TSA's Sloppy Redacting Reveals All

A travel blog breaks the story of a poor job of redacting by the TSA: they posted a PDF of airport screening policies, with certain sections blacked out — not realizing that simply laying a black rectangle over the text is hardly sufficient. Cryptome has posted a copy with the redaction removed (ZIP).

Comments

Well, at least the rest don't do this.

[JoshuaZ]

I know people who work in the US government. As I understand it, when releasing material that is partially blacked out, in most departments the procedure is to simply black it out on a hard copy and then photocopy the hard copy or scan it if it is to go online. This removes any chance of clever ways of getting the data if there's something about the file format or such that is strange. I don't see why the TSA wouldn't do the same thing. Moreover, isn't the fact that you can do this with PDFs well known? I've even seen it used as a way of covering up spoilers. What were they thinking?

Re:Well, at least the rest don't do this.

[Reason58]

I don't see why the TSA wouldn't do the same thing.

For the same reason they make you take your shoes off? For the same reason they have so many ineffective security policies that busy airports often have security checkpoint lines containing more people than a plane, which makes for extremely easy bombing targets (no security!)? Clueless, inept, and there to absorb money and power.

Re:Well, at least the rest don't do this.

[Anonymous Coward]

The reason security checkpoint lines and their larger crowd of people isn't as much of a threat as a plane, is because it takes a much smaller bomb to kill all the people on the plane. The plane is what kills people, not the bomb that cripples the planes ability to transport hundreds of people safely at an altitude of miles and high speed. (just read that on Shneier's page)

Re:Well, at least the rest don't do this.

[QuantumG]

That's the stupidest thing I've ever heard.

Re:Well, at least the rest don't do this.

[JWSmythe]

    It's not clueless and inept. It's the illusion of security. Take off your shoes. Put your liquids in a clear bag. Stand here while we do a cursory search of your carry on luggage. It's to make the general population *FEEL* secure, not to actually secure them. Have you looked in their trash bin of confiscated items? It's all stuff that wouldn't sell at a yard sale. Their "explosive" detectors are a joke. And backscatter xrays? I went through one. Because of the way my shirt was sewn, it looked like I was wearing suspenders. 15 minutes to explain that it was just a shirt. How about recent tests where only 25% of the tests done passing obvious dangerous items (bombs, knives, guns, etc) through security were caught?

    They still allow objects with more serious potential through. A laptop as a blunt force instrument? The potential energy stored in a laptop battery? The RF radiation created by handheld electronics? The fact that a highschool football player could overpower the flight crew and air marshals? They worry about that tube of toothpaste. What if 100 of the tickets for a flight were booked by terrorists? Good luck for the rest of the passengers to overpower them.

    But, the people demanded higher security, so they get the illusion of higher security.

    Now, take off your shoes, and play along with the security theater.
 

Re:Well, at least the rest don't do this.

[JoshuaZ]

Security theater isn't inherently bad. People get scared very easily. We could say "sure, we've added in some minor stop gaps but the main result is that we hope if you get hijacked you'll do your patriotic duty to stop the hijackers or barring that bringing the plane down. And bombings? We aren't very concerned about them. Such events have been very rare for a long time." People wouldn't respond rationally to that. So instead we add steps that are ostentatious and feel like security. The result is people behave more reasonably and use airplanes they wouldn't otherwise do so. This is a cynical but strong argument for security theater.

Re:Well, at least the rest don't do this.

[Jeremi]

For the same reason they have so many ineffective security policies that busy airports often have security checkpoint lines containing more people than a plane, which makes for extremely easy bombing targets (no security!)?

There are lots of places where many people gather together. The critical difference is that those places don't also contain several thousand gallons of jet fuel, and you you can't fly them into a skyscraper.

Re:Well, at least the rest don't do this.

[furball]

Obviously the solution is a security line for the security line. That way the security line can't be bombed. Duh.

Re:Well, at least the rest don't do this.

[JWSmythe]

    No, your views aren't cynical. They're realistic. Unfortunately, we (the gov't with our tax dollars) are spending so much to enhance the illusion, that could be better spent elsewhere. But, the TSA isn't going away any time soon, and "security" measures will continue, even though they are entertaining at best.

