Security theater is the practice of investing in countermeasures intended to provide the feeling of improved security while doing little or nothing to actually achieve it. Some experts such as Edward Felten have described the airport security repercussions due to the September 11 attacks as security theater.
While it may seem that security theater must always cause loss, it may actually be beneficial, at least in a localized situation. This is because perception of security is sometimes more important than security itself. If the potential victims of an attack feel more protected and safer as a result of the measures, then they may carry on activities they would have otherwise avoided. In addition, if the security measures in place appear effective, potential attackers may be dissuaded from proceeding or may direct their attention to a target perceived as less secure. Unsophisticated adversaries in particular may be frightened by superficial impressions of security (such as seeing multiple people in uniform or observing cameras) and not even attempt to find weaknesses or determine effect.
Security theater has real monetary costs but by definition provides no security benefits, or the benefits are so minimal as to not be worth the cost. Security theater typically involves restricting or modifying aspects of people's behavior or surroundings in very visible and highly specific ways, which could involve potential restrictions of personal liberty and privacy, ranging from negligible (confiscating water bottles where bottled water can later be purchased) to significant (prolonged screening of individuals to the point of harassment).
Security theater encourages people to make uninformed, counterproductive political decisions. The feeling of (and wished for) safety can actually increase the real risk. The disruption, cost, and fear caused by security theater acts as positive feedback for those who wish to exploit it: even if they fail to take lives, they can cause large economic costs.
Critics such as the American Civil Liberties Union have argued that the benefits of security theater are temporary and illusory since after such security measures inevitably fail, not only is the feeling of insecurity increased, but there is also loss of belief in the competence of those responsible for security.
Two studies by a group of Cornell University researchers have found that strict airport security in the United States after the 9/11 attacks has the unintended consequence of increasing road fatalities, as would-be air travelers decide to drive and are exposed to the far greater risk of dying in a car accident. In 2005, the researchers looked at the immediate aftermath of the attacks of September 11, 2001, and found that the change in passenger travel modes led to 242 added driving deaths per month. In all, they estimated that about 1,200 driving deaths could be attributed to the short-term effects of the attacks.
In 2007, the researchers studied the specific effects of a change to security practices instituted by the TSA in late 2002. They concluded that this change reduced the number of air travelers by 6%, and estimated that consequently, 129 more people died in car accidents in the fourth quarter of 2002. Extrapolating this rate of fatalities, New York Times contributor Nate Silver remarked that this is equivalent to "four fully loaded Boeing 737s crashing each year."
The 2007 Cornell study also noted that strict airport security hurts the airline industry; it was estimated that the 6% reduction in the number of passengers in the fourth quarter of 2002 cost the industry $1.1 billion in lost business.
The ACLU has reported that between October 2008 and June 2010, over 6,500 people traveling to and from the United States had their electronic devices searched at the border. The Association of Corporate Travel Executives, whose member companies are responsible for over 1 million travelers and represent over $300 billion in annual business travel expenditures, reported in February 2008 that 7% of their members had been subject to the seizure of a laptop or other electronic device. Electronic device seizure may have a severe economic and behavioral impact. Entrepreneurs for whom their laptop represents a mobile office can be deprived of their entire business. Fifty percent of the respondents to ACTE's survey indicated that having a laptop seizure could damage a traveler's professional standing within a company. The seizure of data or computers carrying business proprietary information has and will force companies to implement new and expensive internal travel policies.
Increased risk of targeted attacks
The direct costs of security theater may be lower than that of more elaborate security measures. However, it may divert portions of the budget for effective security measures without resulting in an adequate, measurable gain in security. Such ripple effects are often connected to fear; visible measures such as armed guards and highly intrusive security measures may lead people to believe that there must be a real risk associated with their activity.
Because security theater measures are often so specific (such as concentrating on potential explosives in shoes), it allows potential attackers to divert to other methods of attack. This not only applies to the extremely specific measures, but can also involve possible tactics such as switching from using highly scrutinized airline passengers as attackers to getting attackers employed as airline or airport staff. Another alternate tactic would be simply avoiding attacking aircraft in favor of attacking other areas where sufficient damage would be done, such as cinemas.
