Six Uncomfortable Answers

We've got answers to some of my questions from yesterday.  And they aren't very comforting.  All in all, they remind me of the saying that the small scandals in Washington are what's illegal, but the real scandal is what's legal.  So, there were ways in which our air security system didn't work as intended, and those are a small failure, but the real failure is the way our air security system is intended to work.

Here are six answers to my questions:

1.  According to press reports, Abdulmutallab had a multiple entry visa to the US, and it was issued before Abdulmutallab's father warned US authorities of his growing militance.  It looks as though the warnings went to a US consular office in Nigeria while the visa was issued in London, which might have had some modest impact on whether consular officials took the warnings seriously. (Officials in London might have been more alert to the risk in Abdulmutallab's visa, since they issued it, which might have led them to dig more deeply and report with more clarity on the warning.)

2.  The intelligence/security agencies would like the consular officials in Nigeria to take the fall for this.  The agencies seem to be telling journalists that the father's warning wasn't relayed to them with enough detail to justify putting Abdulmutallab on a no-fly or selectee list, so they just stuck him in the 550-thousand-name catchall database (known as TIDE, the Terrorist Identities Datamart Environment) rather than a more active 400-thousand-name database.  But neither database would have made him a automatic "selectee" for special screening (roughly 14 thousand people are on that list), let alone no-fly status (4 thousand).  And it's hard to imagine that even transmitting a full transcript of the father's warning would have boosted Abdulmutallab onto the selectee or no-fly list.

Why is it so hard to get on the selectee or no-fly lists?  In part because privacy campaigners have made the lists less effective and more controversial by raising phony privacy concerns -- and getting Congress to buy into those concerns.  Here's the problem:  The lists are full of aliases and alternative spellings that the terrorists might use to defeat screening.  As a result, many, many people (kids, Senators, grandmas) end up as selectees because their names resemble the aliases of terrorism suspects.  The resulting hassles and complaints make officials cautious about adding large numbers of names to the selectee list. 

So why doesnt the US use other information, like date of birth, to "disambiguate" the lists -- to separate terrorist suspects from regular folks?  After all, we knew Abdulmutallab's birthdate, along with a lot of other information; there was no need to stop every Abdul Mutallab or Abdul-Mutallab or abu Mutallab from flying to the US.  But DHS hasn't been able to disambiguate the list because privacy campaigners and Congress prohibited DHS from gathering birthdates from passengers.  That information was too sensitive to share with the government, said the privacy groups, and they insisted that Congress prohibit DHS from running the selection process for years while DHS got over a series of privacy hurdles. 

All those infants and grandmas on the selectee list were, I've said before, privacy victims.  Years after the Congressional barriers were put in place, DHS finally got over them, and it has now started running the screening system.  But the result the privacy campaign was years of delay in setting up a more effective selectee database and years of complaints from the privacy victims.  As a result, the agencies got a bit gunshy about putting people on the selectee list, since the larger the list, the more complaints it generated from ordinary folks.

3.  The databases where Abdulmutallab's name was stored, however, were accessible to both FBI and DHS.  So when he made a reservation to come to the US, DHS should have known he was coming.  DHS probably would have flagged him for special scrutiny when he arrived in the US.  That would make it very hard for him to enter the US, visa or not.

Al Qaeda seems to have a lot of respect for US border security screening.  That's why it is trying to commit terrorist attacks on US soil without actually entering the US.  Since border measures were strengthened after 9/11, al Qaeda has tried three separate plots using the same basic technique -- get on a transatlantic flight and blow it up before it lands and before the terrorists are put through our border screening process.  Every plot has failed.  But if this doesn't remind you of the successive World Trade Center attacks, you're not paying attention.  They've got a schtick, and they're going to keep using it until it works. 

4.  Unfortunately, TSA, the part of DHS that screens air travelers, doesn't use the bigger terrorist databases for screening -- unlike DHS's border officials at CBP.  Partly that's because Congress forced DHS to leave traveler screening in the hands of the airlines for the phony privacy reasons described above.  But it's also because airline screening, unlike border screening, is not well designed to vary the level of screening depending on the risk a traveler poses.  In shorthand, it is trying to find dangerous stuff, not dangerous people.  So DHS's access to the data about Abdulmutallab was practically irrelevant to his ability to get on the plane.

