Slow Down TSA Lynch Mob: That Naked Scanner Expose Video Is Exaggerated & Old News

from the be-real dept

So, a video made by a TSA-critic and blogger named Jonathan Corbett has been making the viral video rounds, supposedly showing how "anyone can get anything past the TSA's scanners." Now, I've been a huge critic of the TSA's scanners and the TSA itself. I think the entire security process is a joke and a form of security theater. I think the naked scanners are a huge waste of taxpayer money and potentially dangerous. But... I'm somewhat surprised at how quickly people just believed what was said in Corbett's video. You can watch the video here:
First off, I was surprised to hear that the "revelation" was that by putting something on your side, the machines wouldn't notice it. That's not a revelation at all. It was one of the conclusions that came out in a research report published in 2010, which got a fair amount of publicity at the time. Among various vulnerabilities for the scanners, the report noted:
The images are very sensitive to the presence of large pieces of high Z material, e. g., iron, but unless the spatial resolution is good, thin wires will be missed because of partial volume effects. It is also easy to see that an object such as a wire or a box- cutter blade, taped to the side of the body, or even a small gun in the same location, will be invisible. While there are technical means to mildly increase the conspicuity of a thick object in air, they are ineffective for thin objects such as blades when they are aligned close to the beam direction.
In other words, strap a knife to your side, and perhaps the machine won't spot it. We heard that years ago. So, nothing new here.

Plus, I'm pretty sure that the machines now take images from multiple angles, which would rule out this vulnerability. On top of that, Corbett bases his claim on a couple of sample images that are black and white -- and uses that to claim that a black object on your side will not show up against the black background. Once again, I'm pretty sure his info is now completely out of date. The TSA has been upgrading the scanners so they no longer show the "nude" picture. Just last month we showed an image of what the new machines show:
And they show this in public, since there's no more nudity to contend with. Notice that there's a white background... and it's not a scan anyway, but a detector system that highlights points to check out.

Now, it is true that Corbett was able to get through the machines with a metallic box in his side pocket, and that's his proof. He does this twice. While, again, I'm not impressed by the machines, I don't think this is "proof" in the sense that Corbett believes. First of all, official tests show that there's a ridiculously high error rate with these machines -- they let through "bad stuff" all the time. So, I agree with Corbett that the machines are a complete waste and should be done away with, but I don't think one guy going through the scanners twice without getting stopped for a little metallic box in his pocket... is absolute proof that anyone can get through without getting stopped.

Of course, it seems worth pointing out that a metal box is not a dangerous object, and the point of the machines (so we're told) is to stop threatening objects from getting through -- not just metallic objects. So it's possible that the TSA agents saw this thing in his pocket and immediately saw that it wasn't something dangerous. Corbett's test was whether or not the scanners detect metal. But they're not metal detectors, so the test itself is flawed.

So, while I don't agree with the TSA's response to this video in which "Blogger Bob" somewhat angrily snaps back about how important TSA scanning is, I don't think Corbett's claims are that convincing and I'm surprised at how much press it's been generating. Yes, the scanners are probably pointless, and it's all security theater, but that doesn't mean we should all stop thinking through the details on videos that potentially show some weaknesses in these machines.


Reader Comments (rss)

(Flattened / Threaded)

  1.  
    icon
    Yakko Warner (profile), Mar 8th, 2012 @ 11:26am

    It wasn't the sewing kit...

    Of course, it seems worth pointing out that a sewing kit is not a dangerous objectů


    The sewing kit was just what he bought to supply his "nefarious plot", what he used to sew the extra pocket to the side of this shirt. The "dangerous object" was the metal box he smuggled through security.

    Although I had much the same reaction: let him try sneaking a gun, knife, or cupcake in his side pocket and see how far he gets.

     

    reply to this | link to this | view in thread ]

  2.  
    icon
    ottonomy (profile), Mar 8th, 2012 @ 11:30am

    I doubt a would-be terrorist would be bold enough to try to exploit this vulnerability

    I think the TSA is probably unlikely to miss something at your side. In PDX last week, they double checked a bit of fabric on my outdoorsy pants side that was just 3 thin empty pockets stacked up--about three layers of pocket-liner fabric thicker than the rest of the pants.

