• Embed Doc
  • Copy Link
  • Readcast
  • Collections
  • CommentGo Back
Download
 
COMMISSION
SENSITIVE
Working
Draft
March 25,
2004
FAULTY
LAYERS
This paper examines
the
discrete layers
of
aviation security that were
in
place
to
prevent
hijacking on
9-11.
In
this examination Team
7
will
present
key
facts
and
observationsabout
the
known
and
perceived
weaknesses
of
each vector, both
as an
independent layer
of
defense
and as
part
of a
"layered
system."
The
analysis
is
intended
to
provide
a
greater understanding
of how the
9-11
attacks were able
to
succeed,
and to
derive lessons
about how to
improve
the
aviation security system
to
better protect
the
country
in the
future.
Layered System
In
the
course
of our
work Team
7
reviewed numerous reports
and
received
the
comments
of
many Civil Aviation Security
officials
and
experts citing
a
simple
but
important
premise:
no
single
vector
of
aviation security
can be
rendered errorless
or
foolproof.Certainly,
the
results
of FAA
compliance inspections, Department
of
TransportationInspector General audits,
and
General Accounting
Office
investigations
of
aviationsecurity measures demonstrated that
no
single layer
of
security could
be
relied upon
to
sufficiently
protect
passengers
and
aircraft
from
piracy
and
sabotage.Highlighting
the
importance
of
having
a
"layered"
aviation security system
as a
means
ofmanaging
single point failures
the
President's Commission
on
Aviation Security
and
Terrorism
in its May
1990 report
on the Pan Am
103
disaster stated.
FAA'sapproach is
based
on
interrelated
security
measures which
are intentionallyredundant. If any one security
measure fails, another will support
or replace it,
according
to
this theory. For example,
fencing
and personnel
identification
systems alone are
insufficient
for the
most
sensitive
airport
areas,
but the
addition
of
lighting,
law
enforcement
personnel,
andvigilant
aviation employees produce
a
more complete
security system.
1
The
1997
White House Commission
on
Aviation
Safety
and
Security also known
as theGore
Commission (named
after
its
Chairman, Vice President Albert Gore) reiterated
the
importance
of
security layering.
The
panel stated that "aviation security should
be a
system
of
systems,
layered, integrated
and
working together
to
produce
the
highest
possible levels
of
protection.
2
The
National Research Council
in a
major study
ofaviation
security also strongly endorsed
the
principle.
The
concept
of
"layering"
in the
realm
of
aviation security
is
closely related
to the
principle
of
"redundancy"
inculcated into aviation safety
policy
and
regulation.
The
U.S.civil aviation system requires
all
critical
flight
and avionic
systems
to be
backed
up byredundant
capabilities.
3
This policy
is
aimed
at
reducing
the
chances that
a
single point
failure
will
result
in a
catastrophic accident. With
a
redundant system,
at
least
two
elements must
fail
simultaneously
to
produce
an
undesirable consequence.Mathematically,
the
chances that
two
systems will
fail
coincidentally
are far
less
than
the
COMMISSION
SENSITIVE
Working
Draft
March 25,
2004
 