5.  Practically but not entirely.  There is one exception.  CBP, which had access to the data, could have decided that it didn't want Abdulmutallab flying to the US, and it could have enforced that decision by telling Delta/NW not to let him board.  Because the visa had already been issued and because of limits on TSA's use of identity in screening, this was the last chance to keep Abdulmutallab off the plane.  We didn't use it.  How come?  Did CBP decide that the derogatory information wasn't enough to block Abdulmutallab without an interview?  Or did Delta/NW take that decision out of CBP's hands by failing to implement the AQQ requirement that was put in place a year ago?  We still don't know.

6.  I asked several questions about how good the screening was in Nigeria and at Schiphol.  I now think that it barely matters how good a job those screeners did.  Without a reason to treat Abdulmutallab differently from other passengers, the current level of screening wasn't likely to find the explosives.  Like 9/11, when the hijackers carried boxcutters because boxcutters were allowed by current screening rules, al Qaeda is adapting to our rules, finding explosives and hiding places that our current procedures can't detect.

The explosives Abdulmutallab was carrying weighed 80 grams.  That's about three ounces -- roughly the weight of a third of a cup of sugar.  So let's role-play al Qaeda at home:  put a third of a cup of sugar in a plastic sandwich bag.  Roll it up.  Can you think of place on your body where you could tape it so that it would be hard for a patdown to find?  Or, if you don't have that kind of imagination, here's one clue:  80  grams happens to be a bit less than the weight of standard lightweight bra inserts for "enhancing cleavage."

OK, now let's roleplay TSA:  What kind of patdown procedures are you going to put in place to find that rolled up plastic baggie?  Those bra inserts?  Remember, you're committed to treating everyone the same way.  Are you really going to pat down every passenger there and there -- and carefully enough to distinguish a baggie from a fashion accessory or an anatomical feature? 

According to the press, that's DHS's plan.  From now on, we'll see more, and more intimate, patdowns.  Less carryon luggage.  Closer looks at everything we do carry.  And on international flights into the US, restrictions on getting items from overhead bins, plus restrictions on what we have on our laps, etc.  In the longer run, we'll use more of the millimeter wave machines that will surely be more appealing to passengers than a patdown that is indistinguishable from getting to third base. 

But al Qaeda has already invented the "booty call" bomb, which makes even the millimeter wave machine ineffective.  So I think we're seeing the endgame for the current, nearly identity-free screening process.  Only a system that looks for terrorists as well as weapons is likely to be able to defeat al Qaeda's transatlantic flight plan.

Actually, al Qaeda's fascination with transatlantic flights -- and its fear of US border procedures -- gives us an obvious way to try out a new approach to screening.  Everyone on transatlantic flights is already carrying a passport.  And we already have good passport-based screening and computer systems for border officials.  Why not hook those systems to computers at the special US-bound screening checkpoints that already exist in European airports?  Then the screeners could perform a graded set of inspections and patdowns that vary depending on whether the traveler is considered risky or not.  Travelers in an intermediate status could be questioned, and US officials could be linked in by videoconference to check the answers against their information.

There is plenty of pain in an approach that looks for terrorists, not just weapons.  For starters, the Obama Administration's recent retreat from REAL ID and good driver's license standards makes it impossible to implement identity-based screening inside the US for the next five to ten years.  And, of course, everyone who ends up on the wrong side of the database will want to litigate about the data that led to their patdown, claiming viewpoint and ethnic discrimination, etc., etc.

Still, I don't see a better alternative.  The current path leads us to more and more obnoxious treatment of all travelers.  And in the end, after all the mass-produced humiliation, it leads in all likelihood to failure.

Update (1):  According to Reuters, KLM used APIS to check Abdulmutallab's admissibility with CBP and got back no objection:  it reports that the head of Nigeria's civil aviation authority "said Abdulmutallab's U.S. visa had been issued in London on June 16, 2008 and was due to expire in June 2010. He said it was scanned without the Advance Passenger Information System (APIS) returning any objection."  If that's so, CBP/DHS has some explaining to do.  It would mean that they knew the guy was coming and they also had access to the most recent intelligence, including the father's report, but did nothing to stop him or get him checked out in Amsterdam.  How come?

