There’s been a lot of hubbub the past couple of days over Christopher Soghoian posting a tool to let anyone print their own boarding pass. While I’m all for publicizing security silliness, I personally try and avoid things that might invite 2 a.m. non-social visits from the FBI.
The thing is, anyone who thinks ID checks and boarding passes provide any security at all to planes (or any public area), shouldn’t be working in security.
I spent a lot of time providing security for large crowds and public spaces. ID’s and boarding passes are a weak form of authentication and authorization- one helps you prove who you are, the other that you’re allowed to do something (get on a plane). Combined with other checks (a passenger manifest) they can be reasonable tools to assure you’re allowed to get on a plane. That’s security, but not really the security we all worry about in airports and on planes.
They don’t do squat to keep anyone safe. Here’s why.
We don’t call them public areas for nothing. Anyone’s allowed in with, at most, just a cursory entrance fee. There’s no significant background check, and any background check short of Top Secret doesn’t really ensure you deserve any kind of trust anyway (and even the value of a TS clearance is arguable). Never mind something as weak as a photo ID and piece of paper anyone can print.
In my days we just kept it easy and didn’t trust anyone. We screened the heck out of everyone coming in, and assumed all of them were a security risk.
Since you can’t guarantee that anyone with a ticket and ID isn’t a security risk, you assume everyone is a security risk and put the proper controls in place to enforce safety and security.
A few computer checks aren’t going to catch a bad guy, Especially when smart bad guys don’t have existing records, and anyone else can easily fake an ID these days. Thus there’s no reliable way to trust someone. Especially with those idiotic “trusted traveler” programs anyone can join (I think they’re just a scam to get a little cash).
Thus we screen (effectively, not what’s done today), and provide security inside the terminals, and more security on the planes, and we screen cargo. And…
…all the other effective security controls that are, apparently, too expensive to actually implement.
It’s a lot easier to pay someone $6/hr and arrest the occasional college student who shows how silly it all is.