Flying in the face of danger. (Airport Security).

TWO MONTHS AFTER THE SEPTEMBER 11 TERRORIST ATTACKS, THE AVIATION and Transportation Security Act (ATSA) was signed into law to, among other goals, improve the screening of passengers and baggage by federalizing the airport Security screener work force. It is too early to assess whether the provisions in the bill, when fully implemented, will be effective. The first progress report will be issued by the General Accounting Office next month. In the meantime, security professionals at airports and airlines are reporting that little guidance has been forthcoming from the newly mandated Transportation Safety Administration (TSA), leaving many unsure of how to proceed.

The ATSA sets forth general requirements--such as the need to improve access control to sensitive areas of airports--but it fails to give specifics. To pick up where the law leaves off, the TSA is holding discussions with hundreds of airports to determine what criteria might be established for standardizing security solutions.

The problem is that while these time-consuming discussions proceed, several hard deadlines loom ahead, says Dr. Seth Young, a professor of aviation business administration at Embry-Riddle Aeronautical University. This time crunch has put airport professionals in a quandary.

"Airport managers and designers are struggling," says Young. "Each airport is different and everyone has to do their own design without any idea of what federal funding will be available or what standards the TSA will impose in the future."

During a workshop Young led in March, airport and airline security experts from around the country discussed their tactics. while some personnel from smaller airports are waiting for TSA standards, others are taking incremental steps to fortify security by addressing such issues as background checks for airline and airport personnel, access controls, cargo tracking, passenger and bag screening, and flight security. "The goal of these more proactive airports is to have an effective plan that aviation officials can present to the TSA when standards are finally developed," says Young.

Background checks. The new bill requires that airports conduct comprehensive background screening--including an FBI criminal records check--on all new employees before they are hired. Existing employees must also be screened before December 6, 2002.

Though a number of airports already required background checks, few used fingerprints to do an FBI criminal records search. Compliance with the new standard has presented a challenge. For example, at Tampa International Airport, officials have found that not all people can produce fingerprints that are adequate for an FBI search. Due to work with solvents or other chemicals, or even genetic reasons, about 2 percent of the applicants screened at Tampa could not provide fingerprints.

"If their fingerprints can't be recognized, they can't be hired and are rejected out of hand," says Tampa's Executive Director Louis Miller. Miller is concerned that some of the airport's 392 existing employees may face the same fate. Since all employees must be screened by the end of the year, some trusted current employees may be affected. To help circumvent the problem, Miller is working with the FBI to develop a background screening process that can be conducted in place of a fingerprint check in these situations.

Bob McNamara, operations manager for the Palm Beach International Airport, turned to technology in hopes of finding a product that would provide quick turnaround of federal checks for the airport's 3,000 employees. McNamara investigated several products before discovering a local company, Cross Match Technologies, that manufactures the ID 1000 Live Scan Fingerprinting System. The system scans an applicant's fingerprints and submits them to the FBI electronically. The FBI then posts the reports of the checks on a secure Web site accessible only by McNamara and other authorized security personnel.

McNamara purchased the unit and installed it in the airport's badging office. In January, he started conducting background checks on the airport's existing employees. He found that the turnaround was reasonable, 48 to 72 hours in most cases. However, software glitches caused minor problems. For example, a software problem caused security some difficulty in getting online and connecting to the FBI's clearinghouse. These concerns were addressed. None of the existing employees have been rejected by the FBI check, says McNamara, but a handful of new hires have been screened out.

By contrast, new background checks of existing employees at three Washington, D.C. area airports turned up problems ranging from immigration violations to drug violations, resulting in the arrest of ioo workers.

Access controls. Under the new aviation law, airports are required to work with the TSA to develop enhanced access control systems and strengthen access control points to secure areas such as air traffic control operations, maintenance, crew lounges, baggage handling, concessions, and catering delivery. As noted, the law does not set forth specifics but leaves it to the TSA to develop standards. The TSA has not announced when such standards will be released. The law also mandates that 20 airports serve as pilot projects for the use of biometrics in access control.

At some airports, security is going ahead with new programs already in the works. For example, at Tampa, where the existing system was 11 years old, a new integrated access control system was already planned before the terrorist attacks, says Brian Rumble, associate deputy director of operations. The airport approved a bid on the access control project on September 6, 2001, and the system became operational in early 2002.

The Tampa airport is the 28th largest in the country, and it is 19th in originating passengers. In 2001, airport served 17 million passengers and screened up to 35,000 bags each day. This origination traffic is critical, says Miller, because originating passengers must undergo extensive body and bag screening, unlike passengers merely changing planes at larger hub airports.

