Tag: TSA

Stunner: Strip-Search Machine Used to Ogle

An airport security staffer faces discipline after using a whole-body imaging machine to ogle a co-worker, according to this report. It’s another signal of what’s to come when the machines are in regular use. (In a previous post, I aired my doubts about the veracity of reports that a famous Indian movie star had been exposed, but the story foretells the future all the same.)

I’ve written before that whole-body imaging machines in airports create risks to privacy despite TSA’s efforts to minimize those risks with carefully designed rules and practices.

Rules, of course, were made to be broken, and it’s only a matter of time — federal law or not — before TSA agents without proper supervision find a way to capture images contrary to policy. (Agent in secure area guides Hollywood starlet to strip search machine, sends SMS message to image reviewer, who takes camera-phone snap. TMZ devotes a week to the story, and the ensuing investigation reveals that this has been happening at airports throughout the country to hundreds of women travelers.)

Rules against misuse of whole-body imaging are fine, but they are not a long-term, effective protection against abuse of “strip-search machines.”

I Told You So?

The story that images of a film star produced by whole-body imaging were copied and circulated among airport personnel in London are a little too good to be true for critics of the technology. It may yet be proven a joke or hoax, and airport officials are denying that it happened, saying that it “simply could not be true.”

But if Bollywood star Shah Rukh Khan was exposed by the technology, it validates more quickly than I expected the concern that controls on body scanning images would ultimately fail.

Here’s how I wrote about the fate of domestic U.S. proscriptions on copying images from whole-body imaging machines in an earlier post:

Rules, of course, were made to be broken, and it’s only a matter of time — federal law or not — before TSA agents without proper supervision find a way to capture images contrary to policy. (Agent in secure area guides Hollywood starlet to strip search machine, sends SMS message to image reviewer, who takes camera-phone snap. TMZ devotes a week to the story, and the ensuing investigation reveals that this has been happening at airports throughout the country to hundreds of women travelers.)

I have my doubts that this incident actually happened as reported, but it is not impossible, and over time misuse of the technology is likely. That’s a cost of whole-body imaging that should be balanced against its security benefits.

The Department of Sneak-a-Peek

Big_Sis_PeakThe Drudge Report’s provocative banner this afternoon combines with other news to suggest a homeland security trend: sneakin’ a peek.

The other story is the question whether the nominee to head the Transportation Security Admnistration violated federal privacy laws as an FBI agent, then omitted key information in reporting it to Congress. Robert O’Harrow of the Washington Post (returning to the privacy beat!) reports that Erroll Southers, a former FBI agent, made inconsistent statements to Congress about wrongly accessing confidential criminal records about his estranged wife’s new boyfriend. (More here.)

That was 20 years ago. Being fully transparent about it today would almost certainly have prevented it from being disqualifying. But over the last 20 years, data collection has grown massively, and federal access to personal data has grown — including access by the TSA. Data about the appearance of your naked body may be on the very near horizon.

Southers’ problem with sneaking a peek at confidential records — and whatever cover-up or oversight in his reporting of it to Congress — signal precisely the wrong thing at a time when people rightly want their security not to be the undoing of privacy.

WaPo: Too Dismissive of Privacy Concerns

The Washington Post writes, “There’s nothing to fear from the use of full-body scanners at airports.”

That’s a little too dismissive. While it’s true that TSA has done much to limit the privacy threats, this is a fundamentally invasive technology.

I was particularly struck by this doe-eyed argument: “Officers in [the] remote screening room are prohibited from bringing in cellphones, cameras or any device with a camera.”

Here’s how I wrote about the fate of that rule in an earlier post:

Rules, of course, were made to be broken, and it’s only a matter of time — federal law or not — before TSA agents without proper supervision find a way to capture images contrary to policy. (Agent in secure area guides Hollywood starlet to strip search machine, sends SMS message to image reviewer, who takes camera-phone snap. TMZ devotes a week to the story, and the ensuing investigation reveals that this has been happening at airports throughout the country to hundreds of women travelers.)

My error was to say it would be SMS. In the Washington Post’s account, TSA screeners communicate by wireless headset. (I don’t remember how they communicated in the demonstration I saw in Detroit.)

In college, I worked at a bar, and at the door of this bar it was customary to say at appropriate moments, “Did you get those books?” or “Did you get that book?” Everyone knew what these phrases meant and trained their eyes accordingly. I’m sorry if that was crude.

I’m more sorry if nobody on the editorial board at the Post recalls the vigor and ingenuity of youth. There is not “nothing to fear” from the use of full-body scanners.

Review of the Big REAL ID Hearing

The Senate Homeland Security and Governmental Affairs Committee held a hearing yesterday on the REAL ID Act and the REAL ID revival bill, known as PASS ID. I attended and want to share with you some highlights.

Good News!

