I'm often critical of the way that we get subjected to pointless and ineffective security measures, particularly at places like TSA checkpoints. My friend Bruce Schneier is the high priest of this criticism, and calls it "Security Theatre." Sometimes, TSA folks will sort of admit this, as this former one does in the Atlantic.

The TSA knows what it does is often fruitless, so why do they do it? Is it political pressure? Is it the need we all have to keep up the appearance of doing something? Are they just morons who don't realize their techniques are of limited use and cause great disruption to air travel? Or do they have a more reasonable purpose?

Security theatre, like at the TSA, is not a counter-terrorist tool. It's a counter-terror tool

While there is much to debate about the goal of terrorists, one thing that is clear is that their goal is not to blow up planes or kill random people. For them, those are means to a larger goal, striking terror in their enemies, and the eventual goal of disrupting them or bending their politics.

Terrorists don't so much want to make flying dangerous. They want to make it scary. To fight the terrorist, you need to make flying not scary. Obviously, the ideal way to do that is to actually thwart them with security. But that's really, really hard, so you can make up for that difficulty with the appearance of security. At least to some degree. It can even be argued that because terrorism is so rare, it merits only a modest security effort -- but because the fear of terrorism is so strong, it merits a larger anti-fear effort.

Now even poor security provides some real security. Even though the X-ray machines only catch 5% of weapons when they test them, that random risk of being caught is enough to scare away many bad guys. As long as you don't know for sure, it's a risk, and it's also moderately effective against things like the 9/11 attacks, which needed to get 20 people on the plane. Even a sucky system will catch one or two, and that will put the whole system on higher alert and possibly thwart the real plan.

On the other hand, really poor security does a bad job at making the public feel safe, because if bad guys get through it, and really do blow up planes, people are not going to feel safe no matter how much you give them the illusion of it. You need a decent level of security on which to paste the illusion.

To complicate it more, sometimes the best real security is hidden from the public, both to make it less defeatable (security through obscurity) and because it includes things like secret spy networks which track down bad guys. In fact, traditional on-the-ground intelligence is probably the most effective technique there is, but its activities can't be advertised except in a very vague way.

Criticism of security theatre can focus instead on some other factors:

• Is it moral to lie to the public to make them feel better? If the lie is effective, is that better?
• The theatrics come with a huge cost, not just in the TSA budget, but also to our time, and to the air travel industry in general.
• In some ways, the burdens caused by security and security theatre may match the terrorist's goal to disrupt society. If they make us incur great cost because of them it is a victory for them.
• Analysis and criticism in public of security systems is the best way to make them improve.

This puts critics in a bind. By showing the flaws of security theatre, we are weakening its effectiveness at reducing terror, and possibly revealing the poor level of the security to uninformed attackers. But staying silent has many things wrong with it as well, in particular it leaves unfixed flaws in real security.

One might imagine a special "point out the flaws" complaint desk at agencies like the TSA which would allow secret complaint, but this approach has rarely been effective. Because of this, people have poor confidence that such reports will be attended to, and in fact they will often see their reports not get attended to and be frustrated and want to be public about it. The failure to act may be due to many reasons -- bureaucracy, difficulty or cost of acting, differences of opinions -- or because the flaw is actually deliberate security theatre. But the agencies can never tell the public something is deliberate security theatre, as that defeats the whole point.

I do believe the TSA knows they do theatre, and that they believe it has a purpose, but they can't admit they do it. I bet they are frustrated that people in the public security community insist on pointing it out, and probably revile us for screwing up what they think is working. Yet at the same time, I don't think we can stop doing it.

I also think some of the theatre is there for political, bureaucratic and otherwise totally wrong reasons. Vastly expensive X-ray machines and offensive pat-downs might make sense if they provided lots of real security, but they are much more likely classic cases of "fighting the last war" security, where you spend a fortune to shut down a technique the terrorists have already moved past, mostly because you will really look bad if they can pull off the same attack twice.

Even if theatre has a place, they could do a much better job at how they tune it, and choose theatre that does not put a massive burden on air travel. I suspect they know that too, and one reason they created TSA Pre (which I get automatically with my Nexus US/Canada travel card) is to stop the wealthy and powerful passengers from complaining, because the complaints of the powerful actually get listened to. From a civil rights perspective, that's a pretty nasty approach.

The TSA could do this by eliminating lines at airport security. There is no excuse for lines 99% of the time in a field where the number of arriving passengers is fully known well in advance. Not in a world which has high-speed video and tele-operations centers possible for everything but manual bag inspection. If our times were quick and as importantly highly predictable, outside of rare special lockdowns, the burden of the security would be much lower.

The public likes it

The public seems to like security theatre, even when they are told it is theatre. Schneier calls this the "Something must be done! This is something. Let's do it!" mentality. People don't like the answer, "There's nothing practical we can do to stop that, we have to lump it" and they don't like believing that the thing they are doing is useless, because that's scary.

I think the TSA also knows this. It's a source of the "last war" security described above. Even though the terrorists can switch from shoe bombing to something else after everybody (who is not in the wealthy class) is forced to take off their shoes, the idea of letting another shoe bomber through is unthinkable. It makes the security people look like idiots -- how did you let this happen when you knew about it -- and increases public fear. The latter is the real concern.

After all, it's pretty likely that security experts already knew about the potential to make shoe bombs and underwear bombs and toner cartridge bombs before those things were tried. The only new information was, "Oh, the terrorists are trying this now." To the outside the reaction to these attempts looks like the terrorists taught the security people a new vulnerability which they fixed, but I suspect that's not the case. Good security organizations have people who work all day to think of possible flaws in the security. When the defence is expensive -- like taking nude photos of every non-wealthy passenger -- you don't deploy it until it's out in the open and clear the bad guys have also thought of it.

So what should we have?

The ideal solutions, of course, are those that provide real security and also reassure the flying public, but which create minimal disruption to travel and civil rights. It's a tall order. The most effective post 9/11 measure, reinforced cockpit doors and access procedures -- fits this bill exactly.

Any measure which causes travel disruption should be evaluated as a random check, the rarer the better. Random checks are effective against group terrorist attacks, because while a solo attacker might accept the risk of being caught in the random check, a group can't. Random extra checks should be assigned at the back of the security line, when you enter it. That way you can be pulled out for your random check and ideally get through security in less time than the people who waited in line. (No, you would not be able to volunteer.) Of course, there should not be lines, but this can work with even short lines.

If there is to be security theatre, then techniques which are inexpensive and non-disruptive should be favoured. Putting your shoes through X-ray is inconvenient, but it's a lot better than nude photos in very expensive X-ray machines. A method can't be a complete sham, as that will get discovered to negative effect.

While it would be better to have no security theatre measures, if there are to be any, they should be judged not on their security (obviously) but on their cost and burden to travel compared to the level to which they reassure the public. Of course, the TSA will never admit that this is the case, but they could follow such a rule internally, and critics could also point it out.

Instead of spending hundreds of millions on security theatre, what if that money were spent on public education, to make the public aware of the real relative risks of things like terrorism compared to getting in a car crash on the way to the airport? It is hard to get everybody to understand that, but this sort of money, combined with training in schools, might make a dent. This could be studied in the small then implemented in the large.

Those who have read my posts will know I think we could do away with most of the security we have now. But since I am not getting that wish, I still would like it to be better.

Finally, special attention should be taken to criticise security theatre which is done for other motives. For example, the complex ID checks mostly allow airlines to make tickets not usable by other parties. Some measures are probably done to protect the asses of particular officials and departments rather than meeting any of the goals above. That should be rooted out -- and punished where possible.