Surveillance State

Homeland security officials seem to have adopted a naive and dangerous standard to detect bombs: Devices sold by major corporations that come packaged in logo-adorned, mass produced containers are perfectly safe, while those made by hobbyists and tinkerers with exposed wires and batteries are potential bombs or at least hoax devices.

The problem with this approach is that in many past cases of successful terrorism, especially those committed by state-sponsored groups, the bombs were actually hidden in fully-functioning mass-market electronic devices: personal stereos and mobile phones. Smart terrorists, the ones we should be trying to thwart, do not walk into an airport with LED lights and a 9-volt battery dangling from their sweatshirt.

This past Friday, MIT sophomore Star Simpson unintentionally caused a gigantic freak-out when she walked into Boston's Logan airport wearing a jacket with a home-made electronics project attached to it. Airport security officials confused the device - a circuit board, a few LED lights, and 9 volt battery - with an improvised explosive device. In a press conference following the incident, state police Maj. Scott Pare said that Simpson is "extremely lucky she followed the instructions or deadly force would have been used. She's lucky to be in a cell as opposed to the morgue."

Star Simpson's panic causing circuit board

(Credit: Lisa Poole/Associated Press)

This comes less than a year after police in Boston scrambled bomb-response units around the city after discovering Moonitites (flashing promotional electronic signs) that had been placed by a viral marketing firm advertising a TV show on Cartoon Network. After the brouhaha faded, Turner Networks agreed to donate two million dollars to the city of Boston in compensation. The two men who had installed the signs were initially charged with placing a hoax device to incite panic, but the charges were later dropped after the men agreed to perform community service.

Aqua Teen Hunger Force promotional LED sign

(Credit: Jimmy / Wikipedia Commons)

Boston has now rightfully earned itself a reputation as a city that overreacts over the smallest thing. Comparing the reactions by Boston officials, and those of Seattle (where the electronic devices were also placed) clearly demonstrates this.

Massachusetts Attorney General Martha Coakley said the device "had a very sinister appearance. It had a battery behind it, and wires." King County (Seattle) Sheriff's spokesman John Urquhart told members of the press "To us, they're so obviously not suspicious ... We don't consider them dangerous" and that "[i]n this day and age, whenever anything remotely suspicious shows up, people get concerned - and that's good. However, people don't need to be concerned about this. These are cartoon characters giving the finger.

With these two episodes of Chicken Little style overreaction by public officials setting the tone, let us now begin to explore the massively flawed policies adopted, albeit unofficially by homeland security officials: Devices sold by major corporations that come packaged in logo-adorned, mass produced containers are perfectly safe, while those made by hobbyists, tinkerers and electronics nerds with exposed wires and batteries are bombs.

But first, a history lesson:

On December 21, 1988, Pan Am Flight 103 was destroyed by a bomb, and the remains landed in and around the town of Lockerbie, Scotland. The terrorists who constructed the Lockerbie bomb hid a smaller charge of explosives in the power pack of a stereo cassette player, with a barometric fuse (set off by a drop in pressure) and timer hidden behind the tape deck. These were primed to go off at a certain time and altitude. Had anyone checked, the tape deck would have blared out music.

In 2006, Israeli paratroopers raided an explosives lab in the West Bank, discovering teddy bears with wires hanging from them, apparently slated to be used as explosive devices. Presumably, the bomb-makers would seal up the teddy bears to hide the wires before sending them out to be used to kill.

A WWII German Exploding Chocolate Bar

(Credit: M15 History For Schools)

Also in 2006, the Shabak, Israel's internal security agency is reported to have assassinated Yahya Ayyash, the chief bomb maker for Hamas. A double-agent within Hamas slipped Ayyash a cellular phone with explosives hidden inside. The fully working telephone was reportedly tracked by Israeli Intelligence, who listened in on conversations and detonated the device when it was up to Yahya's ear.

These are just a few instances of explosives being hidden in innocent looking devices. The CIA is reported to have attempted to kill Castro with an exploding cigar. Furthermore, according to the British MI5 history archive, German intelligence agencies during WWII created hand grenades that were made to look like chocolate bars. The candy's flavor could best be described as explosive.

After that stroll down memory lane, it should be clear that motivated persons, be they terrorist groups, resistance fighters, or state security agencies, can easily package up a bomb so that it looks like a completely innocent object - something sold by a respected company and bought off the shelf from a major retailer. Moreover, in many cases, the shell device containing the bomb can still function - as a mobile phone, a laptop, or a personal stereo.

