The inability of government security programs to work

A reporter once asked security guru Bruce Schneier what he would do to make the TSA more effective. Schneier replied that if he had the agency's budget, he'd give it back.  He added that only two things have improved airline safety after 9/11: strong cockpit doors and the passenger's realization that they have to fight to live.  And yet airport security is worse now than it was then.

This post from ten years ago still rings true.

The world's cutest terror suspect

Todd Brown is the proud dad of an adorable little girl. A little girl that he found out, is on the TSA's list of potential terrorists.

It seems that if you're willing to do a fair amount of leg work, this sort of silliness actually gets cleared up. So well done to Mr. Brown, and I guess to the TSA for making the skies safe for cuteness.

Mr. Brown makes a good point, that there's nothing to tell you that you're on the list, and need to grovel your way through the TSA's unhelpful web site to find the required form. You could plausibly claim that this is a security feature - if the special someone on the list actually were a terrorist, you wouldn't want to let them know.

Which ignores the issue that it's idiotic to have someone so dangerous that they shouldn't be allowed to fly, but not dangerous enough to arrest. That's a discussion for another day. Today, the issue is false positives, the erroneous report that someone or something matches a particular categorization, when they actually don't.

This is why you get a second opinion when your doctor tells you that you have a serious disease. Any diagnosis will be less than 100% accurate, and you don't want to go on an expensive and invasive regime if you're one of the 2% that don't actually have the disease.

An anonymous commenter left this, over in Brown's comments:

They efficiently shifted the cost of false positives to you.

Bingo.

A long time ago, I posted about false positives and why the TSA doesn't go after everyone on one of its lists:

If we really thought these folks were actually terrorists, we'd investigate them. A reasonable investigation involves a lot of effort - wire taps (first, get a warrant), stakeouts, careful collection of a case by Law Enforcement, prosecution. Probably a million dollars between police, lawyers, courts, etc - probably a lot more, if there's a trial. For each of the 700 [people in our thought experiment]. We're looking at a billion dollars, and this assumes a ridiculously low false positive rate.

There are on the order of a hundred thousand people in TSA's no-fly or watch databases. Not 700. If you investigated them all, you're talking a hundred billionbucks. So they turn the system off.

And that's actually the right answer. The data's lousy, joining lousy data with more lousy data makes the results lousier, and it's too expensive to make it work. How lousy is the data? Sky Marshals are on the No-Fly list. No, really.  5 year olds, too.

Actually, they haven't turned the system off. Rather, they've shifted the cost of the investigation to Mr. Brown and people like him.

From the TSA's perspective, this makes sense. From our perspective, it's annoying. It's double-plus annoying when there's nothing that tells you that you're likely a false positive in their system. There is, of course, a sure-fire way to reduce your chance of triggering a false positive in the TSA's system to zero. Guaranteed to work every time.

Drive.