Friday, Oct. 31 at noon ET

Bruce Schneier Talks Metro Bag Searches

Bruce Schneier
Security Researcher and Author
Friday, October 31, 2008; 12:00 PM

Security specialist Bruce Schneier was online Friday, Oct. 31 at noon ET to answer your questions about the effectiveness of Metro's new policy to search the bags of passengers before allowing them in a station.

The transcript follows.

Schneier is a noted cryptographer and security consultant. He's the author of several books, including "Beyond Fear" and his newest, "Schneier on on Security." He blogs at Schneier on Security, where he has written about the random bag searches implemented by the New York Subway system.


Boston: I'm thinking I left the Washington, DC area just in time. Do people really think this is going to make us safer? What is going to make us safe is if people were more observant. How many people ride with their heads down in a book? How many people just choose to look the other way?

Bruce Schneier: Of course it's not going to make anyone safer.

This kind of thing is What I call security theater against a movie-plot threat.

A movie-plot threat is an overly specific plot or tactic. The problem with defending aginst them is that it only makes sense if you've guessed the plot correctly. If we spend millions on these random Metro searches and the terrorists go bomb shopping malls, or crowded movie theaters, or restaurants, or churches, or buses, or restaurants, or any of the other zillions of places where people congregate together, then we've wasted our money. But a movie-plot threats is a vivid story in our minds, and we respond to vivid stories.

And I don't think that people being more observant will help either. If there's anything we've learned in post-9/11 America, it's that when you put amateurs on the front lines of your security then you get amateur security.


Washington, D.C.: With 80+ stations and 133 operating hours per week, asking every 10th person at one station 40 hours per week (this could take up to 4 teams) would result in a 0.0375 percent change of an individual being asked. If you assume 2 bombers randomly choosing Metro entrances and times, you would have to ask 1 of 5 people at 40 stations 80 hours per week to get to a 1.0 percent chance of asking both of them. Assume only one is an idiot and the other walks to the next station you have a 0.0 percent change of stopping a bomber. This of course doesn't include Metro bus so just divide all the odd by 50. OK question. How does this make me safer?

Bruce Schneier: The way to look at this is definitely through a cost/benefit analysis. Here's mine.

Assume that searches take one minute each; that's a compromise between the cursory pat down you get when you enter a rock concert and the full-blown take-everything-out-of-your bag that happens during a TSA secondary screening. If you assume that an officer costs $60K per year ($30/hour), including benefits and support (almost certainly low), then each search costs $0.50.

According to the Internet -- which never lies -- people take 443,000 trips on the Metro each day: that's 160 million/year. Assume that there is one bomber per year. (Almost certainly unrealistically low. We've had zero bombers in U.S. subways and busses so far.) Also assume that a bomber will kill 50 people. (Low again; the four London bombers collectively killed 56 people: 14 each.) If you assume that a successful search will find and stop a bomber, then for every dollar we spend on these searches we have a 1 in 80 million chance of saving 50 lives. This means that the cost per life saved is $1.6M.

That isn't bad, but it relies on the ridiculous assumption that a bag search will stop a bomber. A bomber is far more likely to turn around and re-enter the Metro from another station, or on another day, or blow up some other place, or detonate the bomb in the station.


Washington, D.C.: Is it likely that concerned riders will be able to convince Metro to abandon the searches? Are there other cases in which a major agency has rolled back search programs in response to public criticism?

Bruce Schneier: I'm not sure what riders can do to convince Metro to abandon this program. I think Metro will abandon it, or -- at least -- reduce its scope if it turns out to be more expensive than they expected or if it causes more delays than they expected. Or a successful court challenge.


Mount Rainier, Md.: Bruce, The whole premise of these searches seems flawed. As I have pieced it together over the last week, Metro Police say the searches are "voluntary" so they stand up in court. Yet, if you refuse, you can't enter Metro (thus denying you a public service which may influence your consent), and if you turn around without being searched and leave you are likely to be taken in to custody (also an influence on your consent, and a violation of the probable cause principal). So, what am I missing here?

