How "Good" is the security at the Super Bowl?

The Superbowl is an annual event here in the USA and today we are going to look at the security of that event. How do they screen a person entering this event and what technology are they using? Are they on a level where we would place the TSA screening process and screener training? Is the security at a high level or is it more of smoke and mirrors like we had pre 9/11? How has DHS oversight of these types of events and lessons learned from past attacks played a role in the standards that have been developed?

So a few years ago we got asked to teach the NFL security staff using the x-rays at the Superbowl events on how to operate the system and threat detection. We were told that we only had 2 hours to teach them and not to worry about IEDs. We told them to have a nice day and find somebody else to do their training and I am sure they did. There was no way in hell we were going to even attempt to do what they were asking. What is even more important is what they asked provides you a very in-depth look at what level of understanding their management has of threat detection. You cannot even teach the operation of an x-ray system in 2 hours so how in the hell is the NFL expecting you to do both operation and threat detection in a 2-hour training course? Is that even remotely close to what a TSA screener is getting in training? The answer is "NO" and the comparison between what a TSA screener gets vs NFL is not even remotely close. Nor are there any training standards or documentation of training being conducted.

What would happen if the GAO did the same type of penetration testing at an NFL facility as they did to Federal Protective Services? How well would the security do in that type of testing and if it does as badly as I know it will why is DHS (which TSA falls under) allowing it?

Typically you never see x-rays used at NFL events for the general public and only until recently have they started using them to screen players and the media. The only tool that is really used at NFL events is walk-through and handheld metal detectors. The key to how well a WTMD "works" is based on what sensitivity the system is set. That sensitivity level determines what will and will not be detected. If the walk-through metal detector does not alarm the person is allowed to come in without any other screening.

One of the major mistakes people make with a WTMD is to try and "Discriminate" against non-threat items and only detect threat items. With the NFL speed is the focus and they want people to get in fast as possible so they do not want all of the cells phones, car keys, and pocket clutter alarming. The problem with this "technique" is it does not work and I am going to show you why.

The below chart is a WTMD system that has a sensitivity level from 1 to 300. 1 is the lowest level of sensitivity and 300 is the most sensitive. What you are seeing in the chart is where each one of these nonthreat items will alarm in that system. Basically, you are seeing at what sensitivity level they have to be at to alarm. If you go below that level they will not alarm. The other items in the chart are known detection standards for WTMD. This means it is a program that the unit is set based on a standard and that is the sensitivity level.

So if you do not want a cell phone to alarm the sensitivity needs to be VERY low (below 10). The other major factor is that detection of any metal in a WTMD is also affected by how close it is to the panel. So if a person has their cell phone in the side pocket you have to go even lower to keep it from alarming. Also when you start combining these items and have more than one on your body that increases the amount of metal the WTMD sees and will require you to lower the sensitivity even lower. If you have any sense when you look at this chart you will see that you cannot and never will be able to set a WTMD to not alarm to these items and still expect to detect threats. A person who thinks this is possible is what we typically refer to as somebody who is a few fries short of a happy meal.

If you still do not believe me the next chart is what I like to call "GAME OVER" and shows you the level of sensitivity you need to detect all of the different types of threats. We tested everything for you from guns, knives, grenades, mace, tasers, and IEDs. We did not just test one or two of them but a ton of different types and sizes. This below list when you look at what level of sensitivity you need to be at to detect each threat and next compare to what level you need to be at to not alarm to non-threat items, you will see that it cannot be done. In fact, it never could be done and if you are trying to do it you are not the sharpest knife in the drawer.

The next set of charts shows you different threat objects and where they would show up on a sensitive scale of 1 to 300. Most of you have never seen this before and the WTMD vendors DO NOT want you to see this. There is a brutal reality to what can and cannot be detected in a WTMD. The "Myth" about discrimination and the ability to not alarm to non-threat and only alarm to threats is a complete lie. When you look at the below remember that to not have a typical smart style cell phone alarm in a WTMD you would need to be at a very low sensitivity of around 10. Shoe shanks are at 35 and car keys with a FOB are at around 85. A women's bra with a metal underwire is going to be at 100. If you want a person with all of the items on them to not alarm you would need to lower the unit's detection sensitivity 10.

The threats are broken down as follows:

Let's first look at pocket knives and what level of sensitivity we need to detect these. We used a wide sample of different types of pocket knives with varying blade lengths and materials for construction. When you look at the chart you can see that if you do not want cell phones of other non-threat items alarming and you set the unit to that level just about everything below is not going to alarm in your system.

Next, let us look at handguns because they are a bigger threat and we want to make sure we detect a handgun. How will they measure up if we set the unit to not alarm to non-threat items so we can speed up the line? Handguns have a ton of metal so a very low setting should be able to detect these and we can let people keep their cells phones and other pocket clutter on their bodies.

