TSA Sued Over New Policy to Refuse Opt-Outs(professional-troublemaker.com)
professional-troublemaker.com
TSA Sued Over New Policy to Refuse Opt-Outs
http://professional-troublemaker.com/2015/12/24/corbett-sues-tsa-over-new-policy-to-refuse-opt-outs/
13 comments
The problem with this theory, as I see it, is identity. When you go through the body scan, they don't ask for your identification. Yes, they ask for ID before going to the security line, but there's a very difficult combinatorial problem with lining up IDs with bodyscans.
Also, I'm inclined to believe that the TSA is incompetent all the way up.
Also, I'm inclined to believe that the TSA is incompetent all the way up.
You don't actually need to match up to the individual, you have roughly say 100 or 1000 possible candidates for each scan, based on people you processed in the last X minutes. You can just save that then all you need is 2 scans to be able to match.
If you're tagging face when they get processed and running face recognition at the scanner, (which is either already possible or will be possible within a couple years) you don't even need to do that.
On a related note, I feel like people dont factor in the (exponential) progress of technology in their threat assessment. For example sites that tell people their password strength don't count Moore's law into password difficulty calculations. Nobody uses post quantum crypto. The NSA has played this by storing as much interesting encrypted data and then decrypting it when technology progresses Or vulnerabilities are discovered. Most of our encrypted data is plain text in some X number of years.
Anyway going back to scanners, you could just store data and wait until computer vision gets to the point where you can do it with computers. Anything a person can do a computer will eventually be able to do. If a person could watch a bunch of camera feeds and track each person from the point he presents ID to the point he is scanned a computer will eventually be able to too.
IMO they already can.
If you're tagging face when they get processed and running face recognition at the scanner, (which is either already possible or will be possible within a couple years) you don't even need to do that.
On a related note, I feel like people dont factor in the (exponential) progress of technology in their threat assessment. For example sites that tell people their password strength don't count Moore's law into password difficulty calculations. Nobody uses post quantum crypto. The NSA has played this by storing as much interesting encrypted data and then decrypting it when technology progresses Or vulnerabilities are discovered. Most of our encrypted data is plain text in some X number of years.
Anyway going back to scanners, you could just store data and wait until computer vision gets to the point where you can do it with computers. Anything a person can do a computer will eventually be able to do. If a person could watch a bunch of camera feeds and track each person from the point he presents ID to the point he is scanned a computer will eventually be able to too.
IMO they already can.
Except they don't know who they've processed. I guess they have the list of ticketed passengers, and most people will only go through the machines once. But they don't record anything when they check your ID.
I don't think this is a very hard combinatorial problem. At least last time I flew, they scan my boarding pass when I'm pretty close to the scanners. They'd just have to pick me out of, say, 50-100 other scans. And once they establish decent time data on BP scan to body scan correlation, they'd be able to narrow the field further.
I agree with you, though, that your last point makes this moot. They're too bumbling for me to worry.
I agree with you, though, that your last point makes this moot. They're too bumbling for me to worry.
[deleted]
[deleted]
This objection seems... naive? Taking an engineering mindset, matching up people and scans doesn't seem like a very hard problem. The checkpoint areas are blanketed in cameras, so face recognition is one possibility. Or, an easier solution would be a computer vision system that tracks movement.
If they have cameras that can track people via facial recognition, then why would they need to track people via body scans?
If they really wanted to use body scans to track people, they'd arrange the checkpoints so the body scanner is the first place you go after they scan your boarding pass and/or ID. And when questioned about why they rearranged the checkpoints that way they'd just say "TSA security evolves to counter ever changing security threats, and we can't speak specifically about what prompted this reconfiguration." End of story since security theater is not to be questioned.
If they really wanted to use body scans to track people, they'd arrange the checkpoints so the body scanner is the first place you go after they scan your boarding pass and/or ID. And when questioned about why they rearranged the checkpoints that way they'd just say "TSA security evolves to counter ever changing security threats, and we can't speak specifically about what prompted this reconfiguration." End of story since security theater is not to be questioned.
Facial recognition is fragile - a simple prosthetic or three can throw it off. Body recognition (and gait recognition) is less so, mainly because there's relatively MORE of it that would need to be disguised.
