Slashdot Mirror


TSA Paid $1.4 Million For Randomizer App That Chooses Left Or Right (geek.com)

An anonymous reader writes: For those of you who have traveled through U.S. airports in recent years, you may have noticed the Transport Security Administration (TSA) use a Randomizer app to randomly search travelers in the Pre-Check lane. The app randomly chooses whether travelers go left or right in the Pre-Check lane so they can't predict which lane each person is assigned to and can't figure out how to avoid the random checks. Developer Kevin Burke submitted a Freedom of Information Act request asking for details about the app. The documents he received reveals the TSA purchased the Randomizer iPad app for $336,413.59. That's $336,413.59 for an app, which is incredibly simple to make as most programming languages of choice have a randomizing function available to use. What may be even more intriguing is that the contract for the TSA Randomizer app was won by IBM. The total amount paid for the project is actually $1.4 million, but the cost is not broken down in Burke's documents. It's possible IBM supplied all the iPads and training in addition to the app itself.

14 of 334 comments (clear)

  1. Standard C library... by Etherwalk · · Score: 2, Insightful

    The question is whether it is truly random or not. If they spent $1.4M and got a truly random result, fine. It's absurdly pricey, but it works. If they spend $1.4M and got the rand() function, then terrorists might be able to exploit it to escape random searches.

    1. Re:Standard C library... by rwven · · Score: 5, Insightful

      That's really stretching things. If you use something as simple as microseconds on a clock as the seed for your "random" number generation, there's "pretty much" no way you can exploit that short of hacking the device itself. It's not like people are going to stand there with a stopwatch and tell the TSA guy "OK....press the button...Now!"

    2. Re:Standard C library... by Jason+Levine · · Score: 4, Insightful

      That cartoon villain level of planning isn't needed at all. There are gaping holes in the TSA security net. They take the "security" out of "security theater"

      Not to mention the huge security hole before you hit the TSA checkpoint. Especially if you are in a large airport during a busy time of the year.

      TSA: "We spent $14 million to make our security process safer and more effective!"
      Terrorists: "That's nice. We think we'll detonate our bombs in this nice, crowded security line. Not only will we kill a lot of people, but then you'll shut down this airport for days wrecking even more havoc on people's travel plans."

      --
      My sci-fi novel, Ghost Thief, is now available from Amazon.com.
    3. Re:Standard C library... by vlad30 · · Score: 4, Insightful

      Terrorists: "That's nice. We think we'll detonate our bombs in this nice, crowded security line. Not only will we kill a lot of people, but then you'll shut down this airport for days wrecking even more havoc on people's travel plans."

      Always wondered why terrorist chose airports why not a church/synagogue packed with people on a Sunday/Saturday and zero security its easy pickings, then it would be Christians and truly a religious war but they attack airports sporting events concerts, symbols of western affluence. sort of answered my own question its not really about religion is it.

      --
      Your'e all thinking it, I just said it for you
  2. Maybe by Anonymous Coward · · Score: 3, Insightful

    "as most programming languages of choice have a randomizing function available to use"
    You mean has a psudo-random function that is not that hard to predict.
    Casino Level Randomization is a little harder.

    1. Re:Maybe by Anonymous Coward · · Score: 3, Insightful

      Reset the seed to the millisecond the button was pressed each time it's pressed. Its breakable, but if you can bribe the guard to time it exactly, you can also bribe him to simply put you in one line regardless of what the app says. If you can't bribe the guard, good luck syncing the device's time and trying to social engineer the guy to press the button at an exact moment.

  3. Re:Obviously they had to pay a lot by TWX · · Score: 4, Insightful

    I know you're being silly on purpose, but would a true randomizing device really be necessary? Human traffic patterns already have such a random element to them that even if one somehow could reliably predict the next number in the software algorithm, there are so many other factors that can't be controlled that it's still essentially random anyway.

    I honestly could see it being in the low five-figures to develop such an application, but that money would mostly be applied to figuring out how to design the user-interface of the application such that it best-fits with how the TSA is *supposed* to operate, and in beta-testing to confirm that it does what it's supposed to do and that any untrained TSA agent down to the junior-assistant-trainee who breathes with his mouth open could use it and understand it, but mid-six-figures is pretty ridiculous.

