Terrorists could easily sneak weapons and bombs past Transportation Security Administration (TSA) scanners that were designed to see through clothing, a study by top security researchers has discovered.
If the report was correct, TSA agents could still see what’s underneath travelers’ clothes while not seeing what the bad guys were carrying.
“We find that the system provides weak protection against adaptive adversaries,” a paper presented at the Usenix Security Symposium in San Diego in mid-August said of the Rapiscan Secure 1000 Single Pose full-body scanner. “It is possible to conceal knives, guns, and explosives from detection by exploiting properties of the device’s backscatter X-ray technology.”
The TSA used the Rapiscan device in airports from 2009 to 2013, after which it was discontinued because of public anger at agents’ ability to see private body parts while using the device. Rapiscan Secure 1000 scanners are still used in some foreign countries and many government buildings in the United States. Other devices manufactured by Rapiscan are still used in US airports.
Researchers Bought Scanner on eBay
A team of researchers from the University of California at San Diego, the University of Michigan and Johns Hopkins University tested a Rapiscan 1000 they purchased on eBay for $49,500, Bloomberg Businessweek reported. The researchers found that they had little trouble outwitting the device and smuggling weapons and bombs past it.
“You see the gun? No? It’s taped above the knee,” one of the researchers, J. Alex Halderman of the University of Michigan, said during a presentation of his findings. Halderman showed reporters a number of images of researchers easily sneaking weapons past the devices. His next revelation was even more frightening.
“See a difference between these two guys?” Halderman asked. “No? Well, the guy on left has nothing on him. The guy on the right has almost enough C-4 [explosive] to bring down a plane. The detonator is on his belly button. It turns out that C-4 and flesh have the misfortune of having about the same color on backscatter scanners.”
Halderman believes that the scanners were never properly tested by the TSA. He also thinks that federal authorities never tried to sneak objects past the devices during the testing.
“What does this say about how these scanners were tested and acquired in the first place?” Halderman asked. “It says there’s something wrong with the government’s process.”
The government’s scanner testing process is secret.
Researchers discovered other glaring weaknesses in the system.
Scanners Could Be Easily Hacked and Outwitted
Halderman and his colleagues discovered that they could outwit the scanners by using both high tech and low tech means. They had little trouble inserting malware into the computer capable of fooling the scanner operators with fake pictures that controlled the device. The scanner’s operators would see what terrorists wanted them to see, and not what was really there.
If that wasn’t bad enough, simple objects such as plastic shields could easily conceal weapons from the scanner. They found that they could hide objects such as an 18-centimeter-long knife by simply wrapping them in Teflon.
The researchers were able to sneak a number of other weapons past it including a .380 ACP pistol and an 11-inch folding knife.
Frightening Security Lapses
The most frightening security lapse may have involved eBay. The researchers found that a German company called Ive Agne Surplus Remarketing was selling two of the Rapiscan 1000 Scanner in 2012 while they were still being used in US airports.
The researchers also found that details of the scanner’s operations were readily available from patents and other public records. They were even able to obtain documents describing the scanners’ operations and the software that controls them from the federal government using a simple Freedom of Information Act request.
Halderman and his colleagues only examined the Rapiscan Secure 1000. They did not examine other Rapiscan devices used to scan luggage nor did they test the devices that have replaced the Rapiscan. The Rapiscan devices cost taxpayers $1 billion, according to Wired.com.
What is your reaction to the scanners failing a basic test? Share your thoughts in the section below: