THREAT IMAGE PROJECTION: CARROT, STICK OR BOTH?

THREAT IMAGE PROJECTION: CARROT, STICK OR BOTH?

There are various methods of assessing X-ray screener performance. Covert testing and red teaming exercises are all well and good but they are time consuming and not suitable for evaluating all of the screeners on a regular basis. Computer-based training certainly has a rôle to play in both educating the front line and driving up standards, but the screener knows when they are being assessed and, like a pre-announced audit, can ensure that they are performing at their optimum at that moment in time. The third method is by utilising images that can appear during the normal course of an X-ray screener’s regular duties, without the need to actually introduce a weapon, explosive or other restricted or prohibited item into the airport environment; the process and the images are referred to as threat image projection, or TIP for short. Tom Campbell has been developing training images for 40 years and shares with readers his own personal journey and explains why such imagery does not only test the detection capability of a screener but, given the fortunate absence of real threat items at airport checkpoints, can also serve as a motivational tool, continually updating their knowledge of existing and emerging threats.

I began my career in aviation security by joining Luton Airport on 1 April 1975 after a short time as a forensics officer with the London Metropolitan and Bedfordshire police forces. It’s the only time I’ve doubled my income – from £32 to £64 per week and, with overtime, sometimes reaching £100!

My training with ‘the Met’ in Peel Street, London, included all aspects of security search and the preservation of evidence. Further training at Hendon Police College provided me with skills in forensic photography. At Luton Airport the training was, shall we say, minimal! We were issued the Department of Transport lecture notes, which were more focused on legal and procedural issues than actual operational concerns. The first acquisition of security technology was a portable archway metal detector produced by John Adams. Six months later, when the airport decided to buy an X-ray machine, my colleagues and I were bussed to Manchester to look at their Scanray fluoroscopic systems (slide open the door, place the bag inside, close the door and press the button to see the image on the screen). Not great technology, but adequate for the era. It was later determined that the lead shielding on older machines tended to stretch and thin under the influence of gravity and the constant vibration caused increased radiation escape and therefore posed a potential health risk.

Fluoroscopic X-ray was in daily use at shoe shops for fittings until the late 1960s
Fluoroscopic X-ray was in daily use at shoe shops for fittings until the late 1960s

Luton Airport bought the Canadian Picker conveyor systems which were somewhat different. After the guys had got over the novelty of putting themselves through the system and pressing the zoom button a few times to view their pelvic regions, we found that the images were actually helpful for the identification of guns and knives. Before you condemn the screeners for their ignorance of the risk they were taking, it is worth remembering that in the 1950’s and 60s, every decent shoe shop was equipped with a fluoroscope and children would have their feet X-rayed as part of the shoe-fitting exercise. Eventually, I undertook the National Radiological Protection Board course at Aldermaston UK and was subsequently appointed as a radiological protection supervisor at Heathrow.

“…it is worth remembering that in the 1950’s and 60s, every decent shoe shop was equipped with a fluoroscope and children would have their feet X-rayed as part of the shoe-fitting exercise…”

Initial Conveyorised Systems

At Luton I began to compile a series of training slides of X-ray images of handguns which I had borrowed from my colleagues with Special Branch stationed at the airport. By pointing the camera at the screen and making sure that the shutter speed was not a multiple of the screen refresh rate (to avoid black lines on the image), I generated a training package on knives and firearms. The images were, of course, monochrome.

It was in October 1988, following the circulation of the images from the ‘Autumn Leaves’ (Herbstlaub) investigation carried out by the German Bundeskriminalamt (BKA) in Frankfurt, that I first saw an improvised explosive device (IED) as an X-ray image. This was a revelation! Here was something with a recognisable structure – a main charge, power source, delay to arm (control mechanism), and, most importantly, a detonator.

The detonator had a dense and recognisable area in the centre, the ASA (aluminium, lead styphnate, lead azide) compound. Operators generally assumed aluminium detonators could not be detected through X-ray examination but that was only because they were trained on dummy shells of detonators which had no ASA content. They were, therefore, trained to look for ‘wires’ or ‘anything unusual’ in a bag. Hmm…

1989, immediately after the loss of Pan Am flight 103 in December 1988 over Lockerbie, saw me in the position of Training Officer at Heathrow Airport with Heathrow Airport Limited Security (HALSEC). This was the time of transition from monochrome systems to colour (Heimann and Rapiscan Tri-mat) systems. This development followed on from Andrew Kotowski’s invention of dual energy systems using a copper filter and photodiodes rather than the phototransistors of the Picker system. This was first implemented by EG&G Astrophysics and, though a system of that type had been deployed in the Pan Am baggage transfer area, there was a mismatch in conveyor speeds and many bags were not actually screened! Despite this, it is doubtful that the supposed Lockerbie device, concealed in a Toshiba Bombeat stereo radio cassette recorder, would have been detected as the main charge had been wrapped in several layers of aluminium foil from Toblerone packaging, therefore, changing the X-ray signature of the material1. Again, I produced a slide pack.

