Saturday, August 12, 2006

On the implausibility of the liquid explosives plot

Perry Metzger is a real person. I knew him at Columbia, where he was a child prodigy who entered at age 14 or so. He was and is extraordinarily smart. We weren't friends; he was kind of a jerk back then.

Here's a lengthy letter that Perry wrote to the public mailing list Interesting People, which is run by the semi-legendary Dave Farber. (He invented SNOBOL, which alone makes me a fan of his, but most people admire him for his work that led to the Internet.) I would point you to the mailing list's archive site, but it looks like they've lost the domain for the moment.

Below is the entire content of Perry's letter, only modified in form for HTML, plus a few added links. (Why? Because I work hard for you, both of my readers). In brief, Perry's calling bullshit on the specifics of the plot, as reported.
First, a note of introduction. Until recently, I was a computer security guy, and as with many in my profession, the application of computer security analysis to non-computer security problems was increasingly interesting to me. Now, for reasons that don't need exploring at this juncture, I'm back at school, studying chemistry, and I'm spending this summer in a lab doing organic synthesis work. Strangely, today I find my interests colliding.

So, I'm doing a bunch of reading, and I find the claimed method the "highly sophisticated" attackers came up with for bringing down airliners kind of implausible. I wonder if it could ever work in reality.

A disclaimer, I'm working entirely off of news reported by people who don't know the difference between soft drinks and nail polish remover, but the information I've seen has the taste of being real. As near as I can tell, it is claimed that the terrorists planned to make organic peroxides in situ on board an airplane and use them to destroy the plane.

This seems, at least given my initial examination of the idea, implausible.

Based on the claims in the media, it sounds like the idea was to mix H2O2 (hydrogen peroxide, but not the low test kind you get at the pharmacy), H2SO4 (sulfuric acid, of necessity very concentrated for it to work at all), and acetone (known to people worldwide as nail polish remover), to make acetone peroxides. You first have to mix the H2O2 and H2SO4 to get a powerful oxidizer, and then you use it on acetone to get the peroxides, which are indeed explosive.

A mix of H2O2 and H2SO4, commonly called "piranha bath", is used in orgo labs around the world for cleaning the last traces out of organic material out of glassware when you need it *really* clean -- thus, many people who work around organic labs are familiar with it. When you mix it, it heats like mad, which is a common thing when you mix concentrated sulfuric acid with anything. It is very easy to end up with a spattering mess. You don't want to be around the stuff in general. Here, have a look at a typical warning list from a lab about the stuff:

Now you may protest "but terrorists who are willing to commit suicide aren't going to be deterred by being injured while mixing their precursor chemicals!" -- but of course, determination isn't the issue here, getting the thing done well enough to make the plane go boom is the issue. There is also the small matter of explaining to the guy next to you what you're doing, or doing it in a tiny airplane bathroom while the plane jitters about.

Now, they could of course mix up their oxidizer in advance, but then finding a container to keep the stuff in that isn't going to melt is a bit of an issue. The stuff reacts violently with *everything*. You're not going to keep piranha bath in a shampoo bottle -- not unless the shampoo bottle was engineered by James Bond's Q. Glass would be most appropriate, assuming that you could find a way to seal it that wouldn't be eaten.

So, lets say you have your oxidizer mixture and now you are going to mix it with acetone. In a proper lab environment, that's not going to be *too* awful -- your risk of dying horribly is significant but you could probably keep the whole thing reasonably under control -- you can use dry ice to cool a bath to -78C, say, and do the reaction really slowly by adding the last reactant dropwise with an addition
funnel. If you're mixing the stuff up in someone's bathtub, like the guys who bombed the London subways a year ago did, you can take some reasonable precautions to make sure that your reaction doesn't go wildly out of control, like using a lot of normal ice and being very, very, very careful and slow. You need to keep the stuff cool, and you need to be insanely meticulous, or you're going to be in a world of

So, we've covered in the lab and in the bathtub. On an airplane? On an airplane, the whole thing is ridiculous. You have nothing to cool the mixture with. You have nothing to control your mixing with. You can't take a day doing the work, either. You are probably locked in the tiny, shaking bathroom with very limited ventilation, and that isn't going to bode well for you living long enough to get your explosives manufactured. In short, it sounds, well, not like a very good idea.