This is nonsensical. From the time that a person looks at your identification to the time that you go through the scanners, there is no tracking of individuals to associate the body type and DNA information with the ID provided.
Depending upon the airport, people can go from the ID checks to up to a dozen different lines with no ordering of people as they go through the scanners. Then on the swabbing side, there's no checking of ID once again.
If their intent was as nefarious as you claimed, the TSA would have changed the way you move through security in order to properly correlate the collected biometric information with ID.
Depending upon the airport, people can go from the ID checks to up to a dozen different lines with no ordering of people as they go through the scanners. Then on the swabbing side, there's no checking of ID once again.
If their intent was as nefarious as you claimed, the TSA would have changed the way you move through security in order to properly correlate the collected biometric information with ID.
Adding onto this, a skin swab for a DNA sample is pretty useless. You have contamination from everything from skin flora to skin cells from other people you've had physical contact with. Given the very public nature of airports, contamination by others is not far fetched.
To clarify, I didn't mean to imply that all those swabs get sequenced. That's too expensive to make sense. Rather, I'd expect them to be sequenced on demand if called for by a specific investigation.
Ah, gotcha. I misunderstood that one. My bad.
That said, I'm not too sure how that would work. They only check your boarding pass at the initial security check before the scanners, and the order at which people have their IDs checked is not preserved once you get to the scanners, so you can't track identification that way. On top of that, as someone who's been swabbed multiple times (I'm assuming something to do with my camera equipment), I've never been asked for identification when swabbed. So you might get some DNA to sequence, but you won't really know who it actually is.
That said, I'm not too sure how that would work. They only check your boarding pass at the initial security check before the scanners, and the order at which people have their IDs checked is not preserved once you get to the scanners, so you can't track identification that way. On top of that, as someone who's been swabbed multiple times (I'm assuming something to do with my camera equipment), I've never been asked for identification when swabbed. So you might get some DNA to sequence, but you won't really know who it actually is.
It's still feasible without the direct tracking. If you see the same body/DNA at three different times, odds are only one person was flying at all three times, and then you have a match.
Security checkpoints don't combine identifying information with the order you go through security. If you had to scan your boarding pass before entering the scanner, that would be different, but... you don't.
So, unless they are using face recognition to scan you when you get your boarding pass checked then re-compare it at the rapiscan, there's no PII gathering happening.
(Now, they could always make a policy change and say "now you must tag your boarding pass on the scanner before entering" but we're not there yet.)
So, unless they are using face recognition to scan you when you get your boarding pass checked then re-compare it at the rapiscan, there's no PII gathering happening.
(Now, they could always make a policy change and say "now you must tag your boarding pass on the scanner before entering" but we're not there yet.)
My boarding pass has been scanned by a machine with a cat5 coming out the back at DIA, LGA, JFK, ORD, MDW, PHL and DFW this year. This happens at the podium when presenting ID and boarding pass.
Although not directly at the time of scanning video surveillance shouldn't make it too hard to match the records up.
Although not directly at the time of scanning video surveillance shouldn't make it too hard to match the records up.
Yes, but after that, you enter a queue of maybe a dozen people in no specific order to actually go through the scanner.
They could pool results saying "these 10 scans are potentially from these 40 people" and cross reference against every airport visit, but are they that competent?
They could pool results saying "these 10 scans are potentially from these 40 people" and cross reference against every airport visit, but are they that competent?
You don't want to rely on them being incompetent, because you may end up with
your hand deep down the toilet when they become smart enough. Now you only
rely on incompetence alone, and that is quite easy to change.
But it specifically says in DHS document:
TSA does not store any personally identifiable information from AIT screening.This could just mean that all PII is handed off to another agency before it is stored. The NSA pulled similar shenanigans with public statements about their bulk data collection.
This isn't as strong a statement as it seems. It doesn't say that the machines themselves don't store PII, or that "AIT screening does not result in any permanent record of PII". There have been cases of body scans leaking (if I recall, the vendor was recording the scans within machines used by the US Marshals).
How have they defined "personally identifiable information?"
