Is the U.S. Ready for X-Ray Vision?

The recent attempts by underwear bomber Umar Farouk Abdulmutallab to detonate explosives on flight to Detroit in December and the attempt by a terrorist in Saudi Arabia to blow up Prince Mohammed bin Nayef with explosives in his rectum, has raised concern among transportation officials on how to detect explosives hidden beneath clothing. The U.S., along with several other nations, is looking to implement the use of body scanners to detect explosives hidden under clothing, with plans to install close to 1,000 machines within the next two years throughout U.S. airports.

A number of civil liberty and privacy advocates have questioned the use of the scanners, raising concerns that Transportation Safety Administration (TSA) employees will be essentially viewing passengers’ nude outlines. The ACLU and other privacy advocates claim it amounts to a “virtual strip search.” Employees are located remotely and only see the image on the screen, not the actual passenger.

According to the TSA website, “TSA has implemented strict measures to protect passenger privacy, which is ensured through the anonymity of the image. The image cannot be stored, transmitted or printed, and is deleted immediately once viewed. Additionally, advanced imaging technology screening is optional to all passengers.”

In an article published in the Washington Post, former DHS Secretary Michael Chertoff wrote “the TSA has listened to the reasonable concerns of privacy advocates and incorporated numerous suggestions into its protocols to draw the right balance between security and privacy.”

While TSA has stated that the images will not be stored or sent, the Electronic Privacy Information Center (EPIC) has claimed that 2008 documents it obtained from TSA state that the machines need to have image storage and sending capabilities while in test mode.

EPIC Executive Director Marc Rotenberg says that this could facilitate abuse by employees and hackers.

So what is the potential for data breaches with the body scanner technology?

The threat from outsiders can be mitigated by ensuring that the body scanners are not wired to external Internet or to machines that are connected to the Internet. Additionally, if the images are transmitted to the TSA officer responsible for viewing the images, the risk of possible interception increases. Earlier this year, The New New Internet reported on the use of SkyGrabber software by insurgents to intercept Predator drone feeds in Iraq.

The insider threat is more difficult to combat. Earlier this month, a former TSA employee attempted to sabotage a terrorist database after he was fired. Insider threats are often difficult for IT security professionals to defend against, as insiders have easier access to the systems and often understand the system architecture better than outsiders.

At the time of writing, TSA has not yet responded to a request for comment on the set-up of the body scanning system.

According to the TSA website, the images are automatically deleted once they are cleared by the TSA employee viewing the image. Also, TSA officers viewing the images are in a “secure resolution room” and “are not permitted to take cameras, cell phones or photo-enabled devices into the resolution room.”

The process still remains optional for all passengers. Any passenger can refuse to undergo the body scan but is subjected to a pat-down search instead.

Recent polls suggest that the majority of Americans have no problem with the body scanning technology. Nevertheless, some experts question how effective the technology is at detecting small quantities of certain types of explosives, like that used by the underwear bomber.

To learn more about how body scanners work, click here

Related posts:

1. Most Data Centers Not Ready for Cyber Attack
2. INSA’s Ellen McCarthy: Private Sector Ready for Cyber Coordinator