checkpoint of the future blueprint - aci...

CoF IATA VER 2.0_14Mar_11_MASTER 1

Checkpoint of the Future

Blueprint


Forward

The December 2009 attempted bombing of a Northwest Airlines flight bound for

Detroit, Michigan demonstrates that in the future aviation needs smarter and faster, next-

generation passenger screening measures to confront new and emerging threats. It also

dramatically illustrates that those who would do harm by injuring innocent passengers

and disrupting national economies continue to view aviation infrastructure as a primary

target.

This and other recent events also provide instructive lessons on the detection

capabilities of today’s checkpoints and illustrate a lack of correlation between passenger

inconvenience and increased detection fidelity. A system focused on finding bad objects

and offering no additional capabilities in exchange for long wait times and intrusive

personal inspections cannot expect to maintain the confidence of increasingly

sophisticated and experienced passengers.

Security and technology are often confused. IATA remains concerned that novel

technology is being viewed as the silver bullet for future checkpoints. Discussions by

national legislative bodies, regulators, and industry on novel drop-in technologies for

checkpoints should not mask the need for a new philosophy behind checkpoint

architecture.

For these reasons we believe that the day is rapidly approaching where the 40

year old concepts which serve as the underpinning for current checkpoints will become

obsolete. IATA has developed a Checkpoint of the Future blueprint.


Introduction

There is a need for a new concept in passenger security screening that

emphasizes enhanced security and more efficient throughput. Today’s screening

paradigm globally tends to be “one size fits all.” Elevated risk passengers use the same

lanes as the frequent fliers, which use the same lanes as everyone else. Passenger data

is not used at the checkpoint to make intelligent screening decisions. This paradigm has

created long queues, inconvenienced passengers, and generally not resulted in higher

detection levels of threatening objects.

The Checkpoint of the Future described here, relies on two basic concepts. First,

passengers should be screened at the airport with devices and processes

commensurate with what is known about them. Second, while passengers need to be

both physically and electronically screened, varying ratios of each can be used to create

a complete security picture of the traveler before a cleared-to-board is issued.

IATA is planning development of this Checkpoint in two phases. The first step is

to repurpose and reintegrate existing technology into an intermediate checkpoint. This

reworked checkpoint would integrate several central elements of the Checkpoint of the

Future including passenger data, behavioral analysis and the creation of new screening

lanes. In the longer term, we envision an interruption free passenger transit from curb to

aircraft. Combining biometrics, stand-off screening, and passenger data, travelers

should walk uninterrupted through a “tunnel of technology”1 where security and customs

processing occurs in a transparent manner.

Passenger information plays a driving role in Checkpoint of the Future. Data

collected by customs and immigration agencies would be merged with data collected for

security. Intelligence agencies then would conduct pre-screening to determine which of

two possible outcomes occur. Either a passenger is categorized as a “no fly” or into one

1 “technology” means all technologies that play a role in screening, including systems that enable data, information and intelligence to be gather, analyzed and transmitted and those that enable pre-screening, risk categorization and detection


of three risk levels for screening and it is this that marks a significant improvement over

previous processes. The results of categorization would be made known to screeners at

the checkpoint and that encoded information would be used to direct the passenger to

one of three new screening lanes: Known Traveler (KT), Normal Screening (NS), or

Enhanced Security (ES) for elevated risk passengers.

For example, a Known Traveler who has passed a background check and

registered their biometric data would be eligible for a high speed Known Traveler (KT)

lane at the checkpoint. Shoes would be left on, laptops allowed in bags, and coats would

remain on. Conversely, a passenger whom a regulator has categorized as an elevated

risk would go through an Enhanced Security (ES) lane where extremely thorough

screening would be performed. Shoes come off, coats are taken off, laptops come out of

bags and sophisticated explosives screening is performed.

Removing these two categories of passenger from regular screening lanes and

creating an optimized normal risk lane would greatly speed the screening process for the

remaining passengers. These individuals would proceed through a Normal Screening

(NS) lane which would allow for shoes to stay on, liquids/gels to stay in bags, computers

to remain in bags, but jackets would come off. Basic questions for behavior observation

would be asked.

In summary, this concept creates:

• New Enhanced Security lane where elevated risk passengers are removed from

the regular flows of the passenger checkpoint and screened rigorously.

• New Known Traveler lane where Known Travelers receive expedited screening

in exchange for enrolling into a program where they provide regulators with

extended biographical background information.

• A new and faster Normal Screening lane, where advanced passenger

information can be viewed in an encoded format at the checkpoint by screeners,


who will also observe behavior, and re-direct passengers to an enhanced

security lane if necessary.

It is important to note we consider there is not a single “correct” design

appropriate to all operating environments. To be relevant at the widest range of airports

and threat environments, Checkpoint of the Future is envisioned as a menu of screening

processes and components that can be implemented in isolation, in combination or in

full, as deemed necessary and practical by the state regulator.

The following pages more completely describe the concepts, processes, and

technology that form the basis of this framework.


1. The Foundations of this Screening Strategy

This screening strategy offers states and airports that are facing either new

checkpoint design or refurbishment of existing checkpoints, a solution in the form of a

menu of options, capable of being implemented in isolation, in combination or in full in a

manner compatible with that states’ ambient security environment and resource

availability.

Recent airline bombings and attempted bombings have been predominantly

aimed at the passenger cabin and not checked baggage. Terrorist intent appears to

have shifted from hold baggage to the checkpoint in the early 1990s. Some argue that it

may be easier to test and probe the vulnerability of the checkpoints than hold baggage

EDS systems. Because the level of terrorist threat is a function of intent and ability to

attack, the continued use of suicide attackers means that the threat may now actually be

higher at the checkpoint than from hold baggage.

Globally, many legislatures have been directing their security services to spend a

preponderance of their investments in deployment and improvement of hold baggage

screening and not the checkpoint. To date regulators have spent less than 10% of their

aviation security equipment investment budgets addressing checkpoint vulnerabilities

with the balance going toward hold baggage screening and more recently to cargo2. This

is in spite of the fact that detecting bomb components on passengers and in cabin bags

(in addition to weapons that might be used in hijackings), presents more daunting

screening and detection challenges than finding fully assembled bombs in checked

baggage. This indicates that a concentrated focus at the checkpoint may be warranted.

Today’s terrorists have evolved away from simple pipe and dynamite bombs with

alarm clock activators toward sophisticated Improvised Explosive Devices (IEDs) that

use a broad range of explosives and triggering mechanisms. They are less detectable

2 “Cabin Baggage Screening: Best Practices and Effective Technologies”, S. Wolff. Aviation Security International, August 2010; DHS Exhibit 300 Public Release BY11 / TSA - Electronic Baggage Screening Program (EBSP) (2011);


by screening technologies and are better concealed from manual and visual searches.

Terrorists have attempted to disperse components and use teams to bring distributed

IED components - each of which can appear innocuous, through the checkpoint and

assemble them in the sterile area or on board the targeted airliner (UK 2006 liquids plot).

Further, today’s checkpoint can only screen on a bag-by-bag and passenger-by-

passenger basis. The ability to inspect for items dispersed among different passengers

and their cabin bags is not a current capability.

This document shows how the underlying strategy and procedures for passenger

screening need to be, and can be, completely reassessed to increase the ability of the

system to interdict threats and improve passengers’ experience. It does this by:

• Integrating available government and passenger-specific information with the

physical screening process.

• Dividing passengers into risk categories so that the screening process for each

category can be more appropriately designed.

• Searching for components spread across passengers and cabin bags; to counter

tactics likely to be used by individual terrorists and terrorist teams.

• Using advanced and costly technologies and processes only on passengers that

are categorized as elevated risk and using lower cost screening methods on low

risk passengers enhancing prevention while reducing overall costs.

Using advanced and costly technologies and processes only on passengers that

are categorized as elevated risk and using lower cost screening methods on low risk

passengers enhances prevention while reducing overall costs.


2. Governing Principles of the Strategy

This checkpoint concept aims to combine intelligence, passenger information and

physical search into a single, integrated process that screens all passengers to a higher

standard. It removes cumbersome processes of moderate security value and replaces

the “one size fits all” screening approach with a series of processes that are tailored to

each passenger’s risk category based on information known about them.

The checkpoint has the following key goals:

• Substantially increase the likelihood of countering the next terrorist attempt.

• Improve the ease with which most travelers pass through security.

• Focus the use of expensive technologies and time-consuming processes only on

elevated risk passengers.

• Improve the traveling public’s experience and confidence in the screening

process.

To achieve these goals, the checkpoint relies on the following guiding principles

each of which will be discussed in turn:

• Pre-screen passengers into three risk groups based on intelligence, traveler

information and observed behavior.

• Apply physical screening methods appropriate to each group.

• Ensure that the system is capable of countering attempted attacks by terrorist

teams.

2.1 Pre-screen and Categorize Passengers Pre-screening sorts passengers into three categories: elevated risk, normal risk

and Known Travelers. Pre-screening is based on what is known from government and

industry sources about each passenger. Extensive data on passengers (both from

government databases and industry sources) already exists, but it is not effectively used


as part of the screening process at the checkpoint. Without compromising the security

integrity of the underlying data, the Checkpoint of the Future collects risk information

from these various sources and uses it to sort passengers a risk category that will

subsequently be identified in encoded format on the passenger’s boarding card.

2.2 Different Procedures but Equivalent Security Effectiveness Currently, all passengers are screened at the checkpoint by the same technology

tuned to the same threat levels. This leaves it up to security officers to decide whether

to direct potentially suspect individuals to a standardized secondary search. In the

Checkpoint of the Future, each passenger is subject to physical screening that is tailored

to the passenger’s risk category. The Checkpoint of the Future will ensure that the

scrutiny applied to each passenger is sufficient, but it combines differently the mix of

prescreening and physical inspection for each risk category.

Intelligence has resulted in the interdiction of terrorists. Intelligence and

passenger data are hence important determinants of the Checkpoint of the Future’s

effectiveness and efficiency, and their use allows this checkpoint to select physical

screening intensity according to each passenger’s risk level.

By sorting passengers into three groups, screening officers will know that, for

example, each elevated risk passenger will be sent to an enhanced security lane for a

reason and that its screening process will collect and enable the use of additional data to

reduce system vulnerability. This helps security managers to assign and motivate

screening officers much more effectively than when all passengers are considered of

equal risk. It results in an appropriate overall level of security that combines intelligence,

passenger data, and integrated information from scanners and physical searches, rather

than relying solely on specific search results.

2.3 Appropriate Physical Screening Passengers that have been thoroughly vetted via background checks according

to international and state specific standards will be considered lower risk and hence

subject to much less intensive, faster, less inconvenient physical screening.


Watch-list and other elevated-risk passengers will be subject to a much greater

level of security screening and interpretation along with data collection and storage. The

most time-consuming (and often most expensive) technology and processes will be used

routinely on the small subset of elevated-risk passengers and less often and

unpredictably on lower threat passengers.

2.4 Countering Team-based Attempts To combat the threat of terrorist teams, the Checkpoint of the Future may also

include the ability to look across different passengers’ and bags’ data to assess whether

bomb components are being carried individually. We call this process “flight-based

screening”. Flight-based screening would initially be applied to elevated risk passengers

only, though ideally this could expand to normal risk passengers at a later date.


3. Elements of the Checkpoint of the Future

The checkpoint consists of three elements:

• Prescreening

• Passenger and cabin baggage screening (checkpoint)

• Flight based screening (optional element)

In this section, we show how the checkpoint works and justify why it sorts

passengers into three categories, discuss for each category the screening technology

that would be used, and show how passengers would be processed.

Only a small fraction of passengers can be screened as intensively as is

necessary to interdict the attacks of well-prepared terrorists. Even then, enhanced

security screening requires so much staffing, costly, slow, and space consuming

equipment that its use must be balanced with expedited screening of passengers who

have been categorized as low risk, in order to prevent congestion and excessive queues

at checkpoints.

Once passengers have been screened as individuals, the flight based screening

element looks across elevated-risk individuals that may pose a combined risk to each

flight.

3.1 The Pre-screening Process Pre-screening is an initial categorization of passengers according to the degree

of risk they present. The degree of risk corresponds to the likelihood of a passenger

having the intention to participate in the bombing or hijacking of a flight. Pre-screening

thus produces three risk-based categories of passengers:

• Known Travelers (KTs) who will be screened by an expedited, less intensive

process;


• Elevated risk passengers, who will be subjected to enhanced security

screening; and

• Normal risk passengers who will be screened in an innovative manner that

includes a number of technical and process improvements to increase

throughput and enhance the passenger experience.

The pre-screening process may include:

• Comparing passenger’s names against state terrorist screening lists,

• Reviewing Passenger Name Records and Advanced Passenger Information for

potentially unexpected or inconsistent data that warrants investigation

• With the cooperation of air carriers, functionality associated with the US system

known as the Computer Assisted Passenger Pre-Screening System, which was

in use from 1996 to 2009.

• Designating a passenger as elevated risk based on the observations of a

behavioral observation screener at a checkpoint.

In addition to selecting elevated-risk passengers using the above process, the

pre-screening system would also employ the concept of unpredictability. Known

Travelers, air crew, other relevant staff and normal travelers would be randomly moved

to a lane with enhanced screening measures. The random selection rate could vary

depending on the number of passengers already being selected at any time. Random

selections would decrease when overloading, congestion, and delays in the high-

security lanes become imminent.

Terrorist attacks are very rare events, and the incidence of attackers is on the

order of one in some billions of passengers. So even if the elevated-risk category

comprises 10% of passengers, and the terrorists are among that 10%, only one in

hundreds of millions will actually be an attacker. It follows that high-risk passengers must

be treated with the courtesy and consideration accorded to other passengers.


Sorting of passengers into Known Travelers, enhanced security, and normal risk

categories, begins when they reserve their flights:

Passengers will check-in for their flights in the current manner, either in advance

(printing their own boarding papers) or at kiosks or counters at the airport. Algorithms

prevent issuing boarding cards to persons who are on state no-fly type lists and such

persons would be directed to counters for identification and appropriate disposition.

Know Travelers will proceed to the entrance of the Known Traveler screening

lane(s), partitioned from the rest of the checkpoint, where they will be admitted on the

basis of their boarding card and on-line validation of their biometric identifier against the

database. Validly identified aircrew and airport staff would also use the Known Traveler

lane(s). A possible refinement would be an automatic entrance set of doors activated by

a validated biometric; a properly constructed Known Traveler entrance could be totally

automated and un-staffed.

The process of separating elevated risk from normal risk passengers at the

checkpoint entrance is ideally automatic, but if necessary, a security officer would

positively direct each passenger into the correct screening lane. The passengers would

queue and present their ID media and boarding papers at the second (non-known

traveler) checkpoint entrance and, as indicated by boarding card readers, would be

positively directed into reliably separated normal and enhanced security lanes. Behavior

observation could cause normal risk passengers to be re-categorized as higher (but not

lower) risk on the basis of their observed behavior.

3.2 Passenger-Screening Checkpoint. Very high capacity consolidated checkpoint operations at large international

airports would be governed by three physically separated lane configurations (Known

Traveler /Normal/Enhanced Security) as shown on Page 39. Smaller airports with single

or dual lane checkpoints as well as width-restricted locations at larger facilities will be

supplied with a full complement of equipment used for an enhanced security lane that

can be positioned (staggered) in the small checkpoint to allow for appropriate screening


of the three groups. It is likely that this will require more customized layout design and

passenger management than when the lanes can be physically separated.

Separation of the three categories of passengers will be simplified by Known

Traveler’s being biometrically linked to their system and having a separate check-in

queue. They self-sort. Normal and elevated risk passengers will be separated at the

checkpoint entrance as described above. Once a passenger has been directed to an

Enhanced Security lane, that passenger will be physically separated from the normal

lane. A one-way entry gate to the high security lane as well as rigid translucent partitions

will prevent lane jumping. These arrangements are subject to whatever physical

limitations and other (aesthetic/architectural) issues that might be present at an

individual facility. The overriding concept is that physical separation must be maintained

once an elevated risk passenger has been selected and directed to an Enhanced

Security lane.

An essential pre-requisite for selection of detection technologies to be deployed

at each type of security lane is for regulators to assess how much of what types of

explosives need to be found. To date, terrorists have used a fairly wide range of military,

commercial, and homemade explosives in quantity ranges of roughly 100g. The

Checkpoint of the Future will incorporate technologies and processes that can both

counter that threat and also give probable indications of smaller masses. This process

is better than having a fixed threshold for detection whereby an amount slightly under

the threshold mass would be cleared. In terms of available technologies, we divide

devices into 3 tiers:

• Tier 1: Devices that form the core components of the security lanes.

• Tier 2: Supplementary devices to fill any gaps of detection related to types,

configurations and quantities of IED components in the assessed threat. The

assessed threat is liable to change unpredictably based on new intelligence of

terrorist capabilities and this may affect the technology selection in the High

Security lane.

• Tier 3: Aggressive, high cost technologies that would only be used to fill a

dangerous systemic gap in detection capability.


The final choice of technologies along with processes and configurations would

be determined by simulation modeling and then assembling and testing an Enhanced

Security lane with various components against the regulators’ assessed threat.

Table 1 shows an overview of the various screening technologies, capabilities and

attributes but does not include all technologies (such as transmission x-ray AIT,

quadrapole resonance (QR Portal) that could be used for inspecting elevated-risk

passengers internally, a vulnerability. Such technologies are either immature or

controversial, but may be necessary for certain elevated risk passengers in future and

could be added to the Enhanced Security lane, should the threat assessment warrant

them.

The following sections describe how each type of passenger is handled.

3.3 Known Travelers (KTs) Enrollment of Known Travelers will optional. The objective is to establish with

high confidence the trustworthiness – the complete absence of association with terrorism

– of as many passengers as practicable. The basis for that is a combination of first

knowing the passengers and then clearing them by checks against state crime and

terrorism databases.

The first step is self-nomination by passengers that are currently flying frequently.

Candidate nominees are thus better known from a security viewpoint, and they have the

added benefit of making up a disproportionately high fraction of passengers on any day.

When the candidate nominees have given their consent, they are cleared for registration

by two processes: a fingerprint-based criminal history check; and a check against a state

terrorism database. Although additional checks/ constraints could be incorporated into

the Known Traveler registration requirements at the discretion of individual states’

regulatory authorities, Checkpoint of the Future will set standards and best practices to

minimize the need for differences; establishing global standards is a key objective. If

these checks are completed without issue, the passenger can be enrolled as a Known

Traveler, with his or her biometric identifier and relevant personal data entered in a

government database.


It should be noted that these combined processes are similar to those used by

some states to clear airport workers to have unescorted access to an airport’s secure

area, airliners in the secure area, and practically everything that is loaded into the

airliners. Such checks on airport workers often take less than 72 hours from submission

of the required data and fingerprints, so they should take a similar time for checks on

Known Traveler applicants. The processing cost is not large, and since the Known

Traveler lanes will save considerably in staff and equipment in addition to improving the

passenger experience, it could be borne by the state or the passenger. The advantage

for the Known Traveler is a much quicker and more convenient screening process.

Once at the checkpoint, technology used to screen Known Travelers will consist

of:

• An AT X-ray in automated mode that has been set to a threshold alert level

that corresponds with the Known Travelers’ low risk level. It would allow

laptop computers to remain in bags. This is backed up by operator inspection

of any rejected bags.

• A walk-through metal detector calibrated to allow for shoe shanks and small

metal objects such as belt buckles while still reliably detecting Known

Traveler level threat objects. It would allow Known Travelers to keep their

shoes and jackets on.

Secondary search of Known Travelers or their cabin baggage that has caused

alarms on primary detectors could consist of metal detection hand wand or pat down and

an open bag search augmented by explosives trace detection, in a secondary search

area without impacting throughput of the Known Traveler lane. Exit from the Known

Traveler checkpoint is unrestricted after the KT passenger has completed the screening

process. Since these travelers have no need to “re-assemble” themselves, no benches

tables or chairs will be needed to be directly adjacent to their exit, because the KT will

have ample opportunity to gather the few objects that they needed to divest prior to

exiting. Since entrance to the Known Traveler lane is fully automated, physically

separated from the other lanes and entry gate controlled, the personnel required for

each Known Traveler lane could be reduced to as few as three, possibly two as soon as

the false alarm rate for this checkpoint configuration is validated.


3.4 Normal Risk Passengers

Normal risk passengers make up a considerable fraction of the total at the

checkpoint. They are the passengers who have none of the characteristics that would

cause them to be categorized as elevated risk but have not been enrolled as Known

Travelers, possibly because they are infrequent flyers. Given the high probability that

proper pre-screening has placed potential terrorists in the elevated risk category, it is

highly unlikely that the normal risk category includes any terrorists. Improving the overall

travel experience for normal risk travelers will be achieved by a combination of

technology and process enhancements that reflect the normal risk associated with this

group.

Normal risk passengers are identified as such at check-in by being neither Known

Travelers or in the elevated-risk category. Their category (normal) would be encoded on

their boarding cards, in the same manner as the other two categories are identified on

the boarding cards of Known Travelers and elevated-risk passengers. At the checkpoint

entrance, boarding card readers will show the directing security officer the risk category

of each passenger. Normal risk passengers will then be guided into the appropriate

screening lane. Any normal risk passengers who have been re-categorized as

enhanced risk by behavior analysis officers through questioning will either have their

boarding cards reprocessed to incorporate the higher risk or be escorted into the high

security screening lane, and the passenger’s change of category will be entered in the

security database. Families and motion-limited passengers should have the option of

being directed to a normal lane configured and reserved for them.

Normal security passenger screening will employ:

• Passenger identification;

• Brief questioning based on passenger data supplied to the screener at the

checkpoint to elicit behavioral characteristics that may warrant a referral to

enhanced screening.

Passengers will be screened by:

• Walk through metal detector


• Shoe scanner to eliminate the need to remove footwear.

• Cast/ prosthetic limb inspection systems in the family and motion limited lanes.

Passenger carry on bags and divested items will be screened with:

• Non-automated advanced technology x-ray with operator inspection,

• Liquids/ Bottle inspection system, if not employing advanced technology x-ray

w/liquid detection

• Any bags that require secondary search will be subject to:

o Open bag Trace detection

o Quadrupole resonance (QR) wand

o A secondary liquids inspection system to resolve any liquids flagged

by primary search

3.5 Elevated-Risk Passengers Elevated-risk passengers are those that present a higher likelihood of posing a

threat to airliners or which little biographical/law enforcement data is known. All such

passengers must be identified and directed to an enhanced security lane, in order to be

screened by the technology and processes needed to detect and interdict, with

sufficiently high confidence, the types of IEDs, and their disassembled components,

terrorists are known to use today. It is of course essential that any and all would-be

terrorists intending to attack an airliner will be included in the elevated category. It

follows that the pre-screening of passengers should have several layers, and if any layer

indicates that the passenger should be designated elevated risk, then that must be the

pre-screening system’s final determination, even if all other layers do not.