Bruce Schneier: You're right to be skeptical about the whole thing. Almost certainly there will be a legal challenge to this. I don't know how that will go, unfortunately. Over the past seven years the courts have been very willing to defer to the police and limit the rights of citizens. But the whole "fear of terrorism" thing is abating, so maybe the courts will rule differently this time.


Southern Maryland: What bothers me are the randomness of the searches. This would seem to invite the screeners to select passengers based on personal prejudices or fears. I can easily imagine them targeting black men, or men who look Middle Eastern.

Bruce Schneier: This is certainly a worry; police officers will almost certainly stop people who "look suspicious," whatever that means. And, of course, terrorists will use that to their advantage by looking and dressing and acting like they fit in.

Random screening -- one out of every 20 people, or something like that -- is far more effective than profiling.


Arlington, Va.: I'm having trouble seeing ANY way in which this sort of random consenting bag screen will do ANYTHING to reduce the threat for those who would be trying to do harm.

Seems to me that it's trivial for someone to just refuse a search and just go to another station/entrance.

I could see some security value in screening everyone (as they do in airports and even sports arenas), though it probably wouldn't be remotely practical...though perhaps not legal justification. But I can't understand how this system does anything to protect from explosives.

Bruce Schneier: Your intuition is correct. This is pure security theater.


Laurel, Md.: Metro says they're going to conduct random inspections of every Xth (like 17th) person entering the station. But since people enter stations en masse, how do we know if 16, 17 and 18 come in simultaneously, the choice won't be based on demographic profiling?

Bruce Schneier: Of course. There's no way to do this well without causing massive delays during rush hour.


Baltimore: How does one convince the policy makers (in this case Metro management), that this policy is a pure folly, and really won't accomplish much except perhaps to stop the one-in-a-million, inept, small-time bad guy?

Everybody else see this policy for the sham it is -- why can't Metro?

Bruce Schneier: Actually, you're asking a very profound question. The reason Metro doesn't see this as a sham is that they're too close to the threat.

The threat is terrorism, and smart solutions reduce the threat overall. Dumb solutions move the threat around -- from the Metro to buses, from D.C. to another city -- and so on. But Metro officials have a different view; to them, the threat is terrorism on the Metro. If they institute this program and the terrorists go bomb something else, it's a win for them. But for all of us, it's a waste of money.


Bethesda, Md.: Thank you for doing this discussion today.

So far I have not seen an answer to this question. If I enter a metro station and refuse a search, then exit and return 1 minute later (say after 5 people have passed through the gates), will I be stopped again? Seems like that would not be adhering to the every 15th or 16th person policy and that I was being profiled. And invoking my 4th amendment right is NOT considered probable cause.

Bruce Schneier: I don't know. Certainly a smart terrorist will just take a cab to another station.


Kensington, Md.: Thanks Bruce, I work as a consultant with various government agencies helping them develop new enforcement regimes for all sorts of public safety rules, including those related to security. I am aware that on the local level, law enforcement typically does not take a systematic approach to optimizing the use of its officers.

I have been asking Metro for the last week for any information on the expected benefits of the bag searches versus the costs of passenger time and diverting Metro police -- there will apparently be no increase in the transit police force -- from watching for other, much more prevalent crimes. I have received the same response: "why" they are doing it, but never a response to my actual question, which is, "Can you justify why this will be a net positive strategy."

I don't expect law enforcement to suddenly start employing teams of economists, but what I find troubling is that local law enforcement in general, not just Metro, seems to be giving almost no thought to maximizing the efficient use of its resources, something a mom and pop small business owner could even teach them a thing or two about. Am I perceiving this correctly? Are there any trends to utilizing more rational, scientific methods for determining how best to deploy police?

Bruce Schneier: There is a lot of good rational analysis out there about the cost/benefit of various counterterrorism measures. Here's one example, on airline security:

Cost/Benefit Analysis of Airline Security

Sadly, those in charge of security don't do this very often. Their analysis is more along the lines of: "Something must be done. This is something. Therefor, we must do it."


Washington, D.C.: Metro points to McWade v. Kelly - the New York City case - as proof of the program's legality. But does that case really create binding precedent for courts in DC, Maryland, and Virginia? Isn't the Metro program open for challenge?

