LA Airport Uses Random Numbers To Catch Terrorists

An anonymous reader writes "Los Angeles International Airport (LAX) is using randomization software to determine the location and timing of security checkpoints and patrols. The theory is that random security will make it impossible for terrorists to predict the actions of security forces. The ARMOR software, written by computer scientists at the University of Southern California, was initially developed to solve a problem in game theory. Doctoral student Praveen Paruchuri wrote algorithms on how an agent should react to an opponent who has perfect information about the agent's choices."

Comments

Security Through Obscurity!

[he1icine]

Sorry it had to be said.

Re:Security Through Obscurity!

[Entrope]

Quite the opposite. The bit about strategies given "perfect knowledge" by the opponent assumes that any information about practices or techniques could leak out. Given that, it seems obvious that the proper response is to determine an appropriate level of coverage, and then implement a randomized search pattern that conforms to those constraints. The security is not through obscurity but through a smaller window for discovering and exploiting the search pattern.

Re:Security Through Obscurity!

[brusk]

Actually it didn't. In some ways this sounds like the opposite of security through obscurity. I'd feel more secure with a system whose entire workings was public knowledge, but that was still effective enough to be difficult to penetrate. Randomness is a great way of doing that. You may know, as a potential attacker, how the system is set up, but if you don't know where the people and equipment will be the best you can do is take an informed risk. It also makes it harder to do things like purchase information about the system: it's little use to bribe a guard for the schedule if he doesn't know it until he starts his shift (and then may only know his first task, not the remainder of his schedule).

To my mind, security through obscurity would be setting up a very complicated schedule, then overconfidently assuming that an attacker won't figure it out. There are lots of cases where randomness increases security (e.g. random strings as passwords).

Re:Security Through Obscurity!

[Hangtime]

There is a difference between Security Through Obscurity and disguising the strength, numbers, and routines of your forces by trying to nullify patterns in your behavior. People pick up on patterns very quickly. Patterns makes it easy to train, equip and ultimately be successful when addressing fluid, complex situations. If I know that once I see people streaming from one platform I have 30 seconds before the next train arrives I have an advantage.

By truly randomizing protocols, I can no longer plan for one or two specific scenarios but must be ready for hundreds. This increases the time, energy, and manpower it takes me to prep and execute a mission. In fact, if I can't bank on the fact that there will NOT be a canine unit to take my plastic through security I may change my approach and try to work from a stand-off position rather then a close-end. This makes it easier for security because I can fortify and create choke points in and around my perimeter.

Security Through Obscurity relies on your ability to hide something alone (hiding a key) versus what this is (moving the key every 4 hours and randomizing the patrols in and around the key). There is quite a bit of difference between the two.

Re:Security Through Obscurity!

[Anonymous Coward]

So, to be exact, the security staff is going to play DnD?

Staff sergeant: "Ok, Ralph" *rolls dice* "you are going to move 4 feet to the left."

Re:Security Through Obscurity!

[rthille]

(I haven't read the article, typically I find the comments more interesting :-)

Well, the seed for the random number generator should probably be kept secret. Or there should be no seed, there should be hardware randomness so without that data stream, there's no way to predict. Not sure how you distribute the schedule in real time from the hardware random generator to the actual officers and keep it from being eavsdropped on, but I guess encrypted communications can be assumed...

Re:Security Through Obscurity!

[deepvoid]

Randomized patrols have been around along time. There are several problems with this guy's approach. First, there are inner and outer bounds to patrol initiation and duration, as well as the human tendency to repeat the familiar, thus while the schedule may get changed, the actual patrols will follow a non-random, pattern. In addition, consigning the schedule to a computer also adds a level of security failure potential that shouldn't exist. If the guards, examiners, and cameras, are on a purely random schedule, and are following the direct orders of a machine, eventually, a social engineering exploit would open the door for the opponent to get a complete schedule from the computer itself. Just like lost page encryption can be circumvented by compromising the message sender, random patrols can be brought down by compromising the computer, and unlike computers in Hollywood movies, no computer on Earth, is secure, and connected at the same time.

The thing about having "Perfect Knowledge" of a patrol or observation pattern, is that you have to expect certain variations anyways, and plan accordingly, but the polar bear under the ice is that you also have to expect certain regularities, certain things that repeat, regardless of schedule. Most unit commanders and security bosses have had to learn this the hard way, and after they loose a certain amount of confidence in human nature, they learn how to manipulate it to make their facility more secure.

