Artificial intelligence and integrated screening are converging on the security screening point faster than the frameworks required to govern them. The hard questions are no longer technical.
It’s becoming increasingly hard to talk about the future of aviation security without talking about networking and artificial intelligence (AI), and harder still to talk about it without the conversation drifting into either utopia or alarm, though neither position is especially useful.
What is useful is to look at what is happening right now, and where it’s heading over the next decade. Because the questions are not whether the technology will work, but where the human being fits into the loop, what risks networked security creates, who is accountable when the machine is wrong, and whether AI will earn the trust of a traveling public that, for the most part, never see how decisions about their security are actually made.
Let’s start with where we are.
Already today it’s possible using available technology to link screening equipment to a single backend and have an AI brain do the analysis and the decision-making in a unified way across a network. And the network is important. You can’t deploy meaningful AI across a standalone X-ray or a single screening lane. Instead, AI needs a network to learn and become useful. The larger the network, the better it learns, and the more useful it becomes.
But as AI integrates and becomes embedded into security progresses, where does the human fit into the process?
At the start of AI integration, the human is clearly in the loop. In the AI learning phase, the operator does the analysis and makes the decisions, and the AI learns alongside them. That learning phase is not trivial because AI in screening is genuinely new and there is no past performance to draw on and no existing data set to compare against. The machine has to be taught the job from the ground up and taught correctly. In the same way that a new screening officer taught bad screening practices is at risk of carrying them throughout their career, the AI learning risk is the same.
However, once the operators are satisfied that the AI is making correct decisions, the relationship shifts. The human moves from “in the loop” to “on the “loop.” They are aware of, and supervising, the decision-making, but no longer part of each individual screening decision.
To move in this direction is to ultimately arrive at a position where AI becomes a substitute for the screening officer, with only some decisions elevated to a supervisory level. In a rudimentary manner this already occurs, with today’s level-one screening technology already making calls based on algorithms, and only suspect images being sent to the screener for review. AI, then, would be a continuation of that, only more capable and at massive scale, to the point where a single supervisor might oversee what an airport full of operators does now.
It’s likely that AI screening systems will never be fully autonomous, as AI can only be trained on what already exists, and cannot invent or imagine a threat that has never been seen. Dealing with the new and the emerging is precisely where human judgment remains indispensable. But it does move to a position where almost no “screening decisions” are being made by a person.
Many governments and airport operators, at very different levels of maturity, are already looking to centralize their screening decision-making and to incorporate AI networked learning. The ambition is to transition away from individual “smart” lanes in a single terminal, to a system that supports every screening lane across perhaps ten, twenty or thirty airports, all running centralized operations from a common backend.
The timeframe for this varies depending on who you ask, but there are credible people who believe this capability will be deployable within the next five years. Even if this is ambitious, what’s clear is the question is increasingly around when AI will be incorporated into screening, rather than whether it will happen at all.
However, every benefit of integration has a shadow. Networking, over-the-air updates, remote screening, multiplexing, reduced staffing and reduced human error are all real gains. But the same connectivity that delivers these benefits removes the air gaps that used to contain the security risks to a single location or piece of equipment.
Where screening equipment was once standalone, it now sits on the same network-dependent backbone as everything else at the airport and is exposed in the same way. A small, localized fault no longer stays small or localized. It can become a region-wide or national event in minutes.
The convergence of cybersecurity, physical security and operational technology is precisely what makes this possible, and the failure modes are less obvious than traditional ones. If you try to plug a European walk-through metal detector into a U.S. socket, the incompatibility announces itself immediately. AI systems are more complicated and more nuanced. A system that is quietly failing because two operating environments are incompatible may take months to reveal itself, or may only become apparent at the moment of catastrophic failure. Add to that the prospect of algorithms hallucinating, creating security gaps, or being trained on models that contain unseen security gaps, and the case for caution makes itself.
This problem of substituting a local problem for a regional one also exists when talking about biometric data and identity theft. In an effort to defend against the single individual committing some form of identity fraud, we potentially open up the entire traveling population to having their identities compromised through the misuse of their biometric data. The protection against fraud and impersonation must be robust because one of the central propositions of biometrics is that it addresses identity fraud. Yet someone who hacks the digital system could perpetrate a fraud far more widespread than any single forged document ever could. Moving the vulnerability from paper to silicon may have exacerbated it, not removed it.
