Airports Are Too Safe

The case against checkpoint screening

Before we get into today’s piece, I’m pleased to let you know that my latest feature has been published in American Affairs.

“Why Are American Passenger Trains Slow?” starts with a puzzle: passenger trains in the USA were faster in the 1940s than they are today. The piece explores why this is the case. The answer isn’t that passenger rail went wrong; it’s that freight rail went spectacularly right.

Read it here.

---

If you take a plane in New York City, you must first perform a series of rituals. You set aside any liquids you possess, then you remove your shoes. You place your laptop and sometimes your phone into a plastic bin. You take off your belt and sometimes your shoes and place them into a plastic bin as well. You enter a machine that sees through your clothes. Only then may you board your plane.

If you take the subway in New York City, you swipe a card at a faregate and walk onto the train.

Put another way, airports have ‘checkpoint screening’: systematic inspection of every passenger and their belongings before boarding. Subways and rail stations do not.

Once we start thinking about this asymmetry, the stranger it seems. LaGuardia Airport hosted 32.8 million passengers in 2025, which averages roughly to 90,000 per day. Meanwhile, Penn Station processes more than 600,000 riders per day. Despite the fact that Penn Station has more than six times the number of passengers, no one verifies their identity, checks their bags, asks what liquids they are carrying, nor inspects their belts and footwear.

It’s not as if terrorist attacks on railways are unheard of. Madrid’s commuter trains were bombed in 2004, the London Underground in 2005, and Mumbai’s suburban railway in 2006, causing hundreds of deaths. And yet none of these now feature checkpoint screening. Indeed, the absence of checkpoints is regarded as a merit of rail and a demerit of air; there is no debate over just how many hours before one’s trip one should arrive at a rail station. Meanwhile, the USA’s Transportation Security Administration (TSA) employs over 56,000 people and spends more than $11 billion per year ensuring that no one boards an airplane with an unexamined shampoo bottle.

The asymmetry is so familiar that it barely registers as a choice. It feels like a law of nature: air travellers are screened but rail travellers are not. But it is a choice we’ve made, and the fact of that choice permits only two conclusions: either rail security is unconscionably negligent, or aviation security is irrationally excessive.

Our behaviour reveals which we actually believe.

A History of Violence

In the early days of commercial aviation there was no security at all. For a taste, watch Bullitt (1968) or Airport (1970), where it’s taken for granted that one can carry guns and bombs through terminals, onto the tarmac, or into aircraft without any mechanism for authorities to stop it, or even notice.

Those portrayals fall squarely within the so-called Golden Age of Hijacking, which began in 1961 when Antulio Ortiz, a passenger on a flight from Miami to Key West, threatened the pilot with a gun and demanded to be flown to Cuba. His was the first of 159 hijackings over the next ten years. After a 1972 incident where hijackers threatened to crash a plane into a nuclear reactor, in January 1973 the Federal Aviation Administration finally mandated that every passenger and their carry-on bag be inspected for weapons. Metal detectors appeared at airports that year.¹

The 1973 system had a clear purpose: prevent hijackers from bringing weapons aboard. Metal detectors caught guns and knives and, in principle, explosives carried by passengers, while X-ray machines did the same for carry-on luggage. This physical system to deal with hijacking complemented the social system, which was to cooperate. Acting on the theory that hijackers wanted hostages, not corpses, the doctrine for crew and passengers alike was to comply rather than resist. Going along with demands bought time for negotiation, which generally ended with surrender, or with the hijackers escaping the plane and being apprehended elsewhere without loss of life to those aboard the airplane.

This system, of metal detectors, X-ray machines, and cooperative passengers, persisted largely unchanged for nearly three decades. It was imperfect, but it addressed a real problem, and it worked reasonably well.

This was the model that the 9/11 attackers exploited. They carried box cutters on board the plane, which were seen as tools rather than weapons and as such were permitted. Once aboard, they relied on passengers and crew behaving passively. Lack of resistance meant they were able to carry out their attacks on the World Trade Center and the Pentagon. Notably, Flight 93 did not carry out such an attack, because the passengers did resist. Having learned, via Airphone, that other captured flights were being deliberately crashed, the passengers on that plane understood their only chance of survival was to fight back. They attempted to overpower their captors, who destroyed the plane rather than lose control of it.

