Bruce Schneier
Mercury
News
Thursday, January 25, 2007
Clear has arrived at Mineta San Jose International Airport.
Run by Verified Identity Pass, it's one of several airport ``trusted
traveler'' programs being tried around the country. Fill out an
application, let the company capture your fingerprints and iris
pattern, and present two forms of ID. If you pass the Transportation
Safety Administration's background check, you'll get a card that
will get you through airport security more quickly.
Sounds great, but it's actually two ideas rolled into one: one
clever and one very stupid.
The clever idea is allowing people to pay for better service.
Clear has been in operation at the Orlando airport for over a
year, and members passed through security checkpoints faster simply
because they were segregated from less experienced fliers. Now,
at San Jose and other airports, Clear is purchasing and installing
TSA-approved technology that will further speed up the screening
process: shoe scanning machines that will eliminate the need for
cardholders to remove them, and explosives-trace detection machines
that will eliminate the need for them to remove their coats and
jackets. There are also Clear employees at the check points to
help process -- although not screen -- cardholders. Clear has
not yet paid airports for an extra security lane or the TSA for
extra screening personnel, but both of those enhancements are
on the table if enough people sign up.
I fly more than 200,000 miles per year, and would gladly pay
$100 annually to get through airport security faster.
The stupid idea is the background check. When first conceived,
trusted traveler programs focused on pre-screening. Pre-approved
travelers would pass through security checkpoints with less screening,
and resources would be focused on everyone else. Sounds reasonable,
but it would leave us all less safe.
Background checks are based on the very dangerous myth that we
can somehow pick terrorists out of a crowd if we could only identify
everyone. Unfortunately, there isn't any terrorist profile that
pre-screening can uncover. Timothy McVeigh could have gotten one
of these cards. So could the Shoe Bomber, Eric Rudolph, Demetrius
``Van'' Crocker, and the Washington, D.C., sniper -- terrorists,
all of them. There isn't even a good list of known terrorists
to check people against; the ``no fly'' list has been the butt
of jokes for years.
And have we forgotten how prevalent identity theft is these days?
If you think having a criminal impersonating you to your bank
is bad, wait until he starts impersonating you to the TSA.
The truth is that whenever you create two paths through security
-- a high-security path and a low-security path -- you have to
assume that the bad guys will find a way to exploit the low-security
path. It may be counterintuitive, but we are all safer if enhanced
screening is truly random, and not based on an error-filled database
or a cursory background check.
I think of this as a $100 service that tells terrorists if the
FBI is on to them or not. Why in the world would we provide terrorists
with this capability?
We don't have to. Clear cardholders are not scrutinized less,
they're scrutinized more efficiently. The card doesn't stop you
from being singled out for additional screening, and it doesn't
make a difference if you're on the no-fly list. So why not get
rid of the background checks altogether? Why can't someone walk
up to the airport, pay $10, and use the Clear lanes? They're not
being screened any less thoroughly, only more efficiently.
Email
