One of my rules when I coach 5^th and 6^th grade basketball is that the players must pass the ball five times before a shot. Every season when I explain this rule, I invariably get a lot of questions back:

“What if we have a breakaway layup?”

“What if I am wide open under the basket?”

“What if there is only a second left in the game?”

And it goes on, seemingly forever (you know what I mean if you deal with kids ). Individually, each of these questions is perfectly reasonable and I am always tempted to create a set of complex conditional rules that properly reflect each of the exceptions. But what I know is that if I give in to conditions, the rule essentially disappears and “player judgment” reigns supreme. This works fine with the smart team players, but not so well for the, uhh, “not-so-strategic” players more interested in personal stats than team dynamics.

And so it goes for TSA and airline security groups around the world. Should they make a set of straightforward rules that are easily enforceable yet will also have a significant number of (minor) false positives, or should they create a set of conditional rules that essentially leaves every decision up to the individual screener exercising his/her judgment? Let me tell you – they are darned if they do and darned if they don’t. And ridiculed each way.

In the information security world, we talk about the difference between “policy decision points” and “policy enforcement points” to express the different functions. In most computing environments, the PDP and PEP start off combined in a small set of instances but then get separated as networks grow while some central authority still wants to coordinate security efforts. The good news for security folks is that systems allow us to have the best of both worlds. PDPs can (basically) handle as many conditionals as you want – systems will scale and always make the same decision based on the same set of assumptions.

I guess what I am saying is… ridiculing airline security without understanding the monumental challenges they have is getting old. They’re PEPs, for crying out loud. Sure, I hate it as much as everyone else when they take my toothpaste, but it is only toothpaste. Get over it.