The security measures air travelers encounter at U.S. airports, including federal screening and restrictions on carry-on items, were developed incrementally over decades, largely in response to terrorist attacks and attempted attacks that exposed vulnerabilities.
No single event transformed air travel more profoundly than the September 11, 2001, attacks, when 19 al-Qaida hijackers used commercial airliners as weapons, crashing two into the World Trade Center, one into the Pentagon, and another in a Pennsylvania field.
Before 9/11, authorities generally did not anticipate hijackers would deliberately crash planes as part of an attack. The focus was not on suicide attackers, according to Mary Schiavo, a former Inspector General for the U.S. Department of Transportation.
In the immediate aftermath of 9/11, the Federal Aviation Administration (FAA) restricted gate access to ticketed passengers only and banned knives and box cutters from carry-on bags, as these were the items used by the hijackers. Congress subsequently established the Transportation Security Administration (TSA) in November 2001. This legislation shifted responsibility for screening passengers and baggage to a federal workforce, mandated reinforced cockpit doors, increased the number of federal air marshals, and required 100% of checked luggage to be screened for explosives.
TSA later introduced risk-based screening, a system that uses passenger data to identify individuals requiring additional scrutiny. This approach, developed with input from researchers like Sheldon Jacobson, a University of Illinois professor, aimed to improve efficiency. However, civil liberties advocates raised concerns about potential profiling based on race or religion due to opaque selection criteria and watch list accuracy.
The security flaws exposed on 9/11 came after more than a decade of efforts to address security gaps highlighted by earlier attacks. The bombing of Pan Am Flight 103 over Lockerbie, Scotland, on December 21, 1988, which killed all 259 people aboard and 11 on the ground, was a significant catalyst. Investigators determined an explosive device in a checked suitcase, transferred to the flight without its passenger, caused the destruction.
This attack prompted the FAA to order U.S. carriers to X-ray or search all checked baggage, conduct random checks, and verify that checked bags belonged to passengers on board. The FAA also implemented recommendations from a presidential commission, assigning security personnel at airports, improving intelligence sharing, tightening cargo controls, and developing training for screeners. The agency also conducted covert tests of security systems.
Subsequent incidents continued to drive security enhancements. On December 22, 2001, shortly after 9/11, Richard Reid attempted to detonate explosives hidden in his shoes aboard American Airlines Flight 63 from Paris to Miami. Following this event, passengers were asked to remove their shoes voluntarily at security checkpoints, a requirement that later became mandatory. This incident also led to stricter regulations on liquids, gels, and aerosols in carry-on baggage, initially a near-total ban, later formalized into the TSA's "3-1-1" rule.
On Christmas Day 2009, Umar Farouk Abdulmutallab attempted to detonate explosives concealed in his underwear on Northwest Airlines Flight 253 approaching Detroit. Although the device failed and caused a fire, the incident highlighted the limitations of traditional metal detectors in detecting plastic explosives. This event accelerated the deployment of full-body scanners, a technology already being tested by TSA, which had become a familiar part of airport security by 2010.
As of May 2024, TSA has been expanding facial recognition technology for passenger verification. Additionally, newly manufactured passenger airplanes are required to have retractable security gates between the cabin and flight deck to enhance cockpit security when the main door is open, a measure that the Air Line Pilots Association advocates for on existing aircraft as well.
"Any one layer of security can be breached," said Jacobson, "but collectively, when you put them on top of each other, what you end up with is a very resilient system."