If you take the subway in New York City, you swipe a card at a faregate and walk onto the train.
Put another way, airports have ‘checkpoint screening’: systematic inspection of every passenger and their belongings before boarding. Subways and rail stations do not.
It’s not as if terrorist attacks on railways are unheard of. Madrid’s commuter trains were bombed in 2004, the London Underground in 2005, and Mumbai’s suburban railway in 2006, causing hundreds of deaths. And yet none of these now feature checkpoint screening. Indeed, the absence of checkpoints is regarded as a merit of rail and a demerit of air; there is no debate over just how many hours before one’s trip one should arrive at a rail station. Meanwhile, the USA’s Transportation Security Administration (TSA) employs over 56,000 people and spends more than $11 billion per year ensuring that no one boards an airplane with an unexamined shampoo bottle.
The asymmetry is so familiar that it barely registers as a choice. It feels like a law of nature: air travellers are screened but rail travellers are not. But it is a choice we’ve made, and the fact of that choice permits only two conclusions: either rail security is unconscionably negligent, or aviation security is irrationally excessive.
Our behaviour reveals which we actually believe.
A History of Violence
In the early days of commercial aviation there was no security at all. For a taste, watch Bullitt (1968) or Airport (1970), where it’s taken for granted that one can carry guns and bombs through terminals, onto the tarmac, or into aircraft without any mechanism for authorities to stop it, or even notice.
Those portrayals fall squarely within the so-called Golden Age of Hijacking, which began in 1961 when Antulio Ortiz, a passenger on a flight from Miami to Key West, threatened the pilot with a gun and demanded to be flown to Cuba. His was the first of 159 hijackings over the next ten years. After a 1972 incident where hijackers threatened to crash a plane into a nuclear reactor, in January 1973 the Federal Aviation Administration finally mandated that every passenger and their carry-on bag be inspected for weapons. Metal detectors appeared at airports that year.
The 1973 system had a clear purpose: prevent hijackers from bringing weapons aboard. Metal detectors caught guns and knives and, in principle, explosives carried by passengers, while X-ray machines did the same for carry-on luggage. This physical system to deal with hijacking complemented the social system, which was to cooperate. Acting on the theory that hijackers wanted hostages, not corpses, the doctrine for crew and passengers alike was to comply rather than resist. Going along with demands bought time for negotiation, which generally ended with surrender, or with the hijackers escaping the plane and being apprehended elsewhere without loss of life to those aboard the airplane.
This system, of metal detectors, X-ray machines, and cooperative passengers, persisted largely unchanged for nearly three decades. It was imperfect, but it addressed a real problem, and it worked reasonably well.
This was the model that the 9/11 attackers exploited. They carried box cutters on board the plane, which were seen as tools rather than weapons and as such were permitted. Once aboard, they relied on passengers and crew behaving passively. Lack of resistance meant they were able to carry out their attacks on the World Trade Center and the Pentagon. Notably, Flight 93 did not carry out such an attack, because the passengers did resist. Having learned, via Airphone, that other captured flights were being deliberately crashed, the passengers on that plane understood their only chance of survival was to fight back. They attempted to overpower their captors, who destroyed the plane rather than lose control of it.
That shift on Flight 93, from compliance to resistance, has turned out to be a permanent psychological change. Richard Reid, the ‘shoe’ bomber, was subdued by passengers and crew in 2001. Umar Farouk Abdulmutallab, the ‘underwear’ bomber, was subdued by passengers and crew in 2009. In both cases, everyone else on the plane understood that the right move was to restrain the hijacker rather than submit to his demands. This means that one of the two vulnerabilities the 9/11 attackers used is now closed.
The other is closed as well. By April 2003, all commercial aircraft were required to feature hardened cockpit doors. The flight deck is now mechanically isolated from the main cabin, and will remain that way irrespective of what might happen there. To commandeer the aircraft, as the 9/11 terrorists did, now requires breaching that barrier. At a cost of $12,000 to $17,000 per door, plus annual extra fuel costs of $3,000, these doors make it more-or-less impossible for the cockpit to be captured, meaning that, in the future, any attacker’s bad acts will be confined to the cabin.