The old access control system had several shortcomings. One issue was that it was not integrated with the CCTV system. Another concern was that the old technology was maintenance intensive, according to Rumble. Airport security did not, for example, record video from the 45 CCTV camera feeds on a 4-hour basis because doing so would have been too cumbersome.

Rumble wanted an integrated system that included badging, access control readers, CCTV, and intercoms. He chose a product by IRS Solutions to control access for the airport's 6,000 employees. Using the system, Rumble can now assign any person access to any combination of doors and gates.

The CCTV feeds from the new digital camera system--expanded to no units--are recorded around the clock at the airport's central station. If an alarm is triggered, the appropriate camera feed is displayed to the officer on duty. The officer can then isolate that camera and go back to see what caused the alarm, while still recording current events.

"If an alarm goes off and the camera shows an empty doorway, all we know is that an unauthorized attempt was made to enter the facility. With this system, we can go back and determine whether [the person who triggered the alarm] entered the airport or fled," says Rumble. This information helps security tailor its response to the alarm.

The digital video feeds are stored on site on a PC, which allows security personnel to pull up an image by time, date, and location if needed. While certain alarm events are saved permanently, more routine images are replaced by new information once the PC's memory is full.

Currently, employees carry a proximity card that is also a smart card, and the employee is required to enter a four-digit personal identification number to enter secured areas. But in anticipation of future heightened security requirements, Rumble has altered the badging system so that biometrics can be installed on all doors.

The conversion is expected to take place late this year after the completion of a new terminal. Though the airport has not decided on the type of biometric product to use, security has narrowed the field to either fingerprint or hand geometry readers.

Cargo tracking. The new law also addresses perimeter security at airports, specifically the movement of cargo. The law requires that all cargo come from known shippers. A shipper can become "known" by filling out a comprehensive application and undergoing a background check, which must include a visit from airport security to ensure that the business is legitimate. The law stipulates that all cargo that enters the perimeter of the airport be screened in some way. To seek out new solutions, the bill also calls for pilot projects to explore new technology.

Some airports are exploring both immediate and long-range solutions to improve perimeter and cargo security. For example, the Houston Airport System has hired security consultants to conduct audits at Houston's two airports--Hobby Airport and the George Bush Intercontinental Airport.

The consultants found some simple problems that could be fixed right away. For example, at Intercontinental Airport, the catering kitchens were originally located outside the perimeter fence, meaning that all caterers and their food had to repeatedly go through a checkpoint to enter the airport grounds. To solve the immediate problem after 9-11, security set up a checkpoint on the grounds to screen catering personnel and catering carts each time food needed to be transported from the kitchen to the aircraft. As a result, security was diverted to staff the checkpoint several times a day. The consultants suggested that the kitchens be moved inside the perimeter, thus avoiding this problem. Now, catering personnel go through the regular airport checkpoints once a day and then provide food from the kitchen to the aircraft from inside the airport grounds. The new plan does away with the extra checkpoint.

Rick Vacar, director of aviation for the airport system, is also looking at new technology to improve cargo and perimeter security in the long term. Vacar is currently in talks with NASA officials to test a neutron scanner that can look through cargo containers and detect the molecular structure of explosives or other contraband. "If this proves efficient," says Vacar, "we can set up a checkpoint at the front of the airport so that everything that comes within the perimeter is cleared."

Another proposed technology initiative, involving a major U.S. domestic airline and an international passenger airline in Southeast Asia, would use cargo seals that would allow security to track the location of all moving objects at the airport such as vehicles, containers, and catering carts. The project, being developed in conjunction with the FAA and the TSA, uses technology developed by Say, of Sunnyvale, California.

The goal is to ensure that inappropriate materials are not brought into the airport inside a catering truck, for example. In the program, a known shipper or a U.S. Customs officer is responsible for certifying the contents of a container and sealing it at its point of origin, usually before it comes to the airport.

According to Greg McDougall, Savi's vice president of business development for security, the electronic seal includes built-in radio frequency identification (RFID) technology that allows the cargo to be remotely tracked by security through specialized software. The seal itself is composed of an electric circuit through bolts and clamps.

When the known supplier installs the seal's tamperproof bolt, a circuit is created. Then, if the seal is tampered with, the circuit is broken, and an alarm is triggered. The software program picks up the signal and sends it to security, indicating that the container has been tampered with. The container is then manually checked before it is allowed on the airplane or it is simply not loaded onto the aircraft.