     

    reply to this | link to this | view in thread ]

  3.  
    icon
    Ninja (profile), Mar 8th, 2012 @ 11:30am

    It's a matter of tricking the leprechauns inside the machines. Easy.

    The problematic part is to trick the unicorns in TSA backstage. They'll smell dangerous cupcakes miles away.

     

    reply to this | link to this | view in thread ]

  4.  
    icon
    Philip (profile), Mar 8th, 2012 @ 11:41am

    So it's possible that the TSA agents saw this thing in his pocket and immediately saw that it wasn't something dangerous.

    You give the TSA far too much credit. lol

     

    reply to this | link to this | view in thread ]

  5.  
    icon
    Mike Masnick (profile), Mar 8th, 2012 @ 11:46am

    Re: It wasn't the sewing kit...

    The sewing kit was just what he bought to supply his "nefarious plot", what he used to sew the extra pocket to the side of this shirt. The "dangerous object" was the metal box he smuggled through security.

    Oops.. fixing.

     

    reply to this | link to this | view in thread ]

  6.  
    icon
    Rikuo (profile), Mar 8th, 2012 @ 11:47am

    Re:

    Damn, you beat me to the punch, I was just going to comment on that myself. Given all the paranoia that the TSA shows on a daily basis (pat-downs of six year olds?), I highly doubt that this guy went through the detector and the TSA agent saw the sewing kit on his screen and actually determined that it was safe. No, the MO for a TSA agent is anything that seems the least bit suspicious must obvisouly be a terrorist threat.

     

    reply to this | link to this | view in thread ]

  7.  
    icon
    silencedogood (profile), Mar 8th, 2012 @ 11:52am

    "Plus, I'm pretty sure that the machines now take images from multiple angles,"

    False. Imaging doesn't work this way. Not.at.all.

    You may notice a 3-D rendering of the MMW images, now masked by the "gumby" software.

    However, imaging can only take pictures in planes, and then render a 3-D image. Look closely at the 3-D images from MMW scanners, the sides are black. It's a trick of the eye.

    The sides of an individual are invisible to all of these machines. All of them.

     

    reply to this | link to this | view in thread ]

  8.  
    icon
    :Lobo Santo (profile), Mar 8th, 2012 @ 11:53am

    Re: Re:

    Like colostomy bags, breast implants, cupcakes, formula, water, toothpaste, lighters, nail clippers...

    I suspect if depriving somebody of an item represents a loss of dignity of any sort, then the item represents a "terrorist" threat and must be confiscated.

     

    reply to this | link to this | view in thread ]

  9.  
    identicon
    Scote, Mar 8th, 2012 @ 11:56am

    Getting through twice is enough to prove the point

    If the scanners were even 95% percent effective, what are the odds he could get through twice? And it doesn't matter that the metal box was empty, it is opaque to x-rays and could have been anything or contained anything.

    The machines don't have to be 100% ineffective to be fatally flawed, and I think he's met the burden of proof to show that at least some models are fatally flawed.

    And if you know the machines take images from multiple angles, I'd prefer a citation rather than an "I'm pretty sure".

     

    reply to this | link to this | view in thread ]

  10.  
    identicon
    Anonymous Coward, Mar 8th, 2012 @ 11:59am

    How hard is it to just go through the damn TSA checkpoint without complaining? I do it at least a dozen times a year, and I've never had a single problem. If you don't like the scanners then just have a pat down. Let me break it down for you since there seem to be so many people incapable of doing what's necessary to protect fellow passengers and the safety of the nation:

    1) Go to the security line with ticket and ID in hand, shoes untied, items collected, laptop ready to be removed, etc...
    2) Tell security you're opting out of the scan
    3) Let them pat you down, but while doing so remember to make all the proper statements, such as "Come to this airport often?", "You know I normally have to pay for this", etc...