An additional complication is the protection of biometric data. This is sensitive personal information, and different governments treat it in different ways. What happens when data is used by multiple stakeholders, across borders, in environments where data protection mean very different things?
As biometrics have been rolled out progressively at airports for many years, particularly in immigration and border management, there are essential lessons that aviation security needs to learn from the border implementation experience as it moves in this direction.
Near-term aviation security developments include face-on-the-move recognition at security screening points; automated reconciliation that links real-time passenger manifests with biometric boarding data to confirm identity before a passenger reaches secure areas of the airport; and advanced flow monitoring that tracks movement from airport arrival to exit to detect behavior anomalies. None of this is speculative. It’s being implemented today.
Perhaps one day AI will allow us to move away from physical screening altogether toward more ambitious visions of AI-assisted behavior detection, passenger differentiation, and a cyber-led risk mapping of every passenger.
In the meantime, questions need to be answered before capability arrives. At what stage do you rely on the judgment of the machine? Is there a point at which a screening system becomes autonomous and the human is removed from the equation entirely? At what point can AI demonstrate it’s as capable, or more capable than what exists today, and what is the test for that?
However, suppose for a moment all the technical questions are answered, and the AI is demonstrably better than the operators it replaces. There is still the issue of the traveling public.
In recent years, with the exponential increase in use of drone technology, the debate has begun as to whether automated passenger flight is, or at some point will be, safer than human-piloted flight. Sully Sullenberger’s or Richard de Crespigny’s passengers would argue one way, and the passengers of Aeroflot 593 and Air France 447 might argue the opposite, if they were still alive to do so.
At the end of the day, whether we ever see pilotless passenger aircraft will be decided not by whether one is safer than the other, but what the traveling public perceives as safer. AI in security may go the same way, though given most security decisions are already opaque to the public, they may never really know, or care, that a machine is now making the call. After all, less than 1% of people even bother to read the Apple terms and conditions.
That opacity cuts both ways. Government decision-makers and many of the organizations that buy and operate these technologies do not fully understand cybersecurity or the risks they are exposing their data, systems, and operations to. We may be asking passengers to entrust their security and their most personal data to systems whose risks the people deploying them may not fully understand and cannot fully articulate.
So, it’s worth resisting the temptation to run ahead of ourselves. We are at the machine-learning phase and even this carries risk. Everything AI learns about aviation security could in principle be turned around and used to defeat it, and the ability to infect or control the network could, for example, let a hostile actor push threat items through multiple screening points, in multiple locations, at once.
As integration progresses the technology will need to be tested and comprehensively understood, and the regulations will have to catch up. ICAO has working groups assembling guidance on the use of AI, and standards and recommended practices will no doubt follow.
The collision between the “move fast and break stuff” approach of Silicone Valley and the “18-month debate over should vs shall” approach of international standards development will be fascinating, and frustrating, to watch.
But there is a gulf between how fast we’re integrating, networking and automating, and how slowly our governance, data protection, and collective understanding of cyber risk are keeping pace. We are building a system of remarkable power on foundations we do not yet fully understand, for a public that cannot see it, governed by rules that have not yet been written.
None of which is an argument against the technology, which will arrive on its own schedule regardless of how many Grandpa Simpsons’ angrily shake their fists at it. It’s an argument for doing it well, with the human kept firmly in view, and with data and the networked protected as though it’s the most valuable thing we hold.
The saying goes that there are old pilots, and there are bold pilots, but there are no old, bold pilots. So too does AI integration suggest a cautious approach, if only because the consequences of being wrong could be so severe.
About the Author
Shannon Wandmaker is the director of CW Aviation Security Consulting, a specialized consultancy that works with governments and industry on strategy, governance, and oversight. He is an experienced aviation leader with over 25 years of experience in over 50 countries in the Asia/Pacific, Middle East, and Europe, and has extensive aviation, international relations and diplomatic experience backed by decades of regulatory and operational knowledge. Shannon’s experience spans senior leadership positions in commercial, government, and international organizations, having held roles in G4S Risk Consulting in Kuwait, the International Air Transport Association (IATA), and the European Civil Aviation Conference (ECAC), as well as 12 years in Australian Government aviation policy, operational and diplomatic positions, including as First Secretary (Transport) in the Australian Embassy, Abu Dhabi. He is AVSEC PM qualified and is a Fellow of the Royal Aeronautical Society.