Security Theater

Yes, I am one of those assholes who brings everything as carry-on on the plane that she isn't suppose to. My most frequent candidates are a set of lockpicks which I have in the past three months carried through no less than seven different airports (props to Flagstaff Arizona for at least removing them from my bag to look at them before permitting me to carry them on board.) Other frequent fliers are the more mundane large bottles of shampoo and conditioner, tubes of toothpaste, wires, electronic pieces, breadboards, and various other oddities. The only things I have ever had confiscated were a pair of cans of Rockstar, and a part of me thinks that might have been mostly because the TSA employee was thirsty. I did have a pretty near miss though when those same Flagstaff employees took a long hard look and an extra scan of my copy of The Little Prince. I guess you never can be too careful with those terrorist French and their mindless propaganda.

For a long time I attributed this to the fact that I would intentionally wear clothes to the airport which marked me as working for the feds. I learned the power of flying with a federal logo stamped on you once when confronted by a slightly baffled TSA employee who had recently extracted a cast-iron wok from my carry-on luggage (long story).

"What is this?"

"That, sir," I slid my thumbs along the top of the zipper of my ratty hoodie to flick what would have been the collar forward, emphasizing the federal logo on the right breast, "is a wok."

"Oh," he said, but I watched his eyes catch the logo.

"Will that be all?"

"Uh, yes," he said and handed me the wok. I took it and walked before hearing one of the last calls for the boarding on my flight, at which point I bolted down the terminal, still carrying the cooking implement in my left hand, trying to hold it as little like a club as possible. The TSA employee never said a word, he had probably gone on to the next customer by that time.

The "official-looking" hoodie was out of the gift shop. It wasn't like there had been a whole lot of other places to buy clothes when you're stranded on a federal base.

After I was given my uniform jacket I felt comfortable pushing the limitations much further to almost no resistance. Eventually I decided to forgo the effort of donning the jacket, as while it is very comfortable I dislike the stares I collect when wearing it in public.

It seems I am not alone in this activity. In this hilarious and rather well-written article one Jeffrey Goldberg describes bringing scissors, multiple large bottles of anything he pleases so long as they are labeled to be contact solution, a false beer belly of beer, a knife, and various other things as carry on. To make this more amusing he did it while also carrying things like a three foot by four foot Hezbollah flag and wearing shirts printed with lines like "Osama Bin Ladin: Hero of Islam." His article brought up another fun issue in the ID triangle: namely that you can fly if you are on the no fly list. This is done in a few simple steps.

1. Buy a ticket that isn't in your real name. This is where the name is checked against the no-fly list and so your fake name will not trigger anything.
   
2. Print your real boarding pass.
   
3. Print a fake boarding pass with your real name.
4. Go through security with your fake boarding pass and your real ID. All that is checked here is that your boarding pass matches your ID. It is not checked against the master no-fly list.
5. Present your real ticket at the gate. Since your ID is not checked here, nobody will notice the name does not match. Since it is a real boarding pass it will pass the barcode scanner, when your fake one would not.

The article recommended using photoshop but Christopher Soghoian made a wonderful little tool which will generate passes for you automatically for Northwest Airlines flights. While the FBI eventually shut him down the mirror of the code was left. He also wrote a neat little paper on it with plenty of information about how these loops might be closed. It has been available two and a half years now and ignored by official channels quite efficiently aside from their attempts to bring him to court for publishing it.

More disturbing are the words of Bruce Schneier (of crypto war fame) from 2002 warning (summarized by another author: Mann) about these large scale systems, which have also been primarily ignored.

The argument that a system which relies on secrecy to function (as our airport security system does) is inherently ineffective because such secrets are not well kept is part of what has made modern cryptology what it is today, and considered a well-beaten dead horse by many.

However, some other concepts pulled from the article I found quite novel. For example, if a piece of facial recognition software is accurate 99.32% of the time as claimed by certain manufacturers, and if good-quality photographs of all the terrorists are available, and if an airport had 25 million people go through it a year (such as Boston according to 2001 statistics) then you flag up to 170,000 people each year as terrorists from a single medium-sized airport. Consider that we have had well under 100 terrorists on airplanes nation-wide over a span of about 10 years and that this alarm would go off approximately 500 times a day per airport of this size. This is an alarm which would get rapidly downplayed or ignored by stressed-out TSA employees who are just trying to contain a small mob of people who are all frantically trying to make their flights. What does this mean? It means the enterprising young hacker will still be in an environment where a little charisma will get him through the gate, and the same of a terrorist.

Biometric information suffers many of the same abuses in the article: that as long as we continue to put our absolute faith in imperfect technology (as all technology always is) and have no proper situation to handle its failure, we will be left disappointed in the results. Inattentive guards in the Mann article permitted researchers to game the fingerprint and other biometric readers in any number of ways in the middle of airports. This included doing things like holding masks up over their eyes to fake a retina scan.

