Tag: TSA

Strip-Search Images Stored

The Transportation Security Administration will be sure to point out that it was not them—it was the U.S. Marshals Service—that kept ”tens of thousands of images recorded with a millimeter wave system at the security checkpoint of a single Florida courthouse,” according to Declan McCullagh of C|Net news.

The TSA has taken pains to make sure that their use of strip-search machines does not produce compromising images of the traveling public, but rules are made to be broken. How do you protect privacy in the use of a technology that is fundamentally designed to invade privacy?

Stop ‘n’ Frisk Databases

Via Adam Serwer, New York governor David A. Paterson is expected to sign a bill today doing away with data collection on people the police stop and question, but who have done nothing wrong.

The Transportation Security Adminstration’s “SPOT” program—recently the subject of a scathing Government Accountability Office critique—does similar data collection about innocent people.

From late May 2004 through August 2008, “behavior detection officers” referred 152,000 travelers to secondary inspection at airports. Of those, TSA agents referred 14,000 people to law enforcement, which resulted in approximately 1,100 arrests. None had links to terrorism or any threat to aviation.

The data TSA collects “when observed behaviors exceed certain thresholds”—that is, when a traveler garners TSA suspicion—includes:

  • first, middle, and last names
  • aliases and nicknames
  • home and business addresses and phone numbers
  • employer information
  • identification numbers such as Social Security Number, drivers license number or passport number
  • date and place of birth
  • languages spoken
  • nationality
  • age
  • sex
  • race
  • height and weight
  • eye color
  • hair color, style and length
  • facial hair, scars, tattoos and piercings, clothing (including colors and patterns) and eyewear
  • purpose for travel and contact information
  • photographs of any prohibited items, associated carry-on bags, and boarding documents
  • identifying information for traveling companion.

GAO’s Damning Report on ‘SPOT’

Via the Identity Project’s “Papers, Please” web site, and despite my colleague David Rittgers’ excellent post from yesterday, I note last week’s utterly damning Government Accountability Office report on the SPOT program. “SPOT” stands for “Screening Passengers by Observation Techniques.” In the program “BDO’s,” or “Behavior Detection Officers,” observe travelers in airports, pulling them out of line if a secret list of behaviors signal that they’re a likely threat.

The thing is:

TSA deployed SPOT nationwide before first determining whether there was a scientifically valid basis for using behavior and appearance indicators as a means for reliably identifying passengers as potential threats in airports. … TSA state[s] that no other large-scale U.S. or international screening program incorporating behavior- and appearance-based indicators has ever been rigorously scientifically validated. While TSA deployed SPOT on the basis of some risk-related factors, such as threat information and airport passenger volume, it did not use a comprehensive risk assessment to guide its strategy of selectively deploying SPOT to 161 of the nation’s 457 TSA-regulated airports. TSA also expanded the SPOT program over the last 3 years without the benefit of a cost-benefit analysis of SPOT.

The Israeli airline El Al uses behavior detection, counters the TSA—as did DHS Secretary Janet Napolitano when I asked her about this report at a meeting of the DHS Privacy Committee Tuesday.

The GAO report notes that El Al’s processes, which are different from the TSA’s, have not been scientifically validated. As of 2008, El Al had 34 aircraft, operating out of one hub airport, Ben-Gurion International. There are 457 TSA-regulated airports in the United States. In 2008, El Al had passenger boardings of about 3.6 million; one U.S. airline, Southwest, flew about 102 million passengers that year.

From late May 2004 through August 2008, BDOs referred 152,000 travelers to secondary inspection. Of those, TSA agents referred 14,000 people to law enforcement, which resulted in approximately 1,100 arrests. TSA officials did not identify any direct links to terrorism or any threat to aviation in these cases. GAO noted its inability to determine if this is a better arrest rate than would occur under random screenings.

GAO also determined that at least 16 individuals allegedly involved in terrorism plots have moved at least 23 different times through eight airports where the SPOT program has been implemented. SPOT caught none of them.