Swabbing someone's hands is a pretty poor way to get a DNA sample. Plus, they'd need to prep the sample in short order in order to correctly analyze it.
I'd rather submit to a retinal scan then be xrayed.
Well then the joke is on them, as I can assure you that a scan they made of me 5 years ago no longer matches my body shape so they are going to have a hard time tracking me.
After this holiday's eating season is over, my body shape will diverge even more!
After this holiday's eating season is over, my body shape will diverge even more!
please remove the tinfoil hat...
I don't get this. After Snowden and every revelation to come from that, how you can be so incredibly flip about other conspiracy theories is disappointing.
I don't like it one bit, but every wacko that told you the government was listening on every phone call and reading every email turns out to be very right, and after Clapper, et al lied about it to Congress with no repercussions, well, maybe don't be so quick to dismiss further theories about the government spying on you.
I don't like it one bit, but every wacko that told you the government was listening on every phone call and reading every email turns out to be very right, and after Clapper, et al lied about it to Congress with no repercussions, well, maybe don't be so quick to dismiss further theories about the government spying on you.
Man that's annoying. I don't feel like these scanners have been impartially vetted by the medical community and while they are potentially safe, it's going to be a bummer to finally be forced through one.
Indeed.
And previously pregnant women, those with compromised immune systems, and parents of young children could opt out. Not so much now.
I will say that the current Millimetre Wave machines are likely safer than the now defunct Backscatter X-ray machines. At least we're dealing with non-ironising radiation with a lower amount of raw energy.
And previously pregnant women, those with compromised immune systems, and parents of young children could opt out. Not so much now.
I will say that the current Millimetre Wave machines are likely safer than the now defunct Backscatter X-ray machines. At least we're dealing with non-ironising radiation with a lower amount of raw energy.
Is there independent evidence supporting their claims that they have correctly calibrated these devices to emit non-ionizing radiation?
Have you calibrated your flashlight to emit non-ionizing radiation?
I calibrated mine -- there's a little calibration screw on the back labeled with "Gamma, X-ray, UV, Visible, IR, Microwave, UHF, VHF, HF, ELF"
It's only got about 120 degrees of rotation, so it's tricky trying to tune it to emit a particular color.
I had it turned to ELF for a while, but then the Navy called and said my flashlight was disrupting their submarine communications.
It's only got about 120 degrees of rotation, so it's tricky trying to tune it to emit a particular color.
I had it turned to ELF for a while, but then the Navy called and said my flashlight was disrupting their submarine communications.
Man, you must of twisted that screw tight.
it's going to be a bummer to finally be forced through one.
Earlier this year, Terminal 5 at Heathrow wouldn't let me opt out of the scanner. Kinda felt like a personal violation, but the duty guards just said I was uneducated for having any concerns outside of their training.
Earlier this year, Terminal 5 at Heathrow wouldn't let me opt out of the scanner. Kinda felt like a personal violation, but the duty guards just said I was uneducated for having any concerns outside of their training.
I frequently have conversations with the TSA about their machines. They have been trained to discuss the differences between backscatter x-ray & MMW technology to allay concerns about the health risks associated with the former, especially in airports that only use the latter. They're typically very surprised to find that I'm very clear on the differences, and that my objection rides on the privacy implications rather than health concerns. Call me old fashioned, but we shouldn't let it become normal for the government to scan your body as a precondition to travel.
The Heathrow staff were wrong: the UK has changed its policy to allow travelers to opt-out (which was originally not allowed at all). Their training must not have been updated.
Whenever I travel to a country that uses body scanners, I carry a printed copy of the airport's FAQ page (if available) and the government FAQ page or law that says that passengers are allowed to opt out. Then I know that I can show this to the people operating the checkpoints or to their supervisors if necessary. So far it was only necessary once (in the Netherlands, where body scanners are used routinely and some checkpoint staff aren't trained well about the opt-out option). But I still have a printout of the UK one and remember very clearly when the policy changed (prior to the change, I took the train through the Chunnel to Brussels instead of flying out of Heathrow).
Maybe I can set up a web page that has links to the policy and law documents so that people can find them more easily. There are already some pages that try to track which airports have body scanners, but I don't think I've seen one that tracks "what to show checkpoint staff to convince them that their country allows opt-outs".