Once at the Enhanced Security lane entrance, a security officer scans the boarding card

and receives the high-risk passenger’s information. A photo of the passenger is taken

and stored by the Enhanced Security lane control computer along with the passenger’s

information. The passenger will then start the screening process. Passengers will

remove outer garments (coats, sweaters), shoes, wallets, belts, keys and other objects

on their person and place them in trays on the screening belt. Two tray colors will be

used, one for electronics, the other for non-electronic items. To ensure 100% control


over the passenger and cabin bag data and decisions, a bar code or RFID tag will be

printed and placed on cabin bags. Trays will have permanent identification tags so that

all items placed in trays will be tracked as well.

Advanced technologies to be deployed in the Enhanced Security lane are

described as being “orthogonal” to each other. The term as used here is meant to mean

that independent technologies produce results that combine so that the weaknesses of

one technology is compensated for the by the strength of another and vice versa. In this

schema the whole is (in terms of detection) greater than the sum of its parts. This

concept was validated in the US by the 2003 National Safe Skies Alliance study of

advanced checkpoint technology.

Therefore technologies of the Enhanced Security lane will be selected to be

orthogonal to each other and combined to achieve the highest detection rates available.

Bags will be screened using a carefully configured combination of the following devices:

• Computed tomography X-ray for bulk explosives and inspection of liquids/ bottles.

• Quadropole Resonance (QR) for scanning cabin bags and non-electronic divested

items for sheet and distributed explosives.

• Secondary search of rejected cabin bags will be conducted by manual and visual

inspection and:

o Open bag explosives trace detection for contents and electronics.

o Quadrupole resonance wand for searching linings.

o Liquid scan for any liquids flagged by the CT system.

If needed at a future date, Tier 3 technology options would include nuclear-based

systems (e.g. thermal neutron analysis, fast neutron analysis) for bulk material

inspection.

Passengers will be screened by a combination of the following devices:

• A second-generation (e.g. ion mass spectrometry-based) walk through trace detector


• A high-resolution (non-automated) body scanner in conjunction with a highly

sensitive walk-through metal detector for detection of concealed explosives that

might be carried by the passenger3.

• Shoe scanner (using, for example, a combination of QR and explosives trace

detection), which will be used to ensure explosives are not concealed inside socks

• Passengers requiring secondary search will be directed to a privacy booth to resolve

alarms in the passenger’s clothing or on his or her body.

o Desktop explosives trace detectors.

o A quadrupole resonance wand or technology with similar capability would be

useful for non-intrusively searching passengers and medical casts for

explosives complementing explosives trace detection. Technology for the

inspection of casts and prosthetic limbs will also be on hand and used as

needed.

3.6 Flight-based Screening (Optional) Flight-based screening is a method for determining whether elevated risk

travelers on the same flight might be working in tandem to bring various IED

components onto an aircraft by distributing them across themselves and their cabin

bags. Flight-based screening will work as follows:

1. Software first assesses any connections between/among elevated-risk passengers

on the same flight.

2. The process then allows all screening data on these travelers and bags to be stored

along with the passengers’ information organized by passenger and flight number in

a database.

3. A flight security inspector is assigned to any flight where the above connections have

been determined and uses the passenger data and screening results from the

Enhanced Security lane to assess the probability that a team attack is being

attempted.

3 A quadrupole resonance-based walk through portal or possibly wand would be valuable in addressing existing AIT technology coverage limitations


4. If indications of a possible team attempt are found, the inspector forwards the data,

along with any notes, and the flight-based screener’s recommendations to a PDA

carried by a roving security team.

5. The security team would meet the passengers at the gate and the security concern

would be resolved prior to boarding either at the gate, or by taking the passengers to

a security room at the terminal for a thorough inspection.

6. Depending on the search results, passengers would be released to board or sent to

law enforcement for further disposition.

Upon completion of the flight, the data would be erased from the server.


4. Performance considerations of this Checkpoint concept 4.1 Performance in general

Today’s screening paradigm globally tends to be “one size fits all.” Elevated risk

passengers use the same lanes as the frequent fliers, which use the same lanes as

everyone else. This paradigm creates long lines, inconveniences passengers, and

generally not resulted in higher detection levels of threatening objects. Further the

passenger information provided by travelers to states is not used in the current

checkpoint paradigm.

This Checkpoint, as opposed to today’s traditional checkpoint, relies on a basic

concept and that is to screen passengers with devices and process commensurate what

is known about them. It relies on the premise that passengers need to be both physically

screened and electronically screened, but varying ratios of each can be used to create a

complete security picture of the traveler.

Checkpoint performance is enhanced through the creation of three new

screening processes:

• Enhanced Security lanes where elevated risk passengers are removed from the

regular flows of the passenger checkpoint and more thoroughly screened than

today.

• Known Traveler lanes where Known Travelers receive expedited screening in

exchange for enrolling into a program where they provide regulators with


• Optimized Normal Screening lanes, where screeners use Advanced Passenger

Information (API) and combine it with brief behavior observation/active

questioning to determine if enhanced security lane is necessary.

There are two factors that need to be considered as part of this concept. First, to

detect today’s threats, Enhanced Security lanes will require several orthogonally linked


technologies to screen passengers, their clothing, and their cabin baggage. The overall

screening system will have a high false positive rate, and ultimate alarm resolution by

visual and manual searches will require exceptionally well trained screening staff. Even

more difficult will be the detection and interdiction of threats distributed among several

terrorist passengers and their cabin baggage.

It follows that the Enhanced Security lanes will be expensive in capital investment and

operating costs.

Second, relatively few Enhanced Security lanes may be required in any airport,

because only a small fraction of passengers will require such intensive screening.

Hence, the extra costs of this lane design will be offset by the more numerous normal

and Known Traveler lanes’ lower capital and operating costs. The key to affordability, as

well as effectiveness, is the categorization and screening of passengers according to the

degree of risk they present.