     

    reply to this | link to this | view in thread ]

  11.  
    identicon
    Jonathan Corbett, Mar 8th, 2012 @ 12:02pm

    Almost ;)

    The vulnerability in the article you described is actually a different vulnerability. Imagine looking at a big knife that was laying flat on a table. It's easy to see the blade. Then, imagine rotating that knife 90 degrees such that the sharp edge of the blade were facing you. Now, the blade is taking up MUCH less of your vision -- perhaps 1% of the space it formerly took up. That's the exploit you described.

    The exploit I put out is different. The idea is that the scanner can't tell the difference between a metal object on your side and the wall of the scanner (or empty space). The body scanners are only able to detect metal when metal is against your body and contrasts with your body. Out on the side, there is no contrast, and they are invisible.

    I'm certainly not claiming this is rocket science. But this *is* what happens when you try security through obscurity: the obvious exploits aren't necessarily detected until years and $1B later. The TSA is (and all of us are) lucky that they were forced to confront it now rather than by a terrorist who uses it to kill Americans.

    --Jon

     

    reply to this | link to this | view in thread ]

  12.  
    identicon
    jilocasin, Mar 8th, 2012 @ 12:05pm

    Still taking nakey images......

    Actually, if you read any of the technical documentation for the updated scanners, they still capture nakey pics of everyone.

    The only change is that they no longer display the actual image on the monitor that's out in the open. It's still captured, it's still stored, and if they've gotten what they asked for in the last request for production the new machines are capable of transmitting the actual (not gumby) image across the network to another location.

     

    reply to this | link to this | view in thread ]

  13.  
    icon
    silencedogood (profile), Mar 8th, 2012 @ 12:06pm

    Re:

    That's a really pathetic response.

    It's not that people don't want airport security: we do!

    The TSA is an exercise in compliance. I'm glad you figured out how to do it.

     

    reply to this | link to this | view in thread ]

  14.  
    identicon
    Greg, Mar 8th, 2012 @ 12:07pm

    Just because this is not new doesn't mean the TSA lynch mob is not deserved. Anything that incites a TSA lynch mob is a good thing.

    PS The ATR (think that's right, automated target recognition, going by memory not search) in your example pic only works on the millimeter wave machines. And it certainly works by processing the original output, which would still suffer from the original contrast problems. A new way of presenting the results doesn't change how the machine works!

     

    reply to this | link to this | view in thread ]

  15.  
    identicon
    Anonymous Coward, Mar 8th, 2012 @ 12:08pm

    It should be pointed out that the metal box in his pocket normally would set off the metal detectors that he would have to go through BEFORE the scanner. As such, his point is a little, umm, less than honest.

     

    reply to this | link to this | view in thread ]

  16.  
    identicon
    Greg, Mar 8th, 2012 @ 12:10pm

    "So many people incapable of doing what's necessary to protect fellow passengers and the safety of the nation"

    That would be the TSA brass and others who make up this theater that you so willingly submit to at the airport. The fact that you think these processes protect you or anyone in a significant way is part of the problem.

     

    reply to this | link to this | view in thread ]

  17.  
    identicon
    Greg, Mar 8th, 2012 @ 12:12pm

    Not true. They don't typically do both when they're running the AIT scanners. If you go through the backscatter or millimeter, that's typically it. No metal detector. I've not seen a checkpoint where they sent someone through both.

     

    reply to this | link to this | view in thread ]

  18.  
    identicon
    John, Mar 8th, 2012 @ 12:14pm

    .32 ACP isn't dangerous. Is it?

    Coworker of mine accidentally left about 6 rounds of .32 ACP ammo in a coat pocket (for a C&C gun). He got through TSA not once, but twice.

    His wife was accosted for having a BMW key that flips out of the holder with a rounded edge.

    I was almost arrested for trying to bring toothpaste with me. TOOTHPASTE!

     

    reply to this | link to this | view in thread ]

  19.  
    icon
    Machin Shin (profile), Mar 8th, 2012 @ 12:22pm

    Re: I doubt a would-be terrorist would be bold enough to try to exploit this vulnerability

    Might I just point out a stupid thing with all this. So they are trying to stop someone from getting on a plane and killing few hundred people with a bomb or what have you. So they start the security checks.