Whenever I travel to a country that uses body scanners, I carry a printed copy of the airport's FAQ page (if available) and the government FAQ page or law that says that passengers are allowed to opt out. Then I know that I can show this to the people operating the checkpoints or to their supervisors if necessary. So far it was only necessary once (in the Netherlands, where body scanners are used routinely and some checkpoint staff aren't trained well about the opt-out option). But I still have a printout of the UK one and remember very clearly when the policy changed (prior to the change, I took the train through the Chunnel to Brussels instead of flying out of Heathrow).
Maybe I can set up a web page that has links to the policy and law documents so that people can find them more easily. There are already some pages that try to track which airports have body scanners, but I don't think I've seen one that tracks "what to show checkpoint staff to convince them that their country allows opt-outs".
The EU has banned such scanners over health concerns. Just something to keep in mind.
They didn't ban the currently deployed Millimeter Wave scanners. They banned the previously deployed Backscatter X-ray machines.
To be clear, the EU only banned backscatter x-ray machines, which the TSA has mostly eliminated in favor of millimeter wave machines.
There isn't as much concern about the health implications since the backscatter machines were moved to low volume airports a few years ago (I haven't seen any at major airports anyway), so they're primarily using the microwave machines (non-ionizing radiation) at major airports. Interestingly, it wasn't the risks that led them to opt for microwave scanners - backscatter machines were too slow for the volume of passengers seen at large airports.
I broadly oppose security theater in all its forms, especially when it does nothing to improve actual security - and none of the naked scanners used by the TSA have been shown to be effective.
The only real argument in their favor is that it's so easy to use that there is no reason not to use them - but even that isn't true. It's trivial to show that even if they were nearly foolproof that they still wouldn't be worth using. There are so many airline passengers that the prior probability that an individual traveler has malicious intent means that virtually all alerts will be false positives. It is pointless to violate the privacy of everyone when the benefits are so minimal.
The only real argument in their favor is that it's so easy to use that there is no reason not to use them - but even that isn't true. It's trivial to show that even if they were nearly foolproof that they still wouldn't be worth using. There are so many airline passengers that the prior probability that an individual traveler has malicious intent means that virtually all alerts will be false positives. It is pointless to violate the privacy of everyone when the benefits are so minimal.
The biggest reason not to use them is they are slow. It is a waste of our time, not to mention the cost to run them. And then, at least on the US they don't have the right to search me.
Can we get some blog posts and discussions about how single individuals can put together such a beautifully branded and effective civil rights advocacy program, without a bloated nonprofit organization attached? This is a powerful weapon against tyranny
Hi tamana,
Author of the article and lawsuit here. Anything in particular you'd like to challenge?
The thing is, I can put up a guide, but all of this takes a ton of work (and money). It's not possible to make a lawsuit tutorial that you can follow in a couple hours and be done. Once you've researched, written, and filed your lawsuit, then the real stuff begins: the government attacking your suit and you're left to defend it. I think it's fun, and it's definitely rewarding, but it takes a lot to make happen.
Thanks,
--Jon
Author of the article and lawsuit here. Anything in particular you'd like to challenge?
The thing is, I can put up a guide, but all of this takes a ton of work (and money). It's not possible to make a lawsuit tutorial that you can follow in a couple hours and be done. Once you've researched, written, and filed your lawsuit, then the real stuff begins: the government attacking your suit and you're left to defend it. I think it's fun, and it's definitely rewarding, but it takes a lot to make happen.
Thanks,
--Jon
Thanks for fighting the good fight, Jon. I've been opting out for years, and if there's anything people like us can do to help, please don't hesitate to ask!
They clearly don't like it when you opt out. Things I have experienced while opting out:
They clearly don't like it when you opt out. Things I have experienced while opting out:
1. Being separated from my belongings for up to a half hour while dozens of strangers are walking past them and could easily pluck my wallet or computer out of them.
2. Being asked to wait directly next to the luggage X-ray machines. I think most know that we're specifically not thrilled about that.