COMMISSION
SENSITIVE
Working
Draft
March25,
2004
probability
that either
of the
systems will
fail
independently, making redundancy
aneffective
risk management strategy. Indeed
civil
aviation safety
policies
are
designed
to
reduce
the
risk
of
catastrophic systems
failure
to one in
1,000,000,000 based partly
on
this
principle
4
Achieving such
a
precise
and
ambitious mathematical goal
is
difficult
in any
discipline,
but
perhaps less
so in the
area
of
aviation
safety
in
which physics
and
science dominatethan
in the field of
aviation security. Technology
is
more
predictable
than
the
human
factors
that heavily influence
the
realm
of
security, such
as
criminal imagination
and
screener
performance.
5
Nevertheless, aviation experts agree that
effective
layering
in
security, like redundancy
in
safety,
can
greatly reduce
the
likelihood
of
catastrophic
failure.
Realizing
the
potential
benefits
of a layered system, however, rests on two key factors. First, the layers must bedesigned
to
guard against
the
correct problems.
A flight
control system
and its
backup
that
are not designed to stop a pilot from intentionally flying an
aircraft
into the ground
may
constitute redundant systems,
but are
ultimately ineffective against
a
potentiallycatastrophic problem. Similarlyasecurity checkpoint thatis notdesignedtostop knives
and
onboard security that
is not
designed
to
stop
aknife-wielding
suicide-hijacker
may
represent two layers of security, but they are ineffective against a potentially catastrophicproblem. Second, each layer must
be
effective
in its own right
against
the set of
problems
it is
designed
to
address.
Two
ineffectual
layers operating
in
tandem might
be
little or no better than a single layer of defense.
EXECUTIVE SUMMARY
The Layers of security relevant to the 9-11 hijackings were as follows: Intelligence;Passenger
Prescreening,
Checkpoint Screening and Onboard security.
In
the final
analysis
we
derived
from the
study
to
follow,
it is
difficult
to
perceive
the
aviation security system in place on
9-11
as a system of redundancy in the model ofaviation safety,
or a
system that
was
truly layered,
in the
words
of the
Gore Commission:
"a
system
of
systems,
layered, integrated,
and
working together
to
produce
the
highestpossible levels
of
protection."
Intelligence
initiatives such as watchlisting designed to identify terrorists were not used
to
identify such individuals
in the
commercial aviation ticketing
process
and to
stop them
from
flying.
Intelligence
used to write estimative analyses indicating a real and growing threatleading up to 9-11 was insufficient to stimulate significant
increases
in
security
procedures because
of a
policy making system that
was
conflicted
by
customer
convenience,
influenced
by
industry concerns
and
economic
considerations,
and
wouldrequire either a foregoing security incident or evidence of a "specific"
"credible"
and
"actionable"
threat
to
substantially strengthen security.
COMMISSION
SENSITIVE
Working
Draft
March
25,
2004
 
COMMISSION SENSITIVE
Working
Draft
March 25,
2004
Prescreening
was applied only to passengers checking bags.
"Selection"
meant only
that
the
selectee's
checked
bags
would
be
screened
for
explosives.
For a
terrorist travelinglightly or one with intentions other than sabotage using checked baggage, such as the 9-
11
hijackers,
prescreening
did not present a layer of defense to be overcome.
Checkpoint screening
would not catch an individual carrying on their person any one ofmany deadly or dangerous weapons with metal content less than a 22 caliber handgun,even if the individual were chosen as a security
"selectee."
While the detect-ability issue
is
vital, given that checkpoint screening guidelines
did not
consider
a
three
and
one-halfinch
knife
that locks into place to be a "deadly or dangerous weapon," the question ofdetect-ability is rendered moot. Even if detected, such a
knife
would have been givenback for carriage onto the plane.
Checkpoint screening
offered
little protection against individuals carrying-on luggage
that
containedaprohibited weapon similarinappearance,atleastin anx-ray image,to
any
number of harmless, everyday items. For example, a can of mace or pepper spraywould look very much
like
a can of
shaving cream. Because
the
requirement
to
conduct
"continuous"
and
"random"
hand searches of carry-on luggage at checkpoints had beenlargely ignored,
and the
hand search
of
prescreening
selectees
had
been
eliminated underthe CAPPS system, the chances of a prohibited item being detected by screeningsecondary
to the
x-ray were
remote.
On-board
security
did not
feature
the
presence
of air
marshals
on
domestic
flights(except as they were in transit domestically for international departures), did not
feature
reinforced cockpit
doors,
was
compromised
by
improper management
and
secure
proceduresto
safeguard
cockpit keys.And finally, it
featured
anemergency responsestrategy that
offered
little
or no
resistance
to
hijackers.
As
such
it was a
security layeronly in the most modest sense of the term—particularly to those whose violent intentionsreflected
the
terrorist trend
of the
time
to
maximize casualties,
as
opposed
to the
traditional paradigm of hijacking for transport or barter.
In
the final analysis of whether the aviation security system in place on 9-11 was an
effective,
layered system administered as a national security issue,
staff
would
offer
the
following
summation: A layer with gaping holes is not really a layer. Multiple layers thatarenot redundant, integrated or coordinated cannot be called a layered system. And asystem that does
not
provide adequate defense against reasonably
possible,
highconsequence attacks was not one in keeping with the traditions of U.S. national security.
COMMISSION
SENSITIVE
Working
Draft
March 25,
2004
of 00

Leave a Comment

You must be to leave a comment.
Submit
Characters: ...
You must be to leave a comment.
Submit
Characters: ...