The Checkpoint of the Future will be judged on its performance outcomes, good

and bad. So we will set service level standards and test its performance against these;

the Checkpoint of the Future must be credible in operation and effect,

4.2 Addressing Countermeasures Today’s highly static and visible screening systems make it easier for adversaries

to learn limitations and plan methods to circumvent the processes. This Checkpoint

integrates physical security and relevant information about the passenger, and adapts

the former based on the latter. The overall process is thus concealed from adversaries

and further elements of unpredictability are added by a random selection process and

variation in the types of screening processes that will be used.

To ensure that potential adversaries cannot pass through the Known Traveler

lanes (where physical screening has been largely obviated by thorough background

checks), these lanes will be physically separated from other lanes and use a one-by-one

entry gate that requires biometric data and boarding card (or crew member ID) to be

confirmed prior to allowing an KT passenger to proceed into the lane. In addition,

translucent barriers will prevent non-KT passengers from observing the KT process.


Likewise, the Enhanced Security lane will be physically separated from other lanes

where possible. If not possible, at checkpoints with only one or two existing lanes, then

the enhanced security components and processes will be surrounded by translucent

barriers to prevent external observation.

The attempt to distribute components among different terrorists and cabin bags

(in a team-based attack) represents a substantial threat that needs to be addressed

using a new process: flight-based screening.

4.3 Operations The percentages of Known Travelers, normal and elevated risk passengers can

be forecast adequately by analyzing airline passenger data against the risk

categorization process and each of the three types of lanes will differ in both the dwell

time (the time that passengers reside within the screening process) and overall

passenger throughput.

The Known Traveler lane should be able to operate with significantly greater

speed than the pre 9/11 security checkpoints, especially if it incorporates integration

technology to collate primary search data and forward it to secondary search to expedite

that process. Intuitively, it is estimated that processing rate could possibly be twice faster

than today’s average screening lane times but this estimate will need to be validated

with real world testing.

On the process side, the use of Known Traveler programs to include wider cross

section passengers will reduce passenger numbers in the normal lanes and increase

throughput.

The Enhanced Security lane will require a longer dwell time and will handle fewer

passengers per hour. Based on operational studies performed in 2002 by the US

National Safe Skies Alliance using an early version of such a line (called the Advanced

Technology Screening Checkpoint – ATSC), the operational data indicated that the


ATSC handled roughly 50% of the throughput of a pre 9/11-era checkpoint4. With the

additional technologies and processes proposed for the Checkpoint of the Future, it is

likely that the Enhanced Security lane will operate at between 25 – 33% of the speed of

the proposed Normal Security lane.

Flight-based screening will be performed independently from the checkpoint

process once data have been collected on Enhanced Security lane passengers. Highly

trained inspectors will review data for each flight at a remote location (either at the

airport or centralized within a country) after the passenger has passed through security

but prior to boarding.

A critical part of the design will be to collect data and perform operational modeling

of these screening processes to understand how best to configure the technologies for

maximum operational efficiency and minimum dwell time without compromising security.

4.4 Cost5 The cost of aviation security in general and screening in particular, have

increased exponentially since 2001 in particular. While security represented 5 – 8

percent of airport operating costs a decade ago, that figure has increased to as much as

35 percent at some airports today and there can be no confidence this trend will change.

Checkpoint of the Future aims to arrest and if possible, reverse this trend.6

Facility build-out requirements and cost for the various options in FT Lanes,

Normal lanes and Enhanced Security lanes will vary greatly per site and are not included

in the following assumptions. Additionally, pre-existing equipment on site (depending

on its vintage and capability) could be incorporated into these designs and would reduce

capital costs accordingly. The cost estimates below are based on purchasing new

screening equipment: 4 Advanced Technology Detection System of Systems for Passenger Checkpoints Report Summary, National Safe Skies Alliance, May 2003 (Proprietary Document) 5 Data generated by consultants (Steve Wolff, Cathal Flynn, John Huey) and summarized in Table 1 6 Passenger Security Screening: Where to From Here? Prepared for ACI by Sydney Airport Corporation Limited. 5 November 2010


• Frequent Traveler Lane: US$468K

• Normal Screening Lane: US$369K (assuming shared secondary screening

equipment) Lower capital cost if existing equipment is used.

• Enhanced Security Lane: US$1.3M

• Flight-based Screening:

o Networked Computer workstation and storage: US$7.5K per station;

number of units will depend on peak # flights at each airport.

o Build-out costs will include a single centralized room, networking,

database storage and management estimated at US$50K per facility

o The centralized server and database software is estimated to cost

US$50-100K per facility.

o Non-recoverable engineering costs for development are unknown and will

depend on the final specifications for the flight-based screening process.

For planning and budgetary purposes, an installation and commissioning charge

of 10% of total value should be assumed and an annual maintenance cost (for

equipment only) should be assumed as 10% of equipment value after the first year,

assuming a one-year warranty on new equipment.

Due to the different challenges of the various screening processes, three skill levels of

screeners are likely to be required:

• Skill Level 1 – equivalent to today’s security officers, having proficiency in

operating and interpreting equipment and an understanding of procedures used

to select and conduct secondary search methods in response to primary search

decisions.

• Skill Level 2 – equivalent to today’s supervisors, excellent proficiency, aptitude

and skill in use and interpretation of decisions. Training in the nature

• of IEDs, components and a proven ability to identify IED components in images

and in physical searches

• Skill Level 3 –Specialist Screeners to be deployed on the Enhanced Security

Lane/Flight Based Screening Console only. New skill level. In addition to


excellent technology/ image interpretation proficiency, strong training and

understanding into IED construction, component alternatives and cross

referencing on databases

The total estimated head count for each of these lanes is shown in Table 2 below:

Table 2: Manpower Allocation between the Various Screening Processes

# Primary Screeners # Secondary

screeners

# Supervisors

KT Lane: 27 1, Skill Level 1.