A low level security guard is going to look at the schedule, and try to make it conform to his own sense of order, rounding up or down patrol times, falsifying patrols, or just plain blowing off the whole schedule entirely. After going through more than a few guards, the commander is going to have to admit, that going against human nature is not only counter productive, but dangerous. The radio messages, audio stimulus, and other auditory or visual stimulus that is used to keep the pattern random, can always be intercepted and used to an opponent's advantage, and with the high turnover rate already present in security jobs, it is a simple matter to place somebody on location that can compromise everything.

What the commander has to do is assume that his bottom line guards are going to be compromised, individually. For instance, he can safely assume, that at even if all of his guards are compromised that very few of them are going to entrust that fact with another guard. By identifying the loners on guard staff, he can group them in pairs, or triplets that are socially incompatible, and thus untrusting of one another. Since self preservation is a stronger human reaction than loyalty, the commander has to rely on this to prevent an actual incursion.

In military units, officers do not mix much with enlisted, and doing so can mean punishment or even jail time for the offenders. The reason for this, is that if two groups are not socially compatible, and they have a common stated goal, then the change of a conspiracy amongst the two is greatly reduced. If The officers decided as a group to betray, then military code would force the enlist, or non-commissioned officers to act against it, and visa versa.

The military relies on routine, because, unlike the scientist with his computer driven, game theory approach, they know it works. If patrols become regular, then is easier for those patrols to spot anything out of order. The only way to have consistent security, is to have reliable, consistent, and above all, complete coverage of the facility.

Re:Security Through Obscurity!

[644bd346996]

You make some good points about getting humans to actually follow the random search patterns, but I don't think we need to worry too much about terrorists being able to steal the schedules. Because they are random, they don't need to be generated very far in advance, leaving would-be infiltrators at most a few hours to steal the information, plan the timing of an attack, and execute it. Even though the actual window of opportunity for slipping through security won't be reduced, it becomes much much harder to take advantage of a temporary gap.

Using random patrol patterns gets rid of the biggest known weakness of routine patrols. Only time will tell if the problems introduced by random patrolling are worse. In the meantime, I have no qualms with using the method that has fewer obvious exploits.

Re:Security Through Obscurity!

[bhebing]

If they use your comma placement as a random seed, the system will be absolutely secure.

Re:Security Through Obscurity!

[deepvoid]

Not only that, but with the most common case, the "inside job", the program can be altered or corrupted to produce non random sequences, or worse, the programmer who designs the system could use a pseudo random number generator, which *can* always be predicted.

As an example, if I wanted to compromise the security of a company, I would get on the cleaning staff, get chummy with the rest of the staff, do my job well, and have complete access to the facility after only a few months. After installing passive sniffers (ones with modified drivers which don't send beacon packets when in promiscuous mode), key loggers, tempest scoops, and A/V cameras, I could capture enough information to do plenty of damage, or make a bundle. No amount of patrols, random or otherwise, are going to catch me at it, because I would be by then a *recognized* and *trusted* entity: e.g insider.

Security systems are only as secure as the people that operate them. If the cleaners are required to stay within sight of each other, at all times, or if a guard is to accompany them through all areas, then the level of mistrust can reduce penetration. Just like innovation is fueled by cooperation and ideas, security is powered by fear and mistrust. I was once at a company meeting where the president invited a security expert to give a presentation regarding recent thefts of personal items during the previous week. During the meeting, security was searching the offices, and found many of the items of non other than a leading VP, who had a gambling problem. The woman was not a shifty eyed, back stabbing, low life with coke in the nose, but rather a mother of two, who got too deep into online poker, and was liked by everyone there.

As a practical matter, you want people in your trusted organization to get along and behave respectfully, but you want the people in your security organization to hate their guts. When you have a company picnic, make the security team work overtime at the office. Do things that put the two organizations at a suspicious distance. Do not allow fraternization between the two, and give the security team an unforgiving rule set that keeps order and mistrust at an enhanced level. Monitor everything that enters or leaves the facility, and above all, have security review all cleaning staff appointments, especially during the probationary period, which should be no less than a year, since that is the most common window of time for socially engineered inside operations.

I'm not saying to treat your security staff like trash though, but rather, make them think that the trusted members of the facility are getting a much better deal. Above all: Security is the *least* trusted organization of any facility, and the most easily comprimised. Night watchmen are a dime a dozen, paid poorly, disrespected, and generally treated poorly. With the appropriate financial and social pressures, there are very few security organization that cannot be subverted given time and patience.

Re:Security Through Obscurity!

[niktemadur]

A low level security guard is going to look at the schedule, and try to make it conform to his own sense of order, rounding up or down patrol times, falsifying patrols, or just plain blowing off the whole schedule entirely.

