I saw an interesting story (thanks to Dave Farber's Interesting-People list) on how the TSA is considering selling advertising space at airport security checkpoints. My distaste at the prospect of being subjected to ads during these already humiliating and irritating screenings aside, I found the most fascinating part of this article to be its glimpse at the officious technical jargon that has emerged for airport security paraphernalia. Those grey tubs that you put your laptop in (after removing it from its case, of course) are apparently properly called "divestiture bins"; after X-ray, we retrieve our items at the "composure tables". I don't know about you, but I don't usually feel especially composed after making it through a long security line.
I'd say you can't make this stuff up, but apparently someone does.
Newly armed with the official terminology, I did a bit of googling this morning and found the TSA's Airport Security Design guidelines. This 333 page (PDF format) manual specifies, in all the detail one could ever hope for, everything there is to know about designing the security infrastructure for an airport, right down to the layout of the divest tables for the X-ray ingress points at sterile concourse station SSCPs. It's all very meticulous and complete, even warning of the "potential for added delay while the passenger divests or composes" (page 99). For some geeky reason, I find all this mind-numbing detail about the physical architecture of security to make strangely compelling reading, and I can't help but look for loopholes and vulnerabilities as I skim through it.
Somehow, for all the attention to minutiae in the guidelines, everything ends up just slightly wrong by the time it gets put together at an airport. Even if we accept some form of passenger screening as a necessary evil these days, today's checkpoints seem like case studies in basic usability failure designed to inflict maximum frustration on everyone involved. The tables aren't quite at the right height to smoothly enter the X-ray machines, bins slide off the edges of tables, there's never enough space or seating for putting shoes back on as you leave the screening area, basic instructions have to be yelled across crowded hallways. According to the TSA's manual, there are four models of standard approved X-ray machines, from two different manufacturers. All four have sightly different heights, and all are different from the heights of the standard approved tables. Do the people setting this stuff up ever actually fly? And if they can't even get something as simple as the furniture right, how confident should we be in the less visible but more critical parts of the system that we don't see every time we fly?
There was a nice column by Randall Stross in the New York Times a few weeks back entitled "Theater of the Absurd at the T.S.A." [http://www.nytimes.com/2006/12/17/business/yourmoney/17digi.html]. (Unfortunately, the Times' perversely inverted pricing structure -- in which fresh news is free and old news is charged for -- means that the article may no longer be available on their free site by the time you look for it, but that's another subject for another day.) Anyway, the piece focuses on the ongoing plight of Christopher Soghoian, a computer science graduate student at Indiana University who has found himself in hot water for making available a web-based tool that creates visually convincing -- but entirely fake -- airline boarding passes. Soon after the site went online the FBI raided his home and shut down his site, but ultimately decided against filing any criminal charges. But the Transportation Security Administration isn't so sure. In spite of the FBI's declining to prosecute, the TSA is, as of this writing, apparently considering pursuing tens of thousands of dollars in administrative penalties against Mr. Soghoian. Bruce Schneier and I were both quoted in the Times piece, with the two of us suggesting that openness, rather than threats of fines and prosecution, would be a far better strategy for improving security here.
Does this mean I think putting the boarding pass generator online was a great idea? No, and in fact I have some serious reservations about it. But if Mr. Soghoian may have been guilty of a bit of poor judgement here, the TSA's behavior in response has been far, far worse -- and suggests problems much more damaging to our security than forged boarding passes.
If it works out, I expect to publish most of my non-academic-paper-style writing here.
For a variety of reasons (spam, net kooks, and so on), I've decided against including an "add a comment" feature, at least for now. So if something I write so infuriates you that you simply must respond, you'll need to get your own blog to do it.