    You ever look around when in these lines? Hundreds of people standing packed in like sardines waiting to pass through this security bottleneck. If a terrorist really wanted to do something they could just put bomb in a carry on bag and set it off when they are midway though the line with everyone else all packed up tight waiting to get through.

     

    reply to this | link to this | view in thread ]

  20.  
    icon
    Mike Masnick (profile), Mar 8th, 2012 @ 12:26pm

    Re:

    It should be pointed out that the metal box in his pocket normally would set off the metal detectors that he would have to go through BEFORE the scanner. As such, his point is a little, umm, less than honest.

    Do you travel? If you go through the scanners, you DON'T go through the metal detectors.

     

    reply to this | link to this | view in thread ]

  21.  
    identicon
    A Monkey with Atitude, Mar 8th, 2012 @ 12:27pm

    Re:

    I find you funny, you think the bitching is because its just a hassle (and i fly much much more than you)... its because for all the money, time, and headaches, it hasn't stopped one damn thing, or made anyone any damn safer... its just an excuse to get sheeple (like your funny self) to conform to be good little sheeple and take the pain/cost/humiliations with out crying...

     

    reply to this | link to this | view in thread ]

  22.  
    icon
    Mike Masnick (profile), Mar 8th, 2012 @ 12:28pm

    Re:

    False. Imaging doesn't work this way. Not.at.all.


    A single image doesn't. Multiple images is what I was talking about.

    However, imaging can only take pictures in planes, and then render a 3-D image. Look closely at the 3-D images from MMW scanners, the sides are black. It's a trick of the eye.

    I'm not arguing that a single scan does it. I'm saying that it takes multiple images from different angles.

    The sides of an individual are invisible to all of these machines. All of them.


    I really don't think that's true.

    I'm sure the machines can be fooled, but I don't think you'll have much luck if you think this trick will always work.

     

    reply to this | link to this | view in thread ]

  23.  
    identicon
    Anonymous Coward, Mar 8th, 2012 @ 12:29pm

    Re: Almost ;)

    "I'm certainly not claiming this is rocket science. But this *is* what happens when you try security through obscurity: the obvious exploits aren't necessarily detected until years and $1B later."

    This is a valid point. Its easy for a team of scientists/engineers to come up with a system they can not beat. However it usually takes about 15 minutes in the real world before someone else finds a way around it.

    Case in point would be the bored 15 year old Scandinavian who cracked DVD protection in an afternoon after the studios spent year and 10s of millions implementing it.

     

    reply to this | link to this | view in thread ]

  24.  
    icon
    Mike Masnick (profile), Mar 8th, 2012 @ 12:30pm

    Re: Almost ;)

    The exploit I put out is different. The idea is that the scanner can't tell the difference between a metal object on your side and the wall of the scanner (or empty space). The body scanners are only able to detect metal when metal is against your body and contrasts with your body. Out on the side, there is no contrast, and they are invisible.

    I don't think the exploit is that different, and I'm not convinced that the exploit you explain really works as well as you suggest it does. You getting through twice is hardly proof.

     

    reply to this | link to this | view in thread ]

  25.  
    icon
    Machin Shin (profile), Mar 8th, 2012 @ 12:31pm

    Re:

    I'm sorry but why should I be ok with someone grabbing my junk? If someone walked up on the street and gave me one of the TSA pat downs they could be thrown in jail and charged with sexual assault.

     

    reply to this | link to this | view in thread ]

  26.  
    identicon
    akp, Mar 8th, 2012 @ 12:43pm

    As far as I'm concerned...

    Any bad publicity for the TSA is good for us.

    I think the lynch mob can continue... Just because this particular video is mostly hyperbole doesn't mean these shenanigans should continue.

     

    reply to this | link to this | view in thread ]

  27.  
    icon
    silencedogood (profile), Mar 8th, 2012 @ 12:43pm

    Re: Re: Almost ;)

    Again, Mike, you may understand tech, you clearly do NOT understand imaging.