Damn right. A few years back, my hometown was in the midst of a crime wave, and at the business where I worked, a guy was hired to go and deposit money in the bank. The first thing management told him was to never, ever repeat the same route nor schedule twice in a row. At first, the guy followed this advice, but after a couple of weeks, probably without even realizing it, he fell into a mindless, hurried routine that you could set your watch by. Within a month, he was ambushed - his car was crashed into at an intersection, then when he got off to inspect the damage, a gun was pointed at his temple.

A few days later, the guy resigned and I was given bank duty for a while, and I dare you to try and discern a pattern in the way I handled this baby. Once out of the office, I had six options to choose from within a half block in either direction (east, then straight, left or right - west, then left or right). Sometimes I stalled for up to three hours before dashing off, sometimes I repeated the same route three times at different hours, just to confound whoever might be watching.

To take it up a notch from the PP, here's the twist: Management itself, for all their initial concerns, began dropping hints about other needs I wasn't taking into consideration, such as needing the money deposited within a certain hour. After the assault and robbery shake-up, the organization became open to flexibility, then soon after went back to rigid, routine expectations, downgrading safety for convenience. As an example, the financial department was screaming for regularity, to sort out money movements by X hour.

Within a few months, an armored car service opened in town, which my company hired immediately, and things went back to normal.

Now here's my point: it's not just the grunts, it's also the supervisors and management. On paper, somebody's gonna have to wrack their brain and work harder to schedule activities that follow no pattern, probably for the same amount of pay. Supervisors will constantly have to change their schedules accordingly. There will be initial grudging compliance on all levels, then resistance will manifest itself through groaning, then procrastination turning into inaction. To change organizational habits, an initial push towards implementation is not enough, somebody has to really exert pressure for a long, long time, and who's going to do it, old employees? Unlikely. New employees? A big possibility they'll be sucked into the organizational culture within a couple of unhappy months. You have to find and hire the right outside person, and that'll take a bit of luck, never mind Game Theory, an old and iffy construction that's always caused more harm than good when applied in "real life".

Going offtopic here, and as crazy as it may sound, I do miss the bank deposits, as they turned weekdays into an adventure. First of all, it was a daily shot of adrenaline. And then, there was the deposit itself, not through regular bank tellers, but within a backdoor bank vault, a security-clearance (automated door, long hallway, automated door), CC-monitored bizarro world where the same hungover guys from other companies deposited every day, and the bank employees always kept ice-cold beer for us... in the morning. To get the beer to us on the other side of the 8-inch glass, it had to go through the same time-delay security mechanisms that we placed the ingoing deposits into. It was a small space with no chairs, so we sat on the floor, drinking beer out of paper cones, a thick cloud of cigarette smoke hanging in the air, crushed butts and cones strewn on the floor. After a while, you find yourself regarding this as normal. Talk about organizational culture.

Re:Security Through Obscurity!

[Pollardito]

A few days later, the guy resigned and I was given bank duty for a while, and I dare you to try and discern a pattern in the way I handled this baby. Once out of the office... boom! right there! you always left the office to get to the bank!

seriously though, you're describing the methods yourself, so it's doubtful you would mention something non-random that you hadn't thought of at the time. depending on the size of the cashbox, why wouldn't someone just be willing to wait out the entire 3 hour window and/or pick one or more of the 6 routes and take a couple tries for you to finally choose that same route they picked?

Re:Security Through Obscurity!

[niktemadur]

Back in the day, the wave of robberies in my hometown were precise, quick and bloodless (for the most part). These people were not desperate robbers with an itchy trigger finger, they were professionals. Because they were professionals, surely they calculated cost (time, effort and risk) and return of investment. If you're a robber and think like this, it's inevitable that you also think of "opportunity cost", which is basically "How much am I losing elsewhere by staking out this particular person?" I wasn't the only fish in the sea, you know. Not that I know if I was being watched or not, but I bet I probably was, for a while.

If I was being watched, by making their homework extremely difficult, I was probably branded as "high-effort, high-risk, not worth it", then they moved on to other candidates - clockwork, unlucky souls who made their "job" quicker and easier.

As for the "lone nut" that stalks all day, I've never even thought about it. But no professional acts alone, so it sounds as if somebody like that would be a meth or heroin addict on the comedown, and that person has no time to waste, he'll march right into the company and pull a gun on the receptionist.

Government vs Commercial

[mulhollandj]

I read a fascinating article in the Freeman comparing train security, mostly privately done, with airports security, done by the government. The key difference was that when it was done commercially the inconvenience to customers was quite minimal. On the other hand when the government runs it, it is very inconvenient for customers. Why do you think this is?