Part of this we have fed ourselves. To admit that our systems are fallible or downright ineffective would be to admit a mistake. Every time something bad happens the public wants to believe that Something Is Being Done, and as time passes we are putting more into making sure that our "corrections" are highly visible than that they have impact. Here's a great example:

Special measures have been taken to make it impossible for a terrorist to repeat the Detroit bombing attempt. Mr Abdulmutallab had emerged from the toilet, put a blanket on his lap complaining of an upset stomach, then tried to set off the bomb. Passengers and crew restrained him as flames leapt from his clothing.

In the final hour before landing in the US, passengers are now banned from standing up, using toilets and holding blankets.

Aside from the ACLU which I am sure is already drooling over the fact that use of a lavatory is generally not considered something you can reasonably deny a person in need (it is not legal for things like schools to operate when the bathrooms are broken for this reason) comes the general point that causing a four year old child to piss themselves will not make America safer. Small children (like most sane people) hate plane bathrooms. They are renowned for holding it in as long as possible, and for disregarding parent's warnings that "if you don't go now there won't be another stop for a while." Ask any parent who has taken a small child on a significant car ride. Furthermore, I'm pretty sure whoever gets to sit in a wet seat next flight won't feel America is a whole lot safer either. What will, for the most part, happen? When people have to go, they have to go, and the attendants will probably let them go if they beg hard enough.

What does that mean? It means this is a rule we will put our faith in, but that people will not keep. This is a common security problem: take offices where password changes are mandated so often that people have trouble remembering them. Instead they just slap an incrementing number on the end of the password or write it on a slip of paper on their desk. Other examples are the numerous recorded times when government officials have taken restricted information off of the protected government networks to unsecured computers. They do this because doing work on the secured computers is made slow and tedious by the oppressive security measures.

As long as our government continues to take this heavy-handed blanket approach to our security in airports people will keep adding loopholes, where formal (such as permitting people to print their own boarding passes) or informal (such as using tha bathroom), to keep the system functioning. These gaps, combined with our absolute faith in the technology which is meant to prevent them, provide fantastic exploratory spaces for hackers. I genuinely hope to see many published exploits in the coming months from clever young minds, and I hope they are found, made public enough to be an embarrassment, and corrected before anybody malicious takes advantage of them.

Happy hunting.

Related Posts:

• What happens to what the TSA actually does confiscate
• Security theater in locks
  

Viral Media Rewards Absurdity

"I can't believe Obama won the Nobel Peace Prize for intentions instead of action..."

I heard the same sentiment expressed with varying levels of clarity and expletives dozens of times Friday. "What on earth has come over the commission?" "Nobel is rolling in his grave," and "They have officially made this into a sham," and "Why the hell would they do this?"

I'll tell you why. I'll prove it on one sentence.

Can you name the winner of the 2008 Nobel Peace Prize without looking it up. No? It's Martti Ahtisaari. Here's the sad part: that name probably doesn't help you. A good percent of us could not identify this former President of Finland for love nor for money.

That's alright, lets try again. Can you name any winner of the Nobel peace prize in the past five years? When I tell you that 2007 was Al Gore and some other people for some global warming stuff, you might say "man I knew that," but the recognition on Muhammad Yunus and Grameen Bank (2006), International Atomic Energy Agency and Mohamed ElBaradei (2005), or Wangari Maathai (2004) is pretty low.

So what's special about this? Well, lets consider this: news is a form of media. Media is an industry. Industries seek to make profit. How does media make money? Media makes money from advertising. Advertising pays more when more people see it more. Media wants to make as much money as possible. Media wants as many people to watch it as possible. Media reports the news which people will watch.

This dynamic is as old as the news as a business is (which some people link especially strongly to the development of cable news stations). The issue is: now not everybody gets their news from the news stations. As a matter of fact the majority of the news which I receive is transmitted to me virally either by a friend in an IM or via an IRC channel.

So what gets transmitted? Mostly it's the inane and the insane, in short the absurd. You know the memes as well as I do. I see easily as many links to the likes of Chris Crocker, various forms of Bill O'Riley expressly because he is losing flipping a shit or making an ass of himself, and Reuters' Oddly Enough as I do to "actual news." Try getting the same sort of stories you get off the BBC on Digg. They are probably there, but they are also probably awash in a great deal of other stuff.

Awash isn't a bad word for this whole situation. We're awash in way more information than we can reasonably process. We rely on summaries of everything, from what our friends are up to to the disturbing little bullet points that accompany a one page news article on CNN because they believe we have lost our attention span so badly that we are unable to finish and analyse a one page news article for ourselves.

And what is coming out on top? Well, your diligent readers will probably pick, choose, and not fluctuate but items which actually go viral reward the news site with a huge traffic spike. Spikes like this are very lucrative both financially. They are also psychologically attractive for the same reasons the lottery is.

