BY THOMAS P. MULLIGAN
As early as the mid-1960s, security issues moved away from student protests and sit-ins to a new word in the American vocabulary, “hijacking.” Inadequate security measures at most airports enabled hijackers to bring handguns, knives, and other weapons on-board. The need for a metal detection system to safeguard the flying public was born, and the attention these hijackings got from the media was not lost on the small, growing fanatical organizations located in the unstable regions of the globe. The individuals carrying out these hijackings in the beginning were homesick refugees intent on returning to their country of origin, not organized radicals supporting political goals.
In the 1970s, the airport and aircraft became a focal point for political and social causes because of the widespread coverage given hijackings and airport assaults and the lack of comprehensive security measures. Because of increased security such as metal detectors, terminals became the target of operations, as there were no metal detectors to enter the terminal, and the terrorist could accomplish his goal without setting foot on a plane.
In the 1980s, a breach in airport security was evident when a Pacific Southwest Airlines ex-employee used an expired identification badge to pass through security; board a company jetliner with a weapon; and shoot his supervisor, the pilot, and co-pilot. The aircraft went down with 38 people aboard. This incident was not a terrorist event but showed the system’s vulnerabilities to employee acts. The flight was targeted because of Egypt’s support of the Mideast peace agreement and its alignment with the U.S. policy of peace talks rather than war. The hijackers were becoming better organized and had better planning and execution.
In 1996, TWA Flight 800 exploded over Long Island Sound in New York, leaving behind a host of questions and few answers. Some speculated that a missile or a bomb was onboard; others claimed it was a malfunction. If it was a bomb, why didn’t anyone claim responsibility for it? Were they afraid of the public backlash against their cause for downing a U.S. aircraft over U.S. soil? Was the reason for the explosion some explosives that got past the detectors? The U.S. aviation industry lags considerably behind Europe in the area of detection-specifically, the detection of plastic explosives and bombs. The official investigation has pointed to the fuel tanks as the source of the explosion.
FAA RISK ASSESSMENT
The Federal Aviation Administration (FAA) has jurisdiction over airports, air carriers, and airport operators under FAA Title 14 CFR Parts 107, 108, and 129. The responsibility for levels of alert comes clearly under the auspices of the FAA in consultation with the White House. Under the FAA guidelines, alert levels run from levels 1-4, with level 4 being the highest level of alert with the most restrictions on passenger movement, baggage searches, and passenger scrutiny. Level 4 prohibits curbside check-in, permits no visitors in secured areas (boarding areas), and has higher sensitivity levels in stationary and portable metal detectors.
The FAA has recently called to rescind levels 1 and 2 and make level 3 the standard under nonheightened conditions, with the addition of higher levels of alert above level 4 to adjust to the dynamics of terrorist threats. Under level 3, airline passengers must show photo identification cards on check-in and answer a series of questions about their baggage, and police and security personnel prevent parking in front of the terminal.
A new level 5 would require screening of passengers and baggage before entering the terminal, baggage matching prior to boarding the plan, and possibly automobile searches prior to entering airport property. The question is whether the flying public will acquiesce to the inevitable delays, inconveniences, and loss of control inherent in a more stringent security identification program.
SECURITY/ACCESS CONTROL
Security issues in the terminal are similar to those of any building with areas of high vulnerability, areas completely off limits, and common areas for interaction. The areas of exclusion are secured through access control systems that admit only authorized persons. Included in the terminal’s security management would be controls for fire protection equipment including pull stations, sprinkler valves, fire pumps, alarm annunciation, and failsafe access doors to ensure egress in case of fire. Security professionals would be required to control access into and out of the facility while still ensuring compliance with codes like NFPA 101 (Life Safety Code). The facility might be so secure that the security system itself could be used to terrorists’ advantage if it failed to allow for unrestricted egress in case of fire. Imagine doors that refused to open to allow egress from an airport terminal during an arson fire set by a terrorist.
The first security measure put into place was the metal detector, designed to identify guns, knives, and crude pipe bombs intended to down unsuspecting aircraft. Fire protection measures increased as arson was seen as a potential inexpensive tool of revolt. Next came access control and closed-circuit television (CCTV). Passengers entering the terminal were recorded for identification at a later time, and access control measures were installed to restrict access to sensitive areas of the terminal such as baggage handling and flight crew areas. Access control systems identified who tried to use a terminal, when they used it, and whether they returned the same way. An electronic trail was created identifying lapses in the security blanket that could be addressed as it became known.
