I typically think Schneier is too cavalier about "security theater", but in this case I agree completely. On the other hand, I don't think that means airport security should be drastically scaled back: There are probably 10x as many dumb potential attackers as smart ones, and it makes sense to be eliminate the easy avenues for the dumb ones while you concentrate other resources on the smart ones. It's also important not to ignore both the intelligence value of security checks as well as their potential forensic value in the event of a successful attack.
TSA actually seems to be making an effort to get smarter about its screening. Trusted passenger programs are expanding dramatically, and I expect the overall burden on the traveling public to decline over time.
> On the other hand, I don't think that means airport security should be drastically scaled back
It absolutely should be drastically scaled back. Or eliminated entirely. The thing you're ignoring is that the current level of airport security kills a lot of people. It does so largely by making flying more expensive and inconvenient so people drive instead of fly and as a result die in auto accidents. The TSA makes us all poorer and causes a great many deaths for no clear benefit whatsoever. The hypothetical attackers who you are postulating might be deterred are a sufficiently weird edge case that it's unlikely they exist at all. Basically, you're imagining somebody who has all the following attributes at once. He or she:
(a) is highly motivated to do evil things that kill lots of people in a high-profile fashion
(b) has the resources to actually implement a plan to do these evil things.
(c) is SMART enough that the attack WOULD succeed were it not for security. If they made a bomb, they were successful at figuring out how to make one that would work well (unlike the shoe bomber and the underwear bomber)
(d) but is DUMB enough that they just can't figure out any way to get around security.
(e) but is SMART enough to REALIZE they can't get around security, so they don't try to do so anyway (explaining the fact that security has never ever caught even a single person trying to do so)
(f) but is DUMB enough that they can't think of any way to use the same resources to carry out some OTHER attack that kills a similar number of people with similar terrorizing effect, like by attacking the security line or a bridge or a tunnel or a shopping mall.
If you can find anybody with all those characteristics at once, THAT is the person who airport security has saved us from.
Exactly, there is a massive opportunity cost [1] at play here when you exchange very neutral/limited returns in security, for crippling airport efficiency and disrupting the lives of individuals making them not want to fly (invading privacy, long lines, belittling treatment, etc).
Just arguing whether or not TSA is effective at stopping smart vs dumb criminals is too limited of a discussion. It needs to also factor in the trade-offs at risk of being able to even do so.
Especially considering the TSA is reporting tens of thousands of false-positives for every real security threat prevented. That ratio can't be ignored as a counter-weight.
> There are probably 10x as many dumb potential attackers as smart ones, and it makes sense to be eliminate the easy avenues for the dumb ones while you concentrate other resources on the smart ones. It's also important not to ignore both the intelligence value of security checks as well as their potential forensic value in the event of a successful attack.
This is the point that is always missed when talking about "security theater".
Smart and practiced people can make anything look easy. An attack on an airplane is simply too challenging for the vast majority of people to execute. Is it impossible? No, but almost nothing is impossible.
Making an attack difficult on a plane also eliminates the majority of severally mentally unstable from carrying it out. You can kill 300+ people in one instant, it is impossible to stop the truly motivated and capable (ultra tail risk) attacker, but it is crucial to stop the rest of the tail from casually taking down an airliner.
An attack on an airplane is simply too challenging for the vast majority of people to execute. Is it impossible? No, but almost nothing is impossible.
I don't think you are making the point you intend to make - the very fact that pulling off a successful attack is inherently difficult is what stops those people, not any security agency.
Same thing with attacks anywhere else. For example: The Times Square bomber couldn't even build a working bomb despite two college degrees and the 2007 London & Glasgow Airport bombers couldn't figure it out either, for their swan song they put propane tanks in their jeep cherokee, lit themselves on fire and drove into a barricade in front of the airport, despite one of them having a doctor's education.
In all of its existence, the TSA has never detained someone who was later convicted on terrorism charges, despite the vast lowering of the standard of evidence for such charges since 9/11. The fact that we've seen so few attacks on "softer" targets (roughly 3 civilians have been killed in islamic-extremist attacks on US soil since 9/11) means that the size of the actual threat is practically zero - including the fools.
There was a shooting at LA just weeks ago. Lots of less than spectacular events have occurred on soft targets over the past 10 years. Each of those may have easily converted in to a more spectacular attack.
The marathon bombers were targeting the marathon for the message. They may have choosen to use an airliner to make that message had it not been for TSA. We don't know. There just isn't quality enough data on either side to remove airport security.
You mean Paul Anthony Ciancia who was pissed off about all the excessive security and deliberately targeted TSA agents hoping to commit suicide-by-cop?
Lots of less than spectacular events have occurred on soft targets over the past 10 years. Each of those may have easily converted in to a more spectacular attack.
Citing all attacks anywhere as justification for the TSA is a recipe for the unlimited ratcheting up of security. It is an enormous leap in logic to assume somebody with a semi-auto rifle or a crock-pot bomb is capable of getting them past pre-911 airport security and also doing something effective with it once they have. An attack on an airplane is simply too challenging for the vast majority of people to execute.
But there's little if any evidence that there's any real threat of mentally unstable people, or not particularly smart terrorists, wanting to carry out attacks either.
If these people existed, they'd be attacking trains/metros today. The Madrid and London bombings show how devastating these can be - and on a train, you could do it with a pretty high chance of getting away uninjured - just leave your bag on the train and get off before it's due to explode.