At this time, I was also tasked with conducting remedial training for operators who were ‘failing’. I quickly discovered that it was not the operators who were failing but rather that their basic training had failed them. During this assignment I found that one slide, when shown, would be identified every time – a bag containing a plastic toy Uzi sub-machine gun. The point of identification was the very distinctive foresight pattern.

Embedded Patterns

Research being carried out at the time by Montreal’s McGill University, showed that people can recognise more than 18,000 embedded patterns in otherwise complex images.

In 1991, I gave a lecture to the British Radiological Society; I explained that effective X-ray operation required operators to examine a two-dimensional screen image and correctly identify embedded patterns in that image which may suggest the presence of a threat.

I continued, addressing this audience of around 150 medical and industrial radiographers, saying, “You have it easy. You are from the top percentiles in intelligence and ability, you train for five years or more and you look at a human body, which is basically a bag whose contents do not really change and you have as long as you like to look at the X-ray image to detect minor differences.” I explained that, “we, in the aviation security industry, take people from many walks of life and put them through a 12-week course in aviation security; only around eight hours covers X-ray operations, of which two hours is devoted to X-ray image interpretation. We then have them sit with a similarly trained, albeit more experienced, screener for about a week before considering them fully capable of screening cluttered bags, looking for items that are infinitely complex, and all to ensure your safety in the air”. I additionally explained that, “their decision time is only around 14 seconds and that screeners are constantly under pressure to ‘keep the line moving’ so that you don’t miss your flights”.

“…you train for five years or more and you look at a human body, which is basically a bag whose contents do not really change and you have as long as you like to look at the X-ray image to detect minor differences…”

Image Storage

In 1992, Fred Rogers from Rapiscan came to me with an E-PROM (Erasable Programable Memory chip – basic digital storage where data could be erased) that contained two stored X-ray images. I asked him, “Where are the other 98?”, as I could immediately see an application for a 100-image library.

“…the accepted idea of the time that all explosives, being organic compounds, would appear on the screen of the Tri-Mat X-ray machines in orange. Except that some didn’t!…”

The introduction of personal computers (PCs) as controlling systems for X-ray units enabled the download of images directly to 2.5inch floppy disks which provided a method of distribution of captured images for training purposes; each floppy disk could only store between six to eight images which could then be uploaded onto a computer for viewing or could be printed onto overhead projector film for lectures. E-PROMs were revolutionary as they could store significantly more slides and speed up the process.

Around about the same time, Donald Syme and the late Lyndon Heywood from Security Design and Development (SDD) had volunteered to demonstrate their training kit, which consisted of a briefcase with concealments, strongly scented talcum powder and a deactivated firearm. We also had the Federal Aviation Administration training kit or Modular Bomb Set (MBS) devised by Ed Cotello. While both kits seemed useful, neither fully addressed the needs of screeners. The MBS consisted of a collection of mechanical timers, clocks, dummy (hollow) detonators, a selection of batteries and tubes, and bricks of plastic material.

X-ray images of component parts from the Modular Bomb Set
X-ray images of component parts from the Modular Bomb Set

The accepted idea at the time was that all explosives, being organic compounds, would appear on the screen of the Tri-Mat X-ray machines in orange. Except that some didn’t! Many explosives permitted for use in industry, for example, contain Sodium Chlorate as a dampening agent to reduce flames in gaseous atmospheres; they are used in gaseous areas such as coal mining.

Real explosives under X-ray examination using Rapiscan equipment.  Seamex (left) permitted explosive contrasted with Semtex-H (right).
Real explosives under X-ray examination using Rapiscan equipment.
Seamex (left) permitted explosive contrasted with Semtex-H (right).