Normal Screening Lane:

2 – 3 2, Skill Level 1 1, Skill Level 2

Enhanced Security lane:

3 2-3, Skill Level 2 1, Skill Level 3

Flight-based screening

1 per flight, Skill Level

3

In terms of estimated salary levels each skill level is estimated to compensate (relative to

today’s baseline) as follows:

• Skill level 1: Existing baseline

• Skill level 2: 150% of baseline

• Skill level 3: 200% of baseline

7 Automation and integration technology may reduce the number of primary screeners by 1


5. The Passenger Experience:

5.1 Known Traveler Any business passenger who is a Known Traveler and whose data is vetted by

government authorities would be virtually unimpeded after using his/her biometrics to

enter the checkpoint and will be able to rapidly proceed through the checkpoint. Any

secondary search required would be optimized and short in duration. The process

would be:

1. At check-in, the passenger’s data is acquired from a centralized database and

printed on the boarding card.

2. On arrival at the checkpoint, the traveler accesses a kiosk where biometrics and

identification data is compared with the stored data and, once confirmed, a gate

opens and the passenger is granted entry to the inspection process.

3. These passengers simply drop their bags on a belt while removing only

overcoats, and electronic items from their pockets. Computers will remain in

bags

4. The passenger then walks through a metal detector without removing shoes

5. A fully automated high speed process with equipment settings optimized to the

low threat level posed by a KT will keep the alarm rate low for both bags and the

passengers.

6. In the event of any alarm, all of data from the scanners are integrated and sent to

secondary search, allowing short duration, targeted search of any item that was

flagged by the X-ray and/or metal detector.

7. The KT will now be able to proceed to the departure area.

5.2 Crew member/employee The checkpoint would accommodate on a region-by-region basis the expedited

screening of crewmembers. This would either be via a separate crew lane modeled on

the same technologies and processes used in the KT lane, or if there is insufficient

space, the KT lane itself.


It is anticipated that false alarm rates for crews and employees will be even lower

than for regular KT’s given the experience they will develop with the process. To counter

the potential “insider” threat introduced into this part of the program a random number of

individuals will be sent to the normal or enhanced lanes.

5.3 Senior citizens Senior citizens should expect a significantly better, more leisurely screening

experience through security. Note that old age will not be used to redirect a passenger to

the normal lane if prescreening has categorized him as elevated risk.

5.4 Families Families should pass through the Normal Security lane. Families (particularly with

small children) typically require more time for screening and will be recommended to use

the distinct “family” lane within the Normal Security lanes, if in place at the airport.

Known Travelers that are traveling with their families can opt for normal lane screening

with their families if they wish.

The random selection algorithm for the Enhanced Security lane should include the

provision for preventing a single member of a family group from being randomly

designated as elevated risk. The intent being to keep family members together; either all

will be re-categorized, or none will. Note that this will not be used to redirect a

passenger to the normal lane if he otherwise would be considered elevated risk.

We anticipate families needing a well thought-out layout, space allocation (for

waiting family members and for reassembling their possessions) and the use of

secondary screening technologies (combined with shoe scanning on the front end) to

handle the expected higher false alarm rate and to both greatly enhance throughput and

yield a more positive experience for this lower threat group. Secondary search

technologies will be consistent with those used for the rest of the Normal Security lane

passengers.


5.5 Elevated Risk Passengers

This small group (estimated at less than 10%) of passengers will encounter a

multi-step, rigorous inspection process:

1. At the entrance to the checkpoint, an agent reading boarding cards will identify

enhanced risk passengers

2. Enhanced risk passengers will be sent to the Enhanced Security lane, which will

be visually isolated from the rest of the screening process and will utilize the

most highly trained and effective screeners and handling agents, who could be

dressed appropriately to distinguish themselves from the Normal- and Known

Traveler lane screeners.

3. Enhanced Security lane passengers will be required to remove from their person:

shoes, outer garments, belts, all items in pockets such as wallets, keys, etc,

4. Passengers will divest items from baggage, namely electronics and liquids for

screening and place them in trays. Ideally, different colored trays will be used for

divested electronics and non-electronics.

5. Passengers will pass through each of the primary screening technologies in turn

6. In parallel, bags will be sent through each primary screening system.

7. In the event of primary search rejection, the data from primary search will be

consolidated and stored in the passenger’s security record and sent to a

secondary search station

8. For secondary search, passengers and their bags will enter a private, gender

specific screening room where they will be searched. In the event of additional

concern, a thorough hand search will be used.

9. All data from both primary and secondary search will be stored in an enhanced

security passenger database for use by the flight-based screening process,

which occurs after they leave the security lane but prior to boarding.

10. Any passenger groups flagged by the flight-based screening process will be

intercepted at the gate, questioned either at the gate or at a nearby private room.

Additional search of their bags and persons will be necessary prior to being

released for boarding or referred to law enforcement.


Proper explanations beforehand (including a vigorous public relations effort)

combined with a dedicated and highly trained/professional screener will ensure that all

Enhanced Security lane passengers will be screened thoroughly and effectively while

being treated with dignity and respect.

6. Moving Forward

This section summarizes the main components used in the checkpoint concept

as well as describing follow-on tasks. List of primary components

6.1.1 Known Traveler Lane

Items that could be immediately researched and investigated

Entrance Biometric Reader (10 finger)

Video Surveillance Camera (wide angle)

Scanner (Boarding Card, Biometrics reader)

Scanner (Employee/Crew ID Card Reader)

Dual Sliding Door (Man Trap Assembly with Anti Piggyback Feature)

Opaque Glass Entry/Clear Glass Exit

Baggage screening X-ray in-feed conveyor and tray retrieval system

AT X-ray (automated mode for large object/weapon detection) with

Operators Console

Automatic bag diverter and reject bag conveyor

Cleared bag conveyor with bin return system.

Passenger screening Walk Through Metal Detector

Sorting AT Exit End Conveyor with bin-return system.