That shift on Flight 93, from compliance to resistance, has turned out to be a permanent psychological change. Richard Reid, the ‘shoe’ bomber, was subdued by passengers and crew in 2001. Umar Farouk Abdulmutallab, the ‘underwear’ bomber, was subdued by passengers and crew in 2009. In both cases, everyone else on the plane understood that the right move was to restrain the hijacker rather than submit to his demands. This means that one of the two vulnerabilities the 9/11 attackers used is now closed.

The other is closed as well. By April 2003, all commercial aircraft were required to feature hardened cockpit doors. The flight deck is now mechanically isolated from the main cabin, and will remain that way irrespective of what might happen there. To commandeer the aircraft, as the 9/11 terrorists did, now requires breaching that barrier. At a cost of $12,000 to $17,000 per door, plus annual extra fuel costs of $3,000, these doors make it more-or-less impossible for the cockpit to be captured, meaning that, in the future, any attacker’s bad acts will be confined to the cabin.

This means that the specific attack vector that made 9/11 catastrophic, using aircraft as guided missiles against ground targets, is now defended against by layers that don’t depend on checkpoint performance. Cockpit doors provide physical protection. Passengers provide active resistance. The weaponization-of-aircraft scenario requires defeating both.

Despite these changes, checkpoint screening has become ever more elaborate in the post-9/11 era. After Reid’s failed shoe bombing in 2001, passengers were required to remove their shoes for X-ray inspection. After a foiled liquid-explosives plot in 2006, liquids were restricted to containers of 100 millilitres or less. After Abdulmutallab’s failed underwear bombing in 2009, full-body scanners were deployed. Each measure was a reaction to a specific plot. Each remains in place decades later, despite none of these measures having ever demonstrably prevented a subsequent attack.

Alist, Denver Airport Security Lines, 2008, Flickr, licensed under CC BY-NC 2.0

Indeed the evidence that checkpoint screening catches any threat is weak. In 2015, the Department of Homeland Security red-teamed its own screening and found that screeners failed to detect threat items in 67 of 70 tests: a failure rate of 95%. We’re told things are better now, but I’m not aware of any subsequent published test, so there’s no public evidence to support the claim.

So if the 9/11-style vulnerability has been addressed by hardened cockpit doors and changed passenger psychology, what is the marginal security value of the vast post-9/11 checkpoint expansion? The 1973 system screened for guns and knives; perhaps that still serves a purpose. But the layers added since—shoe scanning, liquid restrictions, body scanners—what are they for?

Asymmetries Everywhere

One way to answer that question is to look at how we treat other modes of mass passenger transport.

We don’t screen rail passengers. The London Underground handles 150,000 entries per hour without checkpoint screening; such checkpoints are also absent at Penn Station in New York, Gare du Nord in Paris, and Union Station in Toronto. All of these are open systems. Passengers merely buy a ticket and board.

This isn’t because rail is safe from terrorism. There were bombings of the London Underground in 2005 that killed 52. There were bombings of Mumbai’s suburban railway in 2006 that killed 209. And there were bombings of Madrid’s commuter train in 2004 that killed 193 and injured over 2,000.

These were not minor incidents, but we didn’t retrofit rail stations with aviation-style checkpoints. There certainly were security responses: the UK introduced surge policing and expanded CCTV coverage, India introduced frisking on some lines, and Spain implemented some access control, though only for high-speed intercity services, not conventional rail. The pattern is consistent across every nation that has suffered a major rail attack: increased vigilance and policing, but no universal checkpoint screening.

Why not?

The answer seems to be ‘it would be difficult and expensive’. For the Underground to screen 150,000 passengers per hour would require an army of screeners and would transform stations into permanent queues. This would be unbearable for the Underground or any urban transit system, which depend on rapid throughput to be useful. The geometry is different too: airports have natural choke points, while rail stations often have dozens of entrances, again for maximization of throughput.