Additional forms of security include the use of passenger profiling to intercept potential threats to the aircraft through the accumulation and dissemination of past data and histories that point to probabilities of a person being involved in terrorist activities. Passenger profiling, while effective, has come under increasing scrutiny as a biased form of terrorist identification and is actively being challenged as unconstitutional by civil libertarians. More recently, airports have installed concrete barriers as a way of combating “crash and burn” suicide bombers. Recent incidents in other countries where army barracks were bombed by a suicide bomber who drove into the building with a large quantity of explosives have pushed airport operators to institute more restrictive measures to reduce the threat. These measures will continue to impinge the personal liberties of Americans and require constraint on the part of agencies charged with the protection of airline passengers.
Since the previously mentioned events, the FAA has implemented several measures to protect against this and other types of air piracy and terrorism in the United States. Some of these were procedural; others include physical and electronic security measures. Much of the focus has been on regulating the access of individuals to the operations areas at airports, thus limiting access to the aircraft. In 1989, Federal Aviation Regulation (FAR) 107.14 was written into law. It required that an airport must be able to exercise control over an individual employee’s right to gain access to the airport operations area through an access control system. Specifically, this regulation states that any airport with regular passenger aircraft service (one flight per day) utilizing aircraft of 60 seats or more must be able to do the following:
- Ensure that only authorized persons have access to secured areas. Provide a means to deny access to those whose authorization status changes. Differentiate between persons authorized access to sections of the protected area, and restrict those not so authorized.
- Have the capability to restrict access by time and day.
Because of the large areas of coverage and the size of operational areas, the trend in access control has been to create a “universal access system” that would allow airline personnel to use a single ID card and access media to gain access to portals at every airport at which they work. On the other hand, one card that provides access to worldwide operations of an airline would present a golden opportunity for someone with an interest in terror or sabotage.
Prescriptive/performance codes
When first written, the FAA rules were prescriptive codes and rules designed to ensure compliance with standards thought to be the best at the time. The problem developed that prescriptive standards limited the vendors competing for the business available and eliminated alternative approaches to the problem.
Revised codes have changed to a performance standard that gives the performance level the FAA wants achieved and allows the operator and carrier to meet those standards through alternatives and competitive bids. This process also creates innovation in product introduction, refinement, and revision. Competition keeps prices reasonable and ensures that the costs passed on to the passenger are minimized.
The FAA has instituted a number of programs to address security at airports, and these regulations and advisories are presented as a Federal Aviation Regulation when reviews and revisions are complete. As of this date, FAR 107 is in the process of being rewritten and will include the requirement that airports be able to immediately assess alarms from monitored doors at airside and to create a log of the alarm, alarm verification, and response to each alarm. This will likely spawn an increase in CCTV installations and also require the integration of this new technology with the existing access control hardware.
FIRE
Although the focus of security in the terminal and airport has been on explosives, it would be negligent not to pursue areas as yet uninvestigated by terrorist organizations. On January 25, 1989, there was a fire at the International Arrivals Terminal of Kennedy Airport. The fire was in the Air France lounge on the first floor in the west end of the building, which was 900 feet long, 22 feet wide, and 20 feet high. Kennedy Airport is exempt from New York City fire and building codes and, as such, did not meet the requirements expected of buildings within the boundaries of New York City. The standpipes in the terminal are 400 feet apart, as opposed to 200 feet under the city fire code; the second floor runs 900 feet undivided by any firestopping.
The fire was upgraded from a second to a third alarm and took nearly three hours to control because of the lack of sprinklers and heat detectors, the standpipe location, and poor housekeeping. The cause of the fire was determined to be an electrical short circuit. A fire of this type in a building meeting the city code would have been out in 45 minutes.
This incident was accidental in nature, but what if a terrorist observed the weaknesses for some future action? If an operation to destroy the terminal were planned even with the slightest forethought, this terminal would be history. Should airport operators serving the New York City area be permitted to skirt and avoid more stringent city fire and building codes because they are a quasipublic authority? They do, and this fire shows the potential impact of what a dollar’s worth of gasoline could accomplish.
