Security Theater

Yes, I am one of those assholes who brings everything as carry-on on the plane that she isn't suppose to. My most frequent candidates are a set of lockpicks which I have in the past three months carried through no less than seven different airports (props to Flagstaff Arizona for at least removing them from my bag to look at them before permitting me to carry them on board.) Other frequent fliers are the more mundane large bottles of shampoo and conditioner, tubes of toothpaste, wires, electronic pieces, breadboards, and various other oddities. The only things I have ever had confiscated were a pair of cans of Rockstar, and a part of me thinks that might have been mostly because the TSA employee was thirsty. I did have a pretty near miss though when those same Flagstaff employees took a long hard look and an extra scan of my copy of The Little Prince. I guess you never can be too careful with those terrorist French and their mindless propaganda.

For a long time I attributed this to the fact that I would intentionally wear clothes to the airport which marked me as working for the feds. I learned the power of flying with a federal logo stamped on you once when confronted by a slightly baffled TSA employee who had recently extracted a cast-iron wok from my carry-on luggage (long story).

"What is this?"

"That, sir," I slid my thumbs along the top of the zipper of my ratty hoodie to flick what would have been the collar forward, emphasizing the federal logo on the right breast, "is a wok."

"Oh," he said, but I watched his eyes catch the logo.

"Will that be all?"

"Uh, yes," he said and handed me the wok. I took it and walked before hearing one of the last calls for the boarding on my flight, at which point I bolted down the terminal, still carrying the cooking implement in my left hand, trying to hold it as little like a club as possible. The TSA employee never said a word, he had probably gone on to the next customer by that time.

The "official-looking" hoodie was out of the gift shop. It wasn't like there had been a whole lot of other places to buy clothes when you're stranded on a federal base.

After I was given my uniform jacket I felt comfortable pushing the limitations much further to almost no resistance. Eventually I decided to forgo the effort of donning the jacket, as while it is very comfortable I dislike the stares I collect when wearing it in public.

It seems I am not alone in this activity. In this hilarious and rather well-written article one Jeffrey Goldberg describes bringing scissors, multiple large bottles of anything he pleases so long as they are labeled to be contact solution, a false beer belly of beer, a knife, and various other things as carry on. To make this more amusing he did it while also carrying things like a three foot by four foot Hezbollah flag and wearing shirts printed with lines like "Osama Bin Ladin: Hero of Islam." His article brought up another fun issue in the ID triangle: namely that you can fly if you are on the no fly list. This is done in a few simple steps.

1. Buy a ticket that isn't in your real name. This is where the name is checked against the no-fly list and so your fake name will not trigger anything.
   
2. Print your real boarding pass.
   
3. Print a fake boarding pass with your real name.
4. Go through security with your fake boarding pass and your real ID. All that is checked here is that your boarding pass matches your ID. It is not checked against the master no-fly list.
5. Present your real ticket at the gate. Since your ID is not checked here, nobody will notice the name does not match. Since it is a real boarding pass it will pass the barcode scanner, when your fake one would not.

The article recommended using photoshop but Christopher Soghoian made a wonderful little tool which will generate passes for you automatically for Northwest Airlines flights. While the FBI eventually shut him down the mirror of the code was left. He also wrote a neat little paper on it with plenty of information about how these loops might be closed. It has been available two and a half years now and ignored by official channels quite efficiently aside from their attempts to bring him to court for publishing it.

More disturbing are the words of Bruce Schneier (of crypto war fame) from 2002 warning (summarized by another author: Mann) about these large scale systems, which have also been primarily ignored.

The argument that a system which relies on secrecy to function (as our airport security system does) is inherently ineffective because such secrets are not well kept is part of what has made modern cryptology what it is today, and considered a well-beaten dead horse by many.