Secondary search Table Top Trace Detection System

Secondary Search Integrated Display Panel.

6.1.2 Enhanced Screening Lane

Entry Point Boarding Card Reader

Passenger Image Capture System

Entry Gate (ADA compliant Swinging or Turnstile)


Bag

Entry/Registration

Boarding Card Reader

Bag Tag Printer (Bag Entry/Registration)

Baggage screening Conveyor

Bag/Tray Tag Reader

Quadrupole resonance bag scanner

CT Bag Scanner with 3-D Workstation


Cleared bag conveyor with bin return system.

Bag/ Tray Tag Reader/Exit End

Passenger screening Boarding Card Reader (enter body scan)

Walk Through Metal Detector

Walk Through Trace Detection Portal (Second Generation/Mass Spec)

Backscatter AIT with local console

Boarding Card Reader (exit Body Scan)

Secondary Search Boarding Card Reader

Private male and female search booths with reject bag entry points

Bench-top Trace Detector

Liquid Detection

Cast/ prosthetics screening system

Quadrupole resonance wand

Bag transfer powered rollers/ conveyor

Checkpoint Exit Integrated Exit End Supervisors Work Station (GUI)

Exit Gate (ADA Swinging or Turnstile)

6.1.3 Normal Screening lane

Entrance Boarding Card Reader for Entry with Results Display Station (2

units)

Baggage screening AT X-Ray Dual View including ECAC or US approved Category

C/ D liquid detection (if available) with operator console


Cleared bag conveyor


Passenger

screening

Shoe Scanner

Walk Through Metal Detector

Secondary Search Search booth (semi private)

Trace Detection System

Liquid/Bottle Scanner

Millimeter-wave AIT with AIT Operator Console

Cast/ prosthetics screening system

We recommend focusing on the Known Traveler and Enhanced Security lanes

and assume initially that the Normal Security lane will largely resemble existing US and

European lanes with some level of process and throughput improvement. This can be

revisited later. The following tasks would allow the Checkpoint of the Future to rapidly

move forward.

6.2 Passenger Flow Analysis Understand passenger flow and load on each part of the process. With

regulators’ cooperation, this can potentially be done by off-line analysis:

• Collect and analyze IATA and carrier data to assess the percentage of likely KT

and Enhanced Security passengers on various types of flights.

• Assess the number of flights that have several elevated-risk passengers on them

as a percentage of the whole (this will allow estimation of the load on a flight-

based screening process) .

• Conduct operational modeling (using software) of KT and Enhanced Security

lanes to optimize technology configuration and design.

6.3 Design

• Develop requirements, specifications, and Concepts of Operations (CONOPS)

for the KT and Enhance Security lanes.

• Discuss with regulators the potential threat matrices that make sense for each

lane type.


• Review various core and ancillary technologies (biometrics, gates, integration

systems, inspection technologies) that are key parts of the KT and Enhanced

Security lanes.

• Combine the results into a final design and CONOPS for review with various

stakeholders

6.4 Implementation

• Configure a KT lane including gate access, screening technology and data

integration for optimized secondary search.

• Configure elements of an Enhanced Security lane at one or more airports.

• Depending on timeline and funding, perform some level of integration to show the

potential benefit of the combined user interface for the Enhanced Security lane.

6.5 Testing

• Operational testing of these elements at an airport.

• Efficacy testing at a Government-recognized independent test facility.

7. Conclusion The “object finding” checkpoint has served us well and kept the traveling public

safe. However, the December 2009 attempted bombing of a Northwest Airlines flight

bound for Detroit, Michigan demonstrates that in the future aviation needs smarter and

faster, next-generation passenger screening measures to confront new and emerging

threats. It also dramatically illustrates that those who would do harm by injuring innocent

passengers and disrupting national economies continue to view aviation infrastructure as

a primary target.

There is a need for a new concept in passenger security screening that

emphasizes enhanced security and more efficient throughput. Today’s screening

paradigm globally tends to be “one size fits all.” Elevated risk passengers use the same

lanes as the frequent fliers, which use the same lanes as everyone else. This paradigm

has created long lines, inconvenienced passengers, and generally not resulted in higher


detection levels of threatening objects. Further the passenger information provided by

travelers to states is not used in the current checkpoint paradigm.

This checkpoint, as opposed to today’s traditional checkpoint, relies on a basic

concept and that is to screen passengers with devices and process commensurate what

is known about them. It relies on the premise that passengers need to be both physically

screened and electronically screened, but varying ratios of each can be used to create a

complete security picture of the traveler.

In summary, this concept creates:

• New Enhanced Security lanes where elevated risk passengers are removed from

the regular flows of the passenger checkpoint.

• New Known Traveler lanes where registered flyers receive expedited screening

in exchange for enrolling into a program where they provide regulators with


• A new and faster Normal Screening lane, where advanced passenger

information can be viewed and used at the checkpoint by screeners to observe

behavior and direct passengers to an enhanced security lane if necessary.

It is important to stress there is no single “correct” design appropriate to all

operating environments and threat levels. The Checkpoint of the Future will not be a

one-size-fits-all solution. To be relevant at a wide range of airports and across the range

of threat situations, it will consist of a menu of screening components and processes that

can be used in isolation, in combination or as a whole. It speeds travel by moving Known

Travellers and those which may need enhanced screening out of the Normal Screening

Lines. It provides an intelligent resilient screening model that will be responsive to future

threat and attack attempts in an efficient, risk-based and cost effective manner.

CoF IATA VER 2 0_14Mar_11 36

Figure 1. Checkpoint of the Future – Tailored Screening Based on Risk


Figure 2. Known Traveller


Figure 3. Normal Screening


Figure 4. Enhanced Security


Figure 5. Tunnels of Technology


Figure 6. The Benefit of Orthogonal Screening. Combining limited performance technologies to achieve higher detection.

checkpoint of the future blueprint - aci...

Documents