After initially, yet unsuccessfully, trying to work with the explosives manufacturers themselves (they had to clean down the manufacturing line after every production of non-explosive simulants), I started to collaborate with SDD to produce X-ray accurate simulant materials – explosives that had a Z-effect (Z-eff)2 close to that of the live materials, detonators, some power sources, timer/delay circuits and, of course, concealment containers/items such as radio cassette recorders, hairdryers and suitcases. All had to be X-ray signature correct. The simulant explosives needed to produce a realistic Tri-Mat signature – orange, green or black, depending on composition – and detonators would imitate the real thing, with dense areas corresponding to bridge wire attachment and ASA compound.

Detonators (left), batteries (centre) and timers (right) under X-ray examination using Rapiscan equipment
Detonators (left), batteries (centre) and timers (right) under X-ray examination using Rapiscan equipment

In respect of timers and power sources, the precise nature of an electronic component is impossible to discern on an X-ray screen and power sources are ubiquitous in most baggage. It is only when a pattern emerges of the main charge, detonator, delay and power source connected, that an operator can identify an IED, always bearing in mind that the delay may be the human element (see image below) whereby a suicide bomber can complete the circuit without the need for an actual control mechanism. Firearms pose a simpler problem as, in order to contain the forces of the gases produced by the cartridge propellant, to work reliably they must contain some metal elements.

Evolv X-ray image of a backpack containing a suicide device and a Glock 17
Evolv X-ray image of a backpack containing a suicide device and a Glock 17

Computer Based Training

The Security Research and Development Department which I managed at Heathrow was, in addition to testing and trialing new equipment, involved in the production of a computer-based training (CBT) system. In 1996, in co-operation with the X-ray company Rapiscan, and CBT provider Renful, we assisted Malaysian Airports Berhad in the construction of the first internet-based security training system. This meant that a trainer in Kuala Lumpur could now conduct classes in Johore Baru, Lankawi and Penang simultaneously.

We continued this work at HALSEC and, in co-operation with Frontline (another CBT development company), produced a system for our own in-house use. No more pointing the camera at the X-ray screen; images were downloaded directly to a Shark digital storage system. The Security Research and Development Department was wound up by the British Airports Authority (BAA) in 1998. I left Heathrow shortly afterwards and was commissioned by several X-ray manufacturers to work at the William J. Hughes Federal Aviation Administration (FAA) Technical Centre in Atlantic City, in the production of the first large library of Combined Threat Images using Vivid, Heimann and Astrophysics EG&G systems to support the FAA’s Screener Proficiency Evaluation and Reporting System (SPEARS) programme.

Lok Koo, the Research Program Manager in Atlantic City, had, it seemed, acquired for the FAA the entire contents of the lost baggage store from the old Kai Tak Airport in Hong Kong which, at the time, was moving to its present site at Chek Lap Kok. This treasure trove was contained in six AVE/ULDs (containers) and consisted of, basically, untouched bags which had originally been packed for a flight and which contained everything that you’d expect in passenger luggage and thus added to the authenticity of the combined threat image – an IED in an empty bag is somewhat obvious! There were some surprises; like a suitcase full of twigs that later turned out to be Catha edulis, better known as qat, a stimulant used in some parts of the Middle East and North Africa. Other surprises included a full set of cardinal’s robes, a cheque and other papers that would have financed the passage of someone through university. These bags became a wonderful resource for producing realistic TIP slides for CBT.

Assessing Screener Performance

Early attempts at red team penetration to assess operator competence were not encouraging as far as operator performance was concerned. I participated in a number of these tests at UK airports which only reinforced my opinion that poor training and supervision contributed to the failures.

 L3 X-ray image of three sticks of Dynamite and a mechanical timer, together with a photograph of the device in a bag.

L3 X-ray image of three sticks of Dynamite and a mechanical timer, together with a photograph of the device in a bag.

Another problem which emerged from these tests was that the training focus was on bombs concealed in electronic devices such as radios and computers. Therefore, a screener complaining that, “I wasn’t told to look for stuff like this” was somewhat justified when faced with the traditional ‘three sticks of Dynamite and an alarm clock’ scenario – exemplified by the 7 May 1948 incident in which a Philippine Airlines Douglas C-47, en route from Daet to Manila, crashed into the sea. In this case, a mechanical delay time-bomb had been placed onboard the aircraft by two ex-convicts hired by a jealous wife to kill her husband for assumed infidelity.