    Imaging does not work in the way you suggest.

    Jon is correct. I work with imaging. An object on the side of the subject will not bounce the x-rays back to the reader in the way human flesh will. Any item on the side of a body is invisible to these machines.

     

    reply to this | link to this | view in thread ]

  28.  
    identicon
    Jonathan Corbett, Mar 8th, 2012 @ 12:44pm

    Re: Re: Almost ;)

    You're certainly entitled to your opinion, Mike. :)

     

    reply to this | link to this | view in thread ]

  29.  
    identicon
    Anonymous Coward, Mar 8th, 2012 @ 12:46pm

    Re: Re:

    Careful, you'll wake them!

     

    reply to this | link to this | view in thread ]

  30.  
    icon
    silencedogood (profile), Mar 8th, 2012 @ 12:46pm

    Re: Re:

    I'm glad you "think" it to be true.

    Physics says otherwise.

    Both varieties, backscatter and MMW, take their views from the front and back plane of the subject. Even on the MMW with its fancy swing around arms, only goes to approximately 45-degrees past the subject. Watch any of these machines in motion. The sides are not captured, and therefore cannot be analyzed.

    I don't "think" it to be true, I work with imaging every day. I know it to be scientific fact.

     

    reply to this | link to this | view in thread ]

  31.  
    identicon
    Anonymous Coward, Mar 8th, 2012 @ 12:53pm

    Re:

    It's necessary to protect fellow passengers and the safety of the nation? Well in that case I suppose your right, if it's for a good cause checking my rights at the ticket counter before I proceed through security is fine.

     

    reply to this | link to this | view in thread ]

  32.  
    icon
    Berenerd (profile), Mar 8th, 2012 @ 1:02pm

    Re:

    another part of the problem is it costs the american tax payer a crap ton of money to run for little to no benefit.

     

    reply to this | link to this | view in thread ]

  33.  
    icon
    Planespotter (profile), Mar 8th, 2012 @ 1:18pm

    Re: Re: I doubt a would-be terrorist would be bold enough to try to exploit this vulnerability

    Been saying this for years, just think of the effect of shutting down an International Hub after detonating a bomb in the security area... as much as I'm not a fan of the state of Israel the security there does seem to make more sense than anywhere else, they watch you from the moment you park your car all the way through to boarding the plane.

     

    reply to this | link to this | view in thread ]

  34.  
    identicon
    Anonymous Coward, Mar 8th, 2012 @ 8:24pm

    Re: Re: Physics

    Actually silencedogood, you are wrong. The MMW machines rotate far enough around that they can see objects on the sides of the body. And the backscatter machines don't just use backscatter, they also use a transmission image, which can't penetrate the body, but which makes it easy to see high-Z materials on the edges of the body that block the x-rays. As mike said, this is a well understood limitation of the basic system configurations, and is something the designers had to fix before TSA deployment.

     

    reply to this | link to this | view in thread ]

  35.  
    icon
    That Anonymous Coward (profile), Mar 8th, 2012 @ 8:32pm

    Even if this is a case of overhype, and we will never actually get an answer because making it all secret is the best way to handle security, It is possible that the TSA response of Blogger Bob getting cranky anyone question their authority and then the follow up of journalists getting the strong impression they shouldn't cover the story at all is not helping...

    http://boingboing.net/2012/03/08/tsa-body-scanner-guy-says-tsa.html

     

    reply to this | link to this | view in thread ]

  36.  
    icon
    That Anonymous Coward (profile), Mar 9th, 2012 @ 6:18am

    Re:

    I found something in the boingboing comments that is a little more worrying.

    http://www.popehat.com/2012/03/08/in-which-i-strongly-caution-the-tsa-to-snort-my-taint -and-probably-get-on-the-no-fly-list/

    The blogger wrote to someone named as speaking to reporters on behalf of TSA. They did indeed work for TSA.

    The response...
    "Any guidance provided is to caution reporters not to generalize that our technology doesn't work or print something without all the facts, based on an inconclusive YouTube video."

