Researchers find security flaws in backscatter X-ray scanners

Professor Hovav Shacham stands in front of the backscatter x-ray scanner as you would during a security check. Credit: Erik Jepsen/UC San Diego Publications

 http://phys.org/news/2014-08-flaws-backscatter-x-ray-scanners.html#jCp

A team of researchers from the University of California, San Diego, the University of Michigan, and Johns Hopkins University have discovered several security vulnerabilities in full-body backscatter X-ray scanners deployed to U.S. airports between 2009 and 2013.

In laboratory tests, the team was able to successfully conceal firearms and plastic explosive simulants from the Rapiscan Secure 1000 scanner. The team was also able to modify the scanner operating software so it presents an "all-clear" image to the operator even when contraband was detected. "Frankly, we were shocked by what we found," said J. Alex Halderman, a professor of computer science at the University of Michigan. "A clever attacker can smuggle contraband past the machines using surprisingly low-tech techniques."

The researchers attribute these shortcomings to the process by which the machines were designed and evaluated before their introduction at airports. "The system's designers seem to have assumed that attackers would not have access to a Secure 1000 to test and refine their attacks," said Hovav Shacham, a professor of computer science at UC San Diego. However, the researchers were able to purchase a government-surplus machine found on eBay and subject it to laboratory testing.

Many physical security systems that protect critical infrastructure are evaluated in secret, without input from the public or independent experts, the researchers said. In the case of the Secure 1000, that secrecy did not produce a system that can resist attackers who study and adapt to new security measures. "Secret testing should be replaced or augmented by rigorous, public, independent testing of the sort common in computer security," said Prof. Shacham.

From left are: Computer science Ph.D. student Keaton Mowery and computer science professor Hovav Shacham. Credit: Erik Jepsen/UC San Diego Publications

Secure 1000 scanners were removed from airports in 2013 due to privacy concerns, and are now being repurposed to jails, courthouses, and other government facilities. The researchers have suggested changes to screening procedures that can reduce, but not eliminate, the scanners' blind spots. However, "any screening process that uses these machines has to take into account their limitations," said Prof. Shacham.

 Explore further: Backscatter body scan redux

NIST- Backscatter Body Scan Redux

Contact: Larry Hudson 
(301) 975-2537
http://www.nist.gov/pml/div682/grp02/airport-scanner.cfm

The system’s scanning capabilities are illustrated on a phantom, a life-size dummy made of tissue-equivalent plastic, meaning it absorbs, transmits, and scatters x rays in a similar way to human tissue. Objects “concealed” beneath the dummy’s clothes -- a razor blade, powdered and plastic explosives, or a cell phone – are revealed in the scans. In the NIST and NAS studies, phantoms were used to assess the levels of backscattered x rays to operators and other bystanders. For full image of the phantom in the scanner, click here.

Airline passengers have already said bon voyage to the controversial backscatter x-ray security scanners, pulled from U.S. airports in 2013 over concerns about privacy and potential radiation risks. But the devices may be reintroduced in the future, in part because they produce superior images of many concealed threats, and Congress still wants to know whether these systems – currently used in prisons, in diamond mines, and by the military – produce safe levels of radiation for screeners and the people they screen.

Two years ago, researchers from the National Institute of Standards and Technology (NIST) in Gaithersburg, Md., produced a report* stating that the radiation exposure levels produced by one widely used class of backscatter machines were in compliance with applicable national and international safety standards. To evaluate these results, as well as similar findings at other institutions, Congress ordered an independent third-party assessment of the backscatter systems to be carried out by a team selected by the National Academy of Sciences (NAS). Last week, NIST hosted the NAS study at the Gaithersburg campus, in a lab that contains a government-surplus backscatter machine that once screened passengers at LaGuardia Airport.

Government agencies regularly ask the National Academies to conduct in-depth studies, says Erik Svedberg, senior program officer of the NAS National Materials and Manufacturing Board and study director for the NAS assessment of the scanner.

“As an independent not-for-profit organization, the National Academies can take a look at almost any issue within their purview without having a ‘stake in the game,’” Svedberg says.

The NAS group will be using the same model of scanner that NIST used to make its measurements – a Rapiscan Secure 1000 that was widely used to screen passengers at airports around the nation. NIST’s scanner is one of very few available machines in the country that is not either in storage or active use, says NIST researcher Lawrence Hudson, co-author of NIST’s original 2012 report.