The focus in the 1980’s and 90’s was, and probably to this day still is, on IEDs fiendishly concealed by unstoppable opponents in everyday objects. The modern X-ray based explosive detection systems (EDS) though not infallible, provide our best barrier to the infiltration of prohibited articles into the airline system. There’s a caveat here in that the airside/landside barrier must be operating in a coordinated and effective manner and that goes from international bodies drafting and agreeing to effective regulation, to governments and security management’s will to apply it.

Going back to SPEARS… the name Screener Proficiency Evaluation and Reporting System doesn’t exactly roll off the tongue but it did address an important factor; if the hardware and software of aviation security costs millions, how does the more costly wetware (i.e. the screener) looking at that display perform? What is it that makes a good screener? This question was addressed at the Atlantic City facility by Eric Neidermann and Michael Barrientos who formulated the SPEARS programme. This programme was mirrored in the UK by Andrew McLumpha and his team at the Royal Air Force Institute of Aviation Medicine in Farnborough, who conducted a series of practical trials at Newcastle Airport using images of IEDs produced at Heathrow. In the US, these practical trials were carried out by Jim Fobes and his team from the FAA Technical Centre at Los Angeles Airport using the EG&G training and testing system incorporating images from the MBS. These trials proved conclusively that exposure to known threat images improved the detection capability of the screeners. And so it was that TIP was born… and why I committed myself to building accurate TIP image libraries.

Threat Image Projection

Threat Image Projection (TIP) comes in two flavours – Combined Threat Image (CTI), where the threat is contained in an actual bag, and False Threat Image (FTI) where the threat is projected into live bags being processed through the system. CTI is more appropriate for use in checked baggage as operators are usually working in a control room away from the actual baggage stream and, when operators have an actual view of the baggage stream, it is blatantly obvious when a false image is projected on the screen. In making TIP libraries I determined that I would produce accurate images of known pattern combinations of main charge, detonator, delay and power source. Of course, this becomes a little difficult when the primary detonating material is TATP and the delay system is a human being, as was the case with Richard Reid and his ‘shoes’.

The explosive amount is relatively small in the case of Richard Reid’s boots (mock-up shown under X-ray examination above) – at least under the minimal detection amount that the X-ray systems algorithms can easily deal with.

Daisy chain of blocks of TNT (ranging from 50g to 200g);  also shown under X-ray examination using L3-SDS equipment.
Daisy chain of blocks of TNT (ranging from 50g to 200g);
also shown under X-ray examination using L3-SDS equipment.

This, unfortunately, also applies to larger charges since the detection algorithms don’t aggregate and thus ‘daisy chain’ devices may be missed by the automatic EDS. However, screeners will recognise the patterns if they have been exposed to an image of such a device. This means that all materials must be X-ray accurate and screeners must have a comprehensive knowledge of IED construction. It is not enough to simply wrap simulated explosive around some obsolete computer circuit board and call it a ‘bomb’!

Depending on X-ray system geometry, each TIP image group I produce consists of one or two views of the FTI or CTI and, in the case of computerised tomography (CT) systems, four or more scans of an object may be required in order to present realistic scenarios to the screener. This is backed up by either an Excel or Access file and a photographic image detailing, for CTI groups, the bag contents plus IED or firearms and their components, or, in the case of FTI groups, just the IED and firearm components. I go into this detail because I consider TIP to be a valuable tool that provides continual training rather than just a method to weed out incompetent performance; the latter is the province of recruitment and training personnel. The job of a screener is difficult and should a TIP insertion be missed it is necessary that the screener is provided with full information about the image.

Conclusion

So, is TIP a carrot to motivate screeners or a stick which highlights their failings? It can be either depending on how it is applied; but above all, TIP is a useful tool that both provides continual operator training while maintaining operator alertness. Data derived from TIP results indicates areas where further training or a change in training methodology may be necessary and provides useful information on the effectiveness of the screening system.

“…a little difficult when the primary detonating material is TATP and the delay system is a human being…”

TIP makes a vital contribution to the safety of the travelling public by providing screeners with images of realistic threats that they would not see in basic training. It is not enough to instruct a screener to ‘look for anything unusual’ since every bag that is presented to them will contain infinitely variable contents. Security managers would be well advised to ‘switch on’ the TIP capability that is resident in every modern X-ray unit. After all, they are the people who will be kicking the dust out of the witness box carpet should the worst happen!


Tom Campbell currently resides in Maine, USA. He trades as Technical Training Resources and can be contacted at tja_campbell@hotmail.com or on +1 (781) 354 1816.

Leave a Reply