by Philip Baum
I had the privilege of chairing the session on the ‘Insider Threat’ at AVSEC World 2015 (the annual global aviation security conference, nowadays co-hosted by the International Air Transport Association, Airports Council International and International Civil Aviation Organisation) held in Dublin. During the Q&A session, one airport delegate questioned whether we were placing excessive focus on the insider threat, and asking why, if we were as vulnerable to attack as so many of us were intimating, the industry had not suffered a significant attack as a result. Well, perhaps, we now have.
One month on from the loss of Metrojet flight KGL9268, 23 minutes after its departure from Sharm el-Sheikh bound for St. Petersburg, all the indicators suggest that the explosion that took place was caused by an improvised explosive device. If it is eventually confirmed that it was a bomb, Islamic State in the Sinai Peninsular/Province are the most likely perpetrators of the attack.
As is commonplace in the aftermath of a tragedy, there is considerable focus on the security measures that were in place at the point of departure. The media is awash with stories from visitors to the Red Sea resort keen to relate their accounts of the inadequate security processes they had witnessed. Whilst some of them are shocking, they are not surprising. The harsh reality is that whichever airport the doomed flight had departed from, there would be similar stories told. Sharm el-Sheikh may well not be an example of best security practice, but it does not stand alone.
Many have been quick to criticise the passenger screening process – being the most visible element of the security infrastructure of an airport – and government inspectors have rushed to the scene to evaluate the standards in place. I’m sure that there is room for improvement, but let’s remind ourselves of the findings of this year’s US Government Accountability Office’s report into screening at American airports – in 67 out of 70 tests, inspectors were able to infiltrate prohibited items, including dummy IEDs, through security checkpoints. That’s a 95% failure rate. Furthermore, government tests, wherever they are conducted around the world, have to be detectable by the screeners – to be fair tests; terrorists attempt to conceal, or infiltrate, devices in ways that are not detectable.
Away from airports, even the most secure facilities, such as prisons, cannot ensure the detection of all prohibited items, despite there being next to no limit on the amount of time one spends screening prisoners, visitors and staff and no customer service issues to worry about.
The images we now see of ‘enhanced’ screening in process in Sharm el-Sheikh do little to inspire confidence in the security professional, although I accept that they may reassure the travelling public. Whilst the industry is generally supportive of passenger differentiation – using a common-sense, risk-based approach to security – the sight of everybody undergoing a pat-down search, with zero consideration as to the passenger’s profile, is illustrative of the theatrical approach the world has taken to screening.
Over the last few days we have heard continual reference to the word ‘compliance’ as if that was in itself the goal. Compliance is the bare minimum we should be achieving and somehow we have to create an operating environment where we aim to excel and exceed baseline levels. Ultimately, of course, it all boils down to money and whether airports and airlines are prepared to make the necessary investment in human life.
In far too many countries around the world, aviation security personnel are poorly paid and struggle to support their families. Other security agencies operating at airports – customs, immigration, quarantine – all tend to pay more and hire staff of a better calibre than those tasked with pre-flight checks. Given the threats that exit, this is no longer tenable. How can we expect excellence in security controls from people who are lacking in education and motivation? As is often said, if you pay peanuts, you get monkeys.
In many airports in the developing world, corruption is rife and bribes are readily accepted; most financial exchanges are made for a ‘service’ by which one is expedited through the airport process, rather than to bypass security controls, but a £10 note – or $10 bill – has a lot of purchasing power. The industry has failed to address this concern adequately. In certain countries, bribery is endemic and part and parcel of daily life, so it is incumbent upon operators to aggressively tackle the problem – encouraging reporting, banning staff from carrying cash (so that periodic spot checks can be effected), and making the acceptance of bribes – or, indeed, payment for any ‘extra’ service – a red line offence resulting in immediate dismissal.
But it’s not only about pay. That may reduce the instances of petty crime, and may make it harder for a terrorist organisation to exploit a member of staff, but where a terrorist wishes to gain a job at an airport, the salary offered will be the last thing on their mind.
It only takes one person to cause a disaster and given the size of many airports around the world, with tens of thousands of employees, many of whom are low-paid, transient workers, identifying ‘bad eggs’ is no easy task, especially in an environment which is driven by speed, customer service and on-time performance.
Whilst we all want 100% security, that is an impossibility. One only has to look to the tragic events of 5th November 2009 at Fort Hood in the US, when Major Nadal Malik Hasan, a psychologist in the US military, killed 13 fellow service personnel and injured 30 others. Or, 16th September 2013 when Aaron Alexis, a civil contractor to the US Navy, killed 12 and injured three others in a shooting at the Navy Yard in Washington DC. If we can’t identify the insider threat in a military environment, where everybody goes through intense screening, how can we do so in airports?
The insider threat to aviation is actually not new. On 11th April 1955, an Air India flight was destroyed by a bomb infiltrated on board by a cleaner at Hong Kong International Airport, with the aim of assassinating Chinese Premier Zhou Enlai who was supposed to be – but wasn’t – on board. The aircraft crashed into the sea near the Natuna Islands killing all on board. But that’s history…
In the 21st century there have been a disturbing number of plots identified involving insiders.