That may apply to urban rail, like subways, but less so to stations for intercity or commuter rail, which have less throughput and more choke points. Security stations there would be feasible, at least in regard to infrastructure; they would still have imposed immense delay. But the Madrid bombings killed nearly 200 people; if aviation logic applied, that should have been enough to make us insist on screening, no matter the cost.

But we didn’t insist, and that choice reveals a preference: we value convenience and throughput over marginal security gains, even after catastrophic attacks. When we weigh the trade-off directly—when the costs of checkpoint screening are immediate and visible—we conclude that checkpoint screening isn’t worth it.

But in aviation, we act as if the opposite is true. We maintain a regime whose costs are staggering (over $11 billion annually in direct federal spending in the USA, plus equivalent per-capita amounts in other nations, plus hundreds of millions of passenger-hours in queues globally) and whose marginal benefits are undemonstrated.

Let me pause to acknowledge a counter-argument: perhaps aviation checkpoint screening deters terrorists, who shift their attacks to softer targets like rail. The Madrid, London, and Mumbai bombings might be evidence of successful deterrence, with subsequent displacement. But if checkpoint screening merely displaces attacks from aviation to rail, the net security benefit is zero; we’ve spent billions and wasted millions of hours to move the threat from one set of passengers to another… implicitly, a set of passengers we think less deserving of our protection.

And the fundamental point remains: whether those rail attacks were sui generis or displaced from harder targets, they killed hundreds, yet we didn’t impose checkpoints. We revealed our preference.

The Security Ratchet

If that revealed preference is for the rail model of security, why doesn’t aviation security move in that direction?

The reason for the air vs. rail distinction is a separate asymmetry among political incentives. An official who maintains excessive security incurs no blame for doing things the way they have always been done. Passengers may grumble, but passengers always grumble. Conversely, an official who loosens security would incur heavy blame in the event of an attack, regardless of whether the loosened measures would have prevented it.

Put another way, any official who changes the system must first incur costs of time, attention, and effort. If things go well, they receive no benefit in return, because no one notices; but if things go poorly, the disbenefit they receive would be massive.²

This incentive structure produces a ratchet. Security measures accumulate, but almost never recede. After the shoe-bomb plot, we started removing shoes. After the liquid explosives plot, we restricted liquids.³ After the underwear-bomb plot, we deployed full-body scanners. Each measure responds to a specific plot, but none is ever removed, at least not without a technological excuse. The only significant rollback in two decades came in July 2025, when the TSA eliminated the shoe-removal requirement… but only because new scanning technology could inspect footwear while still on people’s feet, not because anyone concluded the requirement was unnecessary.⁴

There’s a strong tell that the system understands that checkpoint screening is theatre, namely TSA PreCheck.

PreCheck allows enrolled passengers—currently over 20 million—to skip shoe removal, keep laptops in bags, and pass through expedited lanes. The price is $85 and a background check. The implicit logic is that pre-vetted travellers present lower risk and can therefore face reduced screening burdens. (Outside the USA, other nations have their own versions; Canada has NEXUS, for instance.)

The concession here is significant. If expedited screening is safe enough for 20 million PreCheck passengers, what is the marginal security value of the full screening regime for everyone else? The programme’s eligibility rules would have structurally excluded the 9/11 hijackers, who were neither U.S. citizens nor permanent residents. This might seem to justify PreCheck as a different security model—identity verification plus light screening—rather than simply “less screening.” But the identity verification that PreCheck provides (criminal background checks, watchlist screening) would not have flagged them: they had no disqualifying records and were not on any watchlists. The citizenship bar does real work, but it’s a blunt instrument that excludes millions of innocuous foreign travellers while doing nothing to catch citizens who radicalize.

What PreCheck actually demonstrates is that the TSA treats post-9/11 additions to checkpoint screening—the shoe removal, the liquid restrictions, the laptop divestiture—as dispensable for a large population. If those rituals were essential to security, waiving them for anyone would be unconscionable.⁵

Confusions about security distorts how we think about transport investment.

The case for high-speed rail rests partly on convenience: city-centre departures, walk-on boarding, no two-hour pre-flight buffer. But that convenience is a function of what we don’t require. If we screened rail passengers like air passengers, rail’s travel-time advantage would shrink. The comparison is invidious in a way that favours rail, but rail’s advantage in this case depends on a policy choice.