METAL AND EXPLOSIVES DETECTORS
The public’s perception of metal and explosives detectors at airports is one of interference, intrusion, and inconvenience. When weighed against the backdrop of potential terrorist actions, the fear of injuries outweighs the fear of inconvenience, but only for a short time. When the immediate threat is over, the public demands a return to normal and a reduction of governmental oversight and intrusion. Along with inconvenience comes the associated increased costs of purchasing, operating, and locating machines to perform the function to the level specified by the FAA and the airport operator. Processing times for baggage and people have yet to reach the ideal level and, as such, provide an excuse for airport operators to wait until the better product comes along before purchasing a unit. This leaves a gap in protection that terrorist organizations looking to make a statement can exploit.
The cost factor creates a domino effect: Fear of injury or lost merchandise because of an aircraft accident results in lost commerce and revenue. The reputation of the carrier is on the line, and good public relations can add to the bottom-line earnings just as bad publicity can lead to bankruptcy. Insurance carriers will refuse to write coverage for a bad risk, and stockholders will move to a company whose earnings justify their trust. Employees will move to airlines with a future, and customers will do the same. On top of this, governmental oversight has increased tenfold at the prompting of the flying public because of fears that threats were not being addressed effectively. This oversight has prompted airport operators to react to problems when they are pointed out by government regulators rather than proactively seek out problems and solve them. There is a reluctance to spend revenue on a product or system that will need to be replaced before its time because of revised regulations.
SECURITY/DETECTOR OPERATORS
Security and detection companies at most airports employ contract security services for parking facilities, baggage areas, airport terminal reception points, and detector operators. Contract services provide a limited liability for the airport operator, since he can transfer the risk to the contract security supplier. Contract security personnel have been known in the past to be inadequately trained and poorly educated individuals who have little incentive to perform their job well. They are paid minimum wage, are given a cursory background check, and have a turnover rate of three times those in similar areas of employment. For security to be effective, it must meet standards of conduct and provide incentive for employees to ascend to higher levels of responsibility and compensation. Otherwise, they are just a body in a uniform on display to reduce the fear of the customer.
The average person might look at security guards as responders capable of assisting with injuries and apprehending criminals when, in fact, they are merely there to observe, report wrongdoing, and assist in the administrative function of report writing. Most security guards are not trained in CPR, first aid, crime scene procedures, or criminal apprehension. They are there to call 911 when an incident occurs and to record observations.
Airport detectors, security personnel, and security systems in the terminals are managed by outside contracting firms. When airport operators want to test the effectiveness of their machines or personnel, they contract with audit and inspection services companies. Should an inspection turn up deficiencies, they can take corrective measures to reach the desired risk tolerance level of the operator. Failing to proactively measure their systems’ capabilities may result in severe penalties and fines should the FAA test a facility and find it lacking.
According to the FAA, “Enforcement practice has certainly changed over the years, and we are currently embroiled in a period of high-enforcement activity. The FAA’s enforcement of its own regulations begins with the various inspectors who are stationed in the field. There are inspectors who are designated to deal with operations issues, maintenance issues, airworthiness issues, and avionics issues. In the past, field inspectors have been highly trained individuals who generally came from a background in the industry. But with the tremendous increase in enforcement activity, the FAA has recently hired 600 new inspectors, assigning them to several specialty areas. The negative side of this rapid expansion in the field inspector force has been that we now have an entire team of new and often less trained individuals enforcing the regulations. Many of these inspectors are younger and, therefore, lack the experience and the operational knowledge possessed by their predecessors.”
IMPROVEMENTS NEEDED
An incident at Kennedy Airport raises the question of how effective airport security is. On December 8, 1998, a Catholic priest was detained at Kennedy following a routine passage of his luggage through a new CT scanning metal detector. The detector picked up an object packaged in a box of laundry detergent. The object was a Chinese-made 9mm semiautomatic handgun with 33 rounds of ammunition. It was wrapped in carbon paper and buried in detergent granules inside the detergent box. It was assumed the person who packaged the item believed it was illegal to transport the weapon, so it was wrapped in carbon paper to evade the X-ray machine and buried in soap granules to prevent detection by dogs or explosives detection machines. It was determined that this weapon wrapped as it was would have been unidentifiable to previous X-ray detectors.
This incident begs the question, Just how many weapons, explosives, and contraband materials were getting past these machines before? If the airport terminals can be compromised, just how safe are the jets we board every day?