Check out what is right at the top of the webpage of CNN, which is generally regarded as a fairly reasonable news site. Will the naked burgler that CNN reports as caught change your life? How about that an "ultrarunner" says shoes are the devil? This stuff is not news, its just a light laugh that sells well.

So if somebody is determined to make the news or "have an impact," they are going to have an easier time doing it if they are doing something that will go viral: the inane or the insane, the absurd. The Nobel Peace Prize, like all Nobel Prizes was founded essentially as a form of activism by the man who invented dynamite as an attempt to recognise those who have helped improve humanity. This was to offset the destructive and warlike ramifications of his own invention. The goal is to highlight and reward those who have done something significant to better humanity.

So how can the people who award the prize make sure the prize has an impact? By making sure everybody knows about who won it. How do they do that in this modern age?

They pick somebody who is doing good, but where the statement is just absurd enough to go viral.

Now I'm not proposing that this is some giant media conspiracy. I'm arguing that this is an unconscious algorithm that evolves from the combination of the strength of viral media introduction, media companies trying to make as much money as they can, and the people who are making news attempting to be sure they have an impact. This is the age that rewards Sarah Palin's cutesy folksy gimmicks, and reactionary "opinion pieces" where people completely lose their shit on youtube.

So, in conclusion, stop linking garbage, go read some damn news, and make the world a better place. Hell, while you're at it you might even give yourself an education. :p

America Loves a Man Who Served?

Every election everybody is abuzz over who "nobly served their country in its time of need," and how a candidate's military service (or lack thereof) will impact the election. Parties, for as long as I have lived, have had groups come out every election to tout the extent of their candidate's military service or their opponent's lack thereof. The question really is: are candidates who have convinced the public that they served really any more successful than their peers?

Lets look at recent candidates who have flamboyant war stories...such as getting shot or tortured. Who would that be? John McCain (2008), John Kerry (2004) and Bob Dole (1992). All three of them, as I am sure you know, lost their elections.

So, the question comes from this, does military service in general indicate a losing candidate? Lets look at the records. The 1992 and 1980 elections must be skipped for now because they were between two candidates who won at some point. Al Gore (2000) served in the Vietnam war, while Dukakis (1988) and Mondale (1984) served in Korea. Ford (1976) served in WWII (remember, he was president but he never won an election, which is what is in question here). McGovern (1972) also served in that war. Prior to that a good chunk of the baby boomers were not even of voting age, and it gets a little hard to consider everything one contineous culture.

So, now lets examine the other side of the coin. What are the military histories of winning candidates?

Carter and George Bush Senior each won and lost one election. Both of them won against somebody with equal or less military experience, and both of them lost to somebody with no combat experience. Carter (1972) served on a submarine. He won against Ford, who had a considerable record of service, and lost against Regan who never saw battle at all and couldn't serve overseas. George Bush Senior (1988, 1992) served active duty Navy and saw combat. He won against Dukakis (who served) in 1988. Its reasonable to say this didn't break the trend because when both candidates in an election served they can not both lose. He lost to Clinton, who had no record of military service.

George W Bush (2000, 2004) worked first in the Texas Air National Guard and then was discharged to inactive duty in the Air Force Reserve. Various forms of the National Guard have been socially seen as a great way to draft dodge, and were a popular alternative to serving in the Vientam War for particularly well well-connected people. Since social perceptions directly influence elections, its reasonable to say that is what matters here, and that against the candidates George W Bush faced it isn't unreasonable to say that the majority of the public considered him the figure with less military service.

What about the rest of the candidates? Obama (2008) has no military history. Clinton (1992, 1996) employed significant shennanigans to avoid being drafted into the Vietnam War. Regan (1980, 1984) tried but never saw battle and couldn't serve overseas because of his nearsightedness. Nixon (1968, 1972) was exempt twice over from service, joined anyway and requested multiple times for more demanding duties but retired never seeing combat. This history brings us neatly back, once again, to the time before the baby boomers were of age to vote.

So what can we scientifically conclude from this? Nothing: this is just a statistical correlation. It is, however, a very strong correlation that United States presidental elections have, for the past 40 years, tended very strongly to favor the candidate with less military service.

So, why is this? Hippy baby boomers won't vote for "baby killers" they spent their college years protesting in the streets? Maybe, after all it really does fit the timeline, but I have never heard of a generation who sold their beliefs out so rapidly and wholeheartedly as the baby boomers (upcoming post). Atom proposed that the numerous foreign interests which contribute to our election campeign funds might be more likely to financially support a non-military candidate. That sounds very plausable, but I haven't been able to discover enough election campeign contribution data to really draw correlations either way. Personally, I'm not really ready to break out my tin foil hat quite yet.

What are the odds of this happening by accident? There have been 9 elections since 1972. If for each election a winner was selected at random from the two major parties the odds of it lining up with this exact correlation by random chance would be .19% or just a touch more unlikely than 525 to 1. So, its fairly likely that there is something mathematically to this, but I really haven't a clue what it is. I'd welcome any thoughts on the topic.