The Government Accountability Office is a master of understatement, leaving conclusions for readers to draw. Mine is that the $1.2 billion in planned spending on the program over the next five years will be a wasteful producer of civil liberties violations.

TSA Behavioral Screening

Behavioral screening is a useful tool in deterring and preventing terrorist attacks. As I noted in this piece at Politico, a border patrol agent successfully used behavioral screening to stop the would-be Millennium Bomber. She noticed something “hinky” about a man driving south across the Canadian border. That “hinky” – fidgety and nervous behavior when asked routine customs questions – exposed a car full of explosives intended for the passenger terminal of Los Angeles International Airport.

Two items from the USA Today travel section highlight some mixed results with TSA behavioral screening. Today’s edition reports that behavioral screening, applied by Behavioral Detection Officers (BDOs) missed at least 16 people later linked to terror plots. On the other side of the equation, false positives can impose burdens on those who are nervous or upset for reasons other than terrorism aspirations.

The TSA Blog defended the program: “If you’re one of those travelers that gets frazzled easily (not hard to do at airports), you have no reason to worry. BDOs set a baseline based on the normal airport behavior and look for behaviors that go above that baseline. So if you’re stressing about missing a flight, that’s not a guaranteed visit from the BDOs.”

That would be reassuring if yesterday’s travel section hadn’t revealed that TSA screeners are keeping a list of those who get upset at intrusive screening procedures. “Airline passengers who get frustrated and kick a wall, throw a suitcase or make a pithy comment to a screener could find themselves in a little-known Homeland Security database.”

Of course, we can take comfort from the words of a TSA screener to security expert Bruce Schneier. “This isn’t the sort of job that rewards competence, you know.”

Good Thing There Are So Few Bad Guys

Returning from Chicago this past weekend, I noticed that they were using strip-search machines in several security lanes at the TSA checkpoint (ORD Terminal 1). Naturally, after the ID check—yes, I did show ID this time—I chose a lane that lead to a magnetometer rather than a strip-search machine.

Annnnnd, anyone wanting to smuggle a plastic weapon could do the same.

For all the money spent on strip-search machines at ORD, and for all the exposure law-abiding travelers are getting, the incremental security benefit has been just about exactly zero. Security theater. TSA has to direct people to lanes mandatorily or install strip-search machines at all lanes to get whatever small security benefit they provide.

Going through the strip-search machine is optional—you can get a pat-down instead. Signage to that effect was poorly placed for informing the public, at the entrance to the strip-search machine. Travelers might read it as they stepped into the machine, realizing from that standing spread-eagle position that they didn’t have to be there.

EPIC: Suspend Airport Body Scanners

Last week, the Electronic Privacy Information Center released a petition from a group it spearheaded, asking the Department of Homeland Security to suspend deployment of whole-body imaging (aka “strip-search machines”) at airports.

The petition is a thorough attack on the utility of the machines, the process (or lack of process) by which DHS has moved forward on deployment, and the suitability of the privacy protections the agency has claimed for the machines and computers that display denuded images of air travelers.

The petition sets up a variety of legal challenges to the use of the machines and the process DHS has used in deploying them.

Whole-body imaging was in retreat in the latter part of last year when an amendment to severely limit their use passed the House of Representatives. The December 25 terror attempt, in which a quantity of explosives was smuggled aboard a U.S.-bound airplane in a passenger’s underpants, gave the upper hand to the strip-search machines. But the DHS has moved forward precipitously with detection technology before, wasting millions of dollars. It may be doing so again.

My current assessment remains that strip-search machines provide a small margin of security at a very high risk to privacy. TSA efforts to control privacy risks have been welcome, though they may not be enough. The public may rationally judge that the security gained is not worth the privacy lost.

Wouldn’t it be nice if decisions about security were handled in a voluntary rather than a coercive environment? With airlines providing choice to consumers about security and privacy trade-offs? As it is, with government-run airline security, all will have to abide by the choices of the group that “wins” the debate.