This means that the specific attack vector that made 9/11 catastrophic, using aircraft as guided missiles against ground targets, is now defended against by layers that don’t depend on checkpoint performance. Cockpit doors provide physical protection. Passengers provide active resistance. The weaponization-of-aircraft scenario requires defeating both. [ed. along with the presence of air marshals].
Despite these changes, checkpoint screening has become ever more elaborate in the post-9/11 era. After Reid’s failed shoe bombing in 2001, passengers were required to remove their shoes for X-ray inspection. After a foiled liquid-explosives plot in 2006, liquids were restricted to containers of 100 millilitres or less. After Abdulmutallab’s failed underwear bombing in 2009, full-body scanners were deployed. Each measure was a reaction to a specific plot. Each remains in place decades later, despite none of these measures having ever demonstrably prevented a subsequent attack.
Indeed the evidence that checkpoint screening catches any threat is weak. In 2015, the Department of Homeland Security red-teamed its own screening and found that screeners failed to detect threat items in 67 of 70 tests: a failure rate of 95%. We’re told things are better now, but I’m not aware of any subsequent published test, so there’s no public evidence to support the claim.
So if the 9/11-style vulnerability has been addressed by hardened cockpit doors and changed passenger psychology, what is the marginal security value of the vast post-9/11 checkpoint expansion? The 1973 system screened for guns and knives; perhaps that still serves a purpose. But the layers added since—shoe scanning, liquid restrictions, body scanners—what are they for? [...]
We maintain a regime whose costs are staggering (over $11 billion annually in direct federal spending in the USA, plus equivalent per-capita amounts in other nations, plus hundreds of millions of passenger-hours in queues globally) and whose marginal benefits are undemonstrated.
Let me pause to acknowledge a counter-argument: perhaps aviation checkpoint screening deters terrorists, who shift their attacks to softer targets like rail. The Madrid, London, and Mumbai bombings might be evidence of successful deterrence, with subsequent displacement. But if checkpoint screening merely displaces attacks from aviation to rail, the net security benefit is zero; we’ve spent billions and wasted millions of hours to move the threat from one set of passengers to another… implicitly, a set of passengers we think less deserving of our protection.
And the fundamental point remains: whether those rail attacks were sui generis or displaced from harder targets, they killed hundreds, yet we didn’t impose checkpoints. We revealed our preference.
The Security Ratchet
If that revealed preference is for the rail model of security, why doesn’t aviation security move in that direction?
The reason for the air vs. rail distinction is a separate asymmetry among political incentives. An official who maintains excessive security incurs no blame for doing things the way they have always been done. Passengers may grumble, but passengers always grumble. Conversely, an official who loosens security would incur heavy blame in the event of an attack, regardless of whether the loosened measures would have prevented it.
Put another way, any official who changes the system must first incur costs of time, attention, and effort. If things go well, they receive no benefit in return, because no one notices; but if things go poorly, the disbenefit they receive would be massive.
This incentive structure produces a ratchet. Security measures accumulate, but almost never recede. After the shoe-bomb plot, we started removing shoes. After the liquid explosives plot, we restricted liquids. After the underwear-bomb plot, we deployed full-body scanners. Each measure responds to a specific plot, but none is ever removed, at least not without a technological excuse. The only significant rollback in two decades came in July 2025, when the TSA eliminated the shoe-removal requirement… but only because new scanning technology could inspect footwear while still on people’s feet, not because anyone concluded the requirement was unnecessary.
There’s a strong tell that the system understands that checkpoint screening is theatre, namely TSA PreCheck.
by Andrew Miller, Changing Lanes | Read more:
Image: Alist, Denver Airport Security Lines, 2008, Flickr, licensed under CC BY-NC 2.0[ed. Finally, a voice of reason, no doubt shared by millions. I'd also add another reason for the asymmetry we see between air and rail travel: just the psychological aversion to falling (in a damaged aircraft) vs. smashing into something or being blown up. Nobody every said humans are totally rational.]
