The futility of the TSA during the War on Terror

One advantage of having been involved in Internet Security for a considerable time is that you see what doesn't (and can't) work.  This very often applies to the Real World.

Consider antivirus.  "Everybody knows" that they need to have one.  "Everybody knows" that they need to keep it updated.  The antivirus program works hard - you can see your computer slow down when it fires up to do a scan.  The antivirus companies work hard - you get a daily update that contains hundreds or thousands of new signatures, each day, every day.

And it doesn't work:

Signature-based antimalware detection is increasingly ineffective against an explosion in the number of malware variants as well as an increase in the number of financially motivated targeted attacks.

Does this mean we get rid of antivirus technology altogether? Not at all.

What it means is that we can no longer protect endpoints using signature-based mechanisms alone. Endpoints must be protected using a combination of mechanisms – whitelisting, blacklisting and behavioral-based approaches — working together as a system.

What we see is that the Bad Guys have adapted to the prevalence of antivirus by writing so much new malware - and testing it against commercial antivirus, tweaking it until it gets missed - that your antivirus may only have a 25% chance of catching something new, because a whole Black Hat industry has grown up to make avoiding antivirus detection easy:

For the last six months there has been an explosion in malware scanning portals that cater specifically to the demands of professional malware authors and botnet masters. These portals provide guarantees on privacy of submitted samples and include specialized services designed to suit their criminal clientele – for example, the ability to bulk-upload caches of new samples for testing, CSV formatted reports, automatic tweaking of samples to avoid certain antivirus engines, continuous testing of samples (i.e. alerting of when an antivirus update appears that is capable of detecting a submitted sample) and multiple alerting features (e.g. email, SMS text messaging, IRC/Jabber alerts, etc.).

The Internet Security industry is adapting, by adding different techniques (whitelisting, behavioral based stuff, etc) because it needs to remain viable to the market.  If it doesn't adapt, the companies will become irrelevant and go out of business.  Basically, the industry has to provide results or die.

The TSA doesn't.  The TSA is interesting, because it takes what is basically the same approach as antivirus: looking for known bad things.  It is extremely intrusive when it does this (just like antivirus), and makes a great show of how busy it is (lots of uniformed TSA folks manning lots of checkpoints).

From a results point of view, it doesn't work.  The TSA has caught precisely zero terrorists (although they have caught some run of the mill criminals during their inspections).  It's because they're always looking for the old attack that the terrorists don't try anymore.  Like with antivirus, it's "security in the rear view mirror", focused on the process, not the end result.

Unlike the Internet Security industry, the TSA is not correcting by adding new techniques that might make it more effective.  The reason is captured in a nutshell in this short video by Internet Security guru Bruce Schneier:



Shielded from market forces, the TSA doesn't have to stop new attacks.  To keep its budget, all it has to do is stop old attacks.  And so it implements increasingly expensive, draconian, and futile searches, chasing after the last attack.  It's spent millions of dollars installing expensive X-Ray machines that generate ten times the radiation that we were told:

The results of tests on the radiation levels at x-ray body scanners that have been put in airports acorss America are flawed, the Transportation Security Administration admits.

The tests came back showing ten times more radiation than was expected.

But don't opt out of the scan, or you will be sexually assaulted, like a former Miss USA:

DALLAS, TX (PIX11)—

The latest report of molestation at the hands of TSA agents comes from former Miss USA Susie Castillo, whose tearful account of her experience at the Dallas Fort Worth Intl. Airport already has more than 200,000 views on YouTube.

"I'm crying because, as an American, I have to go through this," she says in the video.

...

Castillo said that an older woman who worked for the airport attempted to comfort her as she sat crying, saying, "Well honey, you know what, I'd rather go through the scanner or get a pat-down than, you know, be blown up." In the video Castillo recalls thinking, "Okay, I guess I'm supposed to find comfort in that, but I didn't."

TSA has since reviewed the incident and a representative reportedly told TMZ, "We have reviewed this passenger's screening experience and found that the officer followed proper procedures."

And it's all futile, just like today's antivirus signatures.  Tomorrow's malware is already tested against these signatures before it is unleashed, just like the terrorists don't do the old attacks.  They make up new attacks.

As Schneier says, "It's a stupid game, and we shouldn't play."

The only one that wins this game is the TSA, whose budget and headcount continually increases while they sexually assault citizens and entirely fail to catch any terrorists.  This is broken, because they aren't responsive to the market.

There is a solution, that I modestly offer here.  A bold (read: media whoring) Governor should federalize airport security in his state.  He should send in the State Police and arrest any TSA agent that engages in sexual assault.  He can have the security outsourced to a company that will actually be responsive to the market.

The TSA, of course, will have a cow.  They will threaten legal action.  Andrew Jackson's dictum will prove popular: The Supreme Court has made its ruling.  Now let it enforce it.  It's unlikely that this visible battle royal will make the Governor less popular; on the contrary, the TSA is at best ignored and at worst despised by most of the country.  Our Governor will be seen as a hero by many registered voters.

The TSA will threaten to close down air traffic to that State.  And here's where we see where the battle will have to be fought.  If you shut down flights to, say, Providence, people will simply fly to Boston.  Can't fight on those terms.  But what about Texas?

You shut down DFW, and you bring America's air travel to a grinding halt.  Matter of fact, if you shut down Atlanta Hartsfield, you bring air travel to a halt.  Same with Chicago O'Hare, and (maybe) Denver.

I wouldn't expect that the Illinois Governor will want to play this game.  But Rick Perry might.  And here's the fun part: during what looks like the slide into a double dip recession just as the 2012 election cycle kicks off, the Obama Administration will fold like a house of cards in a tornado.

And so my plea: Help us Obi-Wan Perry, you're our only hope.

UPDATE 3 May 2011 09:38: Welcome visitors from View From The Porch, and as always thanks, Tam. I left out something important, which I'll add here.

Schneier is absolutely correct that the general public doesn't really understand just how little security they're getting, and will look at the TSA as "people protecting me".  That assessment is wrong, but is the starting point - we have to get past a knee-jerk "but who will protect me" reaction to keep this popular.

That's why it's so very important to bring in some sort of screening company as a replacement.  The Security Kabuki will have to go on, in a less intrusive (and less costly) manner.  Pure Libertarian types won't like it (heck, I don't like it), but there will be no traction with Polly Public without this.

And the messaging has to be 100% "sexual assault is a crime, and will not be tolerated".  Polly Public is almost certain to line up behind this, by large margins.

As Tam said, this is a Hail Mary sort of plan.  As such, it contains all sorts of things I'd really rather not have to put up with.  But the best is enemy of a good dang start.

Next target can be the EPA ...