Re:Government vs Commercial

[speaker of the truth]

I don't know. However first we must look at the sampling done by the article and determine if it was a valid sample that would produce non-biased results. Then we need to look at the numbers themselves and see if they were interpreted correctly (involving both layman and well known mathematicians who are either known to offer non-biased results or enough mathematicians that represent both biases towards the government and towards commercial companies). Only then can we know if the results are correct and even begin to ascertain the reason behind them.

Re:Government vs Commercial

[JackMeyhoff]

Airport security done by the government? It's all private companies here.

Re:Government vs Commercial

[mspohr]

Train security??? Where do they have train security? I've traveled on trains in France, Italy, Germany, Switzerland, Czech republic and never had any kind of security inspection.

I live is Switzerland and we don't have any noticeable train security. They may be some security cameras but the only 'security' I see are the conductors and they are usually friendly and just want to see your ticket. BTW, the trains are very safe, too. No terrorists and very few accidents.

Re:Government vs Commercial

[Anonymous Coward]

"BTW, the trains are very safe, too. No terrorists and very few accidents."

Apparently you didn't read the news in 2004.

http://en.wikipedia.org/wiki/2004_Madrid_train_bombings

Or the news in 1998.

http://en.wikipedia.org/wiki/Eschede_train_disaster

Re:Government vs Commercial

[Teun]

Or the news in 1998.

http://en.wikipedia.org/wiki/Eschede_train_disaster
I fail to see what bad maintenance practice has to do with terrorism.

There have been several incidents in Germany where terrorists were picked up just in time to prevent them blowing up a train, here is one of them:
Suit case bombs(Print version)
(Sorry when you didn't pay attention in your German classes)

Behind the scenes in Homeland Security...

[StandardCell]

[Tour of Accounting] Accounting Troll: "Over here we have our random number generator" Number Generator Troll: "Nine Nine Nine Nine Nine Nine" Dilbert: "Are you sure that's random?" Accounting Troll: "That's the problem with randomness: you can never be sure"

Re:Behind the scenes in Homeland Security...

[smallfries]

On a similar vein:

int numCheckpointsToday()
{
          return 0; // This is a random number chosen by a fair method
}

(With apologies to xkcd).

Doesn't Microsoft hold patents on that?

[jkrise]

They've been using that technique to identify and fix bugs in Windows... even incorporated that into Excel 2007 multiplication recently.

Re:Doesn't Microsoft hold patents on that?

[jkrise]

actually the Excel bug was a rendering bug, the actual calculated value was correct, to prove this, take the output that is visually wrong in the cell and use in a further calculation. You will the result is correct....

Wrong! It is random, actually. It's right there in the summary of the /. artice:

"Suppose the formula is in A1. =A1+1 returns 100,001, which appears to show the formula is in fact 100,000... =A1*2 returns 131,070, as if A1 had 65,535 (which it should have been). =A1*1 keeps it at 100,000. =A1-1 returns 65,534. =A1/1 is still 100,000. =A1/2 returns 32767.5." So it's just not a simple rendering bug... on random ocassions, it calculates further using the faulty value.

Re:Doesn't Microsoft hold patents on that?

[JackMeyhoff]

Somebody ban him for actually reading an article

Re:Doesn't Microsoft hold patents on that?

[jkrise]

No, it's still a rendering bug. The occasions that it appears to calculate further using the faulty value is actually when it still triggers the rendering bug.

Is that so? If you actually took the trouble of reading the responses to the conjectures in the blog (yes, conjectures and speculation.. not an official Microsoft statement) you will come across this bit:

David,

You said "Any calculations based off that cell will be accurate too. Hope that helps."

But that's not entirely correct. At least not from what I have seen. If you happen to be rounding your calculations (=ROUND(850*77.1,2)*2), it also rounds it to 100K making that permanent.

So, while it is true that most cases Excel treats the value as correct except for the visual side of it, in others it actually DOES treat it as 100K.

Rob So it appears that this is just not a simple rendering bug. Also, it is unclear why floating point operations in this zone must result in this peculiar bug.. and again, only in Excel 2007, but not earlier versions. Until the whole truth emerges (which is impossible in a closed-source product) this can only be treated as 'random' behaviour in simple arithmetic operations.

wily terrorists

[sentientbeing]

wily terrorists can easily defeat this lame attempt at security.
 
All they have to do is predict these random numbers ahead of time... Using a dice.

Re:wily terrorists

[Nibbler999]

Let's hope they roll 3 doubles.

Discovery Institute is mad.

[140Mandak262Jamuna]

They are going to create a huge grassroots information and education campaign against this. They believe the security should intelligently designed and should not depend on random chance of security people and the bad guys coming together.

