Q. What is the Secure 1000?
The Secure 1000 is a backscatter X-ray full-body scanner designed for people-screening applications. It works by illuminating the person being scanned with low-energy X-rays and measuring the X-rays that bounce back. Because the X-rays penetrate a short distance into your clothes or skin, this is supposed to let the Secure 1000 detect hidden objects, such as knives, guns, and explosives.
Q. Why did you choose to study the Secure 1000?
Whole body imaging has generated considerable controversy, including claims that these devices are unsafe, violate privacy and civil liberties, and are ineffective. Despite such concerns, neither the manufacturers nor the government agencies that deploy these devices have disclosed sufficient technical details to facilitate rigorous independent evaluation. This lack of transparency has limited the ability of policymakers, experts, and the public to assess contradicting claims.
Q. Isn’t the Secure 1000 used in airports?
The Secure 1000 was used by the TSA from 2009 until 2013, but has recently been removed from U.S. airports due to new privacy requirements; current TSA systems are based on a different scanning technology.
Q. Is the Secure 1000 used anywhere else?
The Secure 1000 units formerly used at airports are now being repurposed to jails, courthouses, and other government facilities.
Q. TSA says their machines weren‘t the same as the one you studied.
As we discuss in the report, TSA models of the Secure 1000 have certain differences from the machine we studied, including different operator software. However, the major problems we found with the machine’s effectiveness are due to the fundamental physics of the way it operates. Consequently, the vulnerabilities almost certainly affect all variants of the Secure 1000, including the ones that were used by TSA.
Q. Prior to your work, how was the Secure 1000 evaluated?
We are aware of only one prior public security evaluation of the Secure 1000, performed by Sandia National Labs in 1991. That report found some of the same issues we identified but also missed important attacks such as the ability to conceal plastic explosives. This reinforces the importance of open, independent evaluation by experienced security researchers.
Q. Is there another model for safely performing this kind of evaluation?
Ideally, evaluations of critical infrastructure systems would be performed prior to their deployment. However, we recognize that in some cases these systems have already deployed, in which case it is important to evaluate them without compromising security. California Secretary of State Debra Bowen’s 2007 “Top-to-Bottom” review of voting machines provides a good model here: teams of experts were given complete access to the systems under conditions of confidentiality but were then free to publish their findings with sensitive details redacted.
Q. Isn’t it bad to publish details of possible attacks?
We have omitted a small number of sensitive details from our attacks in order to avoid providing recipes that would allow an attacker to reliably defeat the screening process without having access to a machine for testing.
Q. Why are computer scientists involved in a study of the Secure 1000?
Whole body imagers are complex cyberphysical systems—much like cars and implantable medical devices—that raise novel computer security issues. In the Secure 1000, as in other cyberphysical screening systems, the image of the object scanned is processed by computer hardware and software. If that hardware and software has been tampered with, it can modify the actual scan in arbitrary ways, faking or concealing threats. Computer security must therefore be considered in any cyberphysical screening system; even so, no previous publicly available study of these devices even considers computer security.
Q. Did you disclose your findings to anyone before going public?
We disclosed our security-relevant findings and suggested procedural mitigations to both Rapiscan and the Department of Homeland Security in May 2014.
Q. How did you obtain the device?
We purchased our Rapiscan Secure 1000 from an eBay seller who had acquired it in 2012 at a surplus auction from a U.S. Government facility located in Europe.
Q. How did you pay for the device?
We purchased our Secure 1000 using intramural (startup) research funds, not an external grant.
Q. How did you limit the exposure of passers-by to radiation?
We worked closely with radiation safety staff at our university to minimize any dangers and assure regulatory compliance. In consultation with them, we located the device in a locked lab, far from the hallway, and facing a thick concrete wall.
Q. How did you limit the exposure of the researchers to radiation?
In consultation with radiation safety staff, we marked a 2 meter region around the machine with tape; no one except the scan subject was allowed inside this region during a scan. We decided, through consultation with our IRB, that only a principal investigator would be used as a scan subject. Furthermore, we used a torso phantom, made from material radiologically equivalent to soft tissue cast over a human skeleton, and used it in place of a human subject for all but the final confirmatory scans.
Q. You brought firearms on campus?
We transported and handled the firearms following procedures drafted in consultation with the Chief of Police and approved by the Chancellor. When brought on campus, the firearms were internally modified to prevent operation, unloaded, and unaccompanied by ammunition. We alerted the police dispatcher when the firearms were brought on and taken off campus.
Q. What about other whole body imagers?
TSA is currently using scanners based on a different technology, millimeter-wave imaging. We do not know if they are vulnerable to the same kind of attacks. We encourage TSA to subject these scanners to rigorous, independent, and public review.