However, some other concepts pulled from the article I found quite novel. For example, if a piece of facial recognition software is accurate 99.32% of the time as claimed by certain manufacturers, and if good-quality photographs of all the terrorists are available, and if an airport had 25 million people go through it a year (such as Boston according to 2001 statistics) then you flag up to 170,000 people each year as terrorists from a single medium-sized airport. Consider that we have had well under 100 terrorists on airplanes nation-wide over a span of about 10 years and that this alarm would go off approximately 500 times a day per airport of this size. This is an alarm which would get rapidly downplayed or ignored by stressed-out TSA employees who are just trying to contain a small mob of people who are all frantically trying to make their flights. What does this mean? It means the enterprising young hacker will still be in an environment where a little charisma will get him through the gate, and the same of a terrorist.

Biometric information suffers many of the same abuses in the article: that as long as we continue to put our absolute faith in imperfect technology (as all technology always is) and have no proper situation to handle its failure, we will be left disappointed in the results. Inattentive guards in the Mann article permitted researchers to game the fingerprint and other biometric readers in any number of ways in the middle of airports. This included doing things like holding masks up over their eyes to fake a retina scan.

Part of this we have fed ourselves. To admit that our systems are fallible or downright ineffective would be to admit a mistake. Every time something bad happens the public wants to believe that Something Is Being Done, and as time passes we are putting more into making sure that our "corrections" are highly visible than that they have impact. Here's a great example:

Special measures have been taken to make it impossible for a terrorist to repeat the Detroit bombing attempt. Mr Abdulmutallab had emerged from the toilet, put a blanket on his lap complaining of an upset stomach, then tried to set off the bomb. Passengers and crew restrained him as flames leapt from his clothing.

In the final hour before landing in the US, passengers are now banned from standing up, using toilets and holding blankets.

Aside from the ACLU which I am sure is already drooling over the fact that use of a lavatory is generally not considered something you can reasonably deny a person in need (it is not legal for things like schools to operate when the bathrooms are broken for this reason) comes the general point that causing a four year old child to piss themselves will not make America safer. Small children (like most sane people) hate plane bathrooms. They are renowned for holding it in as long as possible, and for disregarding parent's warnings that "if you don't go now there won't be another stop for a while." Ask any parent who has taken a small child on a significant car ride. Furthermore, I'm pretty sure whoever gets to sit in a wet seat next flight won't feel America is a whole lot safer either. What will, for the most part, happen? When people have to go, they have to go, and the attendants will probably let them go if they beg hard enough.

What does that mean? It means this is a rule we will put our faith in, but that people will not keep. This is a common security problem: take offices where password changes are mandated so often that people have trouble remembering them. Instead they just slap an incrementing number on the end of the password or write it on a slip of paper on their desk. Other examples are the numerous recorded times when government officials have taken restricted information off of the protected government networks to unsecured computers. They do this because doing work on the secured computers is made slow and tedious by the oppressive security measures.

As long as our government continues to take this heavy-handed blanket approach to our security in airports people will keep adding loopholes, where formal (such as permitting people to print their own boarding passes) or informal (such as using tha bathroom), to keep the system functioning. These gaps, combined with our absolute faith in the technology which is meant to prevent them, provide fantastic exploratory spaces for hackers. I genuinely hope to see many published exploits in the coming months from clever young minds, and I hope they are found, made public enough to be an embarrassment, and corrected before anybody malicious takes advantage of them.

Happy hunting.

Related Posts:

• What happens to what the TSA actually does confiscate
• Security theater in locks
  

Nothing Will Save You from Basic Arithmatic

Nothing made me lose so much faith in the quality of television than being quarantined to my house for approximately three months in high school. For the first time the place where I slept was the same place where a television was kept. I remember laying there, neither awake nor asleep, channel flipping.

A blond woman with a great deal of hair product was sitting on a shiny polished desk in front of what was probably suppose to be a soothing blue background. On the desk were five diet cokes and a medium McDonald's fry. She sat and explained that "many dieters would never dream of eating the medium fry while on a diet but that they will happily drink a diet coke a day and still think they are following their diet. Mathematically they add up to the same thing..."