Elementary

[RAMMS EIN]

Randomize checking so that an attacker can't predict the next check and avoid it? That's what I would do, too. Can I be a high-paid security consultant now?

Probably not. It probably takes more nerve and marketing skills than I have to stand up and demand the world for what is essentially an elementary idea that anybody who thinks about the issue should come up with.

What happens if...

[XxtraLarGe]

The terrorists start using a random number generator too?!?

set of locations?

[nathan.fulton]

"Part of it is to look for patterns in the deployment of assets. We're trying to block the surveillance cycle by making the security patrols appear in unpredictable places at unpredictable times."

If you figure this is a sizable force, and that all of them use the randomization software, four years worth of recon (TFA gave that as a time period for pre-strike operations) ought to give the terrorist enough information to know where these "random points" are. I mean, there has to be a defined set of locations somewhere in the program, they can't just be using coordinates. Imagine, a security guard climbing into an oven at the pizza place at the airport because "a computer told him to" (and the following lawsuits.)

How do they account for the fact that there will always be an area that these security forces don't patrol because no one told the computer that the place exists.

Anyone know how they manage telling the computer which places exist?

Re:set of locations?

[Hangtime]

If you have done it right you may give your security a general location and each patrol has an area within the airport so that they are all covered. Individuals have different patterns for searching. So if I have to watch 12 different teams that are all different in terms of who makes up those teams its going to make my job a lot tougher in pentrating. Maybe one person looks at this area, but another doesn't. If I can't bank on that person who does a crappy job being there when I want them to be there well I have to use a different approach or take a risk...oops canine unit came today, Abort.

To use your analogy but maybe a little more likely scenario, send security into the area behind the Starbucks kiosk. Why you ask? The problem is your trying to defend an infinite number of points while your enemy only needs one approach to win. Creating additional scenarios for them to plan for makes their job much more risky and much more complex. Randomness is your enemy when you're trying to plan and your friend when your trying to protect.

Re:set of locations?

[Ambitwistor]

If you figure this is a sizable force, and that all of them use the randomization software, four years worth of recon (TFA gave that as a time period for pre-strike operations) ought to give the terrorist enough information to know where these "random points" are. You're missing the point. The analysis assumes that the terrorist already knows that information anyway. The adversary is assumed to have perfect information about the randomization strategy, where the checkpoints are, etc. Then a randomization strategy is designed to minimize failures even in light of this information.

How do they account for the fact that there will always be an area that these security forces don't patrol because no one told the computer that the place exists. That is a better point, but we don't know whether there have been lapses in specifying the layout of the airport. (Of course, there will always be security holes that nobody has thought of at all, but obviously it is hard to guard against those with ANY security method.)

Not a bad idea over all

[Sycraft-fu]

While you certainly want to have some things that are purely consistent (for example all bags being X-rayed, all passengers having to pass through a checkpoint) randomness to additional security can work quite well. There are some things that are either too expensive (like additional patrols) or too time consuming (like manual bag searches) to conduct all the time, every where. Well, if you make it truly random when and where they happen, it makes it the kind of thing that is impossible to get around. While there's no guarantee it catches something, it just generally increases the risk to those who want to do mischief. They can't wait and watch and figure out how to beat your system as there just isn't any way. All they can do is hope that they aren't in the wrong place at the wrong time.

As it is DHS involved, I fully expect them to fuck it up and apply it wrong, but having some truly random security is a good way to make things generally more difficult, even to an adversary with a lot of resources to try and find a weakness.

Re:What if the US just doesn't piss other people o

[speaker of the truth]

Hey, I've got an idea! What if the US government just stops meddling in the affairs of other nations? Its amusing to hear people spout this line and then hear them decry America's inaction in Dafur. Which is it people? Do we meddle or not? Because at the moment we're going to be lambasted no matter what we do.

Randomization of security

[Z00L00K]

is only one component that can be used. A perfectly regular timing is never good when doing security checks. But then - it may be even better if the security checks appears to be regular done by uniformed personnel and then random by plain clothed personnel.

However - security checks are still only one component. For example today's airport buildings are largely a huge open place which means that maximum effect may be obtained outside any security checkpoints today. By reducing the queues to check-ins and building compartments the effective radius of an attack will be contained to a much smaller area.

A theoretical method would be to do image analysis and pattern analysis of behavior, but since the behavior pattern varies much from person to person it will create a large number of false alarms.

So..

[madsheep]

Yea, hate to say it, but does this randomize button.. randomly put these checkpoints near a group of middle eastern people? :D

Re:What if the US just doesn't piss other people o

[thegnu]

Its amusing to hear people spout this line and then hear them decry America's inaction in Dafur. Which is it people? Do we meddle or not? Because at the moment we're going to be lambasted no matter what we do.

