Swipe and go: it’s just that easy for some airport workers at San Jose International Airport to bypass all security checks that can take passengers and pilots sometimes hours to get through.
While we take off our shoes and go through body scanners, some employees are allowed to swipe a badge and climb a flight of stairs to get full access to the area where passengers and crews board planes.
After SJC’s security breach last month when a teenager stowed away in the wheel well on a flight to Hawaii, some lawmakers called for new security programs at SJC. The NBC Bay Area Investigative Unit found more concerns.
The Investigative Unit watched workers access doors with a single badge swipe just yards from passenger drop-off and feet from a well-used sidewalk. The Investigative Unit also found employees “piggybacking” (when an employee swipes one badge, but lets others follow ) through a set of doors marked “all personnel must swipe badge”.
An airport spokesperson later emailed the Investigative Unit, saying that door is mislabeled, and that employees are allowed to piggyback through those doors. SJC plans to change the sign.
The team saw workers who stock items at Starbucks and a delivery man without a uniform driving a minivan completely bypassing security.
“I’m not really comfortable with the concept of an honor system when it comes to airport security,” an insider who wanted to conceal his identity, told NBC Bay Area.
“The opportunity is certainly there for them to breach those security protocols,” the insider said.
While background checks are required to receive badges with access to secure areas, some security professionals say more checks are needed.
“I am not convinced that the background checks we do are actually sufficient,” said Rafi Ron, an international airport security expert. “The insider threat is a very serious problem.”
Airports invest significantly in passenger security. Ron says that employee and perimeter security can fall behind.
“The other side of the operation is to make sure the person who carries the badge is actually the person we ran the background check on,” Ron said.
He believes this can best be achieved by biometrics- like finger printing or hand scanning- as an extra check on the badge user, to safeguard the system from abuse, while maintaining efficiency.
“That is something that is unique and attached to the person’s body and cannot be imitated by anyone.”
The Silicon Valley Blue Ribbon Task Force on Aviation and Security recommended biometrics back in 2002, calling it “extraordinarily reliable” in making airports more secure. The task force, made up of Bay Area business leaders and tech gurus, put together post-9/11 technology-driven security recommendations for airports across the country.
It found weak control of the airport workforce due to inconsistent standards, uneven oversight and poor enforcement that could potentially allow unauthorized individuals to access secure areas.
“Technology is there and it should be utilized and implemented,” Congressman Mike Honda, who spearheaded the Blue Ribbon Task Force, told NBC Bay Area from Washington DC.
“One of the things that was disappointing is that they were not able to put in biometrics,” he said. “I believe we should revisit the recommendations; it was meant for everybody.”
Since then, airports across the country have implemented biometrics as a secondary check on badge swiping.
“We did test some biometrics here but that wasn’t an area that TSA has established any standards for at this point,” Kim Aguirre, Director of Aviation at San Jose International Airport, told the Investigative Unit.
When asked if the airport is certain that the individual swiping a badge actually owns that badge, Aguirre responded: “That’s certainly the goal of the program.”
Aguirre said she couldn’t talk specifics when it comes to the layers of SJC security protocol, but insisted that the system had enough checks and balances.
“You know, we call security kind of like an iceberg,” she said. “So you have the tip of the iceberg. We have a lot of things that go on behind the scenes to prepare that employee for what he or she is required and allowed to do.”
“The badge itself has different coding levels on it and there are checks and double checks you might not be seeing,” she continued. “We’re very confident in our program and we feel we’ve met and exceeded the requirements in many places.”
As for the airport insider, he is not as confident. “We’ve been lucky,” he said, “but I don’t think that you can rely on luck moving forward.”