12 ms·

Laptop Ban a Reaction to X-Ray Equipment Stolen by ISIS

201 points by tsaoutourpants 9y ago

tsaoutourpants 9y ago
Hi All, author of the article here. Happy to answer any questions you may have about the laptop ban, aviation security, TSA assholery, Trump's travel-related civil rights abuses (incl. the "Muslim ban"), or other such topics of interest. And, thanks for the support... HN is always one of the first communities to upvote my work and help me share it with the world. As a computer scientist turned almost-lawyer, I definitely appreciate!
- jaclaz 9y ago
  While it is perfectly possible that a scanning device disappeared somewhere, it is not the only way someone can study how to conceal hidden explosive in luggage. I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours? Does the same happen for all technicians that maintain/repair these devices? Does the same happen for all designers of these devices? Or if you prefer, do you believe that such a scanning machine cannot be re-built from commercial parts by someone who knows their innards? Are ALL purchases of new scanners subject to governemnet approval (and even if yes, which government)?
  - tsaoutourpants 9y ago
    Hi jaclaz, > I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours? No, although after-hours testing may set off some alarms. I'm sure their on-hours experience would be useful, though. > Does the same happen for all technicians that maintain/repair these devices? No. > Does the same happen for all designers of these devices? Nope. > Or if you prefer, do you believe that such a scanning machine cannot be re-built from commercial parts by someone who knows their innards? Yes, I do believe that rebuilding a modern, advanced x-ray system from scrap components is beyond the capabilities of ISIS at the moment. > Are ALL purchases of new scanners subject to governemnet approval (and even if yes, which government)? The modern, advanced x-ray systems are not available to the general public. As to how exactly they are controlled, I'm not sure. See also my comments to other users regarding the differences between modern x-rays and old school ones.
    - runamok 9y ago
      My wife works in import/export compliance. There are many regulations associated with many types of technology requiring you to get licenses, "know your customer", etc. I would guess the latest and greatest of this tech for would be governed by EAR if not ITAR regulations. ref: http://ooc.usc.edu/overview-ear-and-itar http://ooc.usc.edu/overview-ear-and-itar
      - jaclaz 9y ago
        Yep, but that applies (maybe) to the US. What about any other country, for the sake of the example, Wherevereristan? Do they have the same rules?
        coredog64 9y ago
        If you fly into the US, it is more than likely that not only will you have to clear airport security provided by the host country, you will also have to go through security provided by the US. It will be US equipment and US citizens operating it. So in that sense, if Whereveristan wants to sell the airport X-ray equipment they can get, it isn't going to be useful in determining what can pass US screening.
        skissane 9y ago
        > If you fly into the US, it is more than likely that not only will you have to clear airport security provided by the host country, you will also have to go through security provided by the US. It will be US equipment and US citizens operating it. How common is such an arrangement? I've only ever flown to the US from Australia, and while there was a pre-boarding security check at the gate, after the main security screening at the entrance to the airside of the terminal, the staff carrying it out appear to be Australian private security guards, not US citizens. (I haven't done it for about two years now, so someone who has done it more recently would have to tell me if anything has changed.)
        cstejerean 9y ago
        That's highly unlikely for most places in the world. What is often required is additional screening at or near the gate to enforce US specific rules (for example liquids in carry-ons). But that's usually not US staff and US equipment but rather extra staff enforcing US specific rules (the same way the laptop ban is currently enforced in Dubai for example).
  - sokoloff 9y ago
    > I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours? If you have a confederate operating the machine, it would seem easier to arrange to pass through their security line than to use the knowledge to make an X-ray look-alike bomb-laden laptop.
    - jaclaz 9y ago
      >If you have a confederate operating the machine, it would seem easier to arrange to pass through their security line than to use the knowledge to make an X-ray look-alike bomb-laden laptop. If you want to simply put a bomb on a single given flight from that particular airport surely yes (and with the risk that your accomplice is caught in the ensuing investigations), but having a general method is - allow me - more elegant, you can in theory embark as many such devices on as many flight as you have suicide volunteers available, leaving from any airport at any date/time.
koenigdavidmj 9y ago
Hey look, a security crisis that can only be fixed by requiring that we prove our devices are functional, most likely by turning them on, logging in, and showing that there are a few documents present. And in some cases, extra manual evaluation will be required, entailing taking that logged-in laptop into a back room for further inspection. They won't copy everything onto a disk of their own---honest!
- tsaoutourpants 9y ago
  VeraCrypt (f/k/a TrueCrypt) is your friend!
  - tantalor 9y ago
    See also: https://en.wikipedia.org/wiki/Making_false_statements https://en.wikipedia.org/wiki/Making_false_statements
    - tsaoutourpants 9y ago
      See also: https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_States_Constitution https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_...
