Fixing a Security Problem Isn’t Always the Right Answer

An unidentified man breached airport security at Newark Airport on Sunday, walking into the secured area through the exit, prompting an evacuation of a terminal and flight delays that continued into the next day. This problem isn’t common, but it happens regularly. The result is always the same, and it’s not obvious that fixing the problem is the right solution.

An unidentified man breached airport security at Newark Airport on Sunday, walking into the secured area through the exit, prompting an evacuation of a terminal and flight delays that continued into the next day. This problem isn’t common, but it happens regularly. The result is always the same, and it’s not obvious that fixing the problem is the right solution.

This kind of security breach is inevitable, simply because human guards are not perfect.  Sometimes it’s someone going in through the out door, unnoticed by a bored guard. Sometimes it’s someone running through the checkpoint and getting lost in the crowd. Sometimes it’s an open door that should be locked. Amazing as it seems to frequent fliers, the perpetrator often doesn’t even know he did anything wrong.

Basically, whenever there is — or could be — an unscreened person lost within the secure area of an airport, there are two things the TSA can do. They can say, “This isn’t a big deal,” and ignore it. Or they can evacuate everyone inside the secure area, search every nook and cranny — inside the large boxes of napkins at the fast food restaurant, above the false ceilings in the bathrooms, everywhere — looking for anyone hiding, and then rescreen everybody, causing delays of six, eight, twelve hours or more. That’s it; those are his options. And there’s no way he’s choosing to ignore the risk; even if the odds are minuscule that it’s a problem, it’ll cost him his career if he’s wrong.

Several European airports have their security screening organized differently. At Schipol Airport in Amsterdam, for example, passengers are screened at the gates. This is more expensive and requires a substantially different airport design, but it does mean that if there is a problem only the one gate has to be evacuated and searched and the people rescreened.

American airports can do more to secure against this risk, but I’m reasonably sure it’s not worth it. We could double the guards to reduce the risk of inattentiveness, and redesign the airports to make this kind of thing less likely, but that’s an expensive solution to an already rare problem. As much as I don’t like saying it, the smartest thing is probably to live with this occasional but major inconvenience.

Bruce Schneier is an internationally renowned security technologist and author.

Composite image via idovermani and rick‘s Flickr photostream.

Suggested articles

Discussion

  • Anonymous on

    What the heck happened here? A major malfunction of the press. Where is the observation that this exit is only 3 m wide? How could the guard miss? Where is the observation that this person had to walk past 3 checkpoint stations staggered from each other and the wall with the exit is glass!  This person walked in plain view past every schmuck sacrificing their 4th Amendment rights and every TSA agent walking the line. Then there is the fact that every 6 or 10 ft there is a camera that the perp had to walk within 1 meter of and they can't recognize him on camera?! To tell the truth, when I look at half these cameras at EWR they look like the fake cameras you get at Harbor Freight.  That the cameras are fake makes sense. The point being, I expect the Port Authority and Dept of Fatherland Security to screw up. But why can't the press make the same basic observations I can from the simple fact of having walked down the corridor?

  • Anonymous on

    if they installed these at the exits (or bigger better versions):

    http://en.wikipedia.org/wiki/Turnstile

    It would probably help a lot...

  • Rafael Gustavo da Cunha Pereira Pinto on

    Bruce, I work in the IT architecture dept on my company, dealing with information security architecture. In my decisions, I always tell everyone that security is a matter of risk management. No system is 100% secure...

    IMHO, if one security layer is breached, they should focus on the next layer so to avoid a  bigger loss.

  • Anonymous on

    This is a very practical consideration. However, the risks are extremely high: we talk about the lifes of 2-300 people! And not just the lifes: mobility is a key factor in economical effeciency - this is why it's a primary target for terrorists. If they managed to scare people away from flying, our economy would collapse. That is their main goal.

  • altNull on

    "This problem isn't common, but it happens regularly." --ROFL Nice turn of words, where you meaning to contradict yourself? I haven't read a paper that did something like this since freshman English. Also, you should probably know that this "problem" is not really that common. Every time even a backwards "hic" airport is evacuated its gets on the News (ie CNN, Fox, ect). Thus, since we haven't heard of this problem arising often (except the last 3 weeks), we can assume that this is not a common problem and it is not happening regularly. Another note: if you wanted to control people, you need to constrain them more. If you put the sensors at the gates or even the individual terminals, then more people (ie families, friends) would be there too. This adds more people to an already tense situation, thus creating more problems not less. What the airports need is better sensors around the parameter. Microwave, sonic, micro-laser, ect. Anything, tie it to an inexpensive wireless camera on a swivel, pay some bloke $12.50/hr to stare at screens and push a button, and you've just tripled your airport security. They also need to add a general roman spectrometer that would sit above the the people and scan down - looking for explosives, corrosives, and other dangerous material. They already created an inexpensive one that does around 100 scans per minute - no way the lines will be moving that fast. You could even put then together with the X-ray machines to check individual bits of luggage. In short the airports and air-transport companies need to cut their CEO budgets and help pay for better security, BEFORE everyone decides to switch to trains or buses.
  • altNull on

    "This problem isn't common, but it happens regularly."  --ROFL

    Nice turn of words, where you meaning to contradict yourself?  I haven't read a paper that did something like this since freshman English.  Also, you should probably know that this "problem" is not really that common.  Every time even a backwards "hic" airport is evacuated its gets on the News (ie CNN, Fox, ect).  Thus, since we haven't heard of this problem arising often (except the last 3 weeks), we can assume that this is not a common problem and it is not happening regularly.

