of people measurably stealing travellers things.

Hudson News is a brand for its Swiss parent company, Dufry.

Dufry existed prior to the invention of the airplane…

While this is true, the method of 11 September 2001 worked for less than two hours. It is effectively impossible to hijack an airplane now, because the passengers will assume that they're dead either way and will do anything they can to stop you. You can still blow them up a la Lockerbie, but that's about it.

I really don't see a meaningful reason for most of "security screening" anymore. It just slows things down.

True, and even two hours maybe pushing it. The crash in PA on 9/11 was a direct result of passengers attacking the cockpit after they found out what happened to the other planes.

Or being shot down by a fighter jet.

It might be worth doing some reading on the actual events of that day. For example, "being shot down by a fighter jet" wasn't an option; the fighters weren't armed when they were put up in the sky. The pilots in them went up knowing that if a plane needed to be taken out, they were going to be using themselves to do it. And none of that is to mention the passengers the parent comment was referring to, who made the conscious, heroic decision that their plane wasn't going to be used as a weapon like two previous ones had been, whatever the cost.

I don't mean to assume bad faith, but this was, at best, a throwaway comment that minimized the bravery and sacrifice of a lot of good people. Either way, I'd like to recommend you educate yourself a bit more. The Wikipedia page has some excellent detail, and if narrative structure is your thing, the book The Only Plane In The Sky is a masterpiece on the subject.

> weren't armed when they went up

How has this claim been authenticated?

From the government itself? You can listen to unclassified / declassified 9/11-related communications (all over YouTube) and literally hear the conversations happening. The pilots have done interviews. There’s really no questioning it. It’s part of the US being woefully unprepared for 9/11 because it was so left of field. All evidence points to a lot of brave people doing their absolute best, working within a system that didn’t know how to handle the circumstance. That includes not being prepared to take down a commercial airliner at short notice, because why the hell would anyone ever need to do that!? (no sarcasm intended).

That was my point. Sorry it wasn’t clear.

Classic example of the Lucas Critique.

As fewer people need to be employed to keep going with society's actual work, we're going to see more of these jobs programs. Our culture is obsessed with this idea that "a living" must be earned through toil, despite civilization requiring less and less toil year after year. You're absolutely right. It would be better for everyone if the TSA simply pay these employees to do nothing, but handing money to people is politically impossible, unless those "people" are banks and Too Big To Fail Businesses.

The demographic cliff happens before the fall in number of required jobs, because location specific manual labor and infrastructure maintenance has not been automated, and may be out 50 or so years due to robotics cost.

Just look at the number of help wanted signs in the US.

It’s not clear what you mean by “our culture” but humans in general struggle to have meaningful lives without feeling like they are contributing.

The Native populations in America and Iceland have some of the worst suicide rates because their cultures way of producing goods and food was supplanted by government benefits.

But there’s no need for them to contribute. The meaningful contributions they make are not going to be compensated, and their compensation is unrelated to labor. The jobs are pointless.

You can feel like you’re contributing even when you aren’t doing that much.

The problem is when they know there is no need for them to contribute. That leads to a sense of pointlessness.

Surely we can find better ways to motivate people than useless make-work.

Perhaps, I’m just pointing out that government free cash to hang around and do whatever isn’t an actual solution for 95% of the people. Most aren’t artists/makers oppressed by their jobs.

I agree with your premise overall, but:

> But the US has a huge contingent of people fundamentally opposed to doing things like this even when it would make literally everything better for literally everyone.

I don't think this is why your idea won't happen. I've talked to many people over the years who are genuinely worried about terrorists and they believe that the TSA protects them. You can cite all the statistics in the world to them, and it won't matter. They are not rational on this topic. They will view "get rid of the TSA" as a huge negative impact to their safety, and will vehemently oppose it with or without the paying agents to stay home.

I do think that paying people to stay home instead of doing make-work is relatively unpopular in the US, so that doesn't help. But the biggest problem you will face is just that people don't want to get rid of the TSA no matter how you do it. The TSA is very unpopular in tech/geek circles (and for good reason), but I've found it to be quite popular with normies.

> paying people to stay home instead of doing make-work is relatively unpopular in the US

I think that's a significant understatement of the prevailing condition.

The TSA stats show that they found 6,542 firearms in carry-on luggage at US airports last year. [0] This seems to undermine the argument that they are ineffective, unless you think those weapons should have been been allowed on aircraft.

[0] https://www.tsa.gov/news/press/releases/2023/01/17/tsa-break...

How many didn't they find?

Zero that were used for hijackings.

How many crimes were prevented? Thousands of guns per year were accidentally or ignorantly (or even defiantly, but nothing happened) brought on board before 9/11, too.

The TSA makes rules and then enforces them. Their ability to enforce their own rules doesn't make them effective.

There were a LOT more plane hijackings (with guns and grenades!) pre 9/11.

Yes, see the other comment.

Can you cite numbers for that claim?

Yes, look at the number of hijackings by year globally pre and post 9/11. https://www.statista.com/statistics/1240246/aircraft-hijacki...

Hijackings have been reduced since 9/11 but were always thousands fewer than the number of guns confiscated in the United States alone.

The most significant safety improvements (to the pilots' door, new training, changed passenger willingness to fight, revamped air marshal program) do not involve the TSA, at least not the 'retail' side to which most passengers are exposed.

I'm still waiting for numbers that back up the claim that thousands of guns were brought on board without being used for hijackings. The 9/11 hijackers did not actually use guns. [0] Checks for guns date back to the early 70s. Presumably they didn't use guns because they were afraid they might be detected.

[0] https://en.wikipedia.org/wiki/September_11_attacks

edit: s/weapons/guns/

Not sure what else you are looking for. The original stat about the number of guns confiscated (that would otherwise be brought on airplanes) comes from the TSA earlier in the thread.

