Penetration testing the TSA

Last week I traveled from Washington, D.C. to Hartford, Connecticut and then back again on a business trip. I’m also really annoyed at recent Transportation Security Administration (TSA) regulations prohibiting liquids in carry-on luggage, as it’s inconvenient to have to separate everything out into a clear plastic bag, and even then, the total amount you can carry is heavily limited (not even a normal sized tube of toothpaste, for instance). For a business traveler who’s only gone for four days and doesn’t want to risk losing anything in checked luggage, these restrictions are limiting. And they’re not making us safer by any means; it’s really just yet another way in which we’re letting the terrorists win by making us afraid.

So on the return trip, I decided to check out just how stringent the liquids regulations were. Would they really know if I tried to bring a tiny little bit of liquid through the scanner? So I grabbed a single 1 oz bottle of shampoo from the hotel and put it in my luggage, then confidently strode through security.
Unfortunately, they did pick up the shampoo, leading to a hand inspection of my luggage. I just played dumb, acting like I didn’t know both that it was even in there and also that it wasn’t allowed. The TSA woman, who wasn’t much older than I am, let me through with the shampoo immediately after finding it (I guess because I’m white and was wearing business attire, hardly the stereotypical terrorist). Funnily enough, the woman in front of me was stopped trying to take back half a dozen mini bottles of shampoo from a hotel. Obviously this kind of thing happens all the time at TSA scanning stations, while as far as we know, no one has ever tried to bring through liquid explosives.

So, yeah, the X-ray scanning machines are indeed good enough to pick up even a tiny bit of liquid, and if the TSA employee manning it is going their job “properly”, you will get your luggage searched. Having abandoned that avenue of search, I don’t know where to proceed next, as there’s no way to get through while wearing shoes or leaving a laptop in a bag (the one time I tried the latter, I ended up getting the laptop swabbed for traces of explosives). And I dare not try to bring a knife through security, both because I don’t want to be arrested and because I don’t want to lose a good knife.

5 Responses to “Penetration testing the TSA”

  1. drinian Says:

    They are getting really good at noticing bottles, and I generally carry a roll of quarters with me that apparently looks suspicious on X-ray. I get stopped for that much more often than for the giant bird’s nest of cables that usually hangs around my laptop bag. But there’s still no rhyme or reason to most of the decisions they make for extra screening, it seems.

    If the TSA really wanted to do a good job of security, they would hire enough people to ensure that there is never a line waiting, enabling them to take their time with each person. They’ve already bought the hardware at most locations; it’s been sitting dormant for years (political pork, most likely). Then they could start training their screeners to use some knowledge along with the rote rules they have now.

    Incidentally, Japan has used liquid explosive detectors for two years now. Why no-one in the TSA seems aware of this seems beyond me.

  2. Cyde Weys Says:

    Funnily enough, the past few times I’ve gone through airport security, they’ve had different apparatii at different stations. In Hartford, one station had the walk-through machine that puffs you with air to detect explosives residue, while one did not. I elected to go through the newfangled machine (and it took a little bit longer to boot) just to see what it was like (it was underwhelming), but I easily had the choice of not doing it. And then earlier today at BWI I had a choice of going through a simple X-ray machine or a backscatter radiation machine. Obviously I did not elect to go through the radiation machine.

    It makes you wonder though, how are we stopping the terrorists if we’re giving them a choice of choosing the laxer security screening? Shouldn’t all of the stations in an airport have the same equipment? It’s kind of like how you have to plug all of the holes in a ship to prevent it from sinking.

  3. Kelly Martin Says:

    Last time I was in Portland I was required to go through the “puffer” (they were making everyone with a laptop go through it). Frankly I think most of the TSA screening processes are intended to create the impression that the TSA is doing something, without any real concern as to whether they actually reduce the risk of an actual terrorist getting through. I think there is also the whole need to make excuses to spend government money on technology that doesn’t necessarily help with reducing risk but definitely does help with padding profit margins.

  4. arensb Says:

    Kelly Martin:

    Frankly I think most of the TSA screening processes are intended to create the impression that the TSA is doing something

    The phrase you’re looking for is “security theater”. Bruce Schneier talks about it in his excellent book Beyond Fear. He also points out that some security theater can be a good thing (e.g., it can be reassuring to see a cop on the beat every once in a while, even if most law enforcement is done through surveillance cameras and such), but obviously it shouldn’t be done at the expense of real security, or in such a way that it causes other security problems (e.g., long lines of people at airports, that could be seen as targets).

    Another problem endemic to the security field is that it’s often hard to judge how effective any given measure is: sure, the US hasn’t been attacked with hijacked airliners since 9/11, but is that because Al Qaeda is in disarray because of the war in Afghanistan? Or because better intelligence coordination through DHS allows such plots to be stopped before they get to the airport? Or because the TSA confiscates shampoo bottles? Or simply because the bad guys haven’t tried a repeat of 9/11? Without knowing how many attempts there have been, it’s impossible to tell how effective a security measure is.

  5. JR Dallas Says:

    This whole system is a joke, the only way to get any form of decent government and security in our lives is to overthrow the current establishment, look who we have elected, look who we have the choice to elect, pathetic. Lets raise up and throw off this yoke, not necessarily a yoke of oppresion, but of keeping us in fear, of keeping us ignorant, of putting us thru these rediculous security measures. Only if we destroy Washington will we be free.