The TSA's behavior detection program

The Times today details the TSA's expansion of behavior detection at airports—basically, informal conversations with travelers to try to see if they are, well, if they can be trusted. On paper, it looks like a good idea. The Israelis do it, and the Israelis have a really good track record when it comes to security. And it's far less invasive (they're not making you strip down, and then having a conversation, after all) and cheaper than $150,000 machines.

Unfortunately, it will probably be implemented like when I recently flew through San Francisco and had this conversation with the TSA agent checking my ID and putting the "TSA squiggle"* on my boarding pass:

TSA agent (holding my ID): What is your name?
Me: Uh, [my name].
TSA agent: Thank you [draws TSA squiggle]
Me: Wait, is that some sort of new security? Does that work?
TSA agent: Yes, it does.
Me: Seriously? People are dumb enough to give the wrong name? You catch terrorists like that?
TSA agent: You'd be surprised.
Me: Yeah, I'd be surprised, if anyone ever fell for it.

I didn't want to insult this fellow's intelligence, but there were two reasons why this was an utter failure of a policy. The first is that anyone who had put a bomb in their underpants or a coke bottle would probably take the time to memorize the name on their fake ID. (Or, in the words of Bruce Schneier: "you're a dumb terrorist and the government will catch you".) Second, the TSA agents, even the creme de la creme out front putting on the terrorist-proof, ever-so-sophisticated squiggles on our nation's boarding passes, are not likely to be highly trained in psychology and able to determine the tics of a nervous potential terrorist.

Hiring some highly-trained psychologists to question travelers might make some sense, but it would still be searching for a needle in a haystack. Some common sense measures like making sure that you couldn't just print out a copy of a boarding pass with a new name on it and use it to board a plane would make a lot of sense. Not having this in place—and, really, some cheap scanners and a database are all we need (I've even seen it used, once in a while)—completely negates the whole reason we have check IDs in the first place. (Hey, remember when the airlines printed our tickets for us? That was much more secure! But it cost them money. Poor guys.)

Case in point: a few months ago I was in a terrible rush to get to the airport; and didn't have time to change out of sweaty running clothes. So when I arrived, I was disheveled, sweaty and looked like a crazy person (more than usual). Did I stick out amongst the rest of the (generally sheveled) travelers? Yes, but not to the TSA. I walked right to the plane.

So if I know the TSA (and I believe I do), I'm sure we'll all be subjected to another round of silly questions every time we fly. At least they won't be strip searching us all.

* The TSA squiggle

This is the most meaningless of all the meaningless security measures. Back in the day (and I mean way back), for about a year after September 11, they checked your boarding pass and ID twice: once at check-in, and once at the gate. The squiggle was, ostensibly, a measure taken to make sure you didn't switch out IDs (and boarding passes) before boarding. This had several flaws: it took a lot of time, it took a lot of personnel, the squiggles were pretty easy to forge (I just imagine the TSA standing in a briefing room every morning saying "okay, today, we're using a blue highlighter, and were underlining the date and making two vertical lines across the destination, okay?") and was rendered obsolete by the "print your own" boarding passes from home—although that happened long after this extra check disappeared. And it has been pointed out that the airlines love this whole name-matching step, because it means that you can't (easily) fly under someone else's name. That's called "revenue protection." I'm glad the government is doing the job of the airlines.

But we still have the squiggle. I've never had my squiggle checked at the gate. Sometimes I print off extra copies of my boarding pass just to see what happens if I go through with a blank one (answer: nothing). It is a completely meaningless layer of security, security theater at it's best. It does nothing to make anyone safer, and even if it did, it could be so easily circumvented that it would be a complete waste of time. And now that we have boarding passes on mobile phones, well, no one is highlighting the screen. (Flyertalk, of course, has a thread with some snarkiness about this.)

Maybe next time when I fly I'll bring along two boarding passes, get the squiggle, and proceed to immediately rip the squiggled pass in to pieces and proceed to the gate. We'll see if that causes any problems. I'm sure it won't.