Little good came from the hearing, as it was primarily focused on how to get the states and people to accept a national ID. But there is some good news.

First, Department of Homeland Security Secretary Janet Napolitano declared REAL ID dead (much as I did in my testimony two-plus years ago). “DOA” is how she referred to it.

She also said that no state will be in compliance with REAL ID by the current December 31, 2009 deadline. This is important because a lot of people think that states doing anything about the security of drivers’ licenses and ID cards are complying with REAL ID.

Another highlight was the commentary of Senator Roland Burris (D-IL). He is a beleaguered outsider to the Senate and evidently wasn’t coached on the talking points around REAL ID and PASS ID. So he flat out asked why we shouldn’t just have “a national ID.”

Senator Susan Collins’ (R-ME) nervous smile was particularly noticeable when Burris asked why the emperor had no clothes. No one was supposed to talk about national IDs at this hearing! But that’s what PASS ID is.

REAL ID and PASS ID are two versions of the same national ID system, and nobody is denying it. That’s good news because the effort to rebrand REAL ID through PASS ID has failed.

A Fake Crisis

Some other issue-framing is worth pointing out. Chairman Lieberman and Secretary Napolitano took pains to point out the importance of acting on PASS ID soon, claiming that the TSA would have to seriously inconvenience travelers with secondary searches at the end of the year if nothing was done.

But this is the same “crisis” that the DHS navigated a little over a year ago. States across the country were refusing to implement REAL ID. The DHS Secretary rattled his saber about inconveniencing travelers. And the DHS Secretary ended up giving all states a deadline extension. Secretary Napolitano will do the same thing if PASS ID fails - saber-rattling included. There is no crisis.

Vermont Governor Jim Douglas Supports a National ID

As I noted above, PASS ID is a national ID, just like REAL ID.

By testifying in support of PASS ID, Vermont governor Jim Douglas (R) put himself on record as supporting a U.S. national ID. He can pretend it’s not a national ID, of course, and he did his best to paper over the issue when Senator Burris asked about it. But Governor Douglas supports a national ID.

There was a time when Republicans stood for resisting federal incursions on state power. In the 104th Congress, the Senate Judiciary Committee had a subcommittee that focused on federalism and the preservation of state power (the Subcommittee on the Constitution, Federalism, and Property Rights). But the National Governors Association, with Douglas at the helm, is now in the process of negotiating the sale of state power over driver licensing and identification policy to the federal government.

Rampant Security Ignorance

The reason why he supports this national ID law, Governor Douglas said, is that he, like every governor, “is a security governor.”

With so many Senators and panelists conjuring security and the 9/11 Commission report, it would be a delight if someone actually examined the security benefits of a national ID. The information is there for them. Again, my testimony to the committee two years ago supplied at least some. Then, I said, “Implementation of REAL ID would impose more costs on our society than it would provide in security or other benefits,” and I articulated how and why a national ID fails to secure.

But Senator Lieberman said he “assumes” REAL ID provides national security benefits. Assumes? He and his staff apparently haven’t familiarized themselves with the level of national security that a national ID would create, taking into account the counterattacks and complications of such a system.

Five years after the vaunted 9/11 Commission report - and the three-quarters of a page it devoted to identity security - Senator Lieberman, the chairman of a committee dealing with domestic security, has yet to look into the merits.

In case Senator Lieberman needs some help …

I’m So Sick of the 9/11 Commission Report!

Speaking of the 9/11 Commission, it has been five years since that report came out, and people continue to parrot the line that REAL ID was a “key 9/11 Commission recommendation.”

The 9/11 Commission dedicated three-quarters of a page to the question of identity security, out of 400+ substantive pages. Its entire treatment of the subject is on page 390.

The 9/11 Commission did not articulate how a national ID system would defeat future terror attacks. It did not even articulate how a national ID would have defeated the 9/11 attacks had it been in place. A minor shift in behavior by the 9/11 attackers, such as using their passports to board planes, would have defeated REAL ID and PASS ID, were we somehow allowed “do-overs.”

We are not allowed “do-overs,” and the problem we face is not 9/11, but securing against current and future threats - including people who might shift their behavior in light of security measures we take.

These shifts in behavior might include taking a few extra steps to get the documentation they need, for access to the country or targets. These shifts in behavior might include attacking targets that do not require documentation. Identity-based security is a Maginot Line.

The 9/11 Commission report was written at a time when little research on identity-based security had been done. It was written by fallible humans who knew little about identity-based security, and who got it wrong. The report is not a religious text.

The report did say something important, though: “For terrorists, travel documents are as important as weapons”! (page 384) It’s a terrific turn of phrase because it shuts down the logic centers in the brain - eek, terrorists! - and ends the discussion.