I remember being really puzzled. Why is this news?

***

Now its my sophomore year of college. I'm standing in a Bank of America branch trying to untangle my accounts cross-state when an advertisement catches my eye. Why do banks advertise for themselves inside their branches? Aren't I already here because I use them? Its not like I could even walk into a random bank to deposit my checks or get an account fixed even if I wanted to.

"Bank of America introduces new 'keep the change' program to help YOU save!"

Eternally a sucker for free money, I ask the teller to explain the system to me. He says that for the first few months of this system every time you make a debit card purchase the charge is rounded up to the nearest dollar and moved to your savings account from your checking. For a brief time (a month or so) Bank of America will match these deposits doubling your money. That much sounded quite nice. After that, the teller explained, Bank of America will continue to round up your purchase to the nearest dollar and move the remaining money from your checking to your savings account.

"Why?" I asked.

"To help you save money!"

How MORONIC is that? You will incrementally hide my own money from me so I don't know it exists and I'll save it?

***

Magpie is looking to buy a house. Sometimes when we are going someplace in the car he shows me neighborhoods he is considering. We, with gleeful political incorrectness, call the number of satellite televisions to visibly broken things on the exterior of a house the "ghettoness ratio." It is what we consider the fundamental measure of how likely the average poor person in that areas is to stay poor. That 100+ dollar bill a month is slowly killing that family's budget because they have not realized that it is not the cost of the bill presented to you that matters so much as the cost of the bill over the time span it covers.

You could make your exhaust work right on your car if you could just cut that 100+ dollar satellite bill for six months. Once that is fixed your car will get better milage per gallon, put that money you don't spend on gas into energy efficient light bulbs. Most states are beginning to heavily subsidize them anyway and now you're saving money on your power bills. Now you're saving money in three places, and savings will continue to pay off so long as you mantain that lifestyle.

But what is more important? 200 channels of television. I bet you don't even watch half of them. The road to actual financial independance, and not just the laywers on the radio who want to erase your debt so you can dig yourself back in again, isn't that far away if you could just suck it up, turn off the TV, and do it.

***

There is something apparently fundamentally missing here, and that is the ability of the American population in general to budget, to understand that conservation of mass exists outside of a textbook. You can make all the congressional and bank bail-out jokes you want but I'd like to see you put down that daily latte while you do it. Your latte at $3.99 5 days a week for 50 working weeks a year costs you $997.50 a year or, if you insist on blowing it, easily a hawaiian vacation. Is a $70 dollar a month cell phone plan with data instead of the $40 dollar voice and text one really worth it? That's another 360 dollars you could have. Do you buy a $5 dollar lunch every day at work? Materials to pack a lunch cost about $1. That's another approximately 1000 dollars you could have every year, want to go to Hawaii a second time with that? Unless you are fabulously rich I can't see how this is something to just shrug off, and even if you are, fucking blow your money with a little bit of style at least. 10 minutes a day you don't have to spend making yourself a sandwich? What sort of vacation is that. You probably blow about 10 minutes a day on commercials if you watch a single half hour of television.

***

"She's on the Atkins diet," he said.

My mentor, Rokelbee, rolled his eyes.

"No you have heard of that one haven't you? It really works. It was proven..."

"They have been saying that on every new diet fad that has ever come out in my entire life. It will be gone in two years, you wait and see. There are no subsitutes for eating right, for getting exercize, and for common sense. That is just how the world works."

Nothing Says "Merry Christmas" like a Dead Fish in a Jar

When I lived in Hong Kong our work there related to removing as many workers as possible from a designated market. Seeing as there isn't exactly a worker's shortage in China we had to find a place to move all these people into ourselves.

We heard tell of a group of fishermen who had turned their former livelihoods into a tourist concept. Because of tax laws in Hong Kong and the fact that their tour location was out on the ocean they hardly had to pay taxes. It seemed pretty ideal, and as foreigners we were pretty well situated to evaluate whether this would likely become successful or a larger market which we could put our market sector into.