      - jakobdabo 9y ago
        See also: https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone
        tsaoutourpants 9y ago
        The Fifth Amendment still applies in the "constitution free zone." The name is a bit exaggerated by the ACLU to make their point. No matter where you are, the U.S.government cannot force you to speak as a condition of flying home. Just be quiet rather than deceitful.
Frenchgeek 9y ago
So instead of creating new measures in order to fix the security problem, they chose to flood the system with false positives...
djmdjm 9y ago
The premise is flawed. X-ray inspection equipment is easy to find - it's regularly offered for sale on EBay and you'll find a number of teardown videos of various models on Youtube. The stolen X-Ray equipment is not being reported probably because it isn't particularly interesting.
- tsaoutourpants 9y ago
  Well, not exactly. Very basic x-ray equipment is easy to find on eBay. The more modern equipment that the TSA uses is not available on eBay... https://securitytoday.com/articles/2008/07/30/tsa-to-expand.aspx https://securitytoday.com/articles/2008/07/30/tsa-to-expand.... "Advantages of AT X-ray include a greatly enhanced image with the ability to target novel threat items resulting in fewer bag checks and faster throughput, and the ability to upgrade the system with enhanced algorithms." ...and that article describes the 2008 edition of the technology! For a more technically-specific perspective, I can say that the newer machines take images from multiple angles and are closer to a medical CT scan than a old-school x-ray. Owning one would allow you to practice placing your items in a direction and location that would be least able to be seen by the operator.
- rst 9y ago
  You could say the same about the toner cartridge ban cited in the article (and the article itself does!) -- but DHS did it anyway.
leggomylibro 9y ago
>So why was the stolen x-ray equipment kept a secret? I asked my source if there was some security reason for keeping the stolen x-ray equipment from the public, and was told, unequivocally, no. “It’s because the mom from the midwest planning to fly her kids to Disney would freak out. They are worried that people would stop flying if they knew.” Kind of ironic, because I've already stopped flying - not because I'm afraid, but because these sorts of measures have gotten to the point where traveling through an airport is an awful experience that I actively avoid. If I absolutely must travel, I take a train or drive. The only reason I ever fly is if I have to cross an ocean or if I face an emergency that requires me to be present somewhere far away, very quickly. And in the case of an ocean, honestly, renting a stateroom on a cargo ship seems like a very relaxing way to go if you have the time. I've got a HUGE backlog of books and games and writing and projects to design and you get the idea.
- finid 9y ago
  Yes, a stateroom on a cargo ship sounds like it would be fun. Something to try one of these days.
  - Animats 9y ago
    No longer available. Considered a hijacking risk.
    - dingaling 9y ago
      That is accurate; there are very very few non-crew berths available on cargo ships nowadays. I know because I've researched alternative means of travelling to see the 2017 Solar eclipse.
    - jamessb 9y ago
      This doesn't seem to be true. This site [1] lists many agencies (based in the US, UK and other countries) that will sell you a passenger ticket for a cargo ship. Availability is probably limited though, as each ship can only take a few passangers: "Cargo ships can carry a maximum of 12 passengers although most vessels only have accommodation for 4 to 6 passengers" [2]. [1]: http://flightlesstravel.com/plan/cargo-ships/ http://flightlesstravel.com/plan/cargo-ships/ [2]: http://www.cargoshipvoyages.com/WhatToExpect/ http://www.cargoshipvoyages.com/WhatToExpect/
leroy_masochist 9y ago
Q for the author: how valuable would an actual proprietary airport X-ray be, in terms of designing devices (as compared to another X-ray of similar spec)? Does having access to the actual X-ray for purposes of product testing really make that much of a difference to a technically gifted bomb-maker?
- tsaoutourpants 9y ago
  Yes. See my comment below to djmdjm, but also, I'll add one more thing. Take a knife out of your kitchen drawer and hold it in your hand in front of you such that the sharp side of the blade is on the left and the dull side is on the right. Easy to see. Now rotate it 90 degrees such that the sharp side is facing you and the dull side is facing away. Much harder to see, especially if you can imagine what it would look like on an x-ray, and how you could further conceal it by carefully placing other items between the "camera" and the item.
  - 15155 9y ago
    Angle-shifting units make this harder, but the obvious blindspot is the conveyor belt entrance/exit holes (they cannot have imaging equipment in them).
    - tsaoutourpants 9y ago
      Exactly. Imaging devices all have blind spots, which is how I was able to defeat the TSA's body scanners in 2012.
fpoling 9y ago
As lithium batteries are opaque to X-Rays, perhaps a ban on laptops with batteries should be considered. This will surely push for standard swappable batteries and standard power supplies so the laptops could be used on board without batteries.
- tsaoutourpants 9y ago
  What? No, that's a wholly unnecessary solution (though more standardization of batteries would certainly be nice). Swab the outside of the laptop for bomb residue, which would be especially difficult to clean from a laptop because the stronger solvents to clean with (like acetone) would mark the plastic. Or hire more dogs. Or make a "puffer machine" for laptops (blasts with air and then samples the air for explosive trace). Or come up with another solution -- this is HN! :)