    Another note: if you wanted to control people, you need to constrain them more.  If you put the sensors at the gates or even the individual terminals, then more people (ie families, friends) would be there too.  This adds more people to an already tense situation, thus creating more problems not less.

    What the airports need is better sensors around the parameter.  Microwave, sonic, micro-laser, ect.  Anything, tie it to an inexpensive wireless camera on a swivel, pay some bloke $12.50/hr to stare at screens and push a button, and you've just tripled your airport security.  They also need to add a general roman spectrometer that would sit above the the people and scan down - looking for explosives, corrosives, and other dangerous material.  They already created an inexpensive one that does around 100 scans per minute - no way the lines will be moving that fast.  You could even put then together with the X-ray machines to check individual bits of luggage.

    In short the airports and air-transport companies need to cut their CEO budgets and help pay for better security, BEFORE everyone decides to switch to trains or buses.

  • Anonymous on

    Fixing a security problem isn't always the right answer -- especially when there are security protocols already in place to address the risk. According to the TSA, "our protocol is to have a security officer stationed at the exit lane, and their function is to allow arriving passengers out and to make sure bystanders who have not been screened on the public side do not enter." It seems if they would have properly followed their own security protocols, this whole incident could have been avoided.

    One simple, cheap step that would likely help would be to increase the penalty for guards that let slip through the unscreened public. It shouldn't be that difficult to ensure people are only travelling one direction through an exit. Sure, mistakes will be made, but I'm guessing the guard will be less "bored" if their job and/or their freedom depend on it. Maybe the mistaken guard could pay for a portion of the cost resulting from the breach. Maybe positive incentives could be introduced for those guards not prone to mistake.

    Security is only as good as the humans behind it. We must make sure proper incentives are in place for the humans behind this security to help ensure incidents like these are minimized.

  • Mike on

    "This problem isn't common, but it happens regularly."

    If it happens once a month, it happens regularly.  If 10,000,000 people travel through airports in a month, and one goes the wrong way, it's not common.

     

  • Matthew Wilkes on

    Regularly means it happens at a predictable frequency, uncommon means that the likelihood of it happening is low. For example, the half life of carbon-14 is around 5000 years. If you had a sample of 5 atoms, you'd say that radioactive decay is uncommon. It is also irregular. The sun rising happens every day at a very predictable time, it is both common and regular. Halley's comet is something most people can only see once in their lifetime, its passage near earth is uncommon, but regular. We know the dates it will next be visible. And finally, teenagers commenting on stories online think they know better than everyone else. This is, undoubtedly, common. However, it is irregular, you never know the next time one will do it.
  • Anonymous on

    Wow, a cost/benefit analysis!  What profound insights into freshman year engineering principles will you be giving us next?

  • Gili on

    Read a hilarious first-hand account of what happened by Shmuley Boteach: http://www.jpost.com/servlet/Satellite?cid=1262339393752&pagename=JPost%2FJPArticle%2FShowFull

  • Anonymous on

    We've spent untold billions of dollars on military weapons tracking technology. Tracking people and detecting when they go in through the out door should not be a problem.

  • LarrySDonald on

    Cost/benifit is already dead and burried when it comes to airport and flight security. None, by a long shot, of the risks are even remotely worth the payoff. Even the most insane spending bill pay off better in lives/$ and worthwhile spending can jump two or three orders of magnitude easily. That may sound callused, but really what is callused is watching people die while saying "Oh yeah, we could totally afford to save you, but it's not, you know, very sexy looking media wise. I think we'd rather fork a few billion into a few thousand whom I'd look really good for saving". This isn't the governemt or medias fault. If people say they'd rather fork up for ineffective treatment of a super rare problem, it'll happen. The enemy here is thrilled about this - a lot of bang for your buck. Billions in damage instantly for a few benjamins in supplies and a cheap guy to take the fall.

  • Anonymous on

    As Captain of a vessel in the local port I was once directed to do exactly that so as to get some papers signed by the customs agents! "Just walk in the exit door" I was told. "What if I am stopped?" I asked. "Show them the forms." [that I had downloaded from the internet!] I was told. Sure enough I walked right past the international gates, some with aircraft parked, got the forms signed and left.

  • rew on

    FYI, at schiphol people are screened just like in most American airports when entering the terminal building. However, some additional screening takes place at the gates for flights going to America. Maybe you even get to skip the main checkpoint, I'm not sure. But I am very sure that there is a safety check just after turning in your luggage.

  • Employee on

    we have proactive alerts and more! look at www.mersecurity.com

  • dan on

    If you ask the people who experienced this evacuation it was more than a major inconvenience, it was unsafe.  Reportedly, the entire population of the secure area was moved into another area not large enough to receive them with choke points as exits.  After hours of wait, frustration mounted, people started to push and a crush began. People were scared for their children.  This evacuation could have resulted in more deaths and injuries which means it's the wrong choice in any but the most extreme security situations.

    If we have a procedure that can necessiate evacuating people from one area there has to be proper safety measures to ensure that there is no danger for the large number of people who are evacuated and then waiting.  Proper  crowd control must be in place and that seems to have be missing.  This safety measures seems to have been inherently dangerous.  

     

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.