Update (2):  A couple of people have taken me to task about blaming privacy activists for the delay in Secure Flight, saying that the privacy flap wasn't just about the government getting date of birth but about the use of the Secure Flight database to catch criminals, not just terrorists.  It's true that the flap was in part about mission creep and some ill-advised statements from DHS on that point.  But the fact is that this system, which uses only DOB and a few other datapoints, has been delayed for years because of the activists and their Congressional allies.  I think there's a whiff of collective punishment in the air:  DHS said some dumb things about how much data it would collect and how widely it would use that data, so it has to be punished by the endless delay of Secure Flight.  Scratch that:  We all have to be punished by more inconvenience and less security.  Reminds me of the exclusionary rule; in order to punish the cops, we all must be exposed to more crime.

Comments

[Tom Cross]

Mr. Baker,

Interesting observations. In answer to your final question, let me offer the nearly groundless speculation that the father's report may have lacked the necessary credibility or specificity. Can anyone in the world really walk up to any US Government official and accuse someone of being an extremist, and be guaranteed that the victim will be subject to intense scrutiny by US security forces and potential visa denials and other hassles? What if it turned out that father was just pissed off at his son and wanted to screw with him?

I worry that the reaction to this event will be that an anonymous tip will be enough to put someone on a no fly list. That becomes a vulnerability in and of itself - as the system can easily be overtaxed.

There has to be a line that you draw in any identity based screening system where you decide that you don't have enough information about someone to bother subjecting them to increased scrutiny. Some of the people who don't meet that bar will, in fact, actually be terrorists. There may not be a solution to that problem. Its sort of a fact of life.

While a detailed inspection of this incident for problems and failures is worthwhile, its possible that this might not have been avoidable. We need to know more about the actual nature of the father's warning, about the quantity and quality of these kinds of tips that the system is processing overall. Perhaps we receive hundreds of these tips every day and it almost never pans out.

Regards,
Tom Cross

[Stewart Baker]

I suppose that's a risk, but not much of one in this case, where the guy making the report is a well-known political figure and his father. I agree that you don't put someone on the no-fly list because his father says he's become virulently anti-American and fundamentalist. But you should give him more scrutiny. If that translates to "hassled" or even "hassled unfairly because someone doesn't like me," well there's unfairness and unfairness. It would have been unfair for a planeload of people to die because some rich kid from Nigeria felt like rebelling against his upbringing, too. I'm not willing to say that their deaths would have been unavoidable if the device had worked properly.

[Ben]

Here's what you do:
Instead of hiring inadequate personnel like TSA is doing these days, you hire U.S. military veterans who spent time in Afghanistan and Iraq and have experience in check points. For every 5 TSA personnel you'll only need 1 such person.
They KNOW who to search for, and they KNOW how to search.
So as long as we don't have the proper technology, these people are the only ones who can give you close to 100% assurance that no terrorist will board a flight. TSA current personnel and screening methods are sub-par, as evident for anyone traveling on planes. You put 3-5 people like that in any international airport that has flights to the U.S. The money to do that will come from letting go over 80% of TSA personnel.

[Arjen]

Consider that you might be wrong about the perceived objective. Isn't it actually about causing disruption and embarrassment? Whether anything blows up is really less of an issue.
Increasing the hassle of travel, making people scared, making people and governments spend lots of money on security measures.... I'd say that the *threat* of terrorism has been tremendously successful in reaching its goals - thanks to the reactions for dealing with them.

I'd suggest that your suggestions, and the statement that privacy concerns are bogus, merely aid this trend. Under the banner of protecting your freedoms, you yourself are restricting your freedoms and encouraging authorities to legislate in this way.
Now please tell me, how does that make sense? And it's *you* doing it, not anybody else.
I'll tell you what. In the grand scheme of things, I'd rather get blown up than live in fear.

[THE_EddieJones]

Airlines do have to capture the DOB and such on passengers now under some kind of "Secure Flight" program. 9I dug up a quick link to hear more about it here: http://www.abc2news.com/news/local/story/Some-Holiday-Flyers-Screened-with-New-Security/CIL8q3WSIkuvl1EN64VDyg.cspx). Not sure exactly what happens to it, but it would seem they could sync up that info with the no-fly list, right?