The “travel documents” the report was talking about, though, were passports and visas, not drivers’ licenses and birth certificates - the things foreign terrorists use to get into the country. If we’re going to turn the driver’s license into an internal passport - and TSA checkpoints are the beginning of such a policy - then perhaps these are travel documents. Just, please, Secretary Napolitano, train your TSA agents to not say, “Your papers, please.”

Even as to international travel documents, though, the 9/11 Commission got it wrong. Weapons are the only things as important as weapons. And the 9/11 terrorists didn’t actually use weapons any more substantial than box cutters. They “weaponized” a non-weapon. (Security is complicated, you see.)

Denying terrorists travel documents, drivers’ licenses, and IDs simply presents them some inconveniences - such as using people with no record of terrorism. Seventeen of nineteen 9/11 attackers were unknown to U.S. officials as threats, so it’s obviously not that much of an inconvenience.

Evading identity-based security is so easy. People do it all the time. And it won’t stop under anyone’s version of a national ID. But the 9/11 Commission said … 

Something New to Worry About

Much of the national ID battle happens at the federal level with these national ID laws, of course, but it’s important to realize that federal officials, state officials, companies, and non-profit groups are working to knit together a cradle-to-grave national ID system no matter what happens with REAL ID and PASS ID.

Here’s one worth highlighting: Thirteen states apparently are already scanning, or have scanned, their birth certificates into databases for use in the national ID system. The effort is being led by the National Association for Public Health Statistics and Information Systems in Silver Spring, Maryland. This group will undoubtedly have access to your private health information should federal e-health records be implemented, so you might want to familiarize yourself with them.

Is your state one of them? How many copies of your birth certificate can be found in how many places around the country? You might want to ask your state legislators about that. The future of this effort is to collect biometrics at birth, of course. This is a privacy problem.

But maybe all the privacy concerns have been taken care of. The proponents of REAL/PASS ID found themselves a fig leaf on that score.

Token Cover on Privacy Issues

Ari Schwartz from the Center for Democracy and Technology testified in favor of PASS ID. (Senator Akaka noted in his opening statement that CDT endorses PASS ID.)

He characterized opponents of REAL/PASS ID as wanting to “do nothing.” It’s a classic ploy - but cheaper than we’re used to seeing from Ari and CDT - to mischaracterize opponents as wanting to “do nothing.” As Ari knows well, I have advocated endlessly for a diverse and competitive identification and credentialing system that would provide all the security ID systems can, without government surveillance.

But Ari testified imaginatively about how PASS ID makes a national ID okay. He has concerns with it, of course, yadda yadda yadda - the privacy fig leaf obliged to wear a fig leaf himself.

And this is the unexpected bad news from the hearing. The Center for Democracy and Technology supports having a national ID in the United States.

Many would find this inexplicable, but it’s not. Though the people who work at CDT personally want very much to do the right thing, there are no principles to the organization beside compromise and having a seat at the table (neither of which are actually principles, of course).

CDT plays a wonderful convening role on many issues, and the name of the organization implies that it reconciles technology programs with fundamental societal values. But here it has given political cover to the push for a national ID in the United States. One can’t help wondering if there is anything that would cause CDT to push back from the table and say No.

Making Airline Travel as Unpleasant as Possible

The Transportation Safety Administration long has made air travel as unpleasant as possible without obvious regard to the impact on safety.  Thankfully, the TSA recently dropped the inane procedure of asking to see your boarding pass as you passed through the checkpoint – a few feet away from where you entered the security line, at which point you had shown both your boarding pass and ID. 

However, there are proposals afoot in Congress to set new carry-on luggage restrictions, to be enforced by the TSA, even though they would do nothing to enhance security.  An inch either way on the heighth or width of a bag wouldn’t help any terrorists intent on taking over an airplane.  But the proposed restrictions would inconvenience travelers and allow the airlines to fob off on government what should be their own responsibility for setting luggage standards. 

TSA also has restarted ad hoc inspections of boarding passengers.  At least flights as well as passengers are targeted randomly.  After 9/11 the TSA conducted secondary inspections for every flight.  The process suggested that the initial inspections were unreliable, delayed passengers, and led experienced flyers to game the process.  It was critical to try to hit the front of the line while the inspectors were busy bothering someone else.  There was no full-proof system, but I learned that being first or second in line was particularly dangerous.

Finally TSA dropped the practice.  And, as far as I am aware, no planes were hijacked or terrorist acts committed as a result.  But TSA recently restarted the inspections, though on a random basis.

I had to remember my old lessons last week, when I ran into the routine on my return home from a trip during which I addressed students about liberty.  Luckily I was able to get on board, rather than get stuck as TSA personnel pawed through bags already screened at the security check point.

There’s no fool-proof way to ensure security for air travel.  Unfortunately, it’s a lot easier to inconvenience passengers while only looking like one is ensuring airline security.