Bruce Schneier: The New York case notwithstanding, there is definitely a court challenge in this case.


Bowie, Md.: Is this one of those things like having to show ID to get into a public building, even if it's just your Costco membership card?

Bruce Schneier: It's similar in that ID checks are just another piece of security theater. They look like they're doing something, but they're not making anyone safer.

I've written about ID checks, and REAL-ID in particular, here:

Will REAL ID Actually Make Us Safer?


Bethesda, Md.: Does Metro employ bomb dogs on the rails and in the stations? I've never seen any but I think trained bomb sniffing dogs would be far more effective than stopping every 16th passenger. Thoughts?

Bruce Schneier: Dogs can be far more effective than hand searching. Dogs are also more expensive (they're expensive to train, can't work as long, need to be cared for, etc.) so are generally used only against specific threats. I don't think they would work for a long-term program like this.


Washington, D.C.: I will be collecting ... ummm ... bodily fluids for a medical test this weekend and then carting the bottle to the hospital for testing on Monday morning. Oh, I hope the Metro police stop me for a search. The expressions on their faces when they realize what's in that bottle should be priceless.

Bruce Schneier: At least you don't to have to make sure the bottle is less than three ounces and in a clear plastic baggie.


Harrisburg, Pa.: Are there other means of detecting bombs, such as bomb sniffing dogs, that could be implemented as another means to assist in preventing bombs from entering transit stations?

Bruce Schneier: Sure. You could add dogs, x-ray machines, metal detectors, explosive trace detectors -- all sorts of things. That's not the issue; the issue is "why bother?" Why is this particular movie-plot threat worth of all these resources and attention, and all the other millions of possible threats not?

That's the problem with movie-plot threats: they require us to guess the plot and the tactic correctly. Counterterrorism is most effective when it doesn't make arbitrary assumptions about the terrorists' plans. Stop searching bags on the subways, and spend the money on 1) intelligence and investigation -- stopping the terrorists regardless of what their plans are, and 2) emergency response -- lessening the impact of a terrorist attack, regardless of what the plans are. Countermeasures that defend against particular targets, or assume particular tactics, or cause the terrorists to make insignificant modifications in their plans, or that surveil the entire population looking for the few terrorists, are largely not worth it.


Washington, D.C.: We had no searches on Metro in the days following 9/11 when terrorists successfully flew a jet into the Pentagon. There were no searches when a sniper killed or wounded dozens of people in the Washington Area in autumn 2002. There were no searches after the New York power outage in August 2003. There were no searches after the Madrid bombing in March 2004. There were no searches after the London bombing of a bus in July 2005. What is the new threat that requires searches on Metro?

Bruce Schneier: Perhaps someone needs to look tough on terrorism in order to secure a promotion.

I don't mean this as a joke. "Threat" needs to be understood from the point of view of the person who is implementing this program. There are threats to the general population, threats to the Metro ridership, threats to the Metro employees, and threats to that particular person. The decision to implement this program is based on all of those threats.

Whenever you see a security trade-off that doesn't make sense, try to undersand it from the point of view of the person making the trade-off. It will make sense that way.


Oceania: Bruce-

What's your response to people who say "Hey, if you have nothing to hide, you have no reason to worry?" I've tried pulling out the "People who sacrifice liberty for security deserve (and get) neither" argument, but it just bounces right off.

Bruce Schneier: I wrote this essay in response to that question:

The Value of Privacy


Washington, D.C.: Okay, okay, a lot of people are against the metro searches, I get it. But I haven't really seen any of these naysayers propose an alternative strategy to keeping people safe. Do you have any ideas?

Bruce Schneier: I said it above: investigation, intelligence and emergency response. Look for security measures that don't require us to guess the plot correctly; that's where you'll find smart alternative strategies.


Washington, D.C.: Metro Transit Police Chief Michael Taborn was online Tuesday, Oct. 28 at 1:30 p.m. Here is one question and answer.