3. Got an "extra-thorough" pat-down by a guy who claimed it was in the name of security and procedure.
4. Teasing/harassment for not trusting the X-ray machines.
I always opt-out. Kudos to you for being able to stop flying soon. I don't fly that often, but flying is always the most painful part of traveling. It's amazing how bad the flying experience has turned into.
I think those with biomedical devices especially implants have a very good case. It's a catch 22 with a life-sustaining device: https://twitter.com/statwonk/status/679390295771979778?s=09
Thank you for your initiative to fight this BS
Interesting.
I opted out this morning. I have friends on flight crews who opt out (either by KCM or by the freedom frisk) and I haven't heard anyone in my circles complain about it on Facebook.
I opted out this morning. I have friends on flight crews who opt out (either by KCM or by the freedom frisk) and I haven't heard anyone in my circles complain about it on Facebook.
I think this headline is misleading. Per discussion from yesterday (there's another thread), TSA published a document which says that they may decline opt-outs but that passengers can "generally" still opt out (they didn't publicly state who won't be permitted to opt out or when or why). While this is a very disturbing change, it's not quite the same as eliminating opt-outs entirely.
So it's probably more likely that opting out is now a courtesy and that if they want to make you go through the peep-show machine, they can.
This does nothing to make us safer, as the ineffectiveness of the TSA has been well documented on numerous occasions since their inception.
would you rather have no security and feel good knowing anyone can walk into the airport unhinged and hop on an airplane?
Definitely. The chances are so low that I'm not worried about it. The same concern applies to any other mode of transportation and we don't have to deal with the "security theater" measures for those other modes of transport.
Do you constantly worry about "unhinged" drivers while walking on the sidewalk? Are you constantly worried that you would be the victim of an intentional attack like what recently happened in Las Vegas? Do you believe we need to go through the "security theater" motions in order to "mitigate" the, for all practical purposes, negligible risk of something similar happening in the future?
Do you constantly worry about "unhinged" drivers while walking on the sidewalk? Are you constantly worried that you would be the victim of an intentional attack like what recently happened in Las Vegas? Do you believe we need to go through the "security theater" motions in order to "mitigate" the, for all practical purposes, negligible risk of something similar happening in the future?
You can have other kinds of security without necessarily having the strip search machines. For example, basic checks like going through a metal detector or passing sniffers for explosives or other undesirable substances have proven to be relatively reliable, and do not cause significant concerns relating to either health or privacy in the way that various body scanning technologies do.
In any case, I am at a similar risk of someone unhinged killing me and hundreds of other people every time I get a local train into the city, which requires no security checks at all. This was, unfortunately, demonstrated in the 7 July attacks in London, and I personally know people who were caught up in those attacks and hurt so I'm the last person who's going to be flippant about that possibility. I still feel just fine about my survival chances getting on a train, though. More people get hurt and killed on our roads most weeks than died in the 7/7 attacks, and those were more than a decade ago and haven't been repeated since.
In any case, I am at a similar risk of someone unhinged killing me and hundreds of other people every time I get a local train into the city, which requires no security checks at all. This was, unfortunately, demonstrated in the 7 July attacks in London, and I personally know people who were caught up in those attacks and hurt so I'm the last person who's going to be flippant about that possibility. I still feel just fine about my survival chances getting on a train, though. More people get hurt and killed on our roads most weeks than died in the 7/7 attacks, and those were more than a decade ago and haven't been repeated since.
YES. The only time I feel unsafe is when I go through security. I get groped and lose sight of my belongings.
But I get on a bus with just anyone, I walk into a mall with just anyone, I drive on the freeway with anyone, and I go to a sporting event with just anyone. Why not fly with just anyone?
That's what we have right now, we just pretend that we don't. The TSA routinely fails their own inspections.
I'd rather have effective security, instead of security theater.
Here is the excerpt from the DHS document:
Individuals undergoing screening using AIT generally will have the option to decline an AIT screeningin favor of physical screening. Given the implementation of ATR and the mitigation of privacy issues associated with the individual image generated by previous versions of AIT not using ATR, and the need to respond to potential security threats, TSA will nonetheless mandate AIT screening for some passengers as warranted by security considerations in order to safeguard transportation security.