Unlike the radiation used in the millimeter-wave whole-body scanners currently used in airports, the radiation in backscatter x-ray scanners such as the Secure 1000 is ionizing. Ionizing radiation can disrupt chemical bonds and, above certain exposure levels, has been shown to be associated with risks of cancer. However, “we live in a sea of radiation,” Hudson says, with natural sources of ionizing radiation including cosmic rays, bananas, and minerals that can appear in products such as cat litter. “So in order to assess relative risk, researchers need to accurately measure the exposures from such systems and compare those measurements to other exposures to ionizing radiation,” he continues.

For comparison, a person’s typical daily “effective whole-body dose” from natural sources is about 1,000 microrem (µrem) or, in SI units, 10 microSievert (µSv) -- both units for measuring radiation absorbed dose. An airplane flight from New York to LA adds an extra 4,000 µrem (40 µSv) to a passenger’s daily dose. The 2012 NIST analysis indicated that the dosage from a single screening with the Secure 1000 scanner is 1.26 µrem plus or minus 0.08 µrem (12.6 nSv plus or minus 0.8 nSv).

All x-ray sources penetrate as well as scatter, or reflect, when they encounter tissue. But instead of collecting the transmitted x rays as one would for a medical image, these scanners collect the x rays that backscatter from the skin. Usually the machines collect two images, one from the front and one from behind.

Members of the NAS team and National Academies representatives with the NIST scanner. From left to right: Leslie Braby, Erik Svedberg, Sandra Hyland, David Hintenlang, and Sadije Redzovic.

The Rapiscan Secure 1000 is a single-pose system. To be scanned, a person stands between two units, each of which houses a moveable x-ray source that travels up or down inside the unit. The x rays from the source fly through a horizontal slit that produces a flat, fan-shaped beam, then encounter a spinning wheel with notched edges. The notches further reduce the output to a small, square beam of x rays that scans the subject line by line like a fax machine. This “flying spot” of x rays goes through clothing, bounces off skin, and is collected by a series of large-area x-ray detectors inside the scanner.

“It’s a really clever way to acquire a well-resolved image of an object or a person with very little exposure to radiation,” Hudson says. The x-ray “spot” spends only a few tens of microseconds on each part of the body. The resolution of the resulting image is determined by the size of the small spot, not that of the detectors whose large size simply helps to increase the sensitivity.

In their 2012 report, the NIST team used radiation detectors to create a 3-D exposure map showing levels of radiation in the inspection zone, the space between the two scanning units where a person would stand. Hudson and colleagues then used this exposure map to estimate how much dose a person would get to their whole body as well as individual organs, particularly the skin and eyes.

Unsurprisingly, the skin gets a higher dose of x rays than an organ inside the body. However, Hudson says, skin is one of the least radiosensitive organs. The calculation of “effective dose” takes that into consideration to produce a number used by regulators to determine compliance with safety standards. Using three different approaches to estimate effective dose to various organs, NIST scientists found that these numbers are well within the limits recommended by the National Council on Radiation Protection and Measurements (NCRP) and the International Commission on Radiological Protection (ICRP). For example, it would take 465,340 scans in a year to reach the annual recommended limit for the skin and 139,602 scans to reach the recommended limit for the eye.

NIST researcher Jack Glover with a scanner image of the phantom.

The NAS report is scheduled to be ready by end of the year or the beginning of 2015, Svedberg says. Meanwhile, NIST has re-assessed the measurement techniques and tools that researchers have been using to measure a rastered source of x rays like that used in the backscatter technique. It is tricky to extrapolate the dose levels as a function of distance produced by the various implementations of x-ray backscatter systems, Hudson explains, because the x-ray sources aren’t stationary; instead, they are spatially translating and in some cases also rotating throughout a scan.

“If you want to compare studies measuring the radiation levels of such machines, you need to be able to correctly extrapolate to different stand-off distances to see if results are consistent,” Hudson says. “This has not been widely appreciated in the studies published so far and has been one source of confusion.”

In a forthcoming article in the Journal of Research of NIST, Hudson and colleagues conclude that the tools commonly used in radiation dosimetry, if properly applied and interpreted, are entirely adequate to determine radiation levels and rates for security-screening systems that employ the backscatter method. But, he explains, neither the measurements of NIST nor the NAS team are intended to assess the safety of backscatter x-ray scanners directly.

“NIST is not in the business of declaring such systems safe or unsafe,” Hudson says. “Our role is to inform the public debate by measuring the exposure levels absolutely, validating the measurement tools and methods, and assessing the uncertainties.”