[Trevor Stone]

A guy tried to blow up a plane, fellow passengers noticed him being weird, and called attention to it. He was restrained, didn't damage the plane, and is now being questioned in custody. Sounds to me like our defenses worked against the underpants bomber, just as they did against the shoe bomber.

You're focused on improving the process for highlighting people with a flagged visa, and that's a good idea, but it's not a strong solution to the terrorist problem. If the next terrorst's father doesn't notice the son's change in demeanor or tacitly supports Al Qaeda, your recommendations don't help. There's no way the U.S. can compile a list of ever person in the world willing to work for a terrorist organization.

So now you can't put a blanket on your lap during the final hour of a flight (what if your legs are cold?). I don't think Al Quaeda is opposed to blowing up a plane over Bermuda rather than over Vermont. As Bruce Schneier has pointed out (http://www.schneier.com/blog/archives/2009/12/separating_expl.html), the only post-9/11 flight security changes that make a difference are reinforced cockpit doors and passenger awareness. This time, the latter defense worked. I suggest that making every passenger go through security naked, with their belongings spread out on a tray, would also help, but I doubt we'd be willing to pay that privacy cost.

Incidentally, security screening for international flights to the U.S. is handled by local contractors (following rules given by the TSA), not the TSA itself. I don't know how good they are in major European airports, but the folks I dealt with in Mexico City weren't very effective; their mindless adherence to the letter of the rules made them confiscate our empty water bottles, despite our clear demonstration that they contained no liquids. If the procedure is as simple as "Give the following passengers extra screening," they could probably follow through, but what do you do when they hire a local with the promise of a free vacation in America and put the explosives in his underpants? We haven't exactly been effective at keeping illegal white powder out of the U.S.

[Trevor Stone]

Ben: So your proposal is to reduce screening staffing to one fifth of its current levels and use personnel who are more effective (let's assume they take twice as long, because they're more thorough). Security wait times would then be ten times as long, turning a half-hour line into a three hour line.

And based on the suicide bombing stories I've heard from Iraq and Afghanistan, the U.S. military isn't close to 100% effective at keeping terrorists out of sensitive areas.

[Stewart Baker]

The Eddie Jones is right. The reason your DOB is being gathered is precisely for the purpose of keeping grandmas and kids off the no-fly and selectee lists. That process is being rolled out now. But it took five years longer to implement than it should have because of the privacy campaign against "trusting" the government with our DOB. If you know someone who has spent the last five years going to the airport early to deal with the hassles of the selectee list, you can thank the ACLU and other privacy groups.

[Stewart Baker]

I just don't buy Trevor Stone's main point. I have nothing but admiration for the passengers who scooped flaming material out of Abdulmutallab's lap, but I think it's most likely that Abdulmutallab failed through incompetence, not because the passengers stopped him. If the explosives had fully discharged, all the passenger alertness in the world would not have saved the plane.

[DeathDealer]

I second that notion from Mr. Baker. What if these failed plots actually were successful. Some of these guys that become the bombers do they have change of heart at the moment of death. The U.S military and Other gov't organizations may have made a significant dent in Al Qaeda but they will not stop.

[Johnv2]

TS, I believe Mr. Stone's point is that the effective way to screen is to screen passengers, not just luggage. The Israelis look for bad actors, not just weapons, and they have been rather effective at keeping bad actors off El Al flights. TSA and its proxies could care less if you are wearing a white robe with "Death to America" on it while carrying a Quran. All they want to do is check your shoes and make sure you pass through a metal detector. TSA and proxies will never find all the weapons, but they might do better if they start looking for terrorists and then give them extra questioning and inspection.

[Theater]

And in the end, after all the mass-produced humiliation,

is it only humiliation when you are searched and not when "they" are searched? you seem to think it is ok for the govt to have a massive overreach of privacy, and impose costs of proving innocence on individuals who are deemed guilty because they get caught in a not-very-discriminate web. mutallab was not hiding his identity. he could've been stopped just with existing information, although it is hard to say how to qualify this information for sure without knowing how often the US govt gets "tips" from family members or other people of impending violence from some people.

also, why do you think grandmas and kids cannot be terrorists? it seems really silly to assume that just because they look innocent, they are incapable of wreaking damage, for example, with explosives. we made the same assumptions about women many years ago till suicide bombings convinced us otherwise. we made assumptions about families till we saw instances where men and women even took their kids on such missions.