Screening. The law mandates that all passengers be screened by metal detectors and x-ray machines before entering the gate area of an airport. The law also requires that all bags be screened for explosives. These two issues, explosives detection (EDS) and screening, are being approached in different ways.

EDS. Explosives detection units must be in place to screen passenger bags at most airports by the end of the year. The law initially stipulated that all airports have the detection units by the end of the year, but now smaller airports, as determined by the TSA, will be exempt from the provision. Smaller facilities will use technology that detects trace explosives by testing a sample obtained by running a swab over the outside of the baggage.

To meet that requirement until explosives detection units are in place or until a decision is made on which airports are exempted, all airports are combining hand searches, x-ray screening, bomb sniffing dogs, and passenger bag matching. (Positive passenger bag matching has been in place for all originating flights since January 18.)

The mandatory deployment of explosives detection units, which are roughly the size of a sport utility vehicle and cost up to $1 million each, has caused controversy among security and aviation specialists--even after the exemption of smaller airports. (Some airport officials complained that installing such machines in small facilities would be impossible and entirely new airports would have to he built to house them.)

Officials at larger facilities are still faced with serious logistical issues. For example, though the law was approved in November 2001, Tampa's Miller had his first scheduled meeting with TSA officials to discuss the EDS machines at his airport in late April 2002. He still had not been notified when machines would arrive or where they would be placed. Similarly, in Houston, Vacar is waiting for directions before exploring EDS placement. "Putting in these machines will mean major reconstruction for us," says Vacar. "We're going to wait and see what the TSA does."

A number of airport security officials have expressed concern about the equipment itself. According to Professor Young, the experts in his workshop were concerned not only about physical implementation of the units but also about whether the units are effective. With high false-positive rates having been reported--the exact percentage is classified--the machines are mistrusted by some experts. Vacar notes that the technology is rapidly improving. But that is a double-edged sword. It's good news for the future, but it also means that money spent on today's technology may be wasted. "I would hate to put in this equipment now and then have better products available in a few years," he says.

According to Paul Turk, a TSA spokesperson, the agency is aware that systems can raise reliability issues, but he asserts that efficiency can be achieved. The goal, says Turk, is to be conscious of these rates and always seek to improve the product. 'This is a dynamic situation," says Turk. "Nothing has been set yet and improvements will he made."

Checkpoints. One ongoing challenge, even before September 11, has been how to prevent passengers from bypassing security at screening checkpoints. Some airports have been modifying the configuration of existing x-ray checkpoints to prevent such security breaches. These programs, they hope, will be sufficient to satisfy any future TSA standards.

One such program was installed at Miami International Airport. In April 2001, the city of Miami announced plans to purchase new checkpoints for the airport to improve passenger flow. The airport had free-standing x-ray machines and metal detectors before the upgrade. Under the new plan, the airport would have lined up the equipment and in some cases isolated the checkpoint with moveable partition walls. However, some of the checkpoints would have remained out in the open, with unguarded space around the equipment. Instead, after 9-11, the city installed an ADT QControl checkpoint facade for each of the airport's 10 checkpoints.

The airport concourse now has a checkpoint, as does the satellite terminal. Each checkpoint has three to five stations that have a walkthrough metal detector and a carry-on baggage x-ray machine. The checkpoint frame has openings only for the metal detectors and x-ray machines. The configuration makes it impossible for someone to walk through and get lost in the crowd.

To help keep false alarms low and streamline the flow of passengers, flat-panel screens at each checkpoint provide passengers waiting in line with general security information about the airport. For example, the screens periodically display information about what cannot be carried onto the plane. They also inform passengers that cooperatively placing all items from pockets in the provided buckets will speed up screening. This helps passengers prepare and makes screening faster.

The message on the screen can he changed by the screening supervisor via a touch-screen monitor. Through the touch-screen, the supervisor can also reconfigure the checkpoint by opening and shutting stations.

When the checkpoints were purchased in early 2001, a prime feature of the system was a secondary screening area. This secondary point, located approximately five feet inside the checkpoint, was reserved for those who set off the metal detector. Screeners at the secondary point would use a hand-held metal-detecting wand to determine the source of the alarm.

After the terrorist attacks, the FAA forbade secondary screening to prevent any passenger from progressing beyond the checkpoint before being fully screened. If a passenger sets off the metal detector, he or she must resolve the issue, by taking a belt buckle off, for example, and then again go through the metal detector. In addition, a final screening process now takes place at the gate and is overseen by airline personnel to prevent hazardous materials being passed off to a passenger after the initial screening.

