Slashdot Mirror
LA Airport Uses Random Numbers To Catch Terrorists
An anonymous reader writes "Los Angeles International Airport (LAX) is using randomization software to determine the location and timing of security checkpoints and patrols. The theory is that random security will make it impossible for terrorists to predict the actions of security forces. The ARMOR software, written by computer scientists at the University of Southern California, was initially developed to solve a problem in game theory. Doctoral student Praveen Paruchuri wrote algorithms on how an agent should react to an opponent who has perfect information about the agent's choices."
I read a fascinating article in the Freeman comparing train security, mostly privately done, with airports security, done by the government. The key difference was that when it was done commercially the inconvenience to customers was quite minimal. On the other hand when the government runs it, it is very inconvenient for customers. Why do you think this is?
[Tour of Accounting] Accounting Troll: "Over here we have our random number generator" Number Generator Troll: "Nine Nine Nine Nine Nine Nine" Dilbert: "Are you sure that's random?" Accounting Troll: "That's the problem with randomness: you can never be sure"
Quite the opposite. The bit about strategies given "perfect knowledge" by the opponent assumes that any information about practices or techniques could leak out. Given that, it seems obvious that the proper response is to determine an appropriate level of coverage, and then implement a randomized search pattern that conforms to those constraints. The security is not through obscurity but through a smaller window for discovering and exploiting the search pattern.
Somebody ban him for actually reading an article
http://www.rense.com/general79/wdx1.htm
The only time I've heard of a Gov. employee getting fired was because they let someone go through with a weapon.
Then there are the stewardesses. Since 9/11 you'd think someone anointed them in Flight Goddesses. Complain about something and the next thing you know, you're being taken away in hand cuffs.
Because of a few jerks in the world, flying has become just one big bullshit hassle. Which, for my own sanity, I refuse all jobs that require travel - bills be damned! Of course now with all the screening software, a bad credit rating will get you a second look by the TSA.
I may have to move to Vermont.
I prefer Flambe as apposed flamebait.
There is a difference between Security Through Obscurity and disguising the strength, numbers, and routines of your forces by trying to nullify patterns in your behavior. People pick up on patterns very quickly. Patterns makes it easy to train, equip and ultimately be successful when addressing fluid, complex situations. If I know that once I see people streaming from one platform I have 30 seconds before the next train arrives I have an advantage.
By truly randomizing protocols, I can no longer plan for one or two specific scenarios but must be ready for hundreds. This increases the time, energy, and manpower it takes me to prep and execute a mission. In fact, if I can't bank on the fact that there will NOT be a canine unit to take my plastic through security I may change my approach and try to work from a stand-off position rather then a close-end. This makes it easier for security because I can fortify and create choke points in and around my perimeter.
Security Through Obscurity relies on your ability to hide something alone (hiding a key) versus what this is (moving the key every 4 hours and randomizing the patrols in and around the key). There is quite a bit of difference between the two.
So, to be exact, the security staff is going to play DnD?
Staff sergeant: "Ok, Ralph" *rolls dice* "you are going to move 4 feet to the left."
Let's hope they roll 3 doubles.
Try Googling these two phrases lifted from your comment "America's inaction in Darfur" and "US government just stops meddling in the affairs of other nations". The first page of each I think is very telling. One is full of American websites, the other is full of foreign websites.
I think this is representative of who you are hearing - two different groups, one composed of Americans and the other composed of the peoples you are meddling with.
(before someone rips into me, I am not expressing any opinion about Darfur, just pointing out that probably the people screaming the loudest for American action in Darfur are Americans. I know that here in Canada I have never heard anyone suggest it is an American problem; every person who brings it up wants the Canadian government to take action)
"The pinnacle of military deployment approaches the formless: if it is formless, then even the deepest spy cannot discern it nor the wise make plans against it."
--Sun Tzu, "The Art of War"
Randomized patrols have been around along time. There are several problems with this guy's approach. First, there are inner and outer bounds to patrol initiation and duration, as well as the human tendency to repeat the familiar, thus while the schedule may get changed, the actual patrols will follow a non-random, pattern. In addition, consigning the schedule to a computer also adds a level of security failure potential that shouldn't exist. If the guards, examiners, and cameras, are on a purely random schedule, and are following the direct orders of a machine, eventually, a social engineering exploit would open the door for the opponent to get a complete schedule from the computer itself. Just like lost page encryption can be circumvented by compromising the message sender, random patrols can be brought down by compromising the computer, and unlike computers in Hollywood movies, no computer on Earth, is secure, and connected at the same time.
The thing about having "Perfect Knowledge" of a patrol or observation pattern, is that you have to expect certain variations anyways, and plan accordingly, but the polar bear under the ice is that you also have to expect certain regularities, certain things that repeat, regardless of schedule. Most unit commanders and security bosses have had to learn this the hard way, and after they loose a certain amount of confidence in human nature, they learn how to manipulate it to make their facility more secure.
A low level security guard is going to look at the schedule, and try to make it conform to his own sense of order, rounding up or down patrol times, falsifying patrols, or just plain blowing off the whole schedule entirely. After going through more than a few guards, the commander is going to have to admit, that going against human nature is not only counter productive, but dangerous. The radio messages, audio stimulus, and other auditory or visual stimulus that is used to keep the pattern random, can always be intercepted and used to an opponent's advantage, and with the high turnover rate already present in security jobs, it is a simple matter to place somebody on location that can compromise everything.
What the commander has to do is assume that his bottom line guards are going to be compromised, individually. For instance, he can safely assume, that at even if all of his guards are compromised that very few of them are going to entrust that fact with another guard. By identifying the loners on guard staff, he can group them in pairs, or triplets that are socially incompatible, and thus untrusting of one another. Since self preservation is a stronger human reaction than loyalty, the commander has to rely on this to prevent an actual incursion.
In military units, officers do not mix much with enlisted, and doing so can mean punishment or even jail time for the offenders. The reason for this, is that if two groups are not socially compatible, and they have a common stated goal, then the change of a conspiracy amongst the two is greatly reduced. If The officers decided as a group to betray, then military code would force the enlist, or non-commissioned officers to act against it, and visa versa.
The military relies on routine, because, unlike the scientist with his computer driven, game theory approach, they know it works. If patrols become regular, then is easier for those patrols to spot anything out of order. The only way to have consistent security, is to have reliable, consistent, and above all, complete coverage of the facility.
Fast machines, powerfull AI, impulsive invention,... All I lack is a good espresso machine!
If they use your comma placement as a random seed, the system will be absolutely secure.
But that's only if you assume that security doesn't react in any way to the discovery of an operative, which is of course false. Once any operative is found, security will then force ALL passengers to be rescreened at that location, and increase security at other locations temporarily as well.
So sending in one operative gives you a 50/50 chance of being successful.
Send two and you have only a 25% chance of successfully penetrating security.
Send ten and you're virtually guaranteed to initiate a complete lockdown of all air traffic in the country.
Recursive: Adj. See Recursive.