A large flat floating dock formed a "town square" and fishing boats were parked continuously along the perimeter.

What fascinated me most about this place was the gift shop, and what fascinated me most about the gift shop was a rack of small bird-like objects with a slick plastic coating on the outside which hung from fishing line and a key chain loop. They had small googly eyes and a straw hat glued on to them. The small beaks on them made them look nothing short of alien but obviously somebody had found them endearing to dress them and market them like this.

Picking one up I shook it. It made a bizarre rattling noise but seemed to have a significant amount of internal structure to it. Why would somebody put so much internal structure into a cheap little keychain? It could have been solid with a single plastic mold around the outside and it would have held up just fine.

"What is this?" I asked. The translator who we had access to (since this was during work hours) turned to one of the shop owners.

"They are keychains," the translator reported, "They are made from sun-dried baby puffer fish."

I thought about Americans and what those who feel a need to compulsively buy things out of gift shops expect out of gift shops. These were not shot glasses with "I love ex-fishermen" on them nor T-shirts not coffee mugs printed with the same.

They also could not pass as some traditional art form which makes white tourists feel culturally aware and superior by the fact that it hangs prominently on their living room wall at home where passers by might politely ask about it.

Visitor who has come over for dinner: oh, what is that?
Smug host: that's a hand-made Incan blanket from our trip through South America. Its made out of real Alpaca wool and dyed with natural pigments just like the native persons there have done for thousands of years.

Alternative scenario
Smug host: that's a key chain from Hong Kong. Its made of a dead baby fish and coated in plastic, just like former fishermen of Hong Kong have been doing since the invention of the plastic googly-eyes to glue on the front.

I just didn't see it going over quite as well.

It was then that I realized I simply had to have one. What would be more hilarious than to show it off with the same air of arrogance only to watch the people who cared about petty things like that recoil in horror? And it would only cost me about a dollar fifty American? Sounds like a deal to me!

So I bought it and I brought it back to my apartment and placed it in an empty nutella glass. I put the jar with the dead fish in it on the table and stared at it for a bit. The initial amusement of it had worn off and so I left it there and turned my attention to my computer. There I spotted an IM window open previously with PJ.

Every year there are people who you care about but who you don't know what to give them for Christmas. You want to give them something, but you can't think of anything they need or want within a socially acceptable price range. PJ was one of those people that year for me. My solution to this is every year I choose one of these people and give them a small cardboard box filled with small cheap items which they find amusing, and whose sum total equates about to one present. Christmas had already passed but I was scheduled to see PJ in March so I had told him I was bringing his present then. PJ's box had been previously filled with strips of LEDs, a few small parts I had scavenged which were perfect for making robots with, and other misc junk which I knew he would love.

Then I turned to the fish. Even better than me acting proud of this as my own possession, how much more infinitely hilarious would it be if I passed this off as a valuable gift?

I'm not the most rational and logical person I'll admit, but PJ seems to have an abnormally low general opinion of my common sense. Unfounded or founded, it is an awful lot of fun to mess with him using that fact. Opening the IM window again I decided this was a great time for continuing this tradition.

Pika: I got you a souvenir
Pika: hopefully they won't find it in customs, I think they would be upset with me
PJ: What have you done now?

I choose to leave the situation there for the time being and not discuss it further.

In March I brought PJ his Christmas present. He eyed the box carefully, obviously remembering the customs comment.

"Come on," I coaxed, "open it."

He opened it and found the Nutella jar directly on top of his other presents. "Huh," he asked intrigued, shaking the jar slightly, "What is this?"

"Its a dead fish in a jar!"

PJ nearly dropped the jar but instead placed it to one side.

"Come on!" I said, "Nothing says 'Merry Christmas' like a dead fish in a jar!"

"You know," PJ laughed, "I guess its true."