    --
    Do not look into laser with remaining eye.
  4. Nice nonsensical article. by Anonymous Coward · · Score: 5, Insightful

    ZOMG $1.4M for an app that randomizes a single bit!!! (*)

    * Note that it may have actually been $1.4M for hardware, training, and app.

    Seriously, how fucking asinine are these clickbait articles getting? If you can decisively say that they charged $300k+ or $1.4M+ for an app that simple, do so. Otherwise you're just full of shit.

  5. Re:When Mr. Trump says fraud and waste .... by beelsebob · · Score: 3, Insightful

    He means precisely instances like that.

    The problem is, that what he proposes, is more of this... He proposes that more of the country should be privatised, because "businesses can do it much more efficiently".

    The correct solution here was not to get any business involved at all, because as soon as you do that, they try and make a (huge) profit out of it. The correct solution was instead to get a software engineering intern on the government's payroll to write this app in one day.

  6. Rules and Regulations by TechyImmigrant · · Score: 5, Insightful

    Are you selling it to the federal government? [YES]
    Is a random number generator used in the product? [YES]
    Is the product intended for a security application? [YES]

    Requirement: The Random Number Generator be CAVS certified to SP800-90A and the module within which is operates be FIPS140-2 certified.

    That's $100,000 before you've got out of bed, to meet the government procurement requirements.

    --
    I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  7. Re:Training? by argumentsockpuppet · · Score: 5, Insightful

    It's possible IBM supplied all the iPads and training in addition to the app itself.

    I know it is fun and easy to criticize the TSA, and I am in favor of replacing them entirely with any of a dozen different possibilities. That said, there is a big difference between developing an app and supplying hardware and doing testing and training. I could build the app but I have no idea what the cost would be to test it sufficiently to meet government standards, then train the staff to use them, then equip the staff with hardware to use it. The cost of the app could literally be $0 and still top $1 million after the testing, training and equipment costs.

    Someone else pointed out this is typical clickbait. It's got a shocking headline but then scant details on what actually caused the scenario. If they'd instead said "TSA has IBM develop an app that IBM contributed for free in exchange for exclusive rights to train staff for $10/hr each on how to handle customer service. Additionally, IBM will supply sufficient devices to have a minimum of two for each airport line at 5% profit per device" then the headline wouldn't generate nearly so much interest and the criticisms would be much better founded.

    I wouldn't be at all surprised to find out that the bureaucracy that guides the TSA spent far more than is reasonable. I just didn't see enough details in TFA to assume that is actually the case. Does *anyone* have a breakdown on what kind of training, what kind of testing, what kind of devices were purchased?

  8. Re:I'd like to bid next time by Applehu+Akbar · · Score: 2, Insightful

    I have a system that is:
    - Analog
    - Does not require electricity
    - Durable
    - Ambidextrous
    - Gender neutral
    - Made in the USA

    Training video here: http://putlocker.is/watch-goin...

    Dear Mr. Sexconker,

    We are in receipt of your case of 2000 (two thousand) manually operated analog cupronickel randomization discs. We admire the evident durability and domestic origin of your product, and initial testing proves that the sequence of flips is suitably random. In addition, we are confident that your training video can be developed into a course that our agents will be able to complete in about six months.

    Unfortunately, your product does not meet the contracted criterion of gender neutrality. Al of the "heads" depicted are male.

    Yours,
    Monroe Fnord, Technology Director
    Transportation Security Administration

  9. It makes sense if you call them by the right name by Required+Snark · · Score: 3, Insightful

    Department of Homeland Pork, Transportation Pork Administration

    --
    Why is Snark Required?
  10. Re:Obviously they had to pay a lot by Gamasta · · Score: 4, Insightful

    "IMO the gaps between the rationals are small enough that it doesn't matter if you can prove this for irrationals"

    Excuse me, but your opinion is wrong. Rational numbers are said to be sparse in the real number space. For the argument see "Lebesgue Measure." As for why there are more irrational numbers than rational numbers see "Cantor's diagonal argument".

    Your reasoning is however correct. If P(HEADS) = p, P(TAILS) = (1-p). The probability for coin tosses are:
    HH = p*p
    HT = p(1-p)
    TH = (1-p)p
    TT = (1-p)(1-p)

    Eliminating HH and TT leaves HT and TH at p(1-p) probability. There's no assumption on p being rational or not. However the further you are from p=0.5, the longer it takes to get a "valid" flip.

    --
    reason defies logic