The flying public is not only in danger of terrorists, religious fanatics, and death-wish heroes trying to make the front page. The airline freight handlers, maintenance departments, and boards of directors impact passenger safety as well. Airlines typically sell space in the forward cargo bays of their passenger jets to freight companies moving cargo domestically and internationally. The airlines require the freight companies to ensure the safety of the cargo they present for loading on passenger jets. Large customers like Sears, General Motors, and K-Mart could simply sign a waiver, and the merchandise is taken in without inspection. Individuals off the street would be questioned as to cargo contents and the package would possibly be inspected, but the inspection would be cursory.
Recent incidents have brought to light the hazardous nature of cargo on passenger planes, but the manner in which it is handled is yet to be significantly changed. TWA Flight 800 was found to have signs of damage tied to oxygen generators packaged in cargo in the forward cargo bay of the jetliner. While the evidence was not overwhelming, it prompted the Department of Transportation to issue an interim report #DGAB-96-01 dated May 24,1996.
The FAA states, “Since the issuance of the interim final rule, the FAA has learned of incidents in which oxygen generators are still being offered and carried aboard passenger aircraft. We believe that these occurrences are primarily due to confusion on the part of shipping and transportation personnel caused by the Proper Shipping Name (PSN) and basic description assigned to oxygen generators (chemical). FAA investigations have established, however, that in actual practice, oxygen generators are also being shipped under various other basic descriptions. Oxygen generator identification is necessary. If there is a likelihood that such a shipment (oxygen generators) might be transported by air, ensure that the ‘cargo aircraft only’ marking is included.”
The Department of Defense definition of terrorism is “the calculated use of violence or the threat of violence to inculcate fear; intended to coerce or to intimidate governments or societies in the pursuit of goals that are generally political, religious or ideological.” This definition was carefully crafted to distinguish between terrorism and other kinds of violence. The act of terrorism is defined independently of the cause that motivates it. People employ terrorist violence in the name of many causes. The tendency to label as terrorism any violent act with which we disagree is erroneous. Terrorism is a specific kind of violence. It may be motivated by political, religious, or ideological objectives. In a sense, terrorist goals are always political, as extremists driven by religious or ideological beliefs usually seek political power to compel society to conform to their views. Terrorism is a specific type of violence. It is a tactic used in peace, conflict, and war. The threat of terrorism is everpresent, and an attack is likely to occur when you least expect it. A terrorist attack may be the event that makes the transition from peace to conflict or war.
The terrorist weapon of choice in the future would likely be chemical, biological, or nuclear. While nuclear devices are prohibitive from a size standpoint, they also present a problem in acquiring restricted ingredients such as enriched plutonium. Chemical and biological weapons, on the other hand, are easy to purchase and even easier to produce.
The new technologies that airports are exploring for the detection of new materials used in making explosives and metal alloys used in making guns have had varying degrees of success. To meet the challenge of a more technically proficient terrorist, security professionals will need to address these risks as a whole and use the technologies together to form a reasonably successful program. Some of these technologies include bomb-sniffing dogs, advanced X-ray imaging, explosives detection, integrated access control, passenger profiling, online risk assessments, and an electronic passenger/bag reconciliation system.
Make terrorism a national security problem, and allow the involvement of government agencies and law enforcement. Airports and airlines have said they do not have the resources to mount an antiterrorism program on the scale that is necessary. Whatever security and safety systems air carriers and operators choose, it is unlikely any system alone will meet all of their operational needs. The answer appears to be an integration of existing technologies with newer advanced technologies coming to market. Seamlessly integrating these various system languages and protocols will require a close working relationship between system designers, software developers, and security managers to minimize loopholes.
While 100 percent effectiveness is unrealistic, the pursuit of complete coverage under all circumstances must continue to be the security providers’ goal. Minimum standards and regulations are just that and could never be presumed to be truly effective in and of themselves. Minimum standards are not meant to be a goal but a foundation for building effective working platforms to not only address the threats of today reactively but create platforms from which the problems of the future can be proactively addressed.
Editor’s note: This article was written before the September 11 terrorist attacks. The entire issue of airport security is being reevaluated by the federal government.
THOMAS P. MULLIGAN is a retired lieutenant from the Fire Department of New York Operations Division. He currently performs safety-related services for the construction industry as well as fire safety surveys. He has a B.S. in criminal justice and an M.S. in protection management from John Jay College in New York City.