[anon]

Another pants wetter. Don't fly if you're so scared of everything. And don't tell me you care about other people because it's obvious you don't in the way you so easily dismiss privacy concerns. Dunderhead.

[Orin Kerr]

Excellent post, Stewart.

[Jeff Walden]

"Can anyone in the world really walk up to any US Government official and accuse someone of being an extremist, and be guaranteed that the victim will be subject to intense scrutiny by US security forces and potential visa denials and other hassles?"

Well, in the case that it's a close relative (of some reputability as noted by Stewart), and you can verify that much of what he says is correct (and that what he says is potentially worrying -- the trip to Yemen seems like a candidate for both, or maybe with more digging the UK visa denied for mentioning a non-existent college), that seems like enough to me. I'm not convinced you need to worry that much about vindictive suggestions, at least not absent evidence that they occur with unusual frequency.

[liamascorcaigh]

"al Qaeda is adapting to our rules, finding explosives and hiding places that our current procedures can't detect."

This is the only success that you can practically hope for when dealing with people who are willing to die to kill others. In this instance the system worked but in a disorganized, haphazard way that undermines rather than increases confidence.

The level of security now in place has constricted the operating space of the attacker to such a degree that his chances of success are minimized. The device he used was crude and inefficient because he now cannot smuggle a more sophisticated piece of kit on board. The means of activating the bomb are also ad hoc and amateurish. Because of increased on board vigilance he is reduced to fumbling under a blanket to trigger the device. When he draws attention to himself he is overpowered. In other words, his failure to explode is not simply mere happenstance but a function of the very restricted environment in which he has to work.

This is a security success not a failure. Parts of the system failed but the overall security environment negated the threat in spite of intermediate lapses. It was not just dumb luck.

[D.Ch.]

No Israeli airplane has been blown up in decades! What do they do to keep flying so safe? Why cannot we do the same things?

[Kevin R.C. O'Brien]

Your procedures are as weak and ineffective as the current administration's. The fact is, you are screening for weapons when the probem is people and intent. But you're so steeped in multi-culti diversitude that you will not name the enemy, and make us all your enemies instead: you have created the Global War on Tourism.

The objections of civil libertarians are perfectly reasonable, given the degree to which TSA, DHS and other agencies' personnel have used the lists for personal reasons such as score-settling. I know this first-hand: after asking then-TSA Director Admiral David Stone a question he did not care to answer during a press conference, and writing an editorial critical of him (for a widely-read aviation industry publication), he (or, more likely, some flunky of his -- you, maybe?) placed me on the selectee list. And my editor. And my publisher. Giving us all the same date of birth. I flew unimpeded to that trade show where I attended Stone's press conference, and had the devil's own time getting back.

Am I a terrorist threat? Janet Napolitano may think so (and Stone, while appointed by Bush, has been an enthusiastic supporter of Obama's national-security approach: see http://www.youtube.com/watch?v=gjz5GvW-TCk for example), After all, I am a combat veteran of the GWOT (the real one, not that game you bozos play), and she says that's a bad thing. I was critical of Stone, and he says that's terrorism. On the other hand, I continue to work daily to secure this country against real terrorists, not the shadows you payroll patriots pursue.

I'm still on some list or other -- I can fly, but can't check in online, print a boarding pass, or check baggage at the kerb. My former editor (who no longer works for the publication in question either) and publisher remain similarly encumbered. Our names are all identifiable by ethnicity, and none of them is a moslem name. The IRA might have had a Kevin O'Brien but his MO wasn't blowing up planes, and he wasn't suddenly discovered the day this Kevin O'Brien's criticism of Stone appeared.

Back while working that journalist gig, I met people at every level of TSA from Stone and Hawley on down to the mouth breathers we all meet in airports. I never met a single one that struck me as competent, capable, honest, or intent on anything but warming a chair till pension and following instructions to the letter -- as long as the instructions weren't too hard. (My best sources on TSA stories were former TSA workers who'd found average or higher intelligence to be a bar to advancement, and left).