* Assessment of the Rapiscan Secure 1000 Single Pose (ATR version) for Conformance with National Radiological Safety Standards, J. L. Glover, R. Minniti, L. T. Hudson, and N. Paulter, NIST report for the TSA, inter-agency agreement HSHQDC-11-X-00585, 28 September 2012

Public Misconception of Low Level Radiation Forces Security Decision Makers to Choose Inferior People Screening Portals (AIT) Says Homeland Security Research Corp.

http://www.prweb.com/releases/2014/06/prweb11969985.htm?PID=6153018

The whole body scanners technology dilemma – performance knockout of Backscatter X-Ray over MMWave gets overlooked due to public misconception of the safety of low level radiation.

According to a new report, U.S. People Security Screening Technologies, Industry & Market – 2014-2020 by Homeland Security Research Corp (HSRC), security decision makers are faced with an almost unfair dilemma in choosing Whole Body Scanners (AIT) technology. On the one hand, MMWave technology has limited resolution and above all cannot detect intra-cavity smuggling (e.g., passengers hiding plastic bags containing drugs or explosives in their body cavities, terrorists’ plans to use surgeries to implant explosives inside the body of would-be suicide aviation terrorists).

On the other hand, Backscatter X-Ray technology provides dramatically-superior screening performance
1.    It detects explosives and arms within and outside the human body
2.    It provides (some) material identification capabilities (e.g., TNT vs. a bar of chocolate)
3.    It can, due to its high spatial resolution, identify a bomb’s wires

In short, it would be very difficult for terrorists to beat this technology at a radiation dose of a two minutes’ flight at 30.000 feet.

The dilemma arises from the public’s fear of radiation – a term that is automatically connected with the word "cancer". Following 40 years of medical research, no study has indicated any elevation of cancer prevalence in commercial air crews who fly hundreds of hours per year for over 20 years over a non-flying population.

MMWave AIT Advantages 

• Does not require bulky portals
• Can provide the dielectric constraint of the screened concealed object (if it is dielectric)
• No privacy issues
• No ionizing radiation

MMWave AIT Disadvantages 

• Limited spatial resolution of ~1cm, but enough to detect an (>2 cm) object mounted outside the body
• Can’t detect intra-body concealed explosives and arms
• Limited throughput

Backscatter X-Ray Advantages 

• High spatial and material ID resolution
• Maximum detection of potential threats
• Detects metallic and non-metallic weapons
• IEDS detection
• Detects explosives and drugs
• Demonstrated effectiveness in prison environment
• Can be used as primary or secondary screening
• Hard to defeat
• Some material ID reduces secondary screening
• The 2nd generation systems have no privacy issues
• Detects intra-body concealed explosives and arms

Backscatter X-Ray Disadvantages 

• Requires ionizing radiation
• Public fear of radiation
• Limited throughput

The "U.S. People Security Screening Technologies, Industry & Market – 2014-2020" report dissects the market in 400 pages and 228 tables, and figures into 18 submarkets granulated by 7 vertical sub-markets, 8 technology sub-markets, and 3 revenue source sub-markets.

The report analyzes the U.S. people security screening technologies, industry and market from several perspectives, including:

Current and pipeline technologies: "Screen while Walk" Technologies, Automated Border Control, Biometric (& Other) ID Documents Screening Technologies, single energy X-ray, dual energy X-ray, backscatter X-ray, multi-view X-ray and coherent X-ray, Threat Image Projection (TIP), Cast and Artificial Limbs X-ray, Transportable X-RAY Checkpoints, Fused X-ray and ETD systems, Fused Hand Held baggage X-ray and RFID, Multi-Threat Multi-Modal X-Ray Screening, Stereoscopic "3D X-ray" Imaging, Explosives Trace Detectors (ETD), Ion Mobility Spectroscopy (IMS), ChemiLuminescence (CL), Electron Capture Detectors (ECD), Surface Acoustic Wave (SAW), ETD MicroChemLab on a Chip, Coated Micro-Cantilever ETD Detector, Nanotechnology Based ETD Detector, Next Generation ETD Technologies, X-ray Backscatter AIT Portals, Active MMWave Whole Body AIT Scanners, Passive MMWave Whole Body Scanners, Terahertz Whole Body Scanners, Terahertz Weapon Detection Portals, Terahertz Time Domain Spectroscopy (TTDS), Metal Detection Portals & Hand-Held Devices, Shoe Scanners, Liquid Explosives Scanners, Body Cavities Screening Systems, Computer Aided Detection (CAD) Software, Biometric Screening, Fused Biometric, Document Authentication Interrogation Portals, Multi-Modal & Multi-Threat Portals

Competitive Environment: 34 vendor profiles and their products description & prices. Companies included in the report are as follows: Auto Clear, ADANI, Red X Defense, Syagen Technology, Thermo Electron Corporation, Biosensor Applications, Hitachi, Scent Detection Technologies, Ketech Defence, Mistral Security Inc, Appealing Products, Inc (API) / ChemSee, DetectaChem LLC, Scintrex Trace, Flir Systems, Ion Applications Inc, BAHIA Corp (Sibel Ltd), CEIA, Garrett Electronics Inc, Fisher Labs, Brijot Imaging Systems, TeraView, ThruVision Systems, Gilardoni SpA, L-3 Communications Security & Detection Systems, QinetiQ Ltd, Westminster International Ltd, LIXI, Inc, Morpho Detection Inc, NUCTECH Co Ltd, Rapiscan Security Products, Inc, SCANNA MSC Ltd., Smiths Detection, Vidisco Ltd.

