Since 2010, the Transportation Security Administration has largely dismissed the public's worries about the use of full-body x-ray security scanners. The official line is that the “naked scanners,” despite privacy and health concerns, are crucial to prevent individuals from sneaking weapons, explosives, and other dangerous materials onto aircraft or into a government building.

On Thursday, security researchers from UC San Diego, the University of Michigan, and Johns Hopkins presented results from a months-long study that show how someone can hide weapons from the scanners through a number of simple tricks. From using Teflon tape to cover an object or just strategic placement of an object around the body, to more cunning approaches like installing malware onto the scanner's console, a person could get away with a concealed weapon or explosive with little trouble.

Although the scanners the researchers tested – the Rapiscan Secure 1000 machines – haven’t been used in airports since 2013, they are still widely used in federal buildings like jails and courthouses. It cost taxpayers over $1 billion to have them installed in more than 160 airports.

Wired has more details on the study. One of the more striking aspects is how the researchers approached their testing, which differs from past experiments:

Unlike others who have made claims about vulnerabilities in full body scanner technology, the team of university researchers conducted their tests on an actual Rapiscan Secure 1000 system they purchased on eBay. They tried smuggling a variety of weapons through that scanner, and found—as [blogger Jonathan] Corbett did—that taping a gun to the side of a person’s body or sewing it to his pant’s leg hid its metal components against the scan’s black background. For that trick, only fully metal guns worked; An AR-15 was spotted due to its non-metal components, the researchers report, while an .380 ACP was nearly invisible. They also taped a folding knife to a person’s lower back with a thick layer of teflon tape, which they say completely masked it in the scan.

If all it takes is some money spent on eBay to acquire a full-body scanner, there’s no telling what a motivated group of would-be attackers with time on their hands could learn, especially if they had access to more advanced physical and digital equipment. The researchers are imploring the TSA and other security agencies to conduct more of the type of aggressive, "adversarial" testing the researcher's themselves ran.

“These machines were tested [by the TSA] in secret, presumably without this kind of adversarial mindset, thinking about how an attacker would adapt to the techniques being used,” says [study-coauthor J. Alex] Halderman […]“They might stop a naive attacker. But someone who applied just a bit of cleverness to the problem would be able to bypass them. And if they had access to a machine to test their attacks, they could render their ability to detect contraband virtually useless.”

So far, the TSA has yet to comment substantively on the study or its results.

[Wired]