You guys are the essential force multiplier for al-Qaeda. They make these ineffectual, laughable, pathetic attempts and you magnify their effect by harassing and abusing innocent travelers, making travel unpleasant and inconvenient, damaging the airlines and other travel businesses to an extent that al-Q could never hope to achieve.

[Tex Lovera]

@liamascorcaigh: "This is a security success not a failure. Parts of the system failed but the overall security environment negated the threat in spite of intermediate lapses. It was not just dumb luck."

The threat waa not "negated". Just ask the people whose lives flashed before their eyes on that plane.

You are hiding a whole lot of "failure" behind a fig leaf of "success". And if you think that AQ isn't working on ways to circumvent the existing measures, you need to look at their history (as the author pointed out wrt the Trade Center attacks).

This whole process of screening is simply playing defense. I don't want my government playing defense against a mortal enemy with one hand tied behind its back. And if, IF, the holdup is over people who are nervous because the government may know your DOB, that is ridiculous.

@Arjen: "I'll tell you what. In the grand scheme of things, I'd rather get blown up than live in fear." So you're afraid of the government knowing... what? Your DOB? And you're not afraid of... what? Getting blown up? That's quite a discount rate you're applying. Wonder how that would change if you were in a free fall over Motown?

[jks]

Interesting article. What are your thoughts on "El-al style" behavioral questioning. The security that they have in place has worked for them for decades. Why not just implement that sort of system here?

[Mike]

Got it...the solution is to giver greater authority and power for numerous alphabet soup agencies to collect and store more data on Americans (file keeping, in other words)...the same agencies that already excel at immediately using new authority and power for purposes besides those it was originally granted for. What could possibly go wrong? Our border screening is so awesome that Americans are regularly stopped and held at the U.S. border for such routine matters as warrants for missing traffic court (or as happened several years ago, for not paying a ticket for failing to properly extinguish a campfire in a national park) or owing child support...and there is talk of adding unpaid municipal parking fines to the data linked to you passport because Customs and Border Protection is now in the general law enforcement business rather than...well, customs and border protection. TSA regularly stops and holds passengers for having too much cash on hand, or a baggie of dope, or any other number of things that have nothing to do with the security of flying from point A to point B, because TSA is desperately trying to get into the general law enforcement business, as opposed to the air travel security business. The author of this blog has fallen into the seductive trap of a bigger, ever more intrusive government answer to every possible problem. When the day comes that we can only fly, whether domestic or international, because a government database says we can, we are truly and wholly screwed.

[Duane Oyen]

Why is it that the privacy radicals such as Theater conflate rights and privileges? If you don't want to give minimal data for the sake of reasonable security, don't fly.

Let there be a choice of airlines- one with draconian security measures contracted out to Mossad, and another that permits everyone to fly wearing burkhas. Let the passenger elect whether to board fast and land in Mexico City, or board more slowly, submit to cavity searches, require more data, but safely land in the US. The international airlines can advertise by security awareness color.

I know which one I would choose.

[richard mcenroe]

I'm baffled by the people here who insist the plot was foiled. The bastard DETONATED his weapon. He just didn't do it right. Full props to the passenger who jumped on the flaming asshole, but if al Qaeda had used a simpler weapon or a less stupid delivery boy, that plane would have been lost.

They've evolved a tactic that works, and DHS is crowing about how all their paperwork was in order after the attack.

[styrgwillidar]

Respect for our border control system? Are you insane or just in deep denial. Terrorists are routinely crossing our border to enter and set up sleeper cells. I would guess the mission of these cells are not to attack, but the strategy is to recruit US citizens, preach radical Islam in US mosques and they will continue to exploit this vulnerablity to funnel personnel into local recruiting and pushing for Shariah/Muslim tolerance movements in places like Minnesota with it's large Somali immigrant population. I ride quads/dirt bikes along the southern border and if anyone believes that security has been improved to anything even remotely acceptable- they're fooling themselves. They also haven't talked to any of the Border Patrol agents actually on the border.

http://www.house.gov/sites/members/tx10_mccaul/pdf/Investigaions-Border-Report.pdf

http://www.local2544.org/

[EconRob]

The key point is you cannot stop dangerous stuff from getting airplanes but it is not hard if you try (and are not PC) from keeping dangerous people off. None of these are true lone wolfs. They all have contacts and leave tracks.