If you choke from fumes, or if your explosives go off before you've got enough made to take out the airplane -- say if you only have enough to shatter the mirror in the bathroom and spray yourself with one of the most evil oxidizers around -- you aren't going to be famous as the martyr who killed hundreds of westerners. Your determination and willingness to die doesn't matter -- you still need to get the job done.

You also need quite a bit of organic peroxides made by this route in order to be sure of taking down a plane. I doubt that just a few grams is going to do it -- though of course the first couple of grams you are likely to go off before you make any more. The possibility of doing all this in an airplane lav or by some miracle at your seat seems really unlikely. Perhaps I'm just ignorant here -- it is possible that a clever person could do it. I can't see an easy way though.

So far as I can tell, for the pragmatic terrorist, the whole thing sounds really impractical. Why not just smuggle pre-made explosives on board? What advantage is this "binary system" idea in the first place? There are also all sorts of ideas a smart person could come up with in a few minutes of thinking -- see below.

The news this morning was full of stuff about "ordinary looking devices being used as detonators". Well, if you're using nasty unstable peroxides as your explosive material, you don't really need any -- the stuff goes off if you give it a dirty look. I suspect a good hard rap with a hard heavy object would be more than sufficient. No need to worry about those cell phones secretly being high tech "detonators" if you're going this route.

Anyway, from all of this, I conclude that either:
  1. The terrorists had a brilliant idea for how to combine oxidizer and a ketone or ether to make some sort of nasty organic peroxide explosive in situ that has escaped me so far. Perhaps that's true -- I'm not omniscient and I have to confess that I've never tried making the stuff at all, let alone in an airplane bathroom.

  2. The terrorists were smuggling on board pre-made organic peroxide explosives. Clearly, this is not a new threat at all -- organic peroxide explosives have been used by terrorists for decades now. Smuggling them in a bottle is not an interesting new threat either -- clearly if you can smuggle cocaine in a bottle you can smuggle acetone peroxide. I would hope we had means of looking for that already, though, see below for a comment on that.

  3. The terrorists were phenomenally ill informed, or hadn't actually tried any of this out yet -- perhaps what we are told was a "sophisticated plot" was a bunch of not very sophisticated people who had not gotten very far in testing their ideas out, or perhaps they were really really dumb and hadn't tried even a small scale experiment before going forward.
There are other open questions I have here as well. Assuming this is really what was planned, why are the airport security making people throw away their shampoo? If you open a shampoo bottle and give it a sniff, I assure you that you'll notice concentrated sulfuric acid very fast, not that you would want to have your nose near it for long. No high tech means needed for detection there. Acetone is also pretty distinctive -- the average airport security person will recognize the smell of nail polish remover if told that is what they're sniffing for. Oh, and even if they used a cousin of acetone, say methyl ethyl ketone (aka MEK, aka 2-butanone), you'll still pick up on the smell.

And now, on to the fun part of this note. First they came for the nail clippers, but I did not complain for I do not cut my finger nails. Now they've come for the shampoo bottles, but I did not complain for I do not wash my hair. What's next? What will finally stop people in their tracks and make them realize this is all theater and utterly ridiculous? Lets cut the morons off at the pass, and discuss all the other common things you can destroy your favorite aircraft with. Bruce Schneier makes fun of such exercises as "movie plots", and with good reason. Hollywood, here I come!

We're stopping people from bringing on board wet things. What about dry things? Is baby powder safe? Well, perhaps it is if you check carefully that it is, in fact, baby powder. What if, though, it is mostly a container of potassium cyanide and a molar equivalent of a dry carboxylic acid? Just add water in the first class bathroom, and
LOTS of hydrogen cyanide gas will evolve. If you're particularly crazy, you could do things like impregnating material in your luggage with the needed components. Clearly, we can't let anyone carry on containers of talc, and we have to keep them away from all aqueous liquids.

