« The best analogy ever for computers | Home | Content addressable web? »

July 29, 2002

Airline security: not solving the right problems

I've only flown once since 9/11, so I haven't paid attention to airport security. But if what I saw this morning was representative, something's not right.

My oldest son was flying out of Atlanta to meet his grandparents. We passed through security at three different points: the ticket counter, going into the terminal, and at the gate. I've never seen guards at the ticket counter before. But here they were, and someone in front of us was told "You've been selected for random screening." They were taken aside, and the bag they had just checked was searched. That seems reasonable; unscreened bags are a clear risk.

What got to me, though, was at the gate. As people lined up to board, there were a few security people with their wands just off to the side. I wasn't paying close attention until I noticed a woman being screened. Right next to her were two little kids: maybe 5 or 6, and they were being screened as well. The guard asked one of the kids to take off her sandals. She did, and the guard waved her wand over them.

Anyone who's ever had to get serious about security understands that security mechanisms and procedures must be guided by threat models and risk assessments. (See Bruce Schneier's Secrets & Lies for a computers security-oriented treatment.) How likely is it that small children are going to be used to smuggle contraband or bombs in their shoes? Is completely random screening more or less likely to be effective than selective screening?

Right after 9/11 the FAA directed that cars shouldn't be allowed to park close to terminals. The result: rows and rows of already scarce parking were closed. Yes, someone with a bomb could come to the airport and blow away part of the terminal. But how does that relate to someone taking over an airplane and using it as a weapon, the unique threat revealed by 9/11? What kind of risk assessment lead from one to the other?

It's tempting to dismiss these kinds of steps as mere show. That's not quite fair; appearance and perception are one part of the security equation. 9/11 drove people away from air travel; people need to be reassured that it's safe to travel again, and that need drives some of the more visible security measures. But I think the wrong balance is being struck by airport security policies: the cure may be worse than disease. Air travel has gotten a lot less convenient, and in that classic security risk vs. cost equation, something's out of whack.