Crypto-Gram Newsletter
January 15, 2012
by Bruce Schneier
[original link]
Posted here on 1/14/12
Chief Security Technology Officer, BT
schneier@schneier.com
http://www.schneier.com
A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.
For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>.
You can read this issue on the web at <http://www.schneier.com/crypto-gram-1201.html>. These same essays and news items appear in the "Schneier on Security" blog at <http://www.schneier.com/blog>, along with a lively comment section. An RSS feed is available.
In this issue:
Have you wondered what $1.2 billion in airport security gets you? The TSA has compiled its own "Top 10 Good Catches of
2011":
10) Snakes, turtles, and birds were found at Miami (MIA) and Los Angeles (LAX). I'm just happy there weren't any
lions, tigers, and bears...
[...]
3) Over 1,200 firearms were discovered at TSA checkpoints across the nation in 2011. Many guns are found loaded
with rounds in the chamber. Most passengers simply state they forgot they had a gun in their bag.
2) A loaded .380 pistol was found strapped to passenger's ankle with the body scanner at Detroit (DTW). You guessed
it, he forgot it was there...
1) Small chunks of C4 explosives were found in passenger's checked luggage in Yuma (YUM). Believe it or not, he
was bringing it home to show his family.
That's right; not a single terrorist on the list. Mostly forgetful, and entirely innocent, people. Note that they fail
to point out that the firearms and knives would have been just as easily caught by pre-9/11 screening procedures. And that
the C4 -- their #1 "good catch" -- was on the return flight; they missed it the first time. So only 1 for 2 on that one.
And the TSA decided not to mention its stupidest confiscations:
TSA confiscates a butter knife from an airline pilot. TSA confiscates a teenage girl's purse with an embroidered
handgun design. TSA confiscates a 4-inch plastic rifle from a GI Joe action doll on the grounds that it's a "replica weapon."
TSA confiscates a liquid-filled baby rattle from airline pilot's infant daughter. TSA confiscates a plastic "Star Wars" lightsaber
from a toddler.
The TSA's Top 10 Good Catches of 2011:
http://blog.tsa.gov/2012/01/...
The TSA missed the C4 the first time.
http://www.oaoa.com/articles/...
TSA stupid confiscations:
http://www.salon.com/2012/01/04/...
The Vanity Fair article:
http://www.vanityfair.com/culture/features/2011/12/...
I have a love/hate relationship with the Cato Institute. Most of their analysis I strongly disagree with, but some of it
I equally strongly agree with. Last September 11 -- the tenth anniversary of 9/11 -- Cato's David Rittgers published "Abolish
the Department of Homeland Security":
DHS has too many subdivisions in too many disparate fields to operate effectively. Agencies with responsibilities
for counterfeiting investigations, border security, disaster preparedness, federal law enforcement training, biological warfare
defense, and computer incident response find themselves under the same cabinet official. This arrangement has not enhanced
the government's competence. Americans are not safer because the head of DHS is simultaneously responsible for airport security
and governmental efforts to counter potential flu epidemics.
National defense is a key governmental responsibility, but focusing too many resources on trying to defend every
potential terrorist target is a recipe for wasteful spending. Our limited resources are better spent on investigating and
arresting aspiring terrorists. DHS responsibilities for aviation security, domestic surveillance, and port security have made
it too easy for politicians to disguise pork barrel spending in red, white, and blue. Politicians want to bring money home
to their districts, and as a result, DHS appropriations too often differ from what ought to be DHS priorities.
I agree with that. In fact, in 2003, when the country was debating a single organization that would be responsible for
most (not all, since the Justice Department, the State Department, and the Department of Defense were too powerful to lose
any pieces of themselves) of the country's counterterrorism efforts, I wrote:
Our nation may actually be less secure if the Department of Homeland Security eventually takes over the responsibilities
of existing agencies. The last thing we want is for the Department of Energy, the Department of Commerce, and the Department
of State to say: "Security; that's the responsibility of the DHS."
Security is the responsibility of everyone in government. We won't defeat terrorism by finding a single thing
that works all the time. We'll defeat terrorism when every little thing works in its own way, and together provides an immune
system for our society. Unless the DHS distributes security responsibility even as it centralizes coordination, it won't improve
our nation's security.
Back to the Cato report:
The Department of Homeland Security should be abolished and its components reorganized into more practical groupings.
The agencies tasked with immigration, border security, and customs enforcement belong under the same oversight agency, which
could appropriately be called the Border Security Administration. The Transportation Security Administration and Federal Air
Marshals Service should be abolished, and the federal government should end support for fusion centers. The remaining DHS
organizations should return to their former parent agencies.
Hard to argue with most of that, although abolishing the TSA isn't a good idea. Airport security should be rolled back
to pre-9/11 levels, but someone is going to have to be in charge of it. Putting the airlines in charge of it doesn't make
sense; their incentives are going to be passenger service rather than security. Some government agency either has to hire
the screeners and staff the checkpoints, or make and enforce rules for contractor-staffed checkpoints to follow.
Last November, the U.S. Congressional Republicans published a report very critical of the TSA: "A Decade Later: A Call
for TSA Reform."
This report is an examination and critical analysis of the development, evolution, and current status and performance
of TSA ten years after its creation. Since its inception, TSA has lost its focus on transportation security. Instead, it has
grown into an enormous, inflexible and distracted bureaucracy, more concerned with human resource management and consolidating
power, and acting reactively instead of proactively. As discussed more fully in the "Recommendations" section on page 18,
TSA must realign its responsibilities as a federal regulator and focus on analyzing intelligence, setting screening and security
standards based on risk, auditing passenger and baggage screening operations, and ensuring compliance with national screening
standards.
In a related link, there's a response to a petition to abolish the TSA. The response is by TSA administrator John Pistole,
so it's not the most objective piece of writing on the topic, and doesn't actually respond to the petition:
Why TSA Exists.
TSA was created two months after the September 11 terrorist attacks, when Congress passed the Aviation and Transportation
Security Act (ATSA) [.pdf] to keep the millions of Americans who travel each day safe and secure across numerous modes of
transportation.
Over the past 10 years, TSA has strengthened security by creating successful programs and deploying technologies
that were not in place prior to September 11, while also taking steps whenever possible to enhance the passenger experience.
Here are just a few of the many steps TSA has taken to strengthen our multi-layered approach to security....
[...]
Our Nation is safer and better prepared today because of these and other efforts of the Department of Homeland
Security, TSA, and our federal, state, local and international partners. TSA is constantly identifying ways to continue to
strengthen security and improve the passenger experience and appreciates the feedback of the public.
Pistole just assumes that what his organization is doing is important, and never even mentions how much it costs or whether
it's worth it.
The Cato report:
ttp://www.cato.org/pub_display.php?pub_id=13650
My 2003 essay:
http://www.schneier.com/essay-007.html
The Congressional Republican report:
http://republicans.transportation.house.gov/Media/...
The TSA response to the petition:
https://wwws.whitehouse.gov/petitions/!/response/... | 
