No Stupid Questions

I'm not going to defend everything the TSA does. And they do have a lot of problems. But, the lines at the checkpoint are the result of trade-offs in security. For all things security related, it's about managing risk. You will never eliminate risk, so you need to pick and choose where to apply controls to reduce the worst risks and accept some risk in other areas.

Think about the possible outcomes from terrorist attacks on airports. There are several possible scenarios:

1. The attacker kills a few people in the airport using a direct weapon (gun, knife, etc.)
2. The attacker kills a lot of people in a small area with a area weapon (bomb, gas, chemical, etc.)
3. The attacker destroys an airplane in flight, killing everyone onboard.
4. The attacker hijacks the airplane and takes everyone onboard for ransom.
5. The attacker hijacks the airplane and uses it as a weapon, killing everyone on board and more people on the ground.

We could probably come up with other cases, but I think this covers the bulk of it. So, let's dive into managing these risks. What are the effects of such attacks, if successful?
Looking at case 1, how many people are likely to be killed? Well, that depends on the police response time and the effectiveness of the attacker's weapon. But, based on other mass casualty events, this probably falls into the range of 10-30 people. It could move outside this range, but this is pretty typical of such situations. To pick a number in the middle, will say they the expected loss for such an attack is around 20.
With Case 2, again there is variability. But, it's also something we have analogs for and may be able to put a range of casualties on. The Boston Marathon bombing in 2013 killed 6. The attack on Kabul Airport in 2021 during the US evacuation killed 182, though that also included multiple gunmen attacking after the explosion. Let's put the loss rate around 50 for as single bomb, assuming a very packed area and a very effective bomb.
For Case 3, the numbers are a bit easier to get a handle on. Typical airliners carry anywhere from 100-200 passengers. The 737 MAX 8-200 is designed for 200, while the Airbus A200-100 carries around 100 passengers. We'll pin the loss rate here at 150, as attackers are likely to target larger aircraft for this sort of attack.
Case 4 is basically Case 3, but with an optional loss of only money. For that reason, I'm going to remove this case, but wanted to mention it to avoid the "well akshuly" crowd, since this is a historic problem.
That leaves Case 5. And it's Case 4's situation, plus some number of people on the ground. Certainly, not every such use of an airplane as a weapon will be as successful as the attack on 9/11. And that also involved multiple successful attacks. But, let's assume that such attacks will hit populated buildings and cause significant damage. We'll pin the expected loss at 200, This is 150 for the airplane and 50 on the ground, somewhat equivalent to Case 2 with a bomb in a crowded area.

Ok, so we have expected losses, now lets talk about how often we expect such attacks to happen? And yes, this is a rough guess. But, since terrorists are unlikely to publish their plans, it's the best we can do. We also face a difficulty in that these are still (thankfully) pretty rare events. And trying to extrapolate from a small set of data points is always a fraught exercise. So, fell free to quibble over these numbers, but I don't think any numbers which fall into a reasonable range will change things much.
Case 1 - This attack as a pretty low barrier to entry. If a person can be found to perform the attack, arming them isn't terribly hard. So, we let's assume we get 2 of these attacks a year. I don't think we're actually getting that, but out goal is just to get into the right ballpark.
Case 2 - This attack takes a touch more work, bomb making isn't that hard, but making a really effective one isn't easy either. This type of attack does have the advantage that it doesn't always require the attacker to die in the process. So, it might be easier to find someone willing to engage in such an attack. Let's call this 1 per year.
Case 3 - This also requires a bomb, but it may not need to be quite as big to be effective. Granted, modern aircraft can be amazingly resilient (see Aloha Flight 243). This attack also results in the attacker dying, so that can be a bit harder to source. So, lets say this happens once every other year, or 1/2 per year.
Case 5 - So, no bomb this time, but you have to have an attacker not only willing to die in the process, but also go through enough flight training to fly the aircraft to it's target. And you need the training itself. Plus, the attacker needs to get a weapon onto the aircraft. And since they need to overpower 100-200 people who might just take exception to the hijacking, you probably need multiple attackers willing to die in the attack. This is a pretty high bar to clear; so, let's say that these attacks happen at a rate of 1 every 5 years.

Ok, so let's consider our Annualized Loss Expectancy (ALE) with what we have:

| Case | Loss Expectancy | Frequency | ALE | |

|

|

|

| | 1 | 20 | 2 | 40 | | 2 | 50 | 1 | 50 | | 3 | 150 | 0.5 | 75 | | 5 | 200 | 0.2 | 40 | | Total| - | - | 205 |

Alright, so lets start talking about controls we can use to mitigate these attacks. By raw numbers, the thing we should care about most is Case 3, as that has the highest ALE. So, what can we do about bombs on airplanes? Making them more resilient seems like a good start, but if we could do that, the military would have done it long ago. So, really the goal is to keep bombs out of airplanes. And that's going to mean some sort of screening. We could just say "no carry on, period" and move the problem to the cargo hold. This would reduce the frequency of Case 3 and Case 5, as it would be much harder to get a bomb or weapon onto an airplane, without a bag to hide them in. But, travelers are not likely to give up all carried on bags. So, that really leaves us with searching bags and controlled checkpoints to do it. Of course, as has been noted, this would likely mean that Cases 1 and 2 become deadlier. Let's put some numbers to it. Let's say that checkpoints reduce the frequency of Cases 3 and 5 by a factor of 4 and increase the Loss Expectancy of Cases 1 and 2 by 1.5.

| Case | Loss Expectancy | Frequency | ALE | |

|

|

|

| | 1 | 30 | 2 | 60 | | 2 | 75 | 1 | 75 | | 3 | 150 | 0.125 | 18.75 | | 5 | 200 | 0.05 | 10 | | Total| - | - | 163.75 |

And we could push the numbers around for the effect of the checkpoints. And we could look at other controls or controls in combination. But, this is the sort of risk analysis which would need to be done to make such decisions. And, ideally, the numbers chosen would be done with a bit more care than my rectal extraction method. Can I say that anyone at the TSA/DHS/etc did this sort of analysis? No, but I suspect there has been some work on it. And it probably does lead to the conclusion that the expected loss is lower for airports with checkpoints than airports without. Though, that doesn't excuse the TSA's abysmal track record for tests done by the FBI.