    Should the TSA be giving "guidance" to reporters?
    Funny to hear someone from TSA talking about facts as they-
    are lacking many of them about how their tech works
    any dangers from it
    how their staff behaves
    how their staff steals
    how their staff shakes down people for cash to jump the line
    how their staff go after pretty girls
    how their staff "searches" people outside of checkpoints
    and several other incidents they have always claimed didn't happen or were isolated incidents... until it happened so many times they couldn't cover it up anymore.

    I'm not sure this YouTube video is correct or not, but the fact TSA wants to hide behind the "we can't reveal anything, it would help the enemy" excuses is really worrying. They could have simply made a video duplicating the original setup and debunked it... it worries me they just want to say its wrong, we fixed it now, trust us.

     

    reply to this | link to this | view in thread ]

  37.  
    identicon
    Anonymous Coward, Mar 9th, 2012 @ 8:22am

    Re:

    I go through airport security a lot and I either go through a metal detector or the backscatter type machines, never both. So what you are saying is false.

     

    reply to this | link to this | view in thread ]

  38.  
    identicon
    Anonymous Coward, Mar 9th, 2012 @ 8:46am

    Re: Re:

    My experience has been that many airports will have you do both, with the metal detector being sort of a "pre-scan".

    Perhaps not in all cases, but I have seen it done.

     

    reply to this | link to this | view in thread ]

  39.  
    identicon
    Sam Edi, Mar 10th, 2012 @ 4:21pm

    A well timed attack on scanners

    "I'm pretty sure..."
    Not exactly sure, are you? Corbett passed through two scanners at two different airports. The experiment was designed to foil the first - the backscatter scanner which everyone knows cannot scan the sides of the body.

    The second was an L3 Millimeter Wave scanner which rotates around the body and uses Automatic Threat Detection software. It was in use instead of a traditional metal detector arch. The German transport police called the tech "useless" after trials which gave an 80% false alarm rate.

    A metal detector arch would have detected the metal box in both cases.

    The video is pertinent especially as, despite German trials, the TSA keeps on buying this charlatan machinery, the UK is continuing trials with it and Australia has just announced its intention to use the technology and even make it compulsory.

    It seems Corbett was telling you what you already knew, but what the US, UK and Australian governments had already forgotten.

     

    reply to this | link to this | view in thread ]

  40.  
    identicon
    tba, Mar 10th, 2012 @ 10:01pm

    "A metal box is not a dangerous object, and the point of the machines (so we're told) is to stop threatening objects from getting through -- not just metallic objects."

    He could have put a knife inside the box, which reflects x-rays. That's why he chose to smuggle a box through. Please use your brain before writing an article.

     

    reply to this | link to this | view in thread ]

  41.  
    identicon
    Silence Dogood, Mar 11th, 2012 @ 10:44am

    Re: Re: Re: Physics

    And yet, with the fix you claim was made, they missed items on the side of the body anyway.

    It's obvious you have a misunderstanding both of how imaging, and these machines, work. We can play the "No, you're wrong!" game all day.

    The simple fact of the matter is that the MMW arms do not swing around to the sides of the body, and the backscatter machines use ionizing radiation to "bounce" or backscatter back to create an image.

    I know everyone is impressed by the 3-D image. It's a rendering, not what the machine sees. The machine assumes the shape, it doesn't capture it.

     

    reply to this | link to this | view in thread ]

  42.  
    identicon
    Anon, Mar 11th, 2012 @ 10:42pm

    Re:

    Completely wrong. At every airport I've been to, you don't go through the metal detector if you choose the scanner.

     

    reply to this | link to this | view in thread ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Save me a cookie
  • Note: A CRLF will be replaced by a break tag (<br>), all other allowable HTML will remain intact
  • Allowed HTML Tags: <b> <i> <a> <em> <br> <strong> <blockquote> <hr> <tt>
Follow Techdirt
A word from our sponsors...
Essential Reading
Techdirt Reading List
Techdirt Insider Chat
A word from our sponsors...
Recent Stories
A word from our sponsors...

Close

Email This