Well, I'll bet that oftentimes it's different people saying the two different things. And in cases where it's the SAME person, we have inaction in Rwanda during a genocide, inaction in Congo during a Genocide, and action in Iraq so that there would be an easy cover for laundering money.

Does anyone have any real number on what percentage of the cost of the war is contracts with private companies? Because we saved lots of money on body armor, armored vehicles, and training for the troops. We can certainly expect to see the same frugality in the area of private contracts, I'm sure.

The government paying private contractors does not constitute privatization.

My $2 opinion. (Weak dollar)

[iknownuttin]

I think it's because there is very little, if any, accountability that the Government employees have to worry about. They can be as rude and obnoxious as they like becuase they know that even if you navigated the bureaucracy to complain, it would just be recorded somewhere and nothing would be done about it. Just look at what the folks who are mistakenly put on the "no-fly" or "extra screening" lists go through. Even a powerful Senator (Kennedy D-MA) had a problem getting off of the list. Or the nun who had to call in a favor with Carl Rove to get off of the list.

The only time I've heard of a Gov. employee getting fired was because they let someone go through with a weapon.

Then there are the stewardesses. Since 9/11 you'd think someone anointed them in Flight Goddesses. Complain about something and the next thing you know, you're being taken away in hand cuffs.

Because of a few jerks in the world, flying has become just one big bullshit hassle. Which, for my own sanity, I refuse all jobs that require travel - bills be damned! Of course now with all the screening software, a bad credit rating will get you a second look by the TSA.

I may have to move to Vermont.

Pretty Useless ...

[butlerdi]

You can not fight someone who is going to blow themselves up. I would think that airplanes probably no longer matter. If you get through fine, if not blow yourself up in a crowded terminal. Probably get more folks that was as well.Especially when so many virgins and good shit is at stake.

The chance of getting blown up (even if you believe the shit ol w and the ol boys say about all the foiled plots) is still less than traveling by car.

Why, I think you are wrong!

[rolfwind]

Only GOVERNMENT run security gives me free colonoscopies while I fly. Not only do I save a trip to the doctor, I ensure I stay in good health.

Smart, really smart

[sumnerp]

So, in order to improve airport security you give "vast amounts" of classified data about airport security to a collection of grad students to input into a program that produces allegedly randomized output. Yes, I see nothing wrong with that; I'd never have thought to do it that way, smart really smart

Re:Smart, really smart

[Ambitwistor]

So, in order to improve airport security you give "vast amounts" of classified data about airport security to a collection of grad students to input into a program that produces allegedly randomized output. Uh, there are plenty of grad students with security clearances: they work on classified research projects, like this one. You think you can't have a clearance if you are a student or something?

Or do you think there's something wrong with giving classified data to people with security clearances, just because they're also grad students?

Re:What if the US just doesn't piss other people o

[OeLeWaPpErKe]

Exactly ... if a muslim government chooses to make it policy to kill blacks, we should all remain silent. After all defending blacks is racist ... or was it attacking muslims ?

We should simply attack islam. After all it is against human rights, against democracy and against just about everything else we stand for.

Solve the wrong problem, with maths

[xmedar]

It doesnt address the biggest threats -

1. MANPAD attack on a plane from outside the airport.

2. Suicide bomber in a nice big truck full of explosives running into the terminal.

3. Suicide bomber with implanted bomb blowing up a plane.

So it is solving the wrong problem, it's like solving the occupation of Iraq by escalating the troop numbers.

Why not?

[mmell]

They apparently already use a random number generator to determine when flights will leave.

Not elementary!

[Ambitwistor]

Randomize checking so that an attacker can't predict the next check and avoid it? That's what I would do, too. Can I be a high-paid security consultant now? The point is not that the strategy is random, but that the randomization is optimized to be robust against an adversary who knows what your randomization scheme is. That's what the game theory is for: it's a classic mixed strategy.

Remember, there are many ways to be random: check area X Y% of the time; perform check W Z% of the time, etc. What should Y and Z be? How do you balance the occurrence of Type I and Type II errors? Some strategies are better than others: there's a reason why game theory was invented.

Try reading the study; the results are not trivial.

Re:What if the US just doesn't piss other people o

[pokerdad]

Its amusing to hear people spout this line and then hear them decry America's inaction in Dafur. Which is it people? Do we meddle or not? Because at the moment we're going to be lambasted no matter what we do.

Try Googling these two phrases lifted from your comment "America's inaction in Darfur" and "US government just stops meddling in the affairs of other nations". The first page of each I think is very telling. One is full of American websites, the other is full of foreign websites.

