Philip Baum is an international authority on behavioural analysis and profiling techniques. The editor of Aviation Security International, visiting professor of aviation security at Coventry University, and managing director of security consultancy Green Light Limited, speaks exclusively to NZSM.
NZSM: You’ve been in Brisbane conducting behavioural analysis training. What is your take on behaviour detection/analysis?
PB: I have long been an ardent proponent of behavioural analysis as a security solution – and what I believe to be the most important element of any facility’s security arsenal.
There’s a tendency in all industries to rely on technologies rather than on human beings. Time and time again in security it’s proven that technologies have significant limitations either because they are only able to detect certain types of prohibited substances, such as metal if you walk through an archway metal detector, or certain types of explosives in certain quantities if you’re using explosive trace detection technology.
The most effective technology of them all is the human brain, and it’s the one that’s hardest to regulate. Regulators find it very acceptable to have x-ray machines that can be subjected to government tests to see whether operators are able to identify specific threat images, but it’s very difficult for regulators to test subjective opinions.
Yet I believe that subjective opinion is probably the most important thing for us to look at, not only because opinions address traditional threats, such as a bomb being placed on an aircraft, but it’s also a more future-proof approach.
For example, what are we doing worldwide to combat the threat of chemical or biological weapon incidents? Next to nothing. And yet the only thing we can use against these is human beings and their ability to identify when an individual does not meet baseline behaviour.
NZSM: The United States Transportation Security Administration (TSA) has copped continued criticism over the subjectivity of their behavioural indicators, which have included such indicators as ‘excessive throat clearing’, ‘gazing down’, and ‘appears to be in disguise’. Do they have it wrong?
PB: In the United States the TSA program has come under significant criticism, but so has the traditional screening program. Only three or four years ago they had a 97 percent fail rate to detect items under x-ray examination that were supposed to be detectable. Those statics are now at 80 percent, but there are fallibilities with that system.
The problem with the TSA’s Behaviour Detection Officer (BDO) program was that it wasn’t being shown to find terrorists. Fortunately, there aren’t that many terrorists walking through our airports, and I hope that remains the case, but behaviour detection programs around the world are known to be able to identify [a wider range of] criminal activity.
It might not be a terrorist. It might be the victim of human trafficking, a human trafficker, a drug trafficker, or a person involved in money laundering. But what we’re proving is that behaviour detection identifies people doing things that are wrong.
Everyday people getting off international flights are being inspected by immigration and customs officers. If you can find people doing things wrong when they get off an aircraft, why not try and find people doing things wrong before they get onto the aircraft, and use a more effective solution based on common sense?
We’ve introduced so many ridiculous processes into the aviation system, such as the liquids, aerosols and gels restrictions.
It was completely understandable in the immediate aftermath of the [9/11] plot to do so. But if you look at it from a logical point of view, all we are doing is focusing screeners’ attention on legitimate passengers who are inadvertently carrying tubes of toothpaste that are too large. It’s actually diverting people’s attention from the real threats.
Other industries keep looking at what aviation is doing as if it’s best practice – and there is a lot of good about it, particularly its deterrent value, but by erecting checkpoints that create queues –chokepoints rather than checkpoints – we’re making targets for the terrorist or the fixated person.
So much of our security effort globally is in a counter terrorism approach because of ISIS or al Qaeda incidents, but I think we should – partly to avoid racial profiling – recognise that actually the threat exists everywhere from anyone, and that an incident can take place anywhere, anytime.
I’m in Australia at the moment, and I would say look at the 1996 incident involving Martin Bryant at Port Arthur in Tasmania. It’s an historic site, but not the most iconic site in Australia; not the number one target. Probably the last place in the world – certainly from a European perspective – where you would think you’d have what was at that time the largest loss of life by a lone gunman in modern history until what happened in Norway.
Enjoying this article? Consider a subscription to the print edition of New Zealand Security Magazine.
But even in the case of Norway, look at where it happened; it wasn’t in Oslo Airport, it was on the Island of Utøya, and I think that’s a lesson that we can all learn.
You may be working in Queenstown and feel immune to international terrorism. Maybe you’re not the number one target – you’re protected a little bit by your geography – but that doesn’t mean you haven’t got some lunatic out there like the one we saw last week in Pittsburgh Synagogue. Who was it that carried out that attack? No, it wasn’t al Qaeda or Islamists; it was a right-wing extremist.
NZSM: A big criticism of behavioural detection in the airport context is that people in airports are often flustered and running late for flights, or emotional because they’re bidding farewell to their loved ones, and they’re not necessarily operating in a baseline type of way. Is BD less effective in this context?
PB: There are certainly inherent stresses in air travel. There’s no question about that. But I actually think that people who work in the aviation environment can tell the difference between a potential terrorist and somebody who is stressed because they’re late for a flight.
If you look at a stereotypical family heading off to the Gold Coast on a two-week bucket and spade holiday, you can tell the difference between that family that people and a group of people trying to look like a family.
Why waste time getting them to take their shoes off and screening their laptops, and confiscating their liquids, aerosols and gels? Just get them through the process. I’m not saying don’t x-ray their bags, but let’s not detain people unnecessarily and slow the process down.
After the Brussels Airport attack, I was hoping that authorities wouldn’t react by creating another checkpoint in the terminal building’s check-in zone. But what did they do? They installed checkpoints outside, and they had queues outside. And who did they cite as their example for this? Istanbul. Three months later in Istanbul there was a terrorist attack where the checkpoint became the chokepoint and the first point to be targeted.
We have to do security on the move. We need to be able to identify people who are potential problems as far away from their intended targets as possible.
