Security Insecurity

A recent entry in the ongoing conversation about air travel security is this German TV show that demonstrates an utterly ineffectual body scanner. Some of the comments here and here provide useful links and partial translations of the proceedings (though some others tend to get ranty and off-colour).

One in particular caught my eye at the first link, posted by paul on January 22, 2010 9:03 AM:

It seems we’re back to the classic sensitivity/specificity tradeoff. If an operator passes every scan that look potentially dangerous to the body-search people, you find stuff, but you don’t have the capacity to actually get people where they’re going.

That is very much like the relevance vs comprehensiveness trade-off in database searching: catch it all and spend a lot of time sifting through the huge mound of results, or catch just the most salient examples, and use them to find more. Of course the latter is what most people use when searching for legal information, and the results vary. In the world of airline bombers, people tend not to be happy with variable and ‘good enough’ solutions, though.

Multiple strategies are used in libraries to bridge this gap. One is the controlled vocabulary. This is, essentially, what the ‘no-fly’ list is. However, the usefulness of controlled vocabularies depends entirely on how well they are suited to the purposes of the ‘searcher,’ and just as crucially, on how well they are applied to the items to be canvassed. In the case of the underpants bomber, the answer to the latter was ‘not well.’

The reference interview is another. I suppose in the world of security, this would be intelligence gathering. It is difficult enough to get an idea of what someone is after when they are not actively trying to mislead you. Usually the problem is they do not know what they want (or more precisely, what they want that the library has).

Getting information from bad actors is one of the classic logic puzzle elements (for instance, this one). One of the tough parts of these puzzles is knowing and tracking the changing conditions that apply. Could it be that US-style airline security has developed and maintained the seemingly ludicrous current security procedures as a method of simplifying the task of bridging the gap between relevance and completeness?

Hopefully, whenever a bomber gets through one of the many security holes maintained by the TSA, other agencies are quietly alerted, and they pick up the malefactor without the publicity that would provide information to the bad guys, thus creating more sophisticated attacks. I am hopeful, if not confident.