I think this is representative of who you are hearing - two different groups, one composed of Americans and the other composed of the peoples you are meddling with.

(before someone rips into me, I am not expressing any opinion about Darfur, just pointing out that probably the people screaming the loudest for American action in Darfur are Americans. I know that here in Canada I have never heard anyone suggest it is an American problem; every person who brings it up wants the Canadian government to take action)

Read the analysis here

[Ambitwistor]

I believe this (PDF file) is a draft of the study being discussed in TFA, or at least is closely related research.

Government vs Commercial, or Train vs. Airplane?

[Ambitwistor]

I read a fascinating article in the Freeman comparing train security, mostly privately done, with airports security, done by the government. The key difference was that when it was done commercially the inconvenience to customers was quite minimal. On the other hand when the government runs it, it is very inconvenient for customers. Why do you think this? You mean this article?

It's comparing apples and oranges, as far as I can tell. It describes private security companies and "posses" pursuing known perpetrators in the 19th century. This is essentially police work, and is a quite different issue from preventing unknown threats from boarding in the first place. It claims that going after criminals is better than screening large numbers of non-criminals. Well duh, the problem is to find out who the criminals are, in a way that safely prevents them from carrying out whatever acts they're trying to carry out.

The article also says the private companies also sent guards on trains to foil robberies and such. Well, that's what federal air marshals are for. We've already got those. The article appears to be arguing that we just need the air marshals, and don't need any airport screening. Well, that's debatable, but as far as I am concerned, it doesn't have much to do with private vs. government security.

I think the situation with train robbers vs., say, suicide bombers is quite different. The article gives an example of train robbers who threatened to blow up the train if they weren't allowed to escape. Well, that's quite different from a guy who intends to die with everyone else: he's got no reason to negotiate. If you let him on with a bomb, you've already lost, unless you're really, really counting on those air marshals or helpful passengers (a la Richard Reid). It's a harder security problem.

Finally, the article says that the railroads booted troublemakers off the premises instead of letting them board the trains. It also says that federal law prohibits airlines from doing the same. I don't understand this; I've certainly read news stories about suspicious passengers being removed from planes, and of course TSA can prevent them from boarding in the first place.

Now, I am not trying to argue in favor of draconian airport screening, but I think the differences between security against train robbers and security against airline terrorists have more to do with the completely different settings and goals, rather than private vs. government administration of the security measures.

Re:You don't understand fanatical jihadis, do you?

[Technician]

I thought that the proper term for US "war fighters" was "queer"?

Try keeping up with the news. Over there in the perfect state of Iran where nothing is out of place, they are having a couple problems. Drugs from Afghanistan and gay sex and AIDS.

http://www.losangeleschronicle.com/articles/viewArticle.asp?articleID=37725

The Art of war

[Anonymous Coward]

"The pinnacle of military deployment approaches the formless: if it is formless, then even the deepest spy cannot discern it nor the wise make plans against it."

--Sun Tzu, "The Art of War"

Randomizing responses to break a protocol...

[drgonzo59]

The randomness can be used as far as behavior is concerned in social encounters. For example you are being robbed, it is expected that you will be scared and pull out your wallet. Instead try acting like a mental case or pretend you don't understand the language, or say, offer to them a cigarette instead. For a couple of seconds, the robber will be confused as they lose control of the situation because something unexpected happened. Then it's up to you to either keep it up or if you feel brave strike back.

    The same strategy goes for when you don't want to interact with certain individuals, solicitors, pan-handlers and so on -- when they ask for you attention, reply with something completely unrelated, for example "Can you spare some change? -No thanks, I'm good. -Huh?...that don't make no sense..." by the time they processes the confusing statement you already walked too far and they'll focus on the next person.

    Another example, say you are having a heated debate with someone. When the argument is the most intense immediately switch and start arguing against your position. Ok, that's more for fun...The actual strategy is to use non-sequiturs. Statements that at first sound normal but when you think about them they just don't make any sense. Stuff like "How do you know that's what you mean?" That statement has to be immediately followed by whatever real point you are trying to make. The brain is trying to process the non-sequitur and it keeps getting segfaulting-ing, but because you keep talking it is also forced to keep up with the argument. Eventually they just remain quiet. If they ask you to repeat the non-sequitur pretend you said something else or make fun of them for being slow.

  Randomizing your response is a good way to throw off an opponent. They expect a certain response or reaction but they are getting something else. That gives you a short window of opportunity while the opponent tries to process or guess your next move. Of course your moves have a degree of randomness (that you control) and it is pointless for them to spend resources (mental, computational) to look for patterns in randomness.

