University of Illinois computer science and mathematics professor Sheldon H. Jacobson, in collaboration with Adrian J. Lee at the Central Illinois Technology and Education Research Institute, explored the benefit of matching passenger risk with security assets. The pair detailed their work in the journal Transportation Science.

"A natural tendency, when limited information is available about from where the next threat will come, is to overestimate the overall risk in the system," Jacobson said. "This actually makes the system less secure by over-allocating security resources to those in the system that are low on the risk scale relative to others in the system."

When overestimating the population risk, a larger proportion of high-risk passengers are designated for too little screening while a larger proportion of low-risk passengers are subjected to too much screening. With security resources devoted to the many low-risk passengers, those resources are less able to identify or address high-risk passengers. Nevertheless, current policies favor broad screening.

"One hundred percent checked baggage screening and full-body scanning of all passengers is the antithesis of a risk-based system," Jacobson said. "It treats all passengers and their baggage as high-risk threats. The cost of such a system is prohibitive, and it makes the air system more vulnerable to successful attacks by sub-optimally allocating security assets."

In an effort to address this problem, the Transportation Security Administration (TSA) introduced a pre-screening program in 2011, available to select passengers on a trial basis. Jacobson's previous work has indicated that resources could be more effectively invested if the lowest-risk segments of the population -- frequent travelers, for instance -- could pass through security with less scrutiny since they are "known" to the system.

A challenge with implementing such a system is accurately assessing the risk of each passenger and using such information appropriately. In the new study, Jacobson and Lee developed three algorithms dealing with risk uncertainty in the passenger population. Then, they ran simulations to demonstrate how their algorithms, applied to a risk-based screening method, could estimate risk in the overall passenger population -- instead of focusing on each individual passenger -- and how errors in this estimation procedure can be mitigated to reduce the risk to the overall system.

They found that risk-based screening, such as the TSA's new Pre-Check program, increases the overall expected security. Rating a passenger's risk relative to the entire flying population allows more resources to be devoted to passengers with a high risk relative to the passenger population.

The paper also discusses scenarios of how terrorists may attempt to thwart the security system -- for example, blending in with a high-risk crowd so as not to stand out -- and provides insights into how risk-based systems can be designed to mitigate the impact of such activities. "The TSA's move toward a risk-based system is designed to more accurately match security assets with threats to the air system," Jacobson said. "The ideal situation is to create a system that screens passengers commensurate with their risk. Since we know that very few people are a threat to the system, relative risk rather than absolute risk provides valuable information."

The National Science Foundation and the U.S. Air Force Office of Scientific Research supported this work.

Note: If no author is given, the source is cited instead.

• Transportation Science
• Weapons Technology

• Hacking
• Information Technology

• Privacy Issues
• Disaster Plan

• Security engineering
• Cyber security standards
• Computer insecurity
• Computer security
• Identity theft
• Computer worm