What this means is that from a risk-analysis perspective, up until the moment someone is searched at the airport security checkpoint, every single passenger is equally likely to have a bomb on them. The laptop being used in an airport Starbucks, the boom-box being carried by a music fan, the carry-on bag with wheels being pulled by a passenger, or the circuit board attached to the sweatshirt of an MIT student are all equally likely to be bombs. The mere fact that one of the items happens to have exposed wires, a few LED lights and a 9-volt battery in no way makes it more likely to be a bomb.

Suspected Terrorist button made famous by John Gilmore

(Credit: Aaron Swartz)

Yes, some of the "terrorists" caught over the past few years have been complete idiots. Richard Reid, who was unable to light his own shoe-bomb with matches, and the Glasgow airport bombers come to mind. Our government should not expect that future terrorists will be as stupid. After all, the 9/11 hijackers were willing to go to flight-training school in order to prepare for their attack. Our security policies should be focused at catching the intelligent, well funded and patient attackers, not just the idiots.

Airport security and law enforcement need to radically rewrite their training materials to focus more on actual threats, and not those pictured in episodes of TV's 24. Real terrorists hoping to take down an airplane do not advertise themselves by wearing "Terrorist" buttons and badges, t-shirts with Arabic writing, or with blinking LED lights, exposed wires and a 9-volt battery hanging from their chest. Terrorists, at least the smart ones, will do their very best to try and stay under the radar. And thus, the sad fact is that in focusing on attack-scenarios and bomb designs straight from a Hollywood movie, security officials may very well be diverting manpower away from the real threat: Someone who looks just like you or me.

Attempts to assert your right to fly without ID can often be very frustrating, due to Transportation Security Administration and airport officials not knowing their own rules.

With any luck, this should no longer be an issue because the TSA has, at last, clarified things.

Passengers with tickets for domestic flights are under no obligation to present ID to TSA. Passengers may be required to show ID to airline employees, but that is a contractual matter between the airlines and their passengers. U.S. government employees cannot, however, require you to show ID in order to pass through the security checkpoints.

Poster at Burning Man '06

(Credit: Christopher Soghoian)

I have personally flown over a dozen times without showing a single form of ID. A number of others have documented similar success stories. Unfortunately, some TSA employees are not aware of their own rules, and at times, have forced passengers to produce ID. Blogger Jake Appelbaum has documented one such experience. Something similar happened to me earlier this year when TSA agents brought over an airport police officer who then compelled me to produce an ID.

The 9th Circuit Federal Court of Appeals clarified a passenger's right to travel without showing ID in its ruling in Gilmore v. Gonzales. Expecting that a TSA screening agent be able to parse a court opinion is often a losing battle. It is for that reason that I've spent the last few months sending letters back and forth to TSA, via my senator, which at least guarantees a reply. Eventually, I was able to get something from TSA in writing that confirms passengers are able to legally fly without showing ID. For those of you who'd like to give it a shot, print out this letter and take it with you. It should (hopefully) reduce any push-back you get from TSA agents.

For those of you who don't get a kick out of asserting your rights, you may wonder why you would ever want to do this. After all, those passengers who decline to provide ID to TSA will instead be forced to go through an invasive "secondary screening" process--a five-minute-or-so procedure in which passengers are patted down, poked, prodded and have their carry-on bag thoroughly searched by hand.

There is a little known, but extremely useful side effect of refusing to show ID: In many airports, you get bumped to the front of the security line. As illogical as it may seem, you can often get through security faster by refusing or "forgetting" your ID at home than if you followed the normal security process.

So, the next time you fly, use my letter and repeat after me: "I hereby assert my right to fly without showing an identification document to any government official." With any luck, you should get through without any problems, and more than likely, you'll get bumped to the front of the queue. If you get any push-back at all, remember the magic words, "I'd like to speak to a supervisor please."

For further reading on the subject: I have a research paper documenting (and fixing) security flaws in the boarding pass system and no-fly lists that'll be published at the IDMAN workshop in October. A pre-print copy of the paper is available online: Insecure Flight: Broken Boarding Passes and Ineffective Terrorist Watch Lists. Researchers from MIT analyzed the benefits of racial profiling in airport security back in 2002. I highly recommend their paper, Carnival Booth: An Algorithm for Defeating the Computer-Assisted Passenger Screening System. Bruce Schneier has been talking about airport security flaws for years, and most recently published a must-read interview with TSA chief Kip Hawley.

Letter from TSA

(Credit: Christopher Soghoian)

Click to see a full-size copy (pdf).