PPRuNe Forums - View Single Post - Netjets Passenger Preflight Procedures
View Single Post
Old 30th Apr 2012, 06:33
  #13 (permalink)  
p7r
 
Join Date: Aug 2011
Location: Manchester
Age: 45
Posts: 8
Likes: 0
Received 0 Likes on 0 Posts
Security theatre isn't security

Apologies for butting in with a bit of a contrarian view, but I have to argue that if divulging security procedures in public makes them less effective, they aren't real security.

My first love/career was in IT security, and we would refer to a security practice that is ineffective once explained to the people who seek to exploit it as being "security theatre": it is a big showy piece of process that is intended to make people feel some security is going on, perhaps modifying their behaviour (in this case stopping terrorists or hijackers from believing they have a credible attack vector), but in essence would be ineffective once that attacker realises it's security theatre.

We're surrounded by security theatre on a daily basis. We actually even seek it sometimes (e.g. more police on streets even though there is no evidence that such a move decreases crime rates or improves detection rates in numerous studies over many years). However, it's dangerous because it prevents us finding genuinely secure and safe practice. I would posit that much of what is done in aviation is security theatre, but if I said that too loudly and pointed out all the attack vectors left by the existing processes, I would no doubt get a visit from Special Branch.

That said, I do worry if we're not spending too much time appearing to be safe rather than actually making flying safer.

For those interested in such matters, Bruce Schneier runs an excellent blog and email newsletter, in which he has pointed out flaws in TSA and airline security procedures as security theatre on numerous occasions.

If NJE - or indeed any operator, airline, airport or law enforcement agency - have security practices in place that they can not explain because they would then become ineffective they already are ineffective, and any attacker who is competent enough to plot a major terrorist action is going to be able to work out the "pain points" of that process they must overcome by travelling with that outfit perhaps just 2-3 times and observing closely.

Given there are numerous stories of TSA staff stealing passenger property (iPads are popular), it would seem that bribing security officials at an airport is viable and therefore would make a complete mockery of these processes anyway.

I used to see a lot of stupidity in IT security as adoption of Internet protocols were adopted, and that took the industry 10-15 years to overcome including half a dozen high-profile failures (one including a worm/virus written by the son of an NSA director), before we started to get it right. It cost time and money, but nobody died. The aviation industry needs to get this right because if they don't, people will die.

This thread has just highlighted what I already feared: aviation security is in such a poor state, we can't discuss it because it would become immediately apparent to everybody just how useless they are as procedures against a highly motivated attacker.

If you do work for an employer who has security procedures that can't be discussed, please go and have the discussion internally that you need to develop better procedures and the industry needs to get away from thinking that putting liquids in a separate bag for the security scan and occasionally scanning footwear is enough.
p7r is offline