Does Risk Management Counsel in Favor of a Biometric Traveler Identity System?

Writing on Reason's Hit & Run blog, Robert Poole argues that the Transportation Security Administration should use a risk-based approach to security. As I noted in my recent "'Strip-or-Grope’ vs. Risk Management" post, the Department of Homeland Security often talks about risk but fails to actually do risk management. Poole and I agree---everyone agrees---that DHS should use risk management. They just don't.

With the pleasure of remembering our excellent 2005 Reason debate, "Transportation Security Aggravation," I must again differ with Poole's prescription, however.

Poole says TSA should separate travelers into three basic groups (quoting at length):

1. Trusted Travelers, who have passed a background check and are issued a biometric ID card that proves (when they arrive at the security checkpoint) that they are the person who was cleared. This group would include cockpit crews, anyone holding a government security clearance, anyone already a member of the Department of Homeland Security’s Global Entry, Sentri, and Nexus, and anyone who applied and was accepted into a new Trusted Traveler program. These people would get to bypass regular security lanes  upon having their biometric card checked at the airport, subject only to random screening of a small fraction.
2. High-risk travelers, either those about whom no information is known or who are flagged by the various Department of Homeland Security (DHS) intelligence lists as warranting “Selectee” status. They would be the only ones facing body-scanners or pat-downs as mandatory, routine screening.
3. Ordinary travelers—basically everyone else, who would go through metal detector and put carry-ons through 2-D X-ray machines. They would not have to remove shoes or jackets, and could travel with liquids. A small fraction of this group would be subject to random “Selectee”-type screening.

He believes, and has argued for years, that dividing "good guys" from "bad guys" will effectively secure. It's certainly intuitive. Poole's a good guy. I'm a good guy. You're a good guy (in a non-gender-specific sense).

Knowing who people are works for us in every day life: Because we can find people who borrow our stuff, for example---and because we know that we can be found---we husband our behavior and generally don't steal things from each other, we, the decent people with a stake in society.

Poole's thinking takes our common experience and scales it up to a national program. Capture people's identities, link enough biography to those identities, and---voila!---we know who the good guys are and who are the (potential) bad.

But precisely what biographical information assures that a person is "good"? (The proposal is for government action: it would be a violation of due process to keep the criteria secret and an equal protection violation to unfairly divide good and bad.) How do we know a person hasn't gone bad from the time that their goodness was established?

The attacker we face with air security measures is not among the decent cohort whose behavior is channeled by identification. That attacker's path to mischief is nicely mapped out by Poole's proposal: Get into the Trusted Traveler group, or find someone who can get in it. (It's easy to know if you're a part of it. They give you a card! You can also test the system to see if you've been designated "high-risk" or "ordinary.")

With a Trusted Traveler positioned to do wrong, chances are good that he or she won't be subjected to screening and can carry whatever dangerous articles onto a plane. The end result? Predictable gnashing of teeth and wailing about a "failure to connect the dots."

All this is not to say that Poole's plan should not be adopted. If he can convince an airline of its merits, and the airline can convince its shareholders, insurers, airports, and their customers, they should implement the program to their heart's content. They should reap the economic gain, too, when they prove that they have found a way to better serve the public's safety, convenience, privacy, and transportation needs.

It is the TSA that should not implement this program. Along with what are significant security defects, it is the creation of a program that the government might use to control access to other goods, services, and infrastructure throughout society. The TSA would migrate toward conditioning all travel on having a government-issued biometric identity card. Fundamentally, the government should not be making these decisions or operating airline security systems.

A very interesting paper surfaced by recent public attention to this issue predicts that annual highway deaths will increase (from an already significant number) by between 11 and 275 because of people's avoidance of privacy-invasive airport procedures. But what caught my eye in it were the following numbers:

During the past decade, terrorist attacks, with respect to air travel in the United States, have occurred three times involving six aircraft. Four planes were hijacked on 9/11, the shoe bomber incident occurred in December 2001, and, most recently, the Christmas Day underwear bomber attempted an attack in 2009. In that same span of time, over 99 million planes took off and landed within the United States, carrying over 7 billion passengers.

Especially because 9/11's "commandeering" attack on air travel has been essentially foreclosed by hardened cockpit doors and passenger/crew awareness, these numbers suggest the smallness of the chance that somone can elude worldwide investigatory pressure, prepare an explosive and detonator that actually work, smuggle both through conventional security, and successfully use them to take down a plane. It hasn't happened in nearly 100 million flights.

This is not an argument to "let up" on security or to stop searching for measures that will cost-effectively drive the chance of attacker success even closer to zero.  But more thorough risk management analysis than mine or Bob Poole's would probably show that accepting the above risk is preferable to either delaying and invading the bodily privacy of travelers or creating a biometric identity and background-check system.