Individuals undergoing screening using AIT generally will have the option to decline an AIT screeningin favor of physical screening. Given the implementation of ATR and the mitigation of privacy issues associated with the individual image generated by previous versions of AIT not using ATR, and the need to respond to potential security threats, TSA will nonetheless mandate AIT screening for some passengers as warranted by security considerations in order to safeguard transportation security.
I already know exactly what's going to represent a "security consideration in order to safeguard transportation security."
When you opt-out, they make you wait a long time standing next to the X-ray machine for someone to give you a pat-down. (It's almost never that the guy doing pat-downs is busy, btw- really weird.)
They're going to claim that having someone wait near the X-ray machines that long represents some kind of security threat. And then they're going to use that fact to justify overriding the opt-out, because the more time you spend next to an X-ray machine, the higher the odds you've tampered with it or have had time to assemble that tactical nuke you've been hiding in your pockets or whatever nonsense they come up with.
When you opt-out, they make you wait a long time standing next to the X-ray machine for someone to give you a pat-down. (It's almost never that the guy doing pat-downs is busy, btw- really weird.)
They're going to claim that having someone wait near the X-ray machines that long represents some kind of security threat. And then they're going to use that fact to justify overriding the opt-out, because the more time you spend next to an X-ray machine, the higher the odds you've tampered with it or have had time to assemble that tactical nuke you've been hiding in your pockets or whatever nonsense they come up with.
Is this inclusive of the TSA PreCheck or Global Entry program?
I have pre check with the global entry program and was 'randomly selected' to go through a body scanner on a recent trip, so it can happen. Most of the time pre check just goes through a simple metal detector though.
[deleted]
Precheck relied on metal scanners only every time I used it. Global entry is an immigration thing which currently includes pre check at no additional fee.
December 2016 prediction: TSA PreCheck (including the $100+ fee) will become mandatory as well. You can always take a bicycle to your destination if you disagree.
That seems like a weird assumption, considering that even today, you can fly domestically without any ID at all, subject to additional screening.
PreCheck is a good thing, and a good system, but it hardly incentivizes the government to make it mandatory.
PreCheck is a good thing, and a good system, but it hardly incentivizes the government to make it mandatory.
$100 fee isn't even such a big de, compared to the Sept 11 Security Fee (terrorism tax) already attached to every leg of your airline trips.
This post was top on the front page an hour ago. It seems to have been removed. Why?
I noticed the same, and it's not the first time it happened to one of my posts. My guess is one of the mods thinks it's "not tech enough" and bumps it down, but who knows?
The same scanners that proved to be inefficient?! I will definitely fly less then and will consider other means of transportation. It's better for the environment as well.
This is not a duplicate. The post is about a new lawsuit filed due to the change in rules, the suit has not been previously on the front page.
It's the same underlying story; note how the thread is much the same as the earlier one. In such cases we treat follow-up posts as dupes unless they're particularly substantive or contain significant new information. I don't think this post quite clears that bar. That is not an opinion about either the TSA or the lawsuit.
We started moderating HN this way after the Snowden deluge of 2013 in which the front page was dominated by follow-up posts for a long time. Many users complained about this, and they were right, yet the underlying stories were obviously on-topic. We came up with the current policy as a way to balance the concerns.
We started moderating HN this way after the Snowden deluge of 2013 in which the front page was dominated by follow-up posts for a long time. Many users complained about this, and they were right, yet the underlying stories were obviously on-topic. We came up with the current policy as a way to balance the concerns.
They're biometrics. They take precise measurements of a person's shape, which is sufficient to detect if someone is traveling under a false name, and they're building a database of those biometrics to have available for use elsewhere. If the scan's result is ambiguous, they swab your hands and stick the swab in a machine, supposedly to detect residue from explosives but with the nice side-effect of producing a stored DNA sample for later use. They've proven pretty useless for controlling the flow of contraband, but they're quite useful for catching fugitives. While the people staffing the checkpoints aren't particularly smart, it's reasonable to assume that the people at the top are pretty clever, and their policies are consistent with this having been the real goal all along.
If they tried collecting fingerprints from travelers, they would get a very strong backlash. This way, they get a weaker backlash and some jokes about how stupid they are for using machines that can't reliably detect guns.