Researchers find security flaws in backscatter X-ray scanners

Professor Hovav Shacham stands in front of the backscatter x-ray scanner as you would during a security check. Credit: Erik Jepsen/UC San Diego Publications

 http://phys.org/news/2014-08-flaws-backscatter-x-ray-scanners.html#jCp

A team of researchers from the University of California, San Diego, the University of Michigan, and Johns Hopkins University have discovered several security vulnerabilities in full-body backscatter X-ray scanners deployed to U.S. airports between 2009 and 2013.

In laboratory tests, the team was able to successfully conceal firearms and plastic explosive simulants from the Rapiscan Secure 1000 scanner. The team was also able to modify the scanner operating software so it presents an "all-clear" image to the operator even when contraband was detected. "Frankly, we were shocked by what we found," said J. Alex Halderman, a professor of computer science at the University of Michigan. "A clever attacker can smuggle contraband past the machines using surprisingly low-tech techniques."

The researchers attribute these shortcomings to the process by which the machines were designed and evaluated before their introduction at airports. "The system's designers seem to have assumed that attackers would not have access to a Secure 1000 to test and refine their attacks," said Hovav Shacham, a professor of computer science at UC San Diego. However, the researchers were able to purchase a government-surplus machine found on eBay and subject it to laboratory testing.

Many physical security systems that protect critical infrastructure are evaluated in secret, without input from the public or independent experts, the researchers said. In the case of the Secure 1000, that secrecy did not produce a system that can resist attackers who study and adapt to new security measures. "Secret testing should be replaced or augmented by rigorous, public, independent testing of the sort common in computer security," said Prof. Shacham.

From left are: Computer science Ph.D. student Keaton Mowery and computer science professor Hovav Shacham. Credit: Erik Jepsen/UC San Diego Publications

Secure 1000 scanners were removed from airports in 2013 due to privacy concerns, and are now being repurposed to jails, courthouses, and other government facilities. The researchers have suggested changes to screening procedures that can reduce, but not eliminate, the scanners' blind spots. However, "any screening process that uses these machines has to take into account their limitations," said Prof. Shacham.

 Explore further: Backscatter body scan redux

NIST- Backscatter Body Scan Redux

Contact: Larry Hudson 
(301) 975-2537
http://www.nist.gov/pml/div682/grp02/airport-scanner.cfm

The system’s scanning capabilities are illustrated on a phantom, a life-size dummy made of tissue-equivalent plastic, meaning it absorbs, transmits, and scatters x rays in a similar way to human tissue. Objects “concealed” beneath the dummy’s clothes -- a razor blade, powdered and plastic explosives, or a cell phone – are revealed in the scans. In the NIST and NAS studies, phantoms were used to assess the levels of backscattered x rays to operators and other bystanders. For full image of the phantom in the scanner, click here.

Airline passengers have already said bon voyage to the controversial backscatter x-ray security scanners, pulled from U.S. airports in 2013 over concerns about privacy and potential radiation risks. But the devices may be reintroduced in the future, in part because they produce superior images of many concealed threats, and Congress still wants to know whether these systems – currently used in prisons, in diamond mines, and by the military – produce safe levels of radiation for screeners and the people they screen.

Two years ago, researchers from the National Institute of Standards and Technology (NIST) in Gaithersburg, Md., produced a report* stating that the radiation exposure levels produced by one widely used class of backscatter machines were in compliance with applicable national and international safety standards. To evaluate these results, as well as similar findings at other institutions, Congress ordered an independent third-party assessment of the backscatter systems to be carried out by a team selected by the National Academy of Sciences (NAS). Last week, NIST hosted the NAS study at the Gaithersburg campus, in a lab that contains a government-surplus backscatter machine that once screened passengers at LaGuardia Airport.

Government agencies regularly ask the National Academies to conduct in-depth studies, says Erik Svedberg, senior program officer of the NAS National Materials and Manufacturing Board and study director for the NAS assessment of the scanner.

“As an independent not-for-profit organization, the National Academies can take a look at almost any issue within their purview without having a ‘stake in the game,’” Svedberg says.

The NAS group will be using the same model of scanner that NIST used to make its measurements – a Rapiscan Secure 1000 that was widely used to screen passengers at airports around the nation. NIST’s scanner is one of very few available machines in the country that is not either in storage or active use, says NIST researcher Lawrence Hudson, co-author of NIST’s original 2012 report.

Unlike the radiation used in the millimeter-wave whole-body scanners currently used in airports, the radiation in backscatter x-ray scanners such as the Secure 1000 is ionizing. Ionizing radiation can disrupt chemical bonds and, above certain exposure levels, has been shown to be associated with risks of cancer. However, “we live in a sea of radiation,” Hudson says, with natural sources of ionizing radiation including cosmic rays, bananas, and minerals that can appear in products such as cat litter. “So in order to assess relative risk, researchers need to accurately measure the exposures from such systems and compare those measurements to other exposures to ionizing radiation,” he continues.

For comparison, a person’s typical daily “effective whole-body dose” from natural sources is about 1,000 microrem (µrem) or, in SI units, 10 microSievert (µSv) -- both units for measuring radiation absorbed dose. An airplane flight from New York to LA adds an extra 4,000 µrem (40 µSv) to a passenger’s daily dose. The 2012 NIST analysis indicated that the dosage from a single screening with the Secure 1000 scanner is 1.26 µrem plus or minus 0.08 µrem (12.6 nSv plus or minus 0.8 nSv).

All x-ray sources penetrate as well as scatter, or reflect, when they encounter tissue. But instead of collecting the transmitted x rays as one would for a medical image, these scanners collect the x rays that backscatter from the skin. Usually the machines collect two images, one from the front and one from behind.