  - rwmj 9y ago
    Does swabbing work? I can imagine that the "batteries" (ie bomb) would be prepared, sealed and cleaned by one person, and then inserted into the laptop by another person so there's no contamination.
    - tsaoutourpants 9y ago
      It's hard to remove all trace, but yes, in theory you could avoid it by being really careful. Then again, if you work in a "bomb factory," there's trace everywhere, so it may be quite difficult. Also, the "turn on your device" thing they sometimes do offers some mitigation against this. Obviously, you can think of ways that may defeat this too, but to defeat all of the security, accurately, in one small package that doesn't look sketchy, is not easy. Fortunately, most terrorists are not the brightest people in the world.
      - kmonsen 9y ago
        Asking people to turn on the device seems stupid. Just do half battery half bomb and make it functional enough it will work for 10 min.
jperras 9y ago
Correct me if I'm wrong, but wouldn't a relatively benign way to fix this simply be that the TSA agents randomly reorient/flop some carry on luggage items in the bins before they go through the scanner?
- tsaoutourpants 9y ago
  That would definitely help. Or, simply re-run bags where there is opaque stuff that the screener is unsure about, oriented in a new direction. But, that wouldn't necessarily solve all the problems, as laptop batteries are opaque in all directions, and so if you got a lead metal box and filled it with explosives, it may look much the same.
subterfudge44 9y ago
One of the sad things about airport security is that there is no scope for private innovation. It is a military industrial complex of using substandard solutions for potentially non existent problems while wasting insane amount of money. May be there is a need for the security theatre but then we can at least get good at it. Can Elon Musk design a better airport security ?
- tsaoutourpants 9y ago
  Fuck Elon Musk, can you design a tool that would make airport security better? I bet in 15 minutes, most HN readers could come up with something that would be cheaper, more effective, and faster to use than the current tool set. There's indeed money to be made here (and good to be done), even if the easiest way would be to patent your idea and sell it to the military industrial complex you speak of. Fun fact: the parent company of the company that makes the TSA body scanners (L-3) also owns the company that made "waterboarding" famous. It is, indeed, the military industrial complex.
  - streetwiseherc 9y ago
    Penn Jillete's "Bacon and a Kiss" airline screening.
  - stevenwoo 9y ago
    There is a model that we already know works in practice but it's not cheaper or faster and it would generate a lot of income for security/airport renovation companies at the cost of much higher ticket costs to pay for it - the Israeli model. https://www.schneier.com/blog/archives/2010/01/adopting_the_is.html https://www.schneier.com/blog/archives/2010/01/adopting_the_...
    - valuearb 9y ago
      There is an easier model called "less stringent security". Flying is incredibly safe. There is little evidence that the TSA's onerous security processes safe enough lives to be worth their massive costs.
Animats 9y ago
The secrecy issue has gotten out of hand. The classic military view of secrecy is time-limited. "Where the ship was last week is unclassified. Where the ship was yesterday is confidential. Where the ship is now is secret. Where the ship will be tomorrow is top secret." The opposition will eventually find out what you're planning on doing. The goal is for them to find out the hard way, when incoming fire starts hitting them. The intelligence community has a longer-term view. "We know, and they know. We think they don't know that we know they know. We hope they don't know how we found out that they know." This protection of sources mindset leads to things being kept secret long after all involved parties know. The anti-terrrorism community has adopted the intelligence community mindset. This is a problem.
- digi_owl 9y ago
  > The anti-terrrorism community has adopted the intelligence community mindset. This is a problem. Wonder how much that has to do with overlap between the two. Today's terrorist may well have been yesterday's informat, and may well be an informant again tomorrow. After all, the CIA was deeply involved in Afghanistan back when the USSR was fighting there. And many of the people that the CIA supported then later turned against USA.
  - mtgx 9y ago
    And then the CIA allied again with alQaeda when fighting Assad. And round and round it goes. Too bad the public is made a to be a sucker every time.
    - simonh 9y ago
      They didn't 'ally with Al Qaeda', they just both happened to be opposed to the same guy while also being opposed to each other. It's a complicated situation out there. Even at the height of the Cold War, sometimes the CIA and KGB would share information of mutual benefit. That didn't mean the CIA was allying with communism. Even Trump has learned this when his 'bombing Syria is the wrong thing to do, what Assad gets up to is non America's business anymore' policy lead to Assad feeling free to start nerve gassing civilians again. Oops. Turns out him being against Islamic State doesn't make him our friend either. It's a horrible nasty mess, but even trying to stay out of it just makes you even more vulnerable to even greater problems in the long run.
knodi 9y ago
ya right, fuck off TSA. They're just trying to pretend they're relevant.
suihkulokki 9y ago
This article seems to miss the fact ISIS took over Mosul international airport in 2014. Surely they got luggage screening machines in hand by then already.
- deleted 9y ago
  [deleted]
- askvictor 9y ago
  My guess would be that the gear at Mosul would not be as advanced as elsewhere.
  - tsaoutourpants 9y ago
    Well, for whatever reason, they stole more equipment more recently. Could be that the new stuff is more advanced, or maybe we bombed the gear they took from Mosul. I don't have more details that would provide insight.
  - nraynaud 9y ago
    Not sure, because the destinations countries for the planes departing from there have some interest (a bit like the US forcing some theater on Europe), and there is some international help for military and security theater gear.
AJ007 9y ago
Reduced airline travel, tourism, and global trade -- sounds like a good action plan for countering global warming.
squarefoot 9y ago
Everyone seem to have missed the opportunity here to push for standard power connector/polarity/voltage/maxcurrent requirement for all laptops while fitting a power cable (with short circuit protection in every seat. That will also discourage from producing laptops not working if a battery isn't plugged in. Having say a 12VDC/3A plug in every seat will force most manufacturers to make at least one airline-friendly laptop, and/or implement on faster models things such as turning off cores and keeping CPU speed low to stay within that current limit. edit- and push to get a standard for battery pack sizes to reduce the number of form factors, then implement a service where you give your used one at departure and get a new one at arrival. Regulations like that one stink badly, but necessities drive progress and I see an opportunity here.
- JadeNB 9y ago
  > edit- and push to get a standard for battery pack sizes to reduce the number of form factors, then implement a service where you give your used one at departure and get a new one at arrival. Or we could implement the Indian system, where you turn in your new batteries at departure and are given used ones on arrival. (Mysteriously, despite the assurance that they are the same batteries, they have sometimes changed brand, too.)
zkms 9y ago
Read this paper as well https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-mowery.pdf https://www.usenix.org/system/files/conference/usenixsecurit... -- the researchers who wrote it obtained (on the surplus market) the same model of backscatter X-ray body scanner that was deployed in US airports and proceeded to evaluate and validate various schemes for undetectable concealment of firearms, knives, and explosives. Other research was done, including a software implant that would selectively strip indications of contraband from the image (when a specific signal pattern was in the image), and a firmware implant that would disable all interlocks and deliver an elevated radiation dose. If it is possible for a few university researchers to obtain this sort of security scanner without resorting to crimes, it is folly to assume that actual adversaries cannot. We need better methods for detecting energetic materials (and not just suspicious shapes) in luggage (detecting it concealed inside humans is harder and would require transmission x-ray which is not currently acceptable for airport security screening) that don't crumble when the adversary has unlimited access to the security scanner to test concealment methods. Concealing knives is kinda easier than concealing energetic materials -- it is, for example, possible to machine a blade that fits perfectly inside a blunt, innocuous "sheath" so precisely (hi, wire EDM) that they appear as a single piece of metal. However, this is not so much of an issue nowadays, as no amount of threatening or stabbing with a knife will make a pilot open the cockpit door.
- astrodust 9y ago
  Ceramic, glass and plastic knives can be extremely dangerous and yet they probably don't show up on these machines at all. The utility of these machines is questionable to say the least. Bruce Schneier observed, like you did, that the heavily secured cockpit door is one of the only real improvements made to airplane security in the last few decades.
  - knodi123 9y ago
    > and yet they probably don't show up on these machines at all Uh, yeah, they do. Have read anything about backscatter xray machines? The real way to defeat these machines is to hide things in folds of your flesh. It can see through clothes, but not too much skin. In staged demonstrations, fat people have gotten a metal pistol through, no problem.
syphilis2 9y ago
It seems to me that if an X-Ray scanner was stolen from an airport, that information would reasonably be considered SSI due to its relation to screening passenger luggage. I wouldn't be comfortable spreading news that stolen equipment is available, that there's a security vulnerability allowing equipment to be stolen, that ISIS is in possession of the stolen equipment, or any vulnerability assessments of the equipment. The unnamed source seemed convinced that any security decision was made to avoid scaring "mom from the midwest," but that comment appears short-sighted if anything more than conjecture.
tsaoutourpants 9y ago
Hi Everyone, author of post here with an update for you. The most modern x-ray systems in use by the TSA at airports to screen carry-on bags can indeed see through lithium batteries. It also differentiates densities, and it seems to me that the latest tech should therefore be able to indicate the difference between a battery and C4 in a battery-shaped box. So is it that the airports subject to the laptop ban have the older tech? Well... Read more: https://professional-troublemaker.com/2017/05/22/update-newest-tsa-carry-on-x-rays-can-indeed-see-through-laptop-batteries/ https://professional-troublemaker.com/2017/05/22/update-newe...
ryanlol 9y ago
>By forcing all these batteries into the cargo hold where a fire cannot be rapidly detected and contained, DHS would be countering any deceased risk of terror with an increased risk of fire. Everyones always been telling me that if I want to bring down a plane I should set the cabin on fire, not the cargo hold. Have I been living a lie?