    I had a nice talk with a TSA agent once. I had time to waste, and he was going through the drill. It was obvious that he understood his job was just to maintain the illusion. We both understood that if air travel is the path of most resistance, a real terrorist would choose the path of least resistance. There are so many options, and even in a total police state those methods wouldn't be fool proof. Consider the underground movements during WWII in Europe. Even in occupied cities with Axis troops on every corner, the resistance was able to not only subvert their security by moving people in and out, but they were able to stage resistance attacks (as we'd now know as terrorist attacks). But as it goes, one man's freedom fighter is another man's terrorist.

Re:Well, at least the rest don't do this.

[LordLimecat]

Most people at airports dont seem afraid, or reassured, they tend to simply be irritated at what the average citizen can recognize as silly and ineffective.

I dont know what part of the population the TSA hopes to fool, but its not the majority.

Re:Well, at least the rest don't do this.

[Anonymous Coward]

Mostly power. The money is a bonus.

You will be controlled.

Know your overlords!

Re:Well, at least the rest don't do this.

[MartinSchou]

Have you looked in their trash bin of confiscated items?

This bit actually says it all.

1) You're not allowed to bring liquids above a certain quantity for fears it might be part of an explosive device
2) Throw said components into an open trash can
3) Repeat 1 and 2 until you hit critical mass
4) Throw an igniter into the trash can
5) Big boom

When's the last time you saw the police or military treat a package like that, when they suspect it might be an explosive? It never happens. They take very serious steps to prevent injuries, going as far as blowing up small bags of bikinis.

But at the airport, where you have hundreds of people standing in line, you're supposed to just toss it all into an open container next to the line. Security indeed.

Re:Well, at least the rest don't do this.

[Jbcarpen]

I'd like to point out that a Terrorist (in general) deliberately targets civilians. If someone is claiming to be a Freedom Fighter they had better be taking steps to ensure that their targets are military in nature. If they target civilians out of choice, then they lose the right to claim freedom fighter status (doesn't stop them from claiming it anyway, but they're just deluding themselves.)

Re:Well, at least the rest don't do this.

[Uberbah]

I'd like to point out that a Terrorist (in general) deliberately targets civilians.

If they aren't targeting civilians, they aren't terrorists. Marine barracks bombing in Lebanon? Not terrorism. Flying a plane into the Pentagon? Not terrorism (though it was for the folks on the plane). Bombing the U.S.S. Cole? Not terrorism. Attacks on military installations and personnel is not terrorism, it's an attack on the military.

Re:Well, at least the rest don't do this.

[Uberbah]

Even though I don't agree with the stupid security "measurements" taken, this is just absurd and not particularly well thought through.

You shouldn't throw stones....

It takes a very, very small bomb to kill the same amount of people once they are on the plane.

Hardly. Planes are designed to withstand heavy weather and have redundant systems. Carrying a large bomb into a long security line is trivial. Carrying a bomb onto a plane large enough to hit the fuel tanks, the cockpit or severely damage one of the wings is NOT trivial.

Re:Well, at least the rest don't do this.

[janek78]

And yet, their budged is several times more than the FDA. Given how many people drugs (and their improper use) kill every year, you'd think that if the US government really wanted to save lives....

Re:Well, at least the rest don't do this.

[meringuoid]

If they target civilians out of choice, then they lose the right to claim freedom fighter status

In such a campaign, who's a civilian? Are informers considered civilians, or can the Resistance shoot them? Are collaborators considered civilians, or can the Resistance intimidate or terrorise them to discourage working with the enemy?

I'm pretty sure the French Resistance did both. So did the IRA.

Re:Well, at least the rest don't do this.

[Richard_at_work]

Aircraft are designed for stresses in particular ways - apply stresses in other ways and its easy to bring down the plane.

You don't have to hit the cockpit, fuel tanks or wings - you simply have to disrupt the fuselage structure itself, which is actually fairly trivial to do. Once the fuselage structure has lost integrity, there is no aircraft.

Re:Well, at least the rest don't do this.

[QuantumG]

There's always one. "Hey everyone, I'm so stupid that I don't even understand how to keep my stupidity a secret."

Ok, I'll try to explain this really simply to you.

1. There's more people in line at the checkpoints than there is on a single plane because there's more than one plane at the airport and the checkpoints take so god damn long.
2. The mythical* terrorists can make those lines even longer just by sending people in to fool around at the checkpoint.
3. People are made of squishy stuff, and are therefore easy to explode.
4. Planes are made of metal which is much stronger than people, so they are harder to explode. And before you mention fuel, the fuel is inside the metal.
5. There's no checkpoints to get to the checkpoints, so it's easier to attack the big mass of people before the checkpoint than it is to attack the small masses of people after the checkpoint.

