Was I being too negative the other day when I said that the TSA failed security tests 95.7% of the time? I should acknowledge that this was a 4.3% success rate. In other words, over four percent of the time, TSA security works every time.
Even though this was a dramatic improvement over past results, DHS secretary Jeh Johnson said Monday that effective immediately, acting TSA administrator Melvin Carraway was being "reassigned." Some speculate that this had something to do with the agency's spectacular failure to do anything useful more than 4.3% of the time, but the announcement didn't say that. The critics are overlooking the fact that Johnson did not make this decision right after the TSA failed the tests, which were conducted more than a week ago. He made it right after the media reported that the TSA failed the tests. So the timing is probably just coincidence.
Johnson took the position that because the test results are "preliminary" (they're not) and "classified" (though everybody knows them), "it is not appropriate or prudent to publicly describe these results." Okay then. He did, though, also announce a series of actions that appear to be designed to reassure Americans that although airport security has not improved 14 years and $70 billion since 9/11, that is all about to change. Here's what he announced (as paraphrased by me):
- TSA will develop procedures to deal with the tactics that just worked (and so won't be used again).
- TSA will also train its employees to use the procedures it develops to deal with the tactics that just worked (and so won't be used again).
- TSA will make sure all airport security directors know the results of the tests they just failed, in case they don't read any news at all.
- TSA will "re-test and re-evaluate" its screening equipment. Again.
- Johnson will personally meet with the guys who run the screening-equipment companies to make sure they know that equipment is supposed to work. Granted, they are pretty much all former DHS or TSA officials, but one more meeting should get the point across.
- The people who did the random covert testing will keep doing that. (The official ones, not the ones who do it unofficially every day.)
- There will be a committee, and it will report to him every other week.
- TSA will ensure that screening equipment is "up to the highest possible standards." This is the same as number four, except DHS & TSA will also "examine adopting new technologies" to deal with the tactics that just worked (and so won't be used again). As with the old technologies, these won't help, but they will make those former DHS & TSA officials who now make screening equipment very wealthy.
Here's the thing: this is all a wild overreaction because the bad guys are not nearly as smart as our testers are. At least, that's what the TSA has claimed in the past after similar failures. In fact, the testers are like ... well, they're like super-terrorists:
In a 2013 hearing on Capitol Hill, then-TSA administrator John Pistole described the Red Team as “super terrorists," who know precisely which weaknesses to exploit.“[Testers] know exactly what our protocols are. They can create and devise and conceal items that … not even the best terrorists would be able to do,” Pistole told lawmakers at a House hearing.
He said this less than a month after a test in which the only fake super-terrorist the TSA was able to catch was a man carrying a doll with "quite obvious" wires sticking out of it. I guess I'd agree with him that the best terrorists would not come up with something like that. I'm just not reassured by it.