Hi All, author of the article here. Happy to answer any questions you may have about the laptop ban, aviation security, TSA assholery, Trump's travel-related civil rights abuses (incl. the "Muslim ban"), or other such topics of interest. And, thanks for the support... HN is always one of the first communities to upvote my work and help me share it with the world. As a computer scientist turned almost-lawyer, I definitely appreciate!

jaclaz 9y ago
While it is perfectly possible that a scanning device disappeared somewhere, it is not the only way someone can study how to conceal hidden explosive in luggage. I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours? Does the same happen for all technicians that maintain/repair these devices? Does the same happen for all designers of these devices? Or if you prefer, do you believe that such a scanning machine cannot be re-built from commercial parts by someone who knows their innards? Are ALL purchases of new scanners subject to governemnet approval (and even if yes, which government)?
- tsaoutourpants 9y ago
  Hi jaclaz, > I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours? No, although after-hours testing may set off some alarms. I'm sure their on-hours experience would be useful, though. > Does the same happen for all technicians that maintain/repair these devices? No. > Does the same happen for all designers of these devices? Nope. > Or if you prefer, do you believe that such a scanning machine cannot be re-built from commercial parts by someone who knows their innards? Yes, I do believe that rebuilding a modern, advanced x-ray system from scrap components is beyond the capabilities of ISIS at the moment. > Are ALL purchases of new scanners subject to governemnet approval (and even if yes, which government)? The modern, advanced x-ray systems are not available to the general public. As to how exactly they are controlled, I'm not sure. See also my comments to other users regarding the differences between modern x-rays and old school ones.
  - runamok 9y ago
    My wife works in import/export compliance. There are many regulations associated with many types of technology requiring you to get licenses, "know your customer", etc. I would guess the latest and greatest of this tech for would be governed by EAR if not ITAR regulations. ref: http://ooc.usc.edu/overview-ear-and-itar http://ooc.usc.edu/overview-ear-and-itar
    - jaclaz 9y ago
      Yep, but that applies (maybe) to the US. What about any other country, for the sake of the example, Wherevereristan? Do they have the same rules?
      - coredog64 9y ago
        If you fly into the US, it is more than likely that not only will you have to clear airport security provided by the host country, you will also have to go through security provided by the US. It will be US equipment and US citizens operating it. So in that sense, if Whereveristan wants to sell the airport X-ray equipment they can get, it isn't going to be useful in determining what can pass US screening.
        skissane 9y ago
        > If you fly into the US, it is more than likely that not only will you have to clear airport security provided by the host country, you will also have to go through security provided by the US. It will be US equipment and US citizens operating it. How common is such an arrangement? I've only ever flown to the US from Australia, and while there was a pre-boarding security check at the gate, after the main security screening at the entrance to the airside of the terminal, the staff carrying it out appear to be Australian private security guards, not US citizens. (I haven't done it for about two years now, so someone who has done it more recently would have to tell me if anything has changed.)
        cstejerean 9y ago
        That's highly unlikely for most places in the world. What is often required is additional screening at or near the gate to enforce US specific rules (for example liquids in carry-ons). But that's usually not US staff and US equipment but rather extra staff enforcing US specific rules (the same way the laptop ban is currently enforced in Dubai for example).
- sokoloff 9y ago
  > I mean are the people that operate daily these machines vetted to a level where you can totally exclude that they (in ALL airports wordwide) can be affiliated to whatever evil organization and do some tests after hours? If you have a confederate operating the machine, it would seem easier to arrange to pass through their security line than to use the knowledge to make an X-ray look-alike bomb-laden laptop.
  - jaclaz 9y ago
    >If you have a confederate operating the machine, it would seem easier to arrange to pass through their security line than to use the knowledge to make an X-ray look-alike bomb-laden laptop. If you want to simply put a bomb on a single given flight from that particular airport surely yes (and with the risk that your accomplice is caught in the ensuing investigations), but having a general method is - allow me - more elegant, you can in theory embark as many such devices on as many flight as you have suicide volunteers available, leaving from any airport at any date/time.

koenigdavidmj 9y ago

Hey look, a security crisis that can only be fixed by requiring that we prove our devices are functional, most likely by turning them on, logging in, and showing that there are a few documents present. And in some cases, extra manual evaluation will be required, entailing taking that logged-in laptop into a back room for further inspection. They won't copy everything onto a disk of their own---honest!

tsaoutourpants 9y ago
VeraCrypt (f/k/a TrueCrypt) is your friend!
- tantalor 9y ago
  See also: https://en.wikipedia.org/wiki/Making_false_statements https://en.wikipedia.org/wiki/Making_false_statements
  - tsaoutourpants 9y ago
    See also: https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_States_Constitution https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_...
    - jakobdabo 9y ago
      See also: https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone
      - tsaoutourpants 9y ago
        The Fifth Amendment still applies in the "constitution free zone." The name is a bit exaggerated by the ACLU to make their point. No matter where you are, the U.S.government cannot force you to speak as a condition of flying home. Just be quiet rather than deceitful.