We need to be more intelligent. We need to be able to apply it in any environment. What does the typical visitor to the zoo look like? How do they behave? Who do they come with? What time do they arrive? What do they carry? And then look for the person who is doing hostile reconnaissance or potentially posing a threat today.
NZSM: Many layers of personnel are involved in the security continuum, from client-facing non-security staff to security officers to specialists like BDOs. Who needs to be engaged and equipped to identify suspicious behaviours?
PB: To a certain extent it’s about making everybody a part of the security web that protects any given facility. One of the problems with BDO programs is that BDOs tend to be people who are recruited for a specific task that are deployed often in pairs in limited numbers. They might not even see the suspicious person as they enter the facility, whether it be a shopping centre or an airport terminal.
My vision of behavioural analysis is that although you might have BDOs, it is actually everybody who are the eyes and ears. At an airport, everybody is asked to “see something, say something”, or to report unusual or suspicious behaviours.
But often, bizarrely, although we tell the general public to report it, if a security guard reports it, he/she is often seen to be slowing down the process, so there’s an inherent resistance to these people reporting things.
In airports and other venues, such as sports facilities, the objective often is facilitation. It’s to keep the queue moving.
If you’re the person loading bags onto the conveyer belt for the x-ray machine and you see something unusual, your observation may be unwelcome because you might slow down the throughput rate of the checkpoint and then people might not spend so much time airside and spending money in the duty-free store.
People might complain, whereas actually we need to be encouraging everybody in the system to be reporting their concerns. We ought to be doing drills and tests on a regular basis of people encouraging them and making sure they do identify unusual activity ,and encouraging management to see that as important part of the process. It’s not a tick a box exercise. Effective security is about using common sense.
NZSM: You mentioned the limitations of technology earlier and the advantage of humans in making subjective assessments. AI technologies are allowing the development of automated check-in kiosks capable of videoing passengers, analysing their facial expressions, identifying markers that are out of the norm and red-flagging them for a human assessment. What are your views on the use of AI in behaviour analysis?
PB: I’m not against technology. I’m very pro-technology, but I’m pro it being used intelligently and knowing how to use the right technology in the right environment.
I’m a little but concerned that we seem to be absolutely desperate to have a machine tell us who is okay and who is not. We seem hell-bent on having technology as part of the solution and we find the idea of human beings making subjective decisions abhorrent. I think that’s a mindset that has to change.
Of course, you can use technology to assist, but ultimately it’s people that are the problem and people that are the solution. We can’t keep trying to default to having a machine saying yes or no just because we are happier that an alarm went off and therefore gave us some ‘proof’ that there was a problem to address.
The other problem with those technologies in airports is the fact that we assume that if somebody has gone through a checkpoint and nothing wrong is found on them that they pose no threat. This doesn’t guard against the insider threat.
Take an airport like Heathrow that’s got around 100,000 airport pass holders who are working airside. Like any environment where you’ve got 100,000 people working, you’ve got a number of bad eggs.
What about the people who are working airside that access the restricted areas without going through the same intense screening processes as passengers? What about the person that goes through the checkpoint that hasn’t got something but goes to an airport duty-free shop and buys a bottle of alcohol and smashes it and turns it into a lethal weapon?
We’re not using joined-up thinking. What we need is people to be assessed – whether they are customers, guests or passengers – and we need our staff to be assessed – whether they be pilots, flight attendants, people working in concessions, or members of our own security teams. And we need to encourage people to report when people’s behaviours do not meet our baseline expectations, and to treat that identification as an important element of the screening process.
NZSM: Much of what is done in airports is dictated by governments and international organisations upon which the public places a higher burden of responsibility for being open and transparent and to be using standards. Is some form of international standard missing from behaviour detection that may help justify the way in which it is used in the aviation context?
From an aviation perspective, the International Civil Aviation Organisation in its latest amendment to Annex 17 has finally recognised that behavioural analysis is an important part of the process. It has become a recommendation, but not a standard.
This is a major step in the right direction, and the only reason they struggle to make it a standard is because standards have to be tested and testable, and it’s very difficult to come up with a test for somebody’s subjective opinion.
Ironically, we don’t argue about the use of subjective opinions when it comes to customs, quarantine or immigration controls. We don’t argue with the fact that the Police do it. We don’t argue with the fact that we all do it when we go to a social event and we decide who we want to interact with and who we don’t.
So why is it that when it comes to airport security checkpoints does everybody get paranoid that you’re going to be racially profiling people, even though the best examples of profiling working have identified, for instance, young pregnant Catholic Irish people – rather than the stereotypical Islamist – as the threat. I think that is the fault of the media.
NZSM: Should major public events have BDO-type people scanning crowds, should open public places and tourist destinations have security personnel who are specifically trained in behaviour analysis?
Every facility to a certain extent should have a behavioural analysis program. Maybe we shouldn’t call them Behaviour Detection Officers solely employed for that purpose, but you certainly need to increase people’s awareness, encourage people to challenge suspicious behaviour and when suspicious behaviour is identified to take it as seriously as if you had found it using x-ray technology.
What I would never do is if somebody had flagged somebody as being a possible threat then decide that the decision whether or not they can enter the facility or board the aircraft be determined on the basis of whether or not something prohibited is then found. That to me is utter nonsense. It is short-sighted tick-box security.
I think every establishment should be doing behavioural analysis. We’ve done sports events and festivals in the UK, and we’ve identified all sorts of unusual behaviours, not only pickpockets, but up-skirt photographers, people involved in shoplifting of retail outlets, people involved in illegal gambling, courtsiding at tennis events – all things that can be identified by behavioural analysis.