The checkpoint also includes an exit lane for people on arriving flights. A dedicated CCTV camera monitors the exit and records any person who breaches it from the checkpoint side. A voice alarm also announces that a breach has been attempted. The video feeds to a VCR at the checkpoint, and screeners can provide airport police with a printout of the perpetrator.

Another airport that has improved its checkpoints is Lambert-St. Louis International Airport in St. Louis. Before September 11, screeners at Lambert-St. Louis had trouble with passengers attempting to bypass security. For example, in one instance, a passenger said he was tired of waiting in line and walked around the metal detector at a checkpoint and proceeded into the terminal.

A general use black-and-white CCTV camera captured video of the man going into the terminal. But when screeners obtained the video from the airport's central security station, they found that it was too fuzzy to use for identification purposes. Though airport police shut down the terminal and searched for the man, he was never found.

Based on this incident, security personnel began investigating new checkpoint products. They chose ExitSentry, manufactured by Cernium, Inc. The product is a color digital CCTV system installed in existing checkpoints. The cameras are linked to computer terminals that display the people walking through the checkpoint.

One camera is positioned to monitor straight down each security lane, while another camera is focused to record the face of any person passing through the metal detector. A computer monitors the video. If it detects a person going the wrong way or an item thrown through the metal detector or someone moving too fast, it sounds an alarm and sets off a flashing strobe light.

The video of the event is displayed for a few seconds, then the computer plays a loop from a few seconds before the alarm to a few seconds after the incident. The loop is displayed both on a small screen for the screening supervisor and on a larger screen for the whole staff.

In most cases, the person causing the alarm has done so inadvertently by walking through the detector prematurely, for example. In these cases, the person turns around and goes through the detector again. The supervisor then resets the system. This happens frequently, about once an hour at Lambert, according to Maurice Garoutte, chief technical officer at Cernium who helped design the Lambert system.

However, if the person is actually trying to bypass security, the emergency procedures are implemented. Though this aspect of the system has not yet been tested, procedures are in place. A predesignated screener follows the person out of the checkpoint area while police are radioed to come to the scene. The supervisor prints the best image of the person captured by the video camera while the alarm image is also saved to disk. The image is then turned over to airport police. Historically, the screener who is following the person has not had any way of communicating with police when pursuing someone who has bypassed the system. However the procedure is under review now and the future policy will be determined by the TSA.

Screeners. The new law transferred responsibility for checkpoint screening personnel from airports to the newly created TSA for three years. The head of this agency is charged with setting standards for hiring and training screeners as well as supervising employees. These federalized screeners will operate all checkpoints in U.S. airports during the three-year time frame established by the law. At the end of this period, airport authorities will be permitted to determine whether to maintain the federal screeners or return to private companies. However, the same government standards implemented by the law will apply to private screeners.

An all-federal screener force--approximately 30,000 people as indicated by federal estimates--must be in place and trained by November 19. In April, Baltimore-Washington International Airport became the first to comply with that directive. The bill also calls for pilot programs at individual airports to assess screening operations by private companies or by airports. One such program, planned for John F. Kennedy Airport in New York City, will employ former law enforcement, fire, and safety personnel as screeners.

Requirements. The law requires that all screeners be U.S. citizens, speak English, and have a high school education or one year of relevant work experience. U.S. Transportation Secretary Norman Mineta has announced that the federal government will try to hire back as many existing screeners as possible.

Some industry experts have criticized these provisions. For example, aviation expert Charles Slepian notes that the FAA's stated goal of rehiring as many existing screeners as possible is a mistake that will only serve to reinstate former security woes. "Giving inadequate screeners more money will not make them better screeners," he says.

Similarly, Slepian criticizes the provision of the law that allows one year of service as a screener to replace the high school degree requirement. "To say that doing a had job as an airport screener for a year is the same as a high school diploma is insulting," he says.

Another critic is Mike Boyd, of BoydForhes, Inc., an international security consulting firm, which has issued a white paper on the deficiencies in the new law. "Instead of federalizing screening programs, we need to provide professional standards for them," he says.

Training As laid out in the TSA's training program, all screeners will undergo 40 hours of classroom training and 6o hours of on-the-job training. The classroom curriculum will be developed by the TSA and will contain instruction on screening people, baggage, and cargo as well as on stress management and personal interaction skills.

