Information Security News: Are we really at risk from snacks on a plane?

[InfoSec News <alerts () infosecnews org>]

http://www.sundayherald.com/57459

Investigation by Neil Mackay
Sunday Herald
20 August 2006

JUST a couple of days ago a pilot was stopped by a security guard while 
getting ready to board his aircraft at a bustling British airport and 
informed he had a fork in his bag which would have to be taken away.

Sarcastically, the pilot says he "asked if the security guard would come 
up to the flight deck and stop me pointing the aircraft at terra firma. 
Also would the guard help me to decide if I should use the fork as a 
weapon against myself or the axe that sits beside me on the flight deck? 
Common sense seems to be a thing of the past."

Speak to anyone in the aviation industry today and they'll tell you the 
current draconian security measures at British airports - which see 
passengers prohibited from taking even water onboard in some instances - 
are "bureaucratic madness," "security lunacy," "stupid" and "absurd." 
They are unanimous in their fury towards the government for enforcing 
regulations they see as "ridiculous."

Airport and airline staff also point out that security rules are not 
followed uniformly and safety measures are inconsistent. Some accuse 
Britain of falling in line behind "US paranoia", and others say the 
industry is "being subjected to knee-jerk reactions" which threaten the 
future of global aviation.

One pilot pointed out that their bag was searched, but not their laptop 
carrier. They were allowed to hold onto their mobile, torch and car 
keys, but one pair of their glasses had to be put into the hold - they 
were, however, allowed to hold onto another pair of glasses. Another 
staff member, just a few places behind the pilot in the security queue, 
wasnt allowed to keep their mobile.

The pilot pointed out that the crew were later given metal knives and 
forks to eat their in-flight food, adding angrily that it was "utter 
morons who think up this sh*t". Unsurprisingly, few of these aviation 
industry insiders will put their names to their comments.

A member of BAA - British Airports Authority - told how last week they 
had to bring their passport and national insurance number to Heathrow to 
get their BAA airport ID card renewed. However, theyd gained access to 
the secure areas of Heathrow - where they needed to go to get their ID 
renewed - using their old, out of date ID card. They referred to the 
experience as "farcical". Some pilots operating in the UK do not have 
any airport ID as they have yet to complete their security checks. 
Another member of Heathrow staff added: "Just where do they get these 
nut-bags from?"

A bus driver at one of Britains airports said that coaches ferrying 
staff around airports were not searched after entering security zones. 
"That is a real security risk," the driver said. One of the suspects 
arrested during the 'liquid bomb' plot raids worked at Heathrow.

"You hide something lethal on the coach, they dont find it in their 
search and you pick it up five minutes later. This must be the easiest 
way for crew to get illegal items aboard an aircraft. Amazingly, the 
department of transport regard this risk as acceptable. Once I 
accidentally left my mobile phone on the seat and it was still there 
when I returned. So much for thorough searching. The only solution is to 
have a different coach airside."

An air stewardess said one of her colleagues was allowed her lipstick 
through security, but not her eyeshadow. A member of ground crew staff 
said he had a metal knife, fork, spoon and Leatherman in his staff 
locker.

Carolyn Evans, head of flight safety at the British Airline Pilots 
Association, says that at BALPAs next meeting with Transec, the 
governments transport security arm, "we will be raising with them some 
of the anomalies and the lack of security training and the 
inconsistencies that have come out of the heightened security measures".

Among the issues that BALPA will raise with the government are "the 
confiscation of essential tools of the trade, such as pens, lap-tops, 
soft lens eyewash and mobile phones, the impossible operating 
constraints of having bags in the hold when operating short-haul with a 
frequent change of aircraft" and "lack of access to food and drink".

Evans added that "the procedures put in place are not sustainable long 
term, and unless the passengers are treated more reasonably we will not 
have an industry left."

Despite the heavy security procedures hampering passengers and staff, 
the UK does not have a nationally recognised airside ID card - merely 
airside ID cards for each airport. Pilots and other aviation staff want 
a national ID system in place.

A member of staff at Manchester airport said that while passengers and 
crew were not allowed to take liquids through security, a shop assistant 
who worked in WH Smith on the other side of the security gates was able 
to take "several cases" of juice through. The woman didnt go to the shop 
but walked into baggage handling.

