alt Hacker NewsThis is trying to sanewash totally insane levels of risk aversion.
Do you think terrorists are really going to name their Bluetooth speaker "bomb"? Do you think this behaviour has any meaningful true positives?
This is the kind of brainworms thinking that has people throwing our their 150ml liquids out at TSA and taking their shoes off.
Replies
1. Are super-organized, highly-capable, fully-sane terrorists the only threat? Or does the threat model include mentally-ill / personality disorder people, who might make mistakes, or taunt those whose job it is to stop them? Or include people of either kind, who create diversions? Or include people who make a statement in an unexpected way?
2. Did the captain, flight control, and everyone else who needed to decide, have definitive information that the report was only an innocuous Bluetooth advertisement for an innocuous consumer device, and somehow knew that no other threat was going on? If not, then I'd commend whomever decided to follow protocol, and err on the side of inconveniencing a lot of people, rather than risk tragedies that the protocol was designed to prevent.
The really crazy thing is they returned to the origin instead of the nearest airport. If it was really an emergency they would have got out of the air at the nearest runway of suitable length instead of flying all the way back. Just theater.
I don't think a threatening name would be unheard of in a hijacking scenario. Someone calls saying they have a bomb on board, and as evidence there is a Bluetooth device called "bomb," showing they have an accomplice on board. They then make demands. This scenario doesn't seem unreasonable in light of pre-9/11 hijacking attempts.
Yes, this was a huge reaction to something that was almost certainly benign, but "almost certainly" isn't an acceptable risk for 100s of people in an explosive flying cylinder. It truly sucks, there maybe can be better procedures, but "100s of people majorly inconvenienced" is better than "100s of people dead in fireball."
You word "kind" unzips to three distinct categories:
1. failing hard: Is $trigger_word in the context of an attack, or is it innocuous? Failing hard then assessing the context question later is at least a simple system to design and implement safely. And an adversary can't pentest it. I mean they can, but they'll fail hard every time no matter the context. And that is very expensive for the attacker.
2. failing soft: throw away your too large container of liquid. I'm not sure what this liquid container rule prevents. In any case, an adversary can pentest this as often as they can buy a ticket, and they'll just blend in with all the other grumpy passengers forced to throw out their containers of liquid and continue on through security.
3. don't touch the spaghetti makefile: add a specific rule about removing shoes after the relevant attempt at an attack. Also, let's keep it for decades because no politician wants the liability of having voted to remove a TSA rule in the case of a future attack.
Conflating these all under a single "brainworm" category tells me you are exactly the kind of person who shouldn't be in charge of designing a secure system!
The comment reminded me of the time that we (developers) were told to avoid the use of the word "abort" in any text displayed to the user in a medical device. e.g., an error message that may have included the words "Operation aborted" would now be "Operation terminated."
Some industries just have trigger words to avoid.
To your point about a terrorist not naming the phone "bomb," I can foresee exactly that happening. Someone building a remotely triggered explosive device has a considerable incentive to not blow themselves up. Part of the safety behavior in that scenario could indeed include clearly naming the device "BOMB" or similar and then forgetting to rename it before sending it out the door.
> Do you think terrorists are really going to name their Bluetooth speaker "bomb"?
The bomb aboard Pan Am Flight 103 (the Lockerbie bombing) was hidden inside a Toshiba 'BomBeat' RT-SF16 radio.
Not about the UA flight, but the grandparent's first point. I can see how it's not simply superstition or theater. Critical info gets communicated either over fuzzy radio or 220 character ACARS messages. You wouldn't want to introduce into that context any spurious usages of phrases that would result in wasted time disambiguating whether a garbled transmission was referring to the Very Serious Bad kind of "crash" or referring to something comparatively trivial like the ticketing system being down.
That's such a poor argument. What is the alternative here? Just let anyone fly with a dozen devices with the names BOMB and CRASH hoping that an actual bomb doesn't go off? Systems and processes exist for a reason.
Your example of 150ml liquids has no connection to this security measure nor incident either. That's just a straw man.
>Do you think terrorists are really going to name their Bluetooth speaker "bomb"?
Yes
They're threatening to blow up an airliner or actually doing so to hit the news. 911 terrorists had blades, bomb jackets (whether these things are actual doesn't matter, saying you have them is enough), and eventually destroyed the tallest towers in NY and part of Pentagon and erased themselves while committing the crime
The point of terrorism is to be visible, dramatic and cause teror. It's not to get a stealth award for hacking the coupon system at the shop and get away with it
A bomb (real or not) planted by terrorists or hijackers is meant to be eventually known one way or another. It's the point
> Do you think terrorists are really going to name their Bluetooth speaker "bomb"? Do you think this behaviour has any meaningful true positives?
You seem overconfident. For one thing, someone getting a Bluetooth signal has absolutely no confidence the device is genuinely only a speaker. For another, it is entirely possible that a nefarious actor could screw up and forget to turn off a wireless transmitter.
Can you imagine if the threat was real and news came out that the Bluetooth device name literally said what it was? People right here would be mocking the personnel for being so stupid that they ignored literally what was written in front of them.
What if it is not the terrorists naming them? What if it is a good samaritan trying to warn the pilot but this is the only way they can get a message out?
