So wait, airport explosives screening is worthless?

| Comments (5) |
Reuters reports (well, reports that NBC News Reports) that GAO tests of explosive screening in airports were, uh, not encouraging (þ Shostack):
WASHINGTON (Reuters) - Security screeners at 21 U.S. airports failed to find bomb-making materials during recent government tests, NBC Nightly News reported on Thursday.

Federal agents carrying materials that could be used to make bombs escaped detection in airport screening during tests conducted between October and January, NBC said, citing government sources.

"In all 21 airports tested, no machine, no swab, no screener anywhere stopped the bomb materials from getting through. Even when investigators deliberately triggered extra screening of bags, no one stopped these materials," the report said.

NBC said, for security reasons, it would not name the airports nor the ingredients involved in the tests conducted by the Government Accountability Office (GAO), the watchdog arm of Congress.

So, assuming this is true (a more direct source would be nice), then there are a number of possibilities:

  1. The explosive detection devices don't work at all.
  2. The explosive detection devices work in the lab but you can't get a reliable sample off of people's bags in an aiport setting.
  3. The procedures being used by the TSA techs are broken somehow.
  4. The TSA techs running the machines are too incompetent to use them.

It's just wild speculation, but my guess is it's (3). It's hard to believe that (even) TSA would deploy something that didn't work at all, so I think that rules out (1) and probably (2), since surely they did some field testing. Incompetence is always a possibility, but it's similarly hard to believe that if they tested at 21 airports they couldn't find someone competent. So, my money is on a systematic procedure problem, and I've got one in mind: these desktop explosive sensors have really high false positive rates, on the order of a .1-2% percent. So, what I'm guessing (and that's all it is, but one of the nice things about it being a blog is you get to do that) is that the airport techs dial the sensitivity way down to avoid having to deal with false positives (which is surely what nearly all positive results they get are. Whatever the reason, it's pretty suboptimal if we can't even detect explosives in canned tests.

5 Comments

Having been the victim of two false positives from these things (once in the US and once in Australia), I think you are right on the money. But perhaps it isn't that they dial down the sensitivity on the machine so much so as they dial back the sensitivity in their heads. It's like care alarms, no one ever pays attention to them going off any more.

I'm not sure why you're ruling out 1 & 2 so quickly. There are clearly organizational mandates to "do something." There was the $250M purchase of baggage screening machines of unknown quality. (See, e.g., http://www.interesting-people.org/archives/interesting-people/200304/msg00081.html)

1 and 2 might very well be a part of it:

Look at bomb-screening dogs walking along. Its' been shown those REALLY don't work.

And it could be the "explosive components" in question were ones which 1 and 2 apply.

I think you are far too quick to dismiss the idea that none of this might work at all.

Keep in mind that the same materials you find in explosives are found in all sorts of other items. The same materials you use to make explosives are used to make all sorts of other items. Just because the TSA wants magic machines that can tell the difference between a nitro group used in explosives and a nitro group in a perfectly legitimate item doesn't mean that the laws of physics permit this.

Indeed, it isn't even clear you can make a non-intrusive machine to detect explosives reliably at all. Much of what they do in the airports looks for materials that appear to have the right density and size and such and hope that those happen to be explosives, but presumably smart attackers can get around it.

I suspect that it might be due to what Bruce Schneier is always railing about: The machines might be very sensitive, but they're not specific enough. So after 3-4 years of working with them, the TSA goons have now been trained to nearly ignore positive results. Because in those 3-4 years, the alarm has gone off probably a couple times per day every day (ie a few thousand false positives per shift worker), and not once has there been a true-positive result since the end of the field-testing period, when the TSA goons knew that they were being tested, and so were extra attentive.

Too many false-positives, and you tune out the warning system.

Leave a comment