Where's the news?

[Opportunist]

They've been using randomization at identifying terrorists for a while now.

random != arbitrary

[xPsi]

One has to be careful not to mistake "arbitrary" for "random." What they are doing is randomizing elements of systematic security, not promoting arbitrary security. That is, they are still sending trained patrols, K9 units, inspectors, etc. but randomizing the time, location, and duration. This seems quite smart to me. The irony is that a huge fraction of airport security today IS arbitrary, but NOT random: everyone must stand in line, take off shoes, pack liquids a certain way, scan their laptops, scan luggage, etc. This creates a dangerous situation: a reliable pattern of huge localized gluts of irritable people in a state of chaos while security is focusing on all the wrong sorts of details. It is a reactionary security method of questionable effectiveness (one guy six years ago attempts to blow up a plane with a shoe bomb so now everyone must take off their shoes). Indeed, the current method may be creating a larger security threat while trying to generate a "perception of security." For example, what if someone did have a bomb or gun in their carry-on? Do your really want to have them surrounded by 500+ edgy people (with no shoes on) being pushed through one-way security gates? Perhaps this randomizing element discussed in the article will be a first step toward leading the system to smarter, more effective, and streamlined airport security methods.

Joel Spolsky thinks it's a rendering bug.

[RealityThreek]

http://www.joelonsoftware.com/items/2007/09/26b.html

Re:Randomizing responses to break a protocol...

[Cowclops]

Or when you're in court, you could start talking about Chewbacca and how he was born on Kashyyyk but lives on Endor.

Just send more operatives

[EmbeddedJanitor]

Sure you can't predict random screening, but still the residual number of operatives will get through. If you're screening half the people (randomly) then:

If you send one operative you have a 50% chance of one getting through.

Send two and you have a 75% chance of at least one getting through.

Send ten and you have a 99.9% chance of at least one getting through.

The handy thing about many organisations is that they are willing to play the numbers.

Re:Just send more operatives

[NMerriam]

Sure you can't predict random screening, but still the residual number of operatives will get through. If you're screening half the people (randomly) then:
If you send one operative you have a 50% chance of one getting through.
Send two and you have a 75% chance of at least one getting through.
Send ten and you have a 99.9% chance of at least one getting through.
The handy thing about many organisations is that they are willing to play the numbers.

But that's only if you assume that security doesn't react in any way to the discovery of an operative, which is of course false. Once any operative is found, security will then force ALL passengers to be rescreened at that location, and increase security at other locations temporarily as well.

So sending in one operative gives you a 50/50 chance of being successful.
Send two and you have only a 25% chance of successfully penetrating security.
Send ten and you're virtually guaranteed to initiate a complete lockdown of all air traffic in the country.

Re:Just send more operatives

[fishbowl]

>Send ten and you're virtually guaranteed to initiate a complete lockdown of all air traffic in the country.

What if that's your goal?

Re:Just send more operatives

[vuffi_raa]

new reality show?

That all depends.

[raehl]

What is success for a terrorist?

If you have 10 operatives, send an operative a month every 30 days +/- 10 days. Even if they all get caught, you'll have instilled a much higher level of terror. Either one of the operatives will certainly get through, or the level of security will be so high that the costs of air travel will increase substantially.

Re:That all depends.

[tumbleweedsi]

Woo, another American who does not understand how to deal with terrorists. Maybe that's because the greatest terrorist of the modern age is the US government. We lived through decades of terror threats and won over by getting on with our lives. Terrorists are having their job done for them by the US government because it is instilling paranoia and uncertainty.
Sure, everyone needs to take some basic precautions but the main way to beat terrorists is to not grant them endless media exposure. Just get on with your lives and refuse to be terrorised.

Re:That all depends.

[E 99]

Both you and the parent poster are clueless as to the actual goals of the Jihadists. They couldn't care less about instilling paranoia and uncertainty in the U.S. or Europe. They couldn't care less if the average Westerner feels some minuscule degree more "terrorized." They couldn't care less if there are longer airport waits, more time-consuming screening, or unquantifiable detrimental effects to the U.S. economy. They often claim that they care about causing as many deaths to Westerners as possible, but that's not what they really care about either.

What they care about is perpetrating large and visually satisfying acts of violence against their perceived enemy. That's why they will not go after things that would REALLY affect us, like going after our water supplies -- there is no visual impact. It's a matter of performance art. It's a matter of creating a spectacle of carnage to prove to your coreligionists that you are a great warrior and powerful taker of life from the infidels.

So, no, causing delays and uncertainty is not a success to them. To them success absolutely requires loss of life, and in generally requires large explosions as well.