Staff cynicism is endemic. "The sheep are buying it", writes one 
American pilot on a website used by air crew. "We've already seen Angie 
Airhead, the 6pm news reporter, on the scene at the airport interviewing 
passengers stuck in hour-long screening lines. Angie: How do you feel 
about these new security measures? Traveller: If it promotes the war on 
terror, Ill gladly give up my tube of Pepsodent. The only thing it 
promotes, moron, is tooth decay."

Air crews are also angered security staff at airports are not under the 
control of the police but rather work for private companies. A British 
airline worker said: "Airport security should be a civil service 
function with properly trained and educated screeners".

Ground staff - as well as not being allowed to bring food and water 
airside - are also prohibited from taking radios through security. "How 
are you supposed to keep in touch and get your flight out in reasonable 
time if you cant communicate," one worker said.

Just like the workers in the aviation industry, the bosses of airline 
companies are outraged with the government.

Michael O'Leary, the Irish boss of Ryanair, the budget airline, issued 
the government with a seven-day ultimatum on Friday saying that airport 
security must be restored to normal levels or else hed sue for 
compensation.

Just like the ordinary members of staff, O'Leary was scathing when 
referring to the security measures as "Keystone Cops-like," and saying 
that it was "insane" to take away water bottles and toothpaste from 
travellers.

"We are not in danger of dying at the hands of toiletries, he said, 
adding that Osama bin Laden must be rolling around the caves of Pakistan 
laughing. O'Leary described as horse manure frightening government 
warnings which amounted to telling the public it was a choice between 
delays or death.

Ryanair bookings were 10% down after the recent terror threat, and the 
cost of the additional security to the company has been around 2 million 
so far. The people being subjected to intense security were, O'Leary 
said, "not terrorists and not fanatics. They are actually called 
holiday-makers".

O'Leary went on: "The best way to defeat terrorists and extremists is 
for ordinary people to continue to live their lives as normal. Because 
of additional security restrictions imposed by the government the 
shambles at airports has been anything but normal.

"The UK government successfully led the return to normality of the 
London Underground within two days of the July 7 terrorist attacks. It 
is important they now restore security at airports to normality and 
remove some of the nonsensical, and - from a security perspective - 
totally ineffective restrictions which were introduced.

"If they dont and they allow these restrictions to stay in place, then 
the government will have handed the extremists an enormous PR victory."

The cost to UK airlines so far has been more than 300 million. The 
no-frills airline, easyjet, has cancelled more than 500 flights. If the 
new restrictions remain in place, BAA says it will need 1000 more staff. 
Ryanair wants the government to send in the army and police next time it 
orders new security measures such as quadrupling the number of body 
searches. Virgin Atlantic also says the government should pay for extra 
security. The government, however, has ruled out an early return to 
security norms, saying "it has no intention of compromising security."

Politicians, like airline staff, are now breaking ranks and damning the 
governments response to the terror threats.

In the next edition of Flight Training News, Lembit Opik, the popular 
Lib-Dem MP and a pilot himself, will let rip against the security 
hysteria. He says: "The unavoidable logic of the ever-tightening noose 
of security leads directly and quickly into a police state...  What has 
happened is a very real compromising of our civil liberties...  Risk 
management, not risk elimination, is the sensible approach." Airline 
security needs "informed decision-making," he goes on, adding: 
"Ministers are only concerned with checking everyone who gets on a 
plane, rather than figuring out why some people board for the wrong 
reasons."

Opik called on the government "to make realistic plans with airports and 
airlines now, not during the next alleged plot, when the temptation for 
knee-jerk over-reaction is obviously greater. Long term, the solution 
isnt found in turning Heathrow into an overcrowded shanty town of 
frustrated travellers...  the challenge is having proportionate 
responses."

Roger Wiltshire, Secretary-General of the British Air Transport 
Association, spoke of the lack of standardised security procedures. In 
Britain, a passenger cant take liquid through security, but can buy 
liquid (including alcohol which is flammable) airside in duty free and 
take that on to a flight - as long as they are not travelling to the 
USA.

If they are going to America, they cant take any liquid onboard - but 
they can take food. Bags can only be taken onboard flights in Britain if 
they fit precise measurements. In Europe, no such baggage size 
restrictions exist. On US domestic flights there is no bag size 
restriction. No lighters can be taken on an aircraft, but matches are 
allowed. Prescribed medicines must be verified by a pharmacist at the 
airport, but no toiletries or cosmetics can be taken on. If a passenger 
is travelling to the USA, they are subjected to a secondary search at 
the departure gate.