The implication runs both directions. One underexplored response to the question ‘how do we improve domestic travel?’ is not ‘build high-speed rail’ but ‘make flying less miserable by relaxing aviation security to evidence-based levels’. This is politically challenging, but the fact that it would be difficult to implement doesn’t make it wrong.

To be clear: I think that the rail model—layered security based on intelligence, visible policing, and passenger awareness rather than universal checkpoint screening—is the right baseline for mass transit in free societies. Aviation should move toward this model, not away from it. I am not arguing that we should be able to walk onto planes the way we walk onto trains, though that position is more defensible than it might first appear. But I am arguing that the post-9/11 checkpoint expansion has not demonstrated its value, and that aviation security should return to something like the 1973 baseline.

The costs of the current regime are enormous: fiscal (billions of dollars), temporal (hundreds of millions of passenger-hours), and philosophical (routine searches that we don’t permit in other contexts). The benefits are undemonstrated. While many people intuitively feel that checkpoint screening offers important protection, that intuition rests on unawareness that hardened doors and a shift in passenger psychology means airplanes can’t be weaponized now. Once you understand that the 9/11 attack vector is blocked by those layers, the case for the post-9/11 checkpoint expansion collapses.⁶

To return to where we began, LaGuardia’s 90,000 daily passengers submit to rituals but Penn Station’s 600,000 do not. We tolerate open rail because we’ve made a judgment—implicit, unspoken, but revealed through action—that checkpoint screening isn’t worth the cost. We maintain fortress aviation because we’re trapped in an equilibrium we cannot escape, not because we’ve judged differently.

This asymmetry is a policy choice we’ve made, and one we could unmake, if we could find the courage to do so.

Respect to Deric Tilson and Kevin Kohler for feedback on earlier drafts.

1. Surprisingly, checked luggage wasn’t scanned, despite the fact that the first bombing of an airplane via an explosive in checked luggage happened in 1955, and the trope was a common feature of thriller fiction in the Golden Age of Hijacking: see, for example, The Doomsday Flight (1966), which led to so many bomb-scare hoaxes that the FAA asked that the film never be shown again. Even the Lockerbie bombing in 1988 only led to sporadic inspection of checked luggage. Such checking only became mandatory after 2001.

2. Another reason may be that for many trips there is no reasonable alternative to air travel, meaning that security theatre poses less deadweight loss; having no other option, people submit to having their time wasted, and airlines do the same business they otherwise would. If trains, which face robust competition from intercity bus and the private car, indulged in security theatre, then passengers would desert them. This means that the mode can’t entertain this inefficiency.

3. I still remember the episode, sometime not long after 2006, when my carry-on bag was pulled at an airport and a smug security agent opened my toiletry kit and confiscated my travel bottle of shampoo, cost $5. I was actually pleased by this, because she stopped the inspection of the kit there and failed to discover my regular-size bottle of cologne, cost $95. Later I reflected that if the point had been to ‘make the plane safe’, she would have searched the whole bag for liquids; the fact that she ceased her search showed that the point was ‘follow a checklist’, or perhaps ‘perform a ritual’.

4. The relaxation only applies to shoes. More complex footwear, like cowboy boots or Wellingtons, must still be removed.

5. Another tell was that during the brief government shutdown of October 2025, TSA agents worked unpaid for a brief period. In this time, agents were less thorough in their work, and there was no important breach of security. Both facts suggest that checkpoint security is unnecessary, though for different reasons.

6. What would change my mind? One of two things.

Firstly, evidence that checkpoint screening has demonstrably prevented terrorist attacks. Absence of attacks is not enough as there are too many confounders: lack of attack could be explained by good intelligence work, incompetent or lazy terrorists, or general waning of terrorism as a political tool. The TSA has stated it cannot point to specific cases in which screeners stopped would-be terrorists, but if it could, that would matter.

Or secondly, a successful aircraft weaponization, despite hardened cockpit doors and active passenger resistance. That would demonstrate those layers are insufficient and checkpoint screening provides essential marginal protection. I’m glad to say that I don’t anticipate any such case.