It is inherently difficult to give examples of security theater that are clear and uncontroversial, because once it is agreed by all that a measure is ineffective, the measure seldom has any noticeable influence on perceived risk. The following are examples of alleged security theater.
- National Guardsmen carrying automatic weapons in airport lobbies in the months following the September 11 attacks. Reports varied on whether the weapons were loaded or unloaded; loaded weapons would apparently pose an extreme danger to the dense crowds found at an airport in the case of an actual incident.
- The announcement after the September 11th suicide attacks that airports would be discontinuing curbside check-in, which had no relationship to the tactics Al Qaeda employed in hijacking the aircraft and would pose no barrier to a suicide bomber who fully intended to board the aircraft with a bomb bag anyway.
- The air travel industry uses a screening system called Computer Assisted Passenger Prescreening System. This system relies on static screening of passenger profiles to choose which people should be searched. Systems of this nature have been demonstrated to reduce the effectiveness of searching below that of random searches since terrorists can test the system and use those who are searched least often for their operations.
- With the aim of preventing individuals on a No Fly List from flying in commercial airliners, U.S. airports require all passengers to show valid picture ID (e.g. a passport or driver's license) along with their boarding pass before entering the boarding terminal. At this checkpoint, the name on the ID is matched to that on the boarding pass, but is not recorded. In order to be effective, this practice must assume that 1) the ticket was bought under the passenger's real name (at which point the name was recorded and checked against the No Fly List), 2) the boarding pass shown is real, and 3) the ID shown is real. However, the rise of print-at-home boarding passes, which can be easily forged, allows a potential attacker to buy a ticket under someone else's name, to go into the boarding terminal using a real ID and a fake boarding pass, and then to fly on the ticket that has someone else's name on it. Additionally, recent investigations show that obviously false IDs can be used when claiming a boarding pass and entering the departures terminal, so a person on the No Fly List can simply travel under a different name.
- Random searches on subway systems, such as those taking place on the New York City Subway system, have been criticized by the American Civil Liberties Union and others as security theater. They allege that since such searches are only at some stations and that people may decline such a search and simply leave that station, a terrorist could simply find a station where no searches were occurring and board there.
- Spanish national railway operator RENFE performs passenger screenings at major stations for long distance trains. However, many of those trains also stop at stations providing only a simple ticket checking, and even some unstaffed stations where passengers could board the train without a ticket, rendering the screening ineffective. Furthermore, the 2004 Madrid train bombings targeted commuter trains: at the time there were screenings at Atocha station but not on the tracks used by the bombed trains.
- The 1950s "duck and cover" drills in U.S. public schools – which suggested that ducking under a desk is a reasonable way to protect oneself from the detonation of an atomic bomb.
- Facial recognition technology was introduced at Manchester Airport in August 2008. A journalist for The Register claimed that "the gates in Manchester were throwing up so many false results that staff effectively turned them off. Previously matches had to be 80% the same – this was quickly changed to 30%. According to Rob Jenkins, a facial recognition expert at Glasgow University, when testing similar machines at a 30% recognition level, the machines were unable to distinguish between the faces of Osama bin Laden and Winona Ryder, bin Laden and Kevin Spacey, nor between Gordon Brown and Mel Gibson.
- Australian airline authorities now prohibit any liquids, aerosols, and gels in a container larger than 100 ml in luggage hand carried onto international flights. They would prohibit a tube of toothpaste labeled able to contain more than 100 ml, even if it were squeezed empty. They would, however, allow the carrying on of 2 or 3 tubes of paste provided each is labeled to carry less than 100 ml.
- Prime Minister of the UK David Cameron suggests banning mobile apps WhatsApp and iMessage as part of his plans for new surveillance powers announced in the wake of shootings in Paris in January 2015.
The term security theater was coined by computer security specialist and writer Bruce Schneier for his book Beyond Fear, but has gained currency in security circles, particularly for describing airport security measures.
Examples of use of the term:
For theater on a grand scale, you can't do better than the audience-participation dramas performed at airports, under the direction of the Transportation Security Administration. ... The T.S.A.'s profession of outrage is nothing but 'security theater,' Mr. Schneier said, using the phrase he coined in 2003 to describe some of the agency's procedures.