Members of the NAS team and National Academies representatives with the NIST scanner. From left to right: Leslie Braby, Erik Svedberg, Sandra Hyland, David Hintenlang, and Sadije Redzovic.

The Rapiscan Secure 1000 is a single-pose system. To be scanned, a person stands between two units, each of which houses a moveable x-ray source that travels up or down inside the unit. The x rays from the source fly through a horizontal slit that produces a flat, fan-shaped beam, then encounter a spinning wheel with notched edges. The notches further reduce the output to a small, square beam of x rays that scans the subject line by line like a fax machine. This “flying spot” of x rays goes through clothing, bounces off skin, and is collected by a series of large-area x-ray detectors inside the scanner.

“It’s a really clever way to acquire a well-resolved image of an object or a person with very little exposure to radiation,” Hudson says. The x-ray “spot” spends only a few tens of microseconds on each part of the body. The resolution of the resulting image is determined by the size of the small spot, not that of the detectors whose large size simply helps to increase the sensitivity.

In their 2012 report, the NIST team used radiation detectors to create a 3-D exposure map showing levels of radiation in the inspection zone, the space between the two scanning units where a person would stand. Hudson and colleagues then used this exposure map to estimate how much dose a person would get to their whole body as well as individual organs, particularly the skin and eyes.

Unsurprisingly, the skin gets a higher dose of x rays than an organ inside the body. However, Hudson says, skin is one of the least radiosensitive organs. The calculation of “effective dose” takes that into consideration to produce a number used by regulators to determine compliance with safety standards. Using three different approaches to estimate effective dose to various organs, NIST scientists found that these numbers are well within the limits recommended by the National Council on Radiation Protection and Measurements (NCRP) and the International Commission on Radiological Protection (ICRP). For example, it would take 465,340 scans in a year to reach the annual recommended limit for the skin and 139,602 scans to reach the recommended limit for the eye.

NIST researcher Jack Glover with a scanner image of the phantom.

The NAS report is scheduled to be ready by end of the year or the beginning of 2015, Svedberg says. Meanwhile, NIST has re-assessed the measurement techniques and tools that researchers have been using to measure a rastered source of x rays like that used in the backscatter technique. It is tricky to extrapolate the dose levels as a function of distance produced by the various implementations of x-ray backscatter systems, Hudson explains, because the x-ray sources aren’t stationary; instead, they are spatially translating and in some cases also rotating throughout a scan.

“If you want to compare studies measuring the radiation levels of such machines, you need to be able to correctly extrapolate to different stand-off distances to see if results are consistent,” Hudson says. “This has not been widely appreciated in the studies published so far and has been one source of confusion.”

In a forthcoming article in the Journal of Research of NIST, Hudson and colleagues conclude that the tools commonly used in radiation dosimetry, if properly applied and interpreted, are entirely adequate to determine radiation levels and rates for security-screening systems that employ the backscatter method. But, he explains, neither the measurements of NIST nor the NAS team are intended to assess the safety of backscatter x-ray scanners directly.

“NIST is not in the business of declaring such systems safe or unsafe,” Hudson says. “Our role is to inform the public debate by measuring the exposure levels absolutely, validating the measurement tools and methods, and assessing the uncertainties.”

* Assessment of the Rapiscan Secure 1000 Single Pose (ATR version) for Conformance with National Radiological Safety Standards, J. L. Glover, R. Minniti, L. T. Hudson, and N. Paulter, NIST report for the TSA, inter-agency agreement HSHQDC-11-X-00585, 28 September 2012

Rapiscan full-body scanners to be removed from airports

My Note: The Rapiscan scanner employs backscatter x-ray, so this is not an obvious news article about THz, however, this could open the door for the TSA to look to THz systems to replace the ionizing, x-ray systems now in operation in many airports. L-3 which employs millimeter wave technology, used in other airports will reap the early benefits.  Whether a THz system will also be considered remains to be seen.
http://www.nytimes.com/2013/01/19/us/tsa-to-remove-invasive-body-scanners.html
Unpopular Full-Body Scanners to Be Removed From Airports

By RON NIXON
WASHINGTON — After years of complaints by passengers and members of Congress, the Transportation Security Administration said Friday that it would begin removing the controversial full-body scanners that produce revealing images of airline travelers beginning this summer.
  The agency said it canceled a contract, originally worth $40 million, with the maker of the scanners, Rapiscan, after the company failed to meet a Congressional deadline for new software that would protect passengers’ privacy. Since going into widespread use nearly three years ago, the scanners have been criticized by passengers for being too invasive and are the subject of lawsuits from privacy groups.
  The T.S.A. began deploying the scanners in 2010, after an attempt by Umar Farouk Abdulmutallab, a Nigerian citizen, to blow up a Detroit-bound Northwest Airlines flight by setting off explosives hidden in his underwear. The T.S.A. said that 174 of the machines are currently being used at airport checkpoints around the country. Another 76 are housed at a storage facility in Texas.
  Rapiscan will be required to pay for removing the scanners. In a statement, Deepak Chopra, the company’s president, said the decision to cancel the contract and remove the scanners was a “a mutually satisfactory agreement with the T.S.A.” The company said that scanners would be used at other government agencies.
  The removal of the Rapiscan scanners does not mean that all full-body scanners will be removed from airport security checkpoints. A second type of full-body scanner does not produce revealing images. Instead, it makes an avatar-like projection on security screens.
  The T.S.A. said those machines, which should be in airports by June, will allow quicker scans than those using X-rays.
  “This means faster lanes for the traveler and enhanced security,” the agency said.
Also see: http://www.forbes.com/sites/kashmirhill/2013/01/18/tsa-abandons-rapiscans-nude-body-scanners/