"Washington, D.C.: I am opposed to these searches and plan on refusing any Metro officer's request to go through my bags. Because I'll be allowed to refuse search and turn around without being detained, I will simply enter the Metro through another escalator or elevator. How do you plan on addressing this loophole?

Michael Taborn: You may choose not to be searched and leave the station with your bags or other items. We do have a plan to address suspicious behavior."

Does this mean that refusing a search is now suspicious behavior? If so can they stop me after I leave for suspicious behavior and do a non random check, or are we going to get a "NO Metro" like the "No fly" list?

Bruce Schneier: We don't know what will happen to people who refuse a search and then leave. I don't even know what happened to those people in New York City. I suppose we'll have to find out.


Washington, D.C.: How many federal attorneys and federal employees are really going to go along with Metro on this? I'm a federal attorney and I swore an oath when I became and attorney and again when I became a fed to uphold the Constitution. It's plainly unconstitutional. It's only a matter of time before they search one of us, we say no, attempt to enter Metro anyway, they arrest us for "trespassing" in a public place and we sue the crap out of them, raising the fares on innocent passengers. Can we just fire Catoe now and get it over with?

Bruce Schneier: No, you have to go through the process. Good luck.


Washington, D.C.: Metro doesn't have enough security personnel to deal with the real threats it has: assault/batteries occurring at the Potomac Avenue Station; rowdy, aggressive teenagers at Tenleytown; harassment on the X2; crime around the 8th & H NE transfer point; crime around Gallery Place.

Now they want to divert personnel to fight theoretical terrorists.

Bruce Schneier: This is another important point. Not only are there different terrorist threats, there are different threats in general. When the police divert resources from crime to terrorism, the result is an increased threat of crime. It's probable that people will be less safe overall because of this.

(A similar thing happened after 9/11 when people drove long distances because they were afraid to fly. Automobile accidents went up, and more people died as a result.)


What happens if...: The thing I never understand about these searches, what happens if they do actually find someone with a bomb? What are these people trained to do? Seems like the bomber would just blow it up anyway. Doesn't really help much.

Bruce Schneier: That's an excellent question. I have no idea. Presumably they have some procedure in place. I doubt it's very sophisticated.

Really, this is more for show than for anything else. It's to show the Metro riders that they're doing something. People like to see the police doing something; it reassures them.

Actual security is secondary.


Washington, D.C.: The only time I ever felt nervous about a possible terrorist attack on the metro system was on 9/11 -- and it seems to me that the time for an attack on Metro has passed. I don't think the random bag searches will prevent anything, in part because there really isn't anything to prevent.

My question: are any of the visible security measures taken in D.C. since 9/11 actually worthwhile?

Bruce Schneier: Doubtful. The things that are effective are largely invisible: investigation and intelligence. The problem is that it's harder to take public credit for invisible measures.


Pittsburgh: I lived in D.C. and I think it's a good idea to do this. It is better safe than sorry, and everyone would want this if something bad happens to us like 9/11.

Bruce Schneier: You certainly don't believe this. If you did, you'd never leave your home. Better safe than sorry, after all. You'd never let anyone into your home; better safe than sorry. You'd never do anything.

The choice is not between safe or sorry. This security measure won't make you safe. And not doing it won't necessarily make you sorry. (The Metro hasn't done it since the system opened in 1976, and no one is sorry.) The choice is the standard security trade-off: are the security benefits worth the cost? And by any reasonable measure, they're not.


Silver Spring, Md.: This idea seems so stupid. If terrorists were going to set off a bomb in the Metro, why haven't they done it already? Are they wandering around Adams Morgan looking for the station that must be there since one of the stations is named after it (private D.C. joke)?

Bruce Schneier: Agreed. It seems unlikely that a would-be terrorist would say something like: "Wow, they're randomly searching bags in the Metro. I will abandon my terrorist plans and go get a real job instead." Far more likely he will make a minor change in his tactic and go about his evil business.


Bruce Schneier: Thanks everyone for this conversation, and good luck.


Editor's Note: moderators retain editorial control over Discussions and choose the most relevant questions for guests and hosts; guests and hosts can decline to answer questions. is not responsible for any content posted by third parties.

© 2008 The Washington Post Company