* All of this is so damn obvious that the only sensible conclusion is that there are no terrorists trying to blow up airports in the US. Further evidence of this is that, in countries that actually have suicide bombings, attacking checkpoints is exactly the strategy they use and, as such, checkpoints are designed to keep people moving through them as fast as possible.

Re:Well, at least the rest don't do this.

[Tony Hoyle]

That's because they were dealing with a real threat not just playing at it. If there's a risk of bombs the last thing you want to do is cause a choke point meaning large numbers of people congregate in a single area - you keep the checks as efficient and fast as possible.

Re:Well, at least the rest don't do this.

[Phylomo]

Awesome branch on this thread. So many people don't know the difference. "Terrorist" designation comes from tactics, from choice of targets, NOT from motivation. Your examples, merinquoid, point out where the line is fuzzy. Another example: PLO suicide bomber attacks against an Israeli military checkpoint? Not terrorism. PLO suicide bomber attacks against a school-bus full of children? Terrorism. PLO suicide bomber attacks against adult Israelis, all of whom might be armed and capable of defending themselves? Civilians, but civilians who view themselves as an extension of the military? Maybe terrorism, maybe not. Certainly an attack that the Israelis have a right to defend themselves against, but maybe not terrorism. (Thanks, jbcarpen, uberbah and merinquoid)

Re:Well, at least the rest don't do this.

[Publikwerks]

But a bomb, or any weapon, can be used to TAKE CONTROL of a a PLANE. "I will blow the plan up unless the pilot opens the security door, and allows me to fly the plane". If they wanted to kill people straight up, they would go to Times Square or a parade or somthing. Someplace with alot less police and security than a freaking airport. Hell, Lansdowne st next to Fenway has more people gametime than ANY airport security. It's just a bad target. They want the plan to crash it into something. As we have seen, that much mass traveling that fast with alot of jet fuel makes a huge mess when it hits something, and there is very little chance of stopping it.

Re:Well, at least the rest don't do this.

[Phylomo]

"[Bunch of junk, trying to draw distinction where none exists to make people feel better about killing each other.]"

I have to disagree with this. I do think there is a distinction. When talking doesn't work, violence happens. We can't control how violence is used against us, but we can control how we use it against other people. THAT is where the distinction matters. We have to justify to ourselves and, to some degree, the rest of the world that we are reacting appropriately.

Re:Well, at least the rest don't do this.

[Uberbah]

What about civilian personnel who make up a large component of the Pentagon staff?

What about them? They're doing military work in the central military command building. Call them servicemen, call them civilians, call them tofu - they are still a willing part of the military in the central command building for the military.

Re:The real link to the cryptome file

[JesseL]

Damn. The line between informative and redundant is measured in seconds.

Can the mirrors please

[shermo]

Dammit. The mirrored files have the highlighting taken out so I don't know where the juicy bits are in the document.

Can someone mirror it with the highlighting left in?

TSA?

[Anonymous Coward]

Why so little context in the description of this article?
From a quick google around.. it seems that the TSA referred to here is a US government agency of some sort - Transport Security Administration.
Perhaps it's assumed around here that almost every TLA from the USA is of global significance and widely understood.

Re:why are they so scared about xray monitors?

[frdmfghtr]

First guess, they don't want the "terrorists" to see how good/bad the x-ray devices are.

Second more cynical guess: Xray machines are mostly useless and the TSA doesn't want the public to realize it's a bunch of voodoo?

Perhaps it a privacy concern between whomever owns the bag being scanned and other members of the public.

Silly

[QuoteMstr]

Here are typical examples of redacted paragraphs:

Ensure TSOs do not handle explosives, incendiaries, or weapons if such items are discovered during the screening process.

D. Whenever a Threat Image Projection (TIP) enabled x-ray is unable to detect 28-gauge wire at Step 10 on the Test Step Wedge, discontinue use. The STSO must immediately notify TSA management.

An airport assigned LEO (if available), STSO, or designated TSA representative clears the individual after inspecting his or her badge, credential, and Government-issued photo ID, and if flying, his or her boarding pass and Notice of LEO Flying Armed Document.