Or can we.......?

When you look at the above the VERY LARGE handguns are the only ones that will alarm at a very low setting in the center of a person's body. This is where any WTMD has the weakest level of detection. Any threat you want to detect MUST be detectable in the center zone. This is why we did not even test these in the pocket area and used the same sensitivity required for the center zone. It would be biblically stupid to set a unit to detect a threat based on it being closer to the panels vs the center zone. So if you set the unit to a sensitivity level of 10 so a cell phone would not alarm you are an idiot based on the above testing.

The next chart is for kitchen and hunting-style knives because outside of the USA handguns is not as common. In Europe, it is very common for attacks to occur with these types of threats. That makes it very important for your WTMD to be able to detect them.

So again the non-threat item sensitivity setting so you can get people in faster is not going to work. However, some security experts look at this as a threat that cannot produce a large number of deaths so they are not so worried about this. However, if you or a family member are the ones getting stabbed at the venue and die my bet is that "expert" would be whom your family would like to stomp the living hell out of after your death.

So what about things like pepper spray/mace and tasers?

These are actually very hard to detect and require a semi-high level of sensitivity. The answer is that if you do not want non-threat items to not alarm you are not going to detect these in a WTMD.

OK, so what about something like a hand grenade or a pipe bomb?

Metal pipes bombs and metal hand grenades are detectable at a very low sensitivity but when you get into the PVC versions the metal content drops drastically. The only metal in these would be metallic fragmentation and the firing circuit. Metal fragmentation is also very easy to detect but it depends on the amount they use. They can also use non-metallic fragmentation in their device construction and in fact, they would if they were targeting a location using a WTMD. Terrorists are not stupid and do surveillance before they attack a target so they would never try and penetrate a checkpoint using a metal detector with something that has a high metallic content. They would also do dry runs as these are public entry points and be able to test what level of sensitivity is being used on the WTMD. WTMD is a dime a dozen and you can buy them on e-bay for very cheap. You can even buy high-end models like the CEIA 02PN20 used by most federal agencies. They can buy that unit and run all of the tests they want and if you think they would not...You are no expert.

I did a quick search on eBay and put in CEIA and on the first page the SMD600 unit came up for $799.99. For those of you that do not know the SMD600 is a VERY high sensitivity unit and a new one runs for $5315.00 on GSA Advantage.

When you look at the last category of Improvised Explosive Devices (IEDs) this is where a WTMD must be set to high sensitivity to be effective at detecting this type of threat. The security "experts" who only use the metal pipe bomb as the IED example are not Bomb Technicians. Any Bomb technician will tell you that a metal pipe bomb is NOT a good example of the IED and is a very small category of all of the different configurations and designs that have been used by terrorists. This threat is also the one the WTMD manufacturers NEVER want to talk about because you have to run the systems at a very high sensitivity to detect these. When you do that the people entering your checkpoint have to remove all of the metal objects or they will alarm. These WTMD manufacturers have created an extreme lack of understanding about what can and cannot be detected. They spin the "Discrimination" lie because that sells units and that is all they care about. Most so-called "Experts" in the security world have no clue what sensitivity setting will provide them the detection they need to detect each category of threat. In fact, this article is the first time they have seen hard data on what the detections windows actually are. When it comes to WTMD and detection most "experts" I have encountered have no clue what they are talking about.

So how does the IED threat break down in a WTMD and what levels of sensitivity do you need for detection?

The IED is detectable in a WTMD and what it is able to detect are the metallic components in the electrical circuit. Typically the power source will be the largest metallic object in the circuit and this will be what gets detected (if set correctly).

So let's get back to our original question on how good is the security at the super bowl. The answer is simple and all you need to do is look at what will and will not be detected by the metal detection technology they have deployed. If you can walk through the metal detector with all of your stuff and it does not alarm their security sucks. If you have to remove all of your stuff because it is alarming their security is potentially "OK".

The next question is what level of training are the security staff getting who are manning these checkpoints. If we were to compare the number of training hours on the hand wand and the WTMD of an NFL security screener vs a TSA screener how would it measure in comparison? In that category, the NFL would be in the totally sucks category as their training has ZERO standards put out by DHS. When I say "Standard" I mean very specific requirements on what training they must have and the hours from a training academy level. That does not even remotely exist and most of the staff I have encountered have either NO TRAINING or have been given a very short demonstration on what they need to do. I was at an event doing some testing and the security staff saw I knew my way around the x-ray. They actually came over and asked me to show them how to use it. They had been given no training and only were shown how to make the belt move. They even asked me what they were supposed to do if they found a gun. I am not making this up and this is just one example of what I have seen with my own eyes.

What I am seeing reminds me very much of the airport security pre 9/11 but much worse.