Frenchgeek 9y ago

So instead of creating new measures in order to fix the security problem, they chose to flood the system with false positives...

djmdjm 9y ago

The premise is flawed. X-ray inspection equipment is easy to find - it's regularly offered for sale on EBay and you'll find a number of teardown videos of various models on Youtube. The stolen X-Ray equipment is not being reported probably because it isn't particularly interesting.

tsaoutourpants 9y ago
Well, not exactly. Very basic x-ray equipment is easy to find on eBay. The more modern equipment that the TSA uses is not available on eBay... https://securitytoday.com/articles/2008/07/30/tsa-to-expand.aspx https://securitytoday.com/articles/2008/07/30/tsa-to-expand.... "Advantages of AT X-ray include a greatly enhanced image with the ability to target novel threat items resulting in fewer bag checks and faster throughput, and the ability to upgrade the system with enhanced algorithms." ...and that article describes the 2008 edition of the technology! For a more technically-specific perspective, I can say that the newer machines take images from multiple angles and are closer to a medical CT scan than a old-school x-ray. Owning one would allow you to practice placing your items in a direction and location that would be least able to be seen by the operator.
rst 9y ago
You could say the same about the toner cartridge ban cited in the article (and the article itself does!) -- but DHS did it anyway.

leggomylibro 9y ago

>So why was the stolen x-ray equipment kept a secret? I asked my source if there was some security reason for keeping the stolen x-ray equipment from the public, and was told, unequivocally, no. “It’s because the mom from the midwest planning to fly her kids to Disney would freak out. They are worried that people would stop flying if they knew.” Kind of ironic, because I've already stopped flying - not because I'm afraid, but because these sorts of measures have gotten to the point where traveling through an airport is an awful experience that I actively avoid. If I absolutely must travel, I take a train or drive. The only reason I ever fly is if I have to cross an ocean or if I face an emergency that requires me to be present somewhere far away, very quickly. And in the case of an ocean, honestly, renting a stateroom on a cargo ship seems like a very relaxing way to go if you have the time. I've got a HUGE backlog of books and games and writing and projects to design and you get the idea.

finid 9y ago
Yes, a stateroom on a cargo ship sounds like it would be fun. Something to try one of these days.
- Animats 9y ago
  No longer available. Considered a hijacking risk.
  - dingaling 9y ago
    That is accurate; there are very very few non-crew berths available on cargo ships nowadays. I know because I've researched alternative means of travelling to see the 2017 Solar eclipse.
  - jamessb 9y ago
    This doesn't seem to be true. This site [1] lists many agencies (based in the US, UK and other countries) that will sell you a passenger ticket for a cargo ship. Availability is probably limited though, as each ship can only take a few passangers: "Cargo ships can carry a maximum of 12 passengers although most vessels only have accommodation for 4 to 6 passengers" [2]. [1]: http://flightlesstravel.com/plan/cargo-ships/ http://flightlesstravel.com/plan/cargo-ships/ [2]: http://www.cargoshipvoyages.com/WhatToExpect/ http://www.cargoshipvoyages.com/WhatToExpect/

leroy_masochist 9y ago

Q for the author: how valuable would an actual proprietary airport X-ray be, in terms of designing devices (as compared to another X-ray of similar spec)? Does having access to the actual X-ray for purposes of product testing really make that much of a difference to a technically gifted bomb-maker?

tsaoutourpants 9y ago
Yes. See my comment below to djmdjm, but also, I'll add one more thing. Take a knife out of your kitchen drawer and hold it in your hand in front of you such that the sharp side of the blade is on the left and the dull side is on the right. Easy to see. Now rotate it 90 degrees such that the sharp side is facing you and the dull side is facing away. Much harder to see, especially if you can imagine what it would look like on an x-ray, and how you could further conceal it by carefully placing other items between the "camera" and the item.
- 15155 9y ago
  Angle-shifting units make this harder, but the obvious blindspot is the conveyor belt entrance/exit holes (they cannot have imaging equipment in them).
  - tsaoutourpants 9y ago
    Exactly. Imaging devices all have blind spots, which is how I was able to defeat the TSA's body scanners in 2012.

fpoling 9y ago

As lithium batteries are opaque to X-Rays, perhaps a ban on laptops with batteries should be considered. This will surely push for standard swappable batteries and standard power supplies so the laptops could be used on board without batteries.