Training will he conducted by the TSA or contracted out to training agencies and will take place at National Guard classrooms near the airport to be serviced. The TSA will also use a train-the-trainers approach to speed the process. The agency is considering videoconferencing and Web-based training as well.

The on-the-job training will consist of several components, including threat image projection-where the image of a prohibited item is projected onto an x-ray machine and run by the screener among other actual items as a test. Other training tools will include videos and role-playing. Some of the training will be conducted at the airport late at night after flights have been grounded so that screeners can become familiar with an airport before they are asked to work during operating hours.

In the air. The law also addresses the safety of air crews and passengers during flights. In addition to calling for air marshals on flights deemed high risk by the Department of Transportation and for enhanced cockpit doors by April 9, 2003, the law mandates security training for flight crews. Training would potentially cover self-defense as well as curity issues related to new duties the crew is being asked to handle on the ground, such as rescreening passengers just before boarding and checking the airplane before takeoff.

Though the FAA has mandated such training for flight attendants, none of the airlines have given it, according to Dawn Deeks, spokesperson for the Association of Flight Attendants. What's more, says Deeks, some attendants are forced to do searches of the aircraft but haven't been given additional time. And no protocols have been established regarding what a flight attendant should do if something suspicious is discovered.

The association, which represents 50,000 flight attendants at 26 airlines, has requested that the airlines either bring in security experts to conduct searches or train ground personnel and attendants and give them extra time. But some of the smaller airlines are claiming that they cannot afford such measures, says Deeks.

Deeks notes that since aircraft will be required to have a locked and secured cockpit, attendants will be the first line of defense against any assailants. Therefore, the association is asking airlines to provide flight attendants with defense training that would include scenario drills. It is also requesting that attendants he armed with nonlethal weapons, such as stun guns. These weapons would give attendants the tools to buy time and protect passengers until the aircraft has landed safely.

As of press time, the association was waiting on approval of nonlethal weapons from the FAA and specific guidelines on self-defense training to be approved by the FBI. The amount of training to be required will be mandated by the FAA in consultation with the FBI and the TSA.

The training requirements will then be given to airlines, which must develop their own training programs and submit them to the FAA for approval. According to Deeks, the Association of Flight Attendants will then serve in a watchdog capacity to make sure that the training is given as mandated by the FAA.

The association has also asked that communications between cabin crew, the cockpit, and ground security be streamlined. Deeks notes that the goal of this measure is to ensure that all parties are aware of any potentially dangerous situation.

The arming of pilots is also still being debated. The law gives TSA that option but does not mandate it.

As airports take interim steps to ensure safety and await standards from the TSA, airport officials worry that the final mandates might require all facilities to put in identical equipment or procedures. They also voice concern that they are not being given the opportunity to provide enough input into a tightly controlled federal program. But they remain hopeful. "The TSA has so far provided more questions than answers," says Vacar. Maybe that means they appreciate the expertise of the people on the ground. "They are on a learning curve about airport security, but we've been doing it a long time," Vacar notes. "We could facilitate the process."

RELATED ARTICLE: Detecting False Documents

ON SEPTEMBER 11, eight of the terrorists who passed through Logan International Airport carried false documents. Though automated document verification of passengers is not required under the new Aviation and Transportation Security Act, officials at Logan have purchased and installed an automated document verification system that uses an optical scanner and software to detect false identification.

The product, BorderGuard by Imaging Automation, has been used for several years at border crossings in various countries. When applied to an airport environment, the system optically scans an ID, such as a driver's license, passport, green card, or visa, with five sources of light. The computer within the unit then analyzes the document to determine whether it has been tampered with. The software performs 10 different tests ranging from analyzing security features of various documents to assessing whether the thickness of the paper is authentic. The analysis takes four seconds.

Additional features can be added to the system. For example, at Logan, the analysis also includes cross-referencing each name against government watch lists and names of disgruntled passengers provided by the airlines. For each flight, the system provides a software manifest with photos of all the people who check in for a flight.

At Logan, the system was initially operated by members of the National Guard, who viewed the results of the check via a PC. However, this task was expected to be taken over by law enforcement officers when National Guard troops were withdrawn from the airport.

During the first 45 days that the system was deployed at Logan, security examined more than 100,000 documents. Officers discovered that more than 100 of those documents were invalid. Many of these were simply expired IDs, but others were either fraudulent or in violation of INS procedures. In these cases, the persons were detained and questioned by INS or Customs officials.

Teresa Anderson is a senior editor at Security Management Documents and reports mentioned in this article are available online at www.securitymanagement.com.