"We want a consistent international standard," said Wiltshire. Without a 
standardised system, air travel will be chaotic. A passenger leaving 
Paris and going to New York via London would, if their hand baggage was 
too big, have to check-in their carry-on luggage at Heathrow if they 
wished to get to JFK airport. They would also have to put banned items 
like shampoo and sweets - in the hold. If the stop-over time between 
flights was just an hour it is unlikely any passenger would make it.

Flights are also being seriously delayed as US authorities want advanced 
passenger information - such as name and address - sent from carriers 
and cleared before the flight takes off. Before the recent alleged plot, 
the US processed passenger information while the flight was en route. 
"If you compare the aviation industry to any other transport sector, we 
are ahead, said Wiltshire."

"After 7-7 what happened to security on the tube? Very little. The more 
security that is loaded on to us, the less competitive we become. There 
should be appropriate security standards applied to all sectors of the 
transport industry."

Wiltshire added his voice to calls for the government to fund the 
additional security measures. "The threat is to the nation," he said. 
"We are the proxy for the nation." The terrorists arent attacking the 
airline; they are making a political point. The government, however, has 
no interest in funding the costs of additional security. It is all down 
to the industry, and the cost trickles down inevitably to the consumer. 
Thats highly unfair as the consumer gets it both ways - the cost and the 
inconvenience." Wiltshire added he could not envisage how the security 
situation could get any worse.

Philip Baum, who runs the aviation security company Greenlight, edits 
the magazine Aviation Security International and is a former soldier in 
the Israeli army and head of security with TWA International, said: 
"After 9/11 we banned sharp objects, now its liquid. As long as we look 
for the items rather than the person we will not have a security system 
based on commonsense."

His answer? Passenger profiling, or what he calls "positive" profiling 
as is used in Israel. This would see passengers - such as the young 
family with two kids on the way to Costa del Sol or the frequent flier 
business man - not being subjected to gruelling security checks. "This 
would reduce the size of the haystack," Baum said. "If you had David 
Beckham on a flight - and you know its David Beckham - why make him take 
off his shoes? Its a waste of time and money. We dont not screen these 
people, we still do the basic checks on them, but we have got to decide 
who will be subjected to thorough security checks, otherwise the 
industry will grind to a standstill."

Inevitably, this means that more Muslims than any other group will be 
subjected to the most rigorous security. Baum denies that this is 
racist. He points out that a number of the suspects arrested recently 
were white converts to Islam. Baum believes that politicians are scared 
to adopt profiling because of "political correctness."

"If we extract the people who dont pose a threat, that pool of people 
will include many Muslims," he added. To underscore his point that the 
current level of security cant be maintained, Baum said: "A drug mule 
can smuggle a kilo of cocaine in their body cavity. Couldnt a bomber do 
the same with explosives? If that turned out to be a plot, what would we 
do? Internally examine every passenger?"

He added the current policy was creating huge queues in airports which 
themselves could be targeted by suicide bombers as has happened in 
Israel. "Our eye is off the ball," said Baum. "We are being driven by 
past events, not future possibilities. We are allowing terrorists to 
win."

He pointed out that a form of profiling already exists when passengers 
disembark from a plane. Passengers leaving flights from Jamaica are 
routinely searched for drugs and flights from Africa are monitored 
closely for illegal immigrants whereas EU passengers get relatively 
little attention from officials and customs.

"If you can pull people aside based on nationality when they leave an 
aircraft, why not do it beforehand as well," Baum asked. He also 
suggests changing the location at which searches are conducted in 
airports. Rather than everyone being screened at a central point - 
airport security - as now happens, Baum suggests shifting security 
checkpoints to the departure gate. That way a passenger going to Ibiza 
isnt subjected to the same intense level of scrutiny as someone flying 
to Islamabad.

"The central checkpoint for everyone would just make sure that they had 
a proper ticket to get through to airside and were who they said they 
were. It would cut down queues and be more responsive and intelligent. 
Right now, our security is clumsy and the same across the board for 
everyone. That cant be allowed to continue."


_________________________________
HITBSecConf2006 - Malaysia 
The largest network security event in Asia 
32 internationally renowned speakers 
7 tracks of hands-on technical training sessions. 
Register now: http://conference.hitb.org/hitbsecconf2006kl/