See the elderly gentleman with the cane? Perhaps it is not really an ordinary cane. The metal parts could be filled with (possibly sintered) aluminum and iron oxide. Thermit! Worse still, nothing in a detector will notice thermit, and trying to make a detector to find thermit is impractical. Maybe it is in the hollowed portions of your luggage handles! Maybe it is cleverly mixed into the metal in someone's wheelchair! Who knows?

Also, we can never allow people to bring on laptop computers. It is far too easy to fill the interstices of the things with explosives -- there is a lot of space inside them -- or to rig the lithium ion batteries to start a very hot fire (that's pretty trivial), or if you're really clever, you can make a new case for the laptop that's made of 100% explosive material instead of ordinary plastic. Fun!

No liquor on board any more, of course. You can open lots of little liquor bottles and set the booze on fire, and besides, see the dangers of letting people have fluids. Even if you let them have fluids, no cans of coke -- you can make a can of coke into a shiv in a few minutes. No full sized bottles of course, since you can break 'em and use them as a sharp weapon, so no more champagne in first class either, let alone whiskey.

Then, lets consider books and magazines. Sure, they look innocent, but are they? For 150 years, chemists have known that if you take something with high cellulose content -- cotton, or paper, or lots of other things -- and you nitrate it (usually with a mixture of nitric and sulfuric acids), you get nitrocellulose, which looks vaguely like
the original material you nitrated but which goes BOOM nicely. Nitrocellulose is the base of lots of explosives and propellants, including, I believe, modern "smokeless" gunpowder. It is dangerous stuff to work with, but you're a terrorist, so why not. Make a bunch of nitrocellulose paper, print books on it, and take 'em on board. The irony of taking out an airplane with a Tom Clancy novel should make the effort worthwhile.

So, naturally, we have to get rid of books and magazines on board. That's probably for the best, as people who read are dangerous.

And now for a small side note. It is, of course, commonly claimed that we have nitro explosive detectors at airports, but so far as I can tell they don't work -- students from labs I work in who make nitro and diazo compounds for perfectly legitimate reasons and have trace residues on their clothes have told me the machines never pick up a thing even though this is just what they're supposed to find, possibly because they're tuned all the way down not to scare all the people who take nitroglycerine pills for their angina.

Now, books aren't the only things you could nitrate. Pants and shirts? Sure. It might take a lot of effort to get things just so or they will look wrong to the eye, but I bet you can do it. Clearly, we can't allow people on planes wearing clothes. Nudity in the air will doubtless be welcomed by many as an icebreaker, having been deprived of their computers and all reading material for entertainment.

Then of course there is the question of people smuggling explosives on board in their body cavities, so in addition to nudity, you need body cavity searches. That will, I'm sure, provide additional airport entertainment. By the way, if you really don't think a terrorist could smuggle enough explosives on board in their rectum to make a
difference, you haven't been following how people in prison store their shivs and heroin.

However, it isn't entirely clear that even body cavity searches are enough. If we're looking for a movie plot, why not just get a sympathetic surgeon to implant explosives into your abdomen! A small device that looks just like a pace maker could be the detonator, and with modern methods, you could do something like setting it off by rapping "shave and a haircut" on your own chest. You could really do this -- and I'd like to see them catch that one.

So can someone tell me where the madness is going to end? My back of the envelope says about as many people die in the US every month in highway accidents than have died in all our domestic terrorist incidents in the last 50 years. Untold numbers of people in the US are eating themselves to death and dying of heart disease, diabetes, etc. -- I think that number is something like 750,000 people a year?
Even with all the terrorist bombings of planes over the years, it is still safer to travel by plane than it is to drive to the airport, and it is even safer to fly than to walk!

At some point, we're going to have to accept that there is a difference between real security and Potemkin security (or Security Theater as Bruce Schneier likes to call it), and a difference between realistic threats and uninteresting threats. I'm happy that the police caught these folks even if their plot seems very sketchy, but could we please have some sense of proportion?



Anonymous wrd said...

As one of your two regular readers let me say that piece made me feel much better. Here comes NakedAir.

Tuesday, 15 August, 2006  

Post a Comment

Links to this post:

Create a Link

<< Home

Blog Flux Directory