Aircraft operator flight crewmembers in uniform, with valid aircraft operator employee identification, are
exempt from the Unpredictable Screening Process and restrictions involving liquids, gels, aerosols, and footwear. Aircraft operator flight crewmembers in uniform, designated as selectees, are not exempt from the requirements regarding liquids, gels, aerosols, or footwear. Any alarm of the aircraft operator flight crewmember's person or accessible property must be cleared.

On what planet is it necessary to keep facts like these secret?

Re:Pehaps intentional?

[MaXintosh]

Slashdotters are fond of pointing out that you should never ascribe to malice what you can ascribe to incompetence.

The TSA redacting process

[MosesJones]

This clearly comes from the people who thought up my favourite piece of brain dead "security" from the TSA

When you enter the line to the security gate a TSA numpty checks your boarding pass to make sure you are allowed to join the line. Everyone joining the line has their boarding pass checked, this is a piece of paper often printed on a computer that says what flight you are on, its just about the easiest thing to fake in the history of fakery.

Then you lob everything into the x-ray machine, clearly needing to separate your laptop out as clearly its impossible to see stuff through that. Shoes of course, belts, internal organs...

Then as you step through the body scanner some TSA numpty says "boarding pass please". Pointing out that you've just put all your crap through the machine and that your boarding pass is with your passport and your wallet is of course pointless. The answer... wait until it comes out of the machine and then show the numpty. you are of course also checked at the gate with both passport (hard to fake) and boarding pass (trivial to fake).

So in otherwords the TSA check TWICE a piece of easy to fake information and NEVER check your ruddy passport.

So how did the TSA redact this PDF. Well simple they had the same process. The first person pasted on the black squares. This was then printed out.

The first checker then looked at the printed out copy and said "looks fine to me"

This document was then scanned in and then printed again to be checked by a second checker who said "yup all okay"

And then they put the ORIGINIAL electronic copy on line with the pasting over the top.

The TSA is to security what Micheal Vick is to Pet Care

Re:The TSA redacting process

[drinkypoo]

Professional sports is only vaguely "the real world". And what in the world is going to change if a pro player gets in trouble for dog fighting? Jack diddly shit. The time people waste committing knowledge about professional sports they will never play is pathetic at best. Oh sure, I do pathetic things, but attacking slashdotters for not being familiar with professional sports is like attacking mother theresa for not being a unicycle rider.

Re:Actual Link to the zip

[girlintraining]

dude, you zipped a pdf....thats almost as bad as when my mom puts a jpg in a doc to email it.

When you're expecting several tens of thousands of people to download it in a short time period -- every kilobyte helps.

Re:why are they so scared about xray monitors?

[pete-classic]

It's almost certainly to prevent test runs.

Suppose you're a religious fundamentalist wack-job who thinks your God wants you to kill people who aren't following his rules. You'd probably have ideas about ways to get certain things on the plane*. (And you'd probably just do it.)

Now, imagine you're some white-bread, middle aged man from the Midwest with a wife, a couple of kids, and a dog. Suppose it's you're job to stop Mr. Wack-job. You'd probably think in terms of what you'd have on the line if you went up against Uncle Sam. And you'd probably suppose that he'd want to do some test runs with indifferent items with similar physical characteristics to the naughty items. But, because the test items would be neither dangerous nor prohibited, you couldn't count on security indicating that they saw the items.

Mr. Wack-job would gain much more information if he could watch the monitor for signs of his test items while an accomplice ran them through security.

-Peter

* I can think of several such items and approaches (and probable counter-measures, and possible counter-counter-measures), but I will keep them to myself so as to avoid any risk of giving the impression that I condone such behavior.

Re:Actual Link to the zip

[Looce]

I know your post was meant to be a joke, but a .zip file is not usually opened automatically by a Web browser like a .pdf is, and the guess might be that most people who open that document would want to save it. I don't know why; maybe it's because cryptome.org expects to get a takedown request soon from the Transportation Security Administration in a great display of Streisand effect... :)

Re:Use what they give you!

[Uberbah]

People are stupid, corrupt and incompetent. How is your Enron stock doing these days?

THIS HAS HAPPENED BEFORE!