Yet despite the ridiculous ease, low risk and effectiveness of such an attack, they still very, very rarely happen.
Without security, you can bet that this list of American Hijackings would continue to present day. Not everyone needs to blow up a plane to cause mass havoc.
I'm not sure what you're trying to say here. From that list, there were 2 involving the US in the 90s and 4 in the 80s. Is the huge increase in disruption, inconvenience and intrusion for every traveller really necessary to cut that level of threat down?
And how many of the attempted hijackings since 2001 had anywhere near the impact of Madrid or London's train/bus bombs? If there's really terrorists trying to cause havoc, why aren't they taking this easy option?
You will notice that they were rolled out in the 70s as security screening started at airports. It was proven effective and unless you can make an argument why people wouldn't pose security threats now with no security checkpoints you won't convince any actual decision maker anywhere.
50s - none involving America. 60s - 5. 70s - 14 (3 of which, as far as I can tell with any fatalities).
However, I'm not really arguing against zero security at airports. What I'm arguing against is the ludicrous increase in security procedures since 9/11.
>It is currently difficult to execute. It won't be if we had no security
It's not difficult to execute bombings on trains, and they are hugely impactful when it happens. Yet they rarely happen. You seem to be ignoring this.
The 70s are the decade where there were many hijackings. That's also when air travel became more commonplace and huge jets were more widely in service.
In the 60s if you weren't a military person, foreigner arriving from or headed to home, or white guy with a suit, you'd be picked up on pretty quickly, security checkpoints or no. Also, we weren't exporting trillions of dollars to and fomenting unrest in the Middle East in those days.
In the 90s, I used to fly to Baltimore on Southwest to get drunk for $30 with friends for the weekend. If I couldn't make it, I'd give the ticket to someone else or sell it. Totally different universe and threat model than ye olden times.
I have never, ever been stopped due to what I consider reasonable amounts of liquid/gel/aerosol beyond the 100ml limit. Typical culprits: deodorant, shaving cream and sunscreen. I do my best to fit everything in a 1qt baggie, but typically the shaving cream and sunscreen are just jammed into a running shoe or put in a separate pocket in my carry-on. Never, ever been stopped. Also, never been confiscated by the TSA random checked bag checks in the couple of cases I've had to gate check a carry-on.
For anyone who doesn't already know or wouldn't be willing to spend the $100 for Global Entry + PreCheck, the AMEX Platinum card covers the cost for both (along with free access to most AIrline lounges, and a free membership to Priority Club, which gives you access to even more lounges). Totally worth the annual fee for frequent travelers, especially ones who find themselves on random airlines connecting random airports.
For anyone who doesn't already know or wouldn't be willing to spend the $100 for Global Entry + PreCheck
These programs are the ultimate sign of just how pointless airport security is. There is simply no way that $100 is even remotely enough money to cover an investigation of any effectiveness whatsoever. It's probably just enough to cover the cost of checking the same lists the TSA already checks on every ticket booked and then adding you to the list of people who get to skip security most of the time.
Those programs are just a way for the TSA to co-opt the ire of the kind of rich and powerful people who might have the political influence to reform the agency. 10 to 1 every member of congress has signed up for Pre-Check. If you believe that the TSA is defending against a real threat, these programs, by their very existence, create a giant gaping hole in the TSA's security. The only reason it hasn't been used to perpetrate an attack is because there is effectively no risk in the first place.
You're totally right, of course. My in-person security interview was a joke. The officer didn't even try to ask any questions. He validated my contact information and we shot the shit while their computer system logged his approval of my application. Took maybe 15 minutes of waiting my turn with a half dozen other poor saps who had also scheduled the interview 2-3 months in advance, and then 5 minutes for the actual processing.
Interestingly, my airport now has a third(!) category of security line, for airline elevated status holders. They skip the long line for the normal screenings, but then go through the normal "remove shoes, belts, jackets and laptops" part, so it's like getting half a reprieve. I'm convinced that by this time next year there will be have so much dilution of the process that everyone will be treated identically again and it'll probably be based on the Pre-Check standards: x-ray machine, no significant liquids, no removal of shoes/belt/jacket.
That right there is a beautiful example of idiocy regarding TSA policies. Remember that that wasn't even a result of 9/11, it was after police foiled a plot to blow up planes using liquids in the UK in 2006 before the terrorists even had a concrete plan. It's always after something happens that TSA reacts, making me believe even more strongly that what passengers get to personally deal with is mostly just security theater rather than anything actually useful.
Bonus points: there was never a limit on the medication you can bring with you (albeit haphazardly enforced with absurd requirements sometimes) even when all liquids were banned, and there has always been a gigantic backlash every time there was a news story about medically necessary liquids being tested or confiscated in unreasonable ways so TSA has never really dared to ban them in the first place. The best thing now is that they don't even bother to check that what you're carrying on is okay most of the time in my experience, nor have they ever cared that I didn't bother to bag things like inhalers separately and declare them to anyone. But they have thrown out a nearly empty toothpaste container for being an ounce too large - that I had gotten past security with a week before - just because.
I'm looking forward to traveling as a "trusted traveler" (aka pay them money!) tomorrow where TSA will even explicitly tell me to leave my baggies of liquids in my bag. :)
TSA actually seems to be making an effort to get smarter about its screening. Trusted passenger programs are expanding dramatically, and I expect the overall burden on the traveling public to decline over time.