Last summer, I watched a fellow passenger at Washington’s Reagan National Airport as he was selected to go through a newly installed full-body scanner. These machines--there are now 40 of them spread across 19 U.S. airports--permit officials from the Transportation Security Administration (TSA) to peer through a passenger’s clothing in search of explosives and weapons. On the instructions of a security officer, the passenger stepped into the machine and held his arms out in a position of surrender, as invisible millimeter waves surrounded his body. Although he probably didn’t know it, TSA officials in a separate room were staring at a graphic, anatomically correct image of his naked body. When I asked the TSA screener whether the passenger’s face was blurred, he replied that he couldn’t say. But, as I turned to catch my flight, the official blurted, “Someone ought to do something about those machines--it’s like we don’t have any privacy in this country anymore!”
The officer’s indignation was as rare as it was unexpected. In the wake of the failed Christmas bombing of Northwest Flight 253, the public has been overwhelmingly enthusiastic about these scanners. A recent USA Today poll found that 78 percent of respondents approved of their use at airports. Western democracies have been no less effusive. President Obama has ordered the Department of Homeland Security (DHS) to install $1 billion in airport screening equipment, and the TSA hopes to include an additional 300 millimeter-wave scanners. Britain, France, Italy, and the Netherlands have all made similar pledges to expand their use. (At the end of January, the European Commission's Information Commissioner, Viviane Reding, announced that in light of body-scanners' "privacy-invasive potential" and unproven usefulness, the machine should not be imposed without "full consideration of its impact.")
Let’s not mince words about these machines. They are a virtual strip search--and an outrage. Body scanners are a form of what security expert Bruce Schneier has called “security theater.” That is, they give people the illusion of safety without actually making us safer. A British MP who evaluated the body scanners in a former capacity, as a director at a leading defense technology company, said that they wouldn’t have stopped the trouser bomber aboard the Northwest flight. Despite over-hyped claims to the contrary, they simply can’t detect low-density materials hidden under clothing, such as liquid, powder, or thin plastics. In other words, the sacrifice these machines require of our privacy is utterly pointless. And, as it happens, it’s possible to design and use the body scanners in a way that protects privacy without diminishing security--but the U.S. government has failed to do so.
Millimeter-wave scanners came on the market after September 11 as a way of detecting high-density contraband, such as ceramics or wax, that would be missed by metal detectors when concealed under clothing--while avoiding radiation that could harm humans. The machines also reveal the naked human body far more graphically than a conventional x-ray. But, from the beginning, researchers who developed the millimeter machines at the Pacific Northwest National Laboratory offered an alternative design more sensitive to privacy. They proposed to project any concealed contraband onto a neutral, sexless mannequin while scrambling images of the passenger’s naked body into a nondescript blob. But the Bush administration chose the naked machine rather than the blob machine: Some blob skeptics argue that blotting out private parts would make it harder to detect explosives concealed, for example, in prosthetic genitalia. Of course, neither the blob nor the naked machine would have detected the suicide bombers who have proved perfectly willing to conceal explosives in real body cavities, as a Saudi suicide bomber proved in a failed attempt to assassinate a Saudi prince using explosives planted in a place where the sun doesn’t shine.
Former DHS director Michael Chertoff, whose consulting firm now represents the leading vendor of the millimeter machines, Rapiscan, has been a vocal cheerleader for body scanning: He called the Christmas bombing a “very vivid lesson in the value of that machinery.” In 2005, under Chertoff’s leadership, TSA ordered five scanners from Rapiscan, claiming that its naked images were less graphic than those of competitors. TSA also introduced one additional privacy protection: Agents who review the images of the naked bodies are in a separate room and, therefore, can’t see the passengers as they’re being scanned. According to the TSA website, the technology blurs all facial features, and, based on some news accounts, private parts have been blurred as well. But because the TSA remains free of independent oversight, it’s impossible to tell precisely how they’re being used.
Most troubling of all, the TSA website claims that “the machines have zero storage capability” and that “the system has no way to save, transmit or print the image.” But documents recently obtained by the Electronic Privacy Information Center reveal that, in 2008, the TSA told vendors that the machines it purchases must have the ability to send or store images when in “test” mode. (The TSA told CNN that the test mode can’t be enabled at airports.) Because no regulations prohibit the TSA from storing images, the House (but not the Senate) voted last year to ban the use of body scanning machines for primary screening and to prohibit images from being stored.
As long as the TSA fails to blur images of both faces and private parts, the machines will represent a serious threat to the dignity of some travelers from the 14 countries whose citizens will now be required to go through them (or face intrusive pat-downs) before entering the United States. Some interpretations of Islamic law, for example, forbid men from gazing at Muslim women unless they are veiled. It’s also unfortunate that, a year after the Supreme Court declared, 8-1, that strip searches in schools are unreasonable without some suspicion of danger or wrongdoing, virtual strip searches will soon be routine for many randomly selected travelers at airports, rather than reserved for secondary screening of suspicious individuals.
But the greatest privacy concern is that the images may later leak. As soon as a celebrity walks through a naked machine, some creep will want to save the picture and send it to the tabloids. And the danger that rogue officials may troll the database is hardly hypothetical. President Obama’s embattled nominee to head the TSA, Erroll Southers, conducted two searches of the confidential criminal records of his estranged wife’s boyfriend, downloaded the records, and passed them on to law enforcement, possibly in violation of the Privacy Act, and then gave a misleading account of the incident to Congress. (On January 20, Southers withdrew his nomination.) That’s why the images should be anonymous and ephemeral, so agents can’t save the pictures or connect them to names.
Even if the body scanners protected privacy, Schneier insists, they still would be a waste of money: The next plot rarely looks like the last one. But, if we need to waste money on feel-good technologies that don’t make us safer, let’s at least make sure that they don’t unnecessarily reveal us naked. President Obama says that he wants to “aggressively pursue enhanced screening technology ... consistent with privacy rights and civil liberties.” With a few simple technological and legal fixes, he can do precisely that. Blob machine or naked machine--the choice is his.
Jeffrey Rosen is the legal affairs editor of The New Republic.