[slimjim8094]

The exact same thing has happened before, and was even covered on slashdot, many many times.

http://entertainment.slashdot.org/story/08/05/20/0228229/FBI-Wiretapping-Audit-Secrets-Uncovered-Via-CtrlC
http://it.slashdot.org/article.pl?sid=06/06/22/138210
http://yro.slashdot.org/story/03/11/01/1729257/Memory-Hole-Un-Redacts-Redacted-DOJ-Memo

Re:THIS HAS HAPPENED BEFORE!

[Wuhao]

The exact same thing has happened before, and was even covered on slashdot, many many times.

http://entertainment.slashdot.org/story/08/05/20/0228229/FBI-Wiretapping-Audit-Secrets-Uncovered-Via-CtrlC http://it.slashdot.org/article.pl?sid=06/06/22/138210 http://yro.slashdot.org/story/03/11/01/1729257/Memory-Hole-Un-Redacts-Redacted-DOJ-Memo

It's almost as if the sort of people who would think drawing black rectangles in a PDF renders text unreadable don't read the sort of websites that laugh at people for drawing black rectangles in a PDF to render text unreadable.

Re:As effective as the rest of the TSA

[Anarchduke]

Especially when part of the redaction specifically talks about TSA Field Intelligence agents. Since when does the TSA have field intelligence agents???

Re:Idiots

[Tom]

Don't worry, they'll lobby a law against that. Problem solved. Right? RIGHT?

WWII terrorism : Who wrote the history books ?

[DrYak]

Most people would not call the attacks of Germany and Britain on each others civilian populations during WWII "terrorism", even though the blanket targeting of civilian populations did occur (ie. the bombing of civilians was not an accident, or "collateral damage", it was a deliberate act designed to kill and undermine moral).
Why was the bombing of civilian cities (those with no or little military infrastructure) during WWII considered valid, and yet now is considered "terrorism"?

Well from a purely theoretical point of view, these bombings (and also the nuclear bombs on Hiroshima and Nagasaki) were *indeed* perfect example of the definition of terrorism (killing civilian target for the sole purpose of undermining the moral), even if they were done by government instead of some rebel groups.

But now you see, with wars done by governments, the small difference is that the winners get to write the history books. And if they choose to call their deeds as "glorious acts of democratic resistance against the evil empire of dumb-stupid nazis" instead of "acts of terror to break the enemy's morale", so be it.
And that's how some doctrine like "Shock and awe" are born.

In an alternate reality where the American economy had collapsed, giving a chance to Afghanistan to actually win the war, you know how the books where going to describe this conflict.

Re:WWII terrorism : Who wrote the history books ?

[bkr1_2k]

The problem is that we classify the bombings done by the Axis powers as war too, not terrorism. It's not just about who gets to write the history books. It's about the constant changing of language and acceptance of new things. We never heard "collateral damage" until the early 90s (as civilians). We certainly never heard words like Jihad, or WMD, or rendition, or any other of a number of words that have "evolved" from the last couple of wars the US has been involved with fighting. And let's not forget how "patriot" has changed in the last couple of generations. Our fathers and grandfathers fought in a war that was "just" (WWII) and were true patriots. They fought to protect life all over the world. Now a "patriot" is someone who doesn't argue with the government... it's pretty scary. We are changing the meaning of words and the use of words to further instill the fear that we are supposedly fighting against. It's would be interesting to watch if it weren't so damned creepy.

Re:One interesting redacted section

[Ralph Spoilsport]

Then why isn't Saudi Arabia on that list?

Re:Easy to laugh when you aren't responsible

[Overzeetop]

Prior to 1/1/2002, what percentage of people who flew were killed by terrorists. Tell you what, let's add in everyone killed on the ground as a result of the plane crashes on 9/11/01. Now what's the percentage. What percentage of people who drive cars are killed every year prior to mandatory seatbelts? And after?

Now compare the percentage reduction in each to the total annual cost of each. I think you'll find the TSA screening to be horribly cost ineffective.

Besides, how many passenger groups are likely to be passive during a hijacking post-9/11? You saw the reaction of the passengers of the third plane; TSA is actually doing very little.

Re:One interesting redacted section

[thisnamestoolong]

Mod parent up to +11 Insightful -- the ONE major terrorist attack that precipitated all of this nonsense was perpetrated by Saudi nationals, yet they are not on this list of nations? That list has no place being in existence, but if it is to exist, it is psychotic to not include Saudi Arabia.