Airline passengers will be able to bring many types of cigarette lighters on board again starting next month after authorities found that a ban on the devices did little to make flying safer, a newspaper reported Friday. 'Taking lighters away is security theater,' Transportation Security Administration chief Kip Hawley told The (New York) Times in an interview.
- Christopher Soghoian, creator of a website that generated fake airline boarding passes
- Placebo effect
- Schneier, Bruce (2003). Beyond Fear: Thinking Sensibly about Security in an Uncertain World. Copernicus Books. p. 38. ISBN 0-387-02620-7.
- Edward Felten (2004-07-09). "Security Theater". Retrieved 2009-07-22.
- Peter N. Glaskowsky (2008-04-09). "Bruce Schneier's new view on Security Theater". Retrieved 2009-07-22.
- "Smoke Screening". Vanity Fair. 20 December 2011. Retrieved 27 December 2011.
- Blalock, Garrick; Vrinda Kadiyali; Daniel H. Simon (February 10, 2005). "The Impact of 9/11 on Road Fatalities: The Other Lives Lost to Terrorism". SSRN Electronic Journal. doi:10.2139/ssrn.677549. ISSN 1556-5068.
- "AEM.cornell.edu" (PDF). Retrieved 2012-01-16.
- Silver, Nate (November 18, 2010). "The Hidden Costs of Extra Security - NYTimes.com". Fivethirtyeight.blogs.nytimes.com. Retrieved November 19, 2010.
- Blalock, Garrick; Vrinda Kadiyali; Daniel H. Simon (2007). "The Impact of Post‐9/11 Airport Security Measures on the Demand for Air Travel". The Journal of Law and Economics 50 (4): 731–755. doi:10.1086/519816. ISSN 0022-2186.
- "GOVERNMENT DATA ABOUT SEARCHES OF INTERNATIONAL TRAVELERS' LAPTOPS AND PERSONAL ELECTRONIC DEVICES". American Civil Liberties Union. Retrieved 11 May 2015.
- "Statement of Susan K. Gurley, executive director, Association of Corporate Travel Executives, Alexandria, Virginia". Laptop searches and other violations of privacy faced by Americans returning from overseas travel. HEARING before the SUBCOMMITTEE ON THE CONSTITUTION of the COMMITTEE ON THE JUDICIARY, UNITED STATES SENATE. 25 June 2008.
- Zack Phillips (2007-08-01). "FEATURES Security Theater". Government Executive. Retrieved 2009-07-22.
- Chakrabarti, Samidh and Strauss, Aaron (2002-05-16). "Carnival Booth: An Algorithm for Defeating the Computer-Assisted Passenger Screening System". Massachusetts Institute of Technology. Retrieved 2006-09-06.
- Slate's Andy Bowers on Airport Security loopholes – Boing Boing
- Crypto-Gram: August 15, 2003
- A dangerous loophole in airport security. – By Andy Bowers – Slate Magazine
- Fake Boarding Pass Generator mirror site – Boing Boing
- Flying without ID won't work? Try making your own ID. – Boing Boing
- Cardiff Airport gets more security theatre
- Gardham, Duncan (2009-04-05). "Airport face scanners 'cannot tell the difference between Osama bin Laden and Winona Ryder'". Telegraph, The. Retrieved 2013-04-20.
- "Expert: TSA Screening is Security Theater". CBS News. 2008-12-21. Retrieved 2009-07-22.
- Theater of the Absurd at the T.S.A.
- http://www.cbsnews.com/stories/2007/07/20/national/main3080127.shtml TSA To Lift Ban On Most Lighters On Planes/Security Chief Says Taking Lighters Away From Passengers Was "Security Theater"
The dictionary definition of security theater at Wiktionary
- Crypto-Gram, Bruce Schneier's newsletter
- stupidsecurity.com a site highlighting inefficient security measures
- Sometimes, Security Theater Really Works experts Gadi Evron and Imri Goldberg show how security theater saves lives in Israel by stopping suicide bombings