If the terrorists goal is to create maximum fear and confusion, why not?
The staff's primary concern probably was not an actual bomb, but a prankster intentionally trying to create panic with elderly and technically illiterate.
This is explicitly mentioned in the article:
> Though some have questioned why anyone intending to blow up a plane would broadcast the word bomb, many terrorist acts have relied on the threat of a bomb as leverage during attempted hijackings or hostage situations.
> Do you think terrorists are really going to name their Bluetooth speaker "bomb"?
If they knew it was a BT speaker, they wouldn’t have returned.
OTOH, who would name a bomb with a Bluetooth transceiver in a way that advertises its function. I’d use something like “pacemaker” so that nobody would ask me to turn it off.
You can't compare a decision made in possession of all of the facts in a calm environment with full hindsight, with decision made in the moment with limited information and hundreds of lives on the line.
No sane terrorist will also call about a bomb on board, but those are taken seriously, too.
And as correctly mentioned by others, we shouldn’t be concentrating on an ideal game theory spherical terrorist in a vacuum.
If anything, this aversion has now made it clear that sneaking a device that can be made coin-sized into a bunch of passengers luggage would be sufficient to throw air travel into total chaos...
That doesn't seem like a smart precedent to set.
The pictures on the ground posted by some Redditors were even more ridiculous. What looked like over 100 police cars surrounded the airplane after it landed. If there was an actual bomb onboard why would the bomber wait for the plane to land?
It's as if multiple airline employees' and other officials' brains were simultaneously unable to process any sentence that starts with "If it was an actual bomb, then why..."
Instead, everyone applied the same rudimentary "IF [bomb mentioned in any context] THEN [take the most extreme actions written in the playbook]."
> Do you think terrorists are really going to name their Bluetooth speaker "bomb"?
Two comments.
If they did and no one took any action people would be asking for their (authority's) blood because they would look really stupid.
If terrorist are intelligent wouldn't they be doing exactly what is not expected of them.
This is modern version of Pascal's wager, a bad game theoretic outcome.
> Do you think terrorists are really going to name their Bluetooth speaker "bomb"? Do you think this behaviour has any meaningful true positives?
You know how they ask you if you have any contraband or if you’re a terrorist or whatever?
You’d be surprised at how many people get busted because they answer truthfully
I wouldn't have thought so, but until now I didn't even realise that there were Bluetooth devices with configurable names.
Imagine the headlines though! (says your will boss, or bosses boss)
It's still stupid, but they are imagining the news:
> This guy said "it's probably fine" right before Flight 1337 explodes over the Atlantic.
Now personally I'd actually be willing to take that risk: the odds are so overwhelmingly in favor of it being a dumb prank; you might as well refuse to take a shower for fear of slipping on the soap.
But all it takes is one person up the chain of command to say "this would be bad PR" and you've lost your job.
> Do you think terrorists are really going to name their Bluetooth speaker "bomb"?
Of course not!
That's what they'd name their bluetooth bomb.
I get your point, but I think that such high risk situations simply are not compatible with common sense, case by case decision making. As a consequence we need some extremely risk averse rules that everyone always follows, no matter how insanely risk averse they sometimes are and everyone in the situation probably knows it and agrees it’s insane.
Because the alternative is a nebulous fog of war where safety decisions are mood, situation, experience, and personality influenced when they shouldn’t be. And when accidents happen we only have difficult to interpret decisions to trace back to. The decisions have to be brainless and black and white.
Could the black and white rules be better? Maybe yes. Then let’s change them carefully.
But I do believe the rules should be black and white, and I personally in this light truly don’t mind I can’t name my Bluetooth device bomb, and I can’t say bomb or joke about having a bomb, no matter how obvious it is that I don’t have one, if that’s the current black and white rules.
Agreed. I’m glad I live in a normal country, last time I was in the US and Canada it struck me how truly insane it is.
Genuine terrorism relies on the creation of fear and alarm in their target group... not just concealment.
You can't yell "fire" in a crowded theater…
on the other hand someone could just be that stupid and if so at least you caught it, err on the side of caution basically
“Forensic investigators, reviewing the black box communications, discovered that the pilots had identified and were aware of a device named ‘bomb’ on the airplane but elected to take no action.”
> Do you think terrorists are really going to name their Bluetooth speaker "bomb"?
Yes. Not every time. But some of the time. Like imagine someone likes to stay organized and they have a bunch of bluetooth devices and gives them all logical names, speaker for speaker, keyboard for keyboard and bomb for bomb. They make a mental note to change the name of bomb before deploying it but then life happens and they forget to fix it.
[dead]
We've just grown accustomed to security theater. Don't forget, this security theater has resulted in more deaths than 9/11 ever did[0,1,2]
[0] Indirectly. The friction in air travel leads to more people driving, which is objectively a more deadly form of travel. We're talking several orders of magnitude, so even a low percentage of people shifting from air travel to car means substantial numbers. That means your risk of dying or being injured in a car crash also increases because it means more people are on the road. It's not a function of how good of a driver you are, it is a function of how good of a driver they are. So you really do want more people flying
[1] https://www.govexec.com/management/2012/11/tsa-killing-us/59...
[2] https://papers.ssrn.com/sol3/papers.cfm?abstract_id=677549