TSA Scanners: The Usual Government-Think Of "Just Throw Money At It And Hope And Pretend It Works"
The Rapiscan scanners the TSA was using were easily foiled by blogger Jonathan Corbett, and they've been refoiled by a bunch of researchers. Andy Greenberg blogs at WIRED that researches easily slipped weapons past them:

Two years ago, a blogger named Jonathan Corbett published a YouTube video that seemed to show a facepalm-worthy vulnerability in the TSA's Rapiscan full-body X-ray scanners: Because metal detected by the scanners appeared black in the images they created, he claimed that any passenger could hide a weapon on the side of his or her body to render it invisible against the scans' black background. The TSA dismissed Corbett's findings, and even called reporters to caution them not to cover his video.

Now a team of security researchers from the University of California at San Diego, the University of Michigan, and Johns Hopkins plans to reveal their own results from months of testing that same model of scanner. And not only did they find that Corbett's weapon-hiding tactic worked; they also found that they could pull off a disturbing list of other possible tricks, such as using teflon tape to conceal weapons against someone's spine, installing malware on the scanner's console that spoofed scans, or simply molding plastic explosives around a person's body to make it nearly indistinguishable from flesh in the machine's images.

The Rapiscan Secure 1000 machines the researchers tested haven't actually been used in airports since last year, when they were replaced by millimeter wave scanners designed to better protect passengers' privacy. But the X-ray scanners are still installed in courthouses, jails, and other government security checkpoints around the country.

More importantly, the glaring vulnerabilities the researchers found in the security system demonstrate how poorly the machines were tested before they were deployed at a cost of more than $1 billion to more than 160 American airports, argues J. Alex Halderman, a University of Michigan computer science professor and one of the study's authors. The findings should raise questions regarding the TSA's claims about its current security measures, too.

"These machines were tested in secret, presumably without this kind of adversarial mindset, thinking about how an attacker would adapt to the techniques being used," says Halderman, who along with the other researchers will present the research at the Usenix Security Conference Thursday. "They might stop a naive attacker. But someone who applied just a bit of cleverness to the problem would be able to bypass them. And if they had access to a machine to test their attacks, they could render their ability to detect contraband virtually useless.

And let's be real about the rest of the "security" the TSA provides: Nobody who is of the caliber where they need a job feeling up people's genitals in airports is going to find anything other than their paycheck and some genital warts.