tsaoutourpants 9y ago
What? No, that's a wholly unnecessary solution (though more standardization of batteries would certainly be nice). Swab the outside of the laptop for bomb residue, which would be especially difficult to clean from a laptop because the stronger solvents to clean with (like acetone) would mark the plastic. Or hire more dogs. Or make a "puffer machine" for laptops (blasts with air and then samples the air for explosive trace). Or come up with another solution -- this is HN! :)
- rwmj 9y ago
  Does swabbing work? I can imagine that the "batteries" (ie bomb) would be prepared, sealed and cleaned by one person, and then inserted into the laptop by another person so there's no contamination.
  - tsaoutourpants 9y ago
    It's hard to remove all trace, but yes, in theory you could avoid it by being really careful. Then again, if you work in a "bomb factory," there's trace everywhere, so it may be quite difficult. Also, the "turn on your device" thing they sometimes do offers some mitigation against this. Obviously, you can think of ways that may defeat this too, but to defeat all of the security, accurately, in one small package that doesn't look sketchy, is not easy. Fortunately, most terrorists are not the brightest people in the world.
    - kmonsen 9y ago
      Asking people to turn on the device seems stupid. Just do half battery half bomb and make it functional enough it will work for 10 min.

jperras 9y ago

Correct me if I'm wrong, but wouldn't a relatively benign way to fix this simply be that the TSA agents randomly reorient/flop some carry on luggage items in the bins before they go through the scanner?

tsaoutourpants 9y ago
That would definitely help. Or, simply re-run bags where there is opaque stuff that the screener is unsure about, oriented in a new direction. But, that wouldn't necessarily solve all the problems, as laptop batteries are opaque in all directions, and so if you got a lead metal box and filled it with explosives, it may look much the same.

subterfudge44 9y ago

One of the sad things about airport security is that there is no scope for private innovation. It is a military industrial complex of using substandard solutions for potentially non existent problems while wasting insane amount of money. May be there is a need for the security theatre but then we can at least get good at it. Can Elon Musk design a better airport security ?

tsaoutourpants 9y ago
Fuck Elon Musk, can you design a tool that would make airport security better? I bet in 15 minutes, most HN readers could come up with something that would be cheaper, more effective, and faster to use than the current tool set. There's indeed money to be made here (and good to be done), even if the easiest way would be to patent your idea and sell it to the military industrial complex you speak of. Fun fact: the parent company of the company that makes the TSA body scanners (L-3) also owns the company that made "waterboarding" famous. It is, indeed, the military industrial complex.
- streetwiseherc 9y ago
  Penn Jillete's "Bacon and a Kiss" airline screening.
- stevenwoo 9y ago
  There is a model that we already know works in practice but it's not cheaper or faster and it would generate a lot of income for security/airport renovation companies at the cost of much higher ticket costs to pay for it - the Israeli model. https://www.schneier.com/blog/archives/2010/01/adopting_the_is.html https://www.schneier.com/blog/archives/2010/01/adopting_the_...
  - valuearb 9y ago
    There is an easier model called "less stringent security". Flying is incredibly safe. There is little evidence that the TSA's onerous security processes safe enough lives to be worth their massive costs.

Animats 9y ago

The secrecy issue has gotten out of hand. The classic military view of secrecy is time-limited. "Where the ship was last week is unclassified. Where the ship was yesterday is confidential. Where the ship is now is secret. Where the ship will be tomorrow is top secret." The opposition will eventually find out what you're planning on doing. The goal is for them to find out the hard way, when incoming fire starts hitting them. The intelligence community has a longer-term view. "We know, and they know. We think they don't know that we know they know. We hope they don't know how we found out that they know." This protection of sources mindset leads to things being kept secret long after all involved parties know. The anti-terrrorism community has adopted the intelligence community mindset. This is a problem.

digi_owl 9y ago
> The anti-terrrorism community has adopted the intelligence community mindset. This is a problem. Wonder how much that has to do with overlap between the two. Today's terrorist may well have been yesterday's informat, and may well be an informant again tomorrow. After all, the CIA was deeply involved in Afghanistan back when the USSR was fighting there. And many of the people that the CIA supported then later turned against USA.
- mtgx 9y ago
  And then the CIA allied again with alQaeda when fighting Assad. And round and round it goes. Too bad the public is made a to be a sucker every time.
  - simonh 9y ago
    They didn't 'ally with Al Qaeda', they just both happened to be opposed to the same guy while also being opposed to each other. It's a complicated situation out there. Even at the height of the Cold War, sometimes the CIA and KGB would share information of mutual benefit. That didn't mean the CIA was allying with communism. Even Trump has learned this when his 'bombing Syria is the wrong thing to do, what Assad gets up to is non America's business anymore' policy lead to Assad feeling free to start nerve gassing civilians again. Oops. Turns out him being against Islamic State doesn't make him our friend either. It's a horrible nasty mess, but even trying to stay out of it just makes you even more vulnerable to even greater problems in the long run.

knodi 9y ago

ya right, fuck off TSA. They're just trying to pretend they're relevant.

suihkulokki 9y ago

This article seems to miss the fact ISIS took over Mosul international airport in 2014. Surely they got luggage screening machines in hand by then already.

deleted 9y ago
[deleted]
askvictor 9y ago
My guess would be that the gear at Mosul would not be as advanced as elsewhere.
- tsaoutourpants 9y ago
  Well, for whatever reason, they stole more equipment more recently. Could be that the new stuff is more advanced, or maybe we bombed the gear they took from Mosul. I don't have more details that would provide insight.
- nraynaud 9y ago
  Not sure, because the destinations countries for the planes departing from there have some interest (a bit like the US forcing some theater on Europe), and there is some international help for military and security theater gear.