Yeah, people leave things in their carry-ons they should have checked all the time. They don’t pay attention to the guidelines and put it in their checked bag with a little sticker because they wanna save their $50. I actually do think every single one of the guns the TSA caught, if allowed on the aircraft, would have proceeded to their final destination with their passenger without incident.

I agree that some security is required, but it's worth noting these guns were caught without the assistance of

- people being forced to throw away their water bottles if they forget to dump them before passing through

- people being forced to remove belts and shoes

- people being forced to have their prescriptions and containers and bags wiped down after they've gone through the first pass

> [...] that the whole thing is just a tax-funded wealth redistribution program [...]

Aren't they paid by the passenger fee?

Yes, it's a tax imposed on air travel, something usually undertaken by the wealthy.

Not to be judgemental, but I don't think of Spirit Airlines' passengers as wealthy. A short haul flight costs < $200, or less than a PlayStation 5, so their customers aren't, like, destitute, but that's a long way from being wealthy.

Potato potahto. Society pays for it

I really don't understand the sentiment of "literally everyone would be better off if the TSA paid people to just stay home and do absolutely nothing at all". I can understand sentiments like the TSA is inefficient, or bloated, or wasteful, but does literally nothing?

Do you really think things would be better if we had no xray scanners for luggage or full body scanners for people? Someone needs to run those machines, and thats the job of the TSA. How can you say we would be better off without those?

> I can understand sentiments like the TSA is inefficient, or bloated, or wasteful, but does literally nothing?

They're not saying that it has no effect, they're saying that it's harmful.

> Do you really think things would be better if we had no xray scanners for luggage or full body scanners for people?

Yes, that's the point?

> Yes, that's the point?

Explain this please? How is it better if I can bring swords or guns onto a plane and no one can even detect it?

If you can't access the cockpit, what are you going to do with either of those? You can kill a passenger, but you can already go out and kill someone before anybody reacts. Most people choose not to do that for some reason.

Adding on to this, you've effectively just moved the chokepoint from the plane to the security queue itself.

1. I can blow up a plane and kill 300 people in the air plus more on the ground

2. If there is no scanners run by the TSA I can bring in tools to open the cockpit door. Now I can redo 9/11.

Also you can pay money for TSA pre-check of CLEAR for faster security clearance. So those who have money to pay for those services are less impacted by TSA bloat.

If my goal was to get something dangerous on board. Why wouldn't I put the people in that group... It seems insane not absolutely everyone is subjected to same level scrutiny each and every time.

Do you have more data about why they are useless?

Safes are still useful even if they have never tried to be breached, and armed forces are useful even if a country has never been attacked.

Perhaps the fact that the TSA exists means fewer crimes are even attempted.

It's not so much a contingent of people fundamentally opposed to doing things like this, as it is people in power having a nice chunk of $ for contractors to milk with 0 inconvenience to them as they fly private.

> Like, literally everyone would be better off if the TSA paid people to just stay home and do absolutely nothing at all.

I don’t think the TSA agents would be better off in that scenario.

Why not?

How did you determine that? People in airports can be extremely abusive.

Of course they would (much more free time to do actually productive tasks!) unless you’re assuming they will be losing the “dignity of work” or something like that.

My question is, why do people only worry about poor people not having the dignity of work? Shouldn’t we be more worried about all the children of the rich who will never need to earn a living? Shouldn’t we make them all do labor, for the good of their own souls?

If they were capable of doing actually productive tasks, they would get a job somewhere other than the TSA. It’s more a question of structure and routine than “dignity of work”, and the type of person who can have structure and routine in their life without a job has enough agency that they wouldn’t be working for the TSA either.

> Shouldn’t we be more worried about all the children of the rich who will never need to earn a living?

We should be worried about those people because they tend to die from drug abuse much more frequently than the general population. The same is true for washed up celebrities and lottery winners. In fact, this is something that rich people tend to worry about a lot in regard to their own children.

> If they were capable of doing actually productive tasks, they would get a job somewhere other than the TSA

This statement seems bonkers to me. People work at the TSA because they need money. Anybody who can hold down a job at the TSA would be entirely capable of doing many productive tasks that may not be remunerative, such as child care, elder care, care for the disabled, any number of home/landscape maintenance tasks, home construction, etc. Not to mention all of the activities that people do to add value to their lives and those around them: contributing the community, making art/music, etc.

> Anybody who can hold down a job at the TSA would be entirely capable of doing many productive tasks that may not be remunerative, such as child care, elder care, care for the disabled, any number of home/landscape maintenance tasks, home construction, etc.

Those are literally all remunerative jobs.

Everyone pretty much assumed the children of the rich will be spoiled and entitled drags on society. But unless you’re proposing to prevent parents from spending their own money on their children, rich children are irrelevant.

Well, high taxes on inheritance could probably have an impact.

I love how you put it. As born and raised in a communist eastern European country I can attest to how accurately it depicts the inefficiencies and absurdities of centrally planned economy. Seeing this kind of nonsense flourishing in the US of A is irony of the highest order.

> Like, literally everyone would be better off if the TSA paid people to just stay home and do absolutely nothing at all.

We would also all be better off if we lived in a socialist utopia where everyone helps each other, free housing, free food, unlimited transportation, no money, no jobs, no rich employers, no corporations, no war, famine, etc.

But all of that is as likely to happen as an American population giving poor people money to live just because there aren't any jobs that will hire them where they live with their qualifications.

So instead we do the hack of a welfare program disguised as a valuable civic service and eat the larger cost to the economy. Every politician knows it's a welfare program, and they love it, because they don't have to call it one.

> it's a welfare program

This is a role usually filled by the armed forces. I suppose it’s good to have a few options.