How Not To Fix Airport Screening

Yesterday’s headlines — screeners missed 67 of 70 “weapons” in a test of airport security — were another embarrassment for a much-maligned agency. They may be just a symptom of the real problem. In order to get better at catching actual threats, the Transportation Security Agency has to reduce the number of travelers it screens. And TSA is undermining its best tool for that job.

On Monday, the Department of Homeland Security announced that airport screeners failed to detect 95 percent of explosives and weapons that undercover operatives were attempting to pass through security checkpoints. One tester even got a fake bomb past the screeners after the device set off a metal detector. In response, DHS Secretary Jeh Johnson pulled acting TSA chief Melvin Carraway off the job, and announced more random covert testing, more training for airport security personnel, and more random equipment checks. But one thing that DHS should not do is rush to overscreen every single passenger.

It turns out that security measures at airports often allocate too many resources to passengers who pose little risk, diverting screening time and attention from those who may be a real threat, according to Sheldon H. Jacobson, a mathematics professor at the University of Illinois, who has been doing research on aviation security for more than 20 years and is considered a leading mind in risk-based modeling for aviation. Even DHS has come around to this line of reasoning, and has implemented various programs meant to exempt low-risk passengers from stricter screening. 

Jacobson says that the “worst thing” that could happen for airport security at this point is to reverse the progress made in this so-called risk-based screening, and instead subject higher numbers of people to screening that doesn’t reflect the likely threat they pose.

Today's airport security overweights the risk of items and underweights the risk of dangerous people, he said, simply because the system, as a whole, still doesn’t differentiate those passengers who may pose a threat from those who surely do not.

“Ultimately, we’re dealing with people’s intent more than items. Which concerns you more: a person who has no bad intent but who has an item on them like a knife or a gun, or someone who has bad intent but doesn’t have such an item?” he said. “Most people are comfortable with the former rather than the latter. A person with bad intent will find a way to cause damage. A person without bad intent who happens to have an item on them is not the issue.”

Risk-based systems can help solve that problem, but only when used correctly. The most famous and widely used is TSA’s PreCheck, which launched in December 2013. It allows U.S. citizens and permanent residents who submit to a somewhat strict background check (including an in-person meeting and fingerprint scan) to receive expedited screening at airports for five years. Jacobson says the best thing policy-makers could do to airport improve security is get a lot more people into PreCheck.

“The irony is that if we do less overall screening by putting the right people in PreCheck and the people we don’t know anything about not in PreCheck, the total amount of screening done will be less, the amount of technology we use will be less, and the total security of the system will be greater. It’s completely counterintuitive.”

Enrollment in PreCheck surpassed 1 million subscribers in March. But that’s a far cry from the number that could be eligible. And the more people in the system, the better it works, according to Jacobson, whose research has shown that 60 to 70 percent of the passengers of any particular flight probably should be in the fast lane.  

This is not to say that PreCheck doesn’t have problems. In March, Kenneth Fletcher, TSA’s chief risk officer, told Congress that 13 of 17 recent recommendations to improve the program by the DHS Office of Inspector General, or OIG, were “resolved” but still “open.”

The big problem, despite the background check, personal travel history testimony and fingerprint scans that PreCheck enrollees submit to, is that DHS still doesn’t have a firm grasp on what differentiates a low-risk and a high-risk human being.

“TSA is working to address the OIG’s recommendations, such as working with the DHS Office of Policy …  to establish a common definition for identifying ‘lower-risk’ travelers and low-risk trusted travelers across the department for consistency in application across all DHS vetting programs,” Fletcher said.

Broadly speaking, Jacobson and other aviation security experts consider PreCheck a huge success. It’s given birth to new and more interesting programs (not yet fully implemented) like the Dynamic Aviation Risk Management Systems, or DARMS, which uses incoming information allowing the TSA to quickly move screeners or resources where they are needed, and to develop changing threat profiles of different people or places.

But more and more people who aren’t in the program are being ushered into PreCheck lines by screeners eager to hurry the process along at the nation’s overcrowded airports. It sounds like an example of poor training for overworked TSA employees — but it’s actually policy. 

TSA calls it “managed inclusion.” Christian Beckner explains it in a February 2015 issue brief for the George Washington University Center for Cyber and Homeland Security: “TSA also now uses its Risk Assessment program and a ‘managed inclusion’ process to bring additional travelers into PreCheck lanes, based either on the results of Secure Flight checks prior to check-in or ...” and this is they key part … “at the discretion of Transportation Security Officers while travelers are queuing at checkpoints, in part based upon how busy the PreCheck lanes are relative to the regular screening lanes.”

Beckner notes that this saves time and money. “As a cumulative result of all of these efforts, currently around 45 percent of air travelers in the United States (more than 276 million in 2014) are receiving expedited screening. This growth in PreCheck has allowed TSA to reduce its screener workforce, and the agency has estimated that these staffing efficiencies will allow it to save at least $100 million in the current fiscal year.”

But Jacobsen warns that allowing screeners and passengers to take shortcuts undercuts the entire point of risk-based modeling.

“Risk-based systems work so long as you stay within the parameters,” he said. “If you push people into risk-based systems who don’t have the risk profile to validate that they should be in the risk-based systems you are now stretching the system beyond security. …I think by putting people in PreCheck who don’t belong there, we may be under-screening people. There is a great deal of analytics that goes into getting a security number for each person.”

The problems with airport security extend beyond TSA. They represent the capabilities and limitations of this moment in history. Humanity has devised a way to ferry people around the world in a day. In order to make sure those people don't blow up the means of their conveyance, we shoot photons at their luggage and bodies. It's dumb. Risk-based modeling of passengers represents an improvement, if we would let it get off the ground.