AJ007 9y ago

Reduced airline travel, tourism, and global trade -- sounds like a good action plan for countering global warming.

squarefoot 9y ago

Everyone seem to have missed the opportunity here to push for standard power connector/polarity/voltage/maxcurrent requirement for all laptops while fitting a power cable (with short circuit protection in every seat. That will also discourage from producing laptops not working if a battery isn't plugged in. Having say a 12VDC/3A plug in every seat will force most manufacturers to make at least one airline-friendly laptop, and/or implement on faster models things such as turning off cores and keeping CPU speed low to stay within that current limit. edit- and push to get a standard for battery pack sizes to reduce the number of form factors, then implement a service where you give your used one at departure and get a new one at arrival. Regulations like that one stink badly, but necessities drive progress and I see an opportunity here.

JadeNB 9y ago
> edit- and push to get a standard for battery pack sizes to reduce the number of form factors, then implement a service where you give your used one at departure and get a new one at arrival. Or we could implement the Indian system, where you turn in your new batteries at departure and are given used ones on arrival. (Mysteriously, despite the assurance that they are the same batteries, they have sometimes changed brand, too.)

zkms 9y ago

Read this paper as well https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-mowery.pdf https://www.usenix.org/system/files/conference/usenixsecurit... -- the researchers who wrote it obtained (on the surplus market) the same model of backscatter X-ray body scanner that was deployed in US airports and proceeded to evaluate and validate various schemes for undetectable concealment of firearms, knives, and explosives. Other research was done, including a software implant that would selectively strip indications of contraband from the image (when a specific signal pattern was in the image), and a firmware implant that would disable all interlocks and deliver an elevated radiation dose. If it is possible for a few university researchers to obtain this sort of security scanner without resorting to crimes, it is folly to assume that actual adversaries cannot. We need better methods for detecting energetic materials (and not just suspicious shapes) in luggage (detecting it concealed inside humans is harder and would require transmission x-ray which is not currently acceptable for airport security screening) that don't crumble when the adversary has unlimited access to the security scanner to test concealment methods. Concealing knives is kinda easier than concealing energetic materials -- it is, for example, possible to machine a blade that fits perfectly inside a blunt, innocuous "sheath" so precisely (hi, wire EDM) that they appear as a single piece of metal. However, this is not so much of an issue nowadays, as no amount of threatening or stabbing with a knife will make a pilot open the cockpit door.

astrodust 9y ago
Ceramic, glass and plastic knives can be extremely dangerous and yet they probably don't show up on these machines at all. The utility of these machines is questionable to say the least. Bruce Schneier observed, like you did, that the heavily secured cockpit door is one of the only real improvements made to airplane security in the last few decades.
- knodi123 9y ago
  > and yet they probably don't show up on these machines at all Uh, yeah, they do. Have read anything about backscatter xray machines? The real way to defeat these machines is to hide things in folds of your flesh. It can see through clothes, but not too much skin. In staged demonstrations, fat people have gotten a metal pistol through, no problem.

syphilis2 9y ago

It seems to me that if an X-Ray scanner was stolen from an airport, that information would reasonably be considered SSI due to its relation to screening passenger luggage. I wouldn't be comfortable spreading news that stolen equipment is available, that there's a security vulnerability allowing equipment to be stolen, that ISIS is in possession of the stolen equipment, or any vulnerability assessments of the equipment. The unnamed source seemed convinced that any security decision was made to avoid scaring "mom from the midwest," but that comment appears short-sighted if anything more than conjecture.

tsaoutourpants 9y ago

Hi Everyone, author of post here with an update for you. The most modern x-ray systems in use by the TSA at airports to screen carry-on bags can indeed see through lithium batteries. It also differentiates densities, and it seems to me that the latest tech should therefore be able to indicate the difference between a battery and C4 in a battery-shaped box. So is it that the airports subject to the laptop ban have the older tech? Well... Read more: https://professional-troublemaker.com/2017/05/22/update-newest-tsa-carry-on-x-rays-can-indeed-see-through-laptop-batteries/ https://professional-troublemaker.com/2017/05/22/update-newe...

ryanlol 9y ago

>By forcing all these batteries into the cargo hold where a fire cannot be rapidly detected and contained, DHS would be countering any deceased risk of terror with an increased risk of fire. Everyones always been telling me that if I want to bring down a plane I should set the cabin on fire, not the cargo hold. Have I been living a lie?