514 U.S. airports with over 100,000 annual screened passengers: Details including the number of screened passengers and the annual growth rate for each airport.

Market & industry analysis: Market drivers & inhibitors and the U.S. people screening industry SWOT analysis

Business environment: Competitive analysis, industry analysis , price elasticity, mergers, and acquisitions (M&A)

Business opportunities and challenges: Dozens of business opportunities, barriers to entry, supply-side & demand-side analysis, variable economic conditions, market tiers, defense primes & mega corporations’ inroads into the market, people screening market entry strategies

The report also includes the following 6 Appendixes:
Appendix A: Covert Walk-by People Screening Technologies
Appendix B: People Profiling and Behavior Tracking
Appendix C: CCTV-Based People Screening
Appendix D: Abbreviations
Appendix F: The People Screening Systems and Devices Industry
Appendix G: People screening Industry: Business Models & Strategies

Explore more Homeland Security and Public Safety Reports at
http://www.homelandsecurityresearch.com.

About Homeland Security Research Corp. (HSRC)
HSRC is a Washington, D.C.-based international market research and strategic consulting firm serving the Homeland Security and Public Safety communities. HSRC provides premium market, present & emerging technologies and industry expertise, enabling our global clients to gain critical insight into the business opportunities that exist within the Homeland Security & Public Safety markets. Government clients include the U.S. Congress, DHS, U.S. Army, U.S. Navy, NATO, U.K., Japan, Korea, Taiwan, Israel, Canada, Germany, Australia, Sweden, Finland, and Singapore; DOD, DOT, GAO, and the EU are among others. HSRC serves over 650 private sector clients, including all major defense and security contractors and many Fortune 500 companies. 70% of our reports are acquired by repeat customers.

Rapiscan full-body scanners to be removed from airports

My Note: The Rapiscan scanner employs backscatter x-ray, so this is not an obvious news article about THz, however, this could open the door for the TSA to look to THz systems to replace the ionizing, x-ray systems now in operation in many airports. L-3 which employs millimeter wave technology, used in other airports will reap the early benefits.  Whether a THz system will also be considered remains to be seen.
http://www.nytimes.com/2013/01/19/us/tsa-to-remove-invasive-body-scanners.html
Unpopular Full-Body Scanners to Be Removed From Airports

By RON NIXON
WASHINGTON — After years of complaints by passengers and members of Congress, the Transportation Security Administration said Friday that it would begin removing the controversial full-body scanners that produce revealing images of airline travelers beginning this summer.
  The agency said it canceled a contract, originally worth $40 million, with the maker of the scanners, Rapiscan, after the company failed to meet a Congressional deadline for new software that would protect passengers’ privacy. Since going into widespread use nearly three years ago, the scanners have been criticized by passengers for being too invasive and are the subject of lawsuits from privacy groups.
  The T.S.A. began deploying the scanners in 2010, after an attempt by Umar Farouk Abdulmutallab, a Nigerian citizen, to blow up a Detroit-bound Northwest Airlines flight by setting off explosives hidden in his underwear. The T.S.A. said that 174 of the machines are currently being used at airport checkpoints around the country. Another 76 are housed at a storage facility in Texas.
  Rapiscan will be required to pay for removing the scanners. In a statement, Deepak Chopra, the company’s president, said the decision to cancel the contract and remove the scanners was a “a mutually satisfactory agreement with the T.S.A.” The company said that scanners would be used at other government agencies.
  The removal of the Rapiscan scanners does not mean that all full-body scanners will be removed from airport security checkpoints. A second type of full-body scanner does not produce revealing images. Instead, it makes an avatar-like projection on security screens.
  The T.S.A. said those machines, which should be in airports by June, will allow quicker scans than those using X-rays.
  “This means faster lanes for the traveler and enhanced security,” the agency said.
Also see: http://www.forbes.com/sites/kashmirhill/2013/01/18/tsa-abandons-rapiscans-nude-body-scanners/