Airline passenger screening in the United States has been transformed since the 9/11 terrorist attacks. These transformations fall into two broad categories: new screening technologies, including advanced X-ray systems for screening carry-on items and whole-body scanners, and changes in policies, procedures, and practices such as requiring passengers to remove laptop computers and liquids from their carry-on luggage at the time of screening. These changes have been overseen by the Transportation Security Administration (TSA), the federal agency created in the aftermath of the 9/11 terrorist attacks under provisions in the Aviation Transportation and Security Act (ATSA; P.L. 107-71 ). In ATSA, Congress mandated that TSA provide for comprehensive security screening of all airline passengers and property carried aboard passenger air carrier aircraft. ATSA, however, gave TSA authority to implement trusted traveler programs and utilize available technologies to expedite the security screening of passengers participating in such programs in order to allow screening personnel to focus on passengers who should be subject to more extensive screening. Subsequently, Congress (see P.L. 108-458 ) directed TSA to assume responsibility for checking all airline passengers against terrorist watchlists maintained by the federal government. Implementing these and other risk-based facets of passenger screening proved to be extremely challenging. Consequently, TSA has mostly relied on an assumption of uniform risk among airline passengers in its approach to airport checkpoint screening. This stands in contrast to the risk-based strategies TSA has employed to address other aspects of aviation security, such as air cargo security and security of charter and non-commercial operators. The uniform approach to screening has proven problematic. Under this approach, efforts to improve screening capabilities and streamline the screening process have primarily focused on technology. Technologies such as whole-body imagers and advanced X-ray equipment have improved detection of a broad array of threat objects, including non-metallic weapons and explosives, but technology limitations, budgetary considerations, and other factors have placed constraints on a strictly technology-driven approach to airport screening. TSA personnel have limited time and resources to screen passengers and property at airports without creating unacceptably long wait times. Space limitations at airports and congressional limitations on screener hiring have constrained TSA's capability to address these concerns simply by adding screening lanes and personnel. Airline passengers continue to face sometimes cumbersome procedures, such as removing shoes and separating laptop computers for X-ray screening, that can make airport wait times unpredictable and even deter travelers from flying. Inflexible security methods may have tainted public perceptions of TSA—a 2012 poll showed 54% of Americans thought TSA was doing a good or excellent job —and led to sharp criticism from experts such as former TSA Administrator Kip Hawley, who has argued, "In attempting to eliminate all risk from flying, we have made air travel an unending nightmare ..., while at the same time creating a security system that is brittle where it needs to be supple." TSA has responded to such criticisms by attempting to shift from an approach that assumes a uniform level of risk among all airline travelers to one that focuses on passengers thought to pose elevated security risks. Risk-based screening has itself been controversial; while some initiatives have been encouraged or even directed by Congress, others have met with considerable skepticism among some Members of Congress or outside groups. The controversy derives, in part, from widely divergent views of what constitutes risk and how risk should be appropriately assessed and mitigated. The dilemma over where to appropriately focus security efforts can be informed by the advice Frederick the Great offered to his generals: "Little minds try to defend everything at once, but sensible people look at the main point only; they parry the worst blows and stand a little hurt if thereby they avoid a greater one. If you try to hold everything, you hold nothing." That view was echoed more recently by former Secretary of Homeland Security Michael Chertoff, who wrote in 2006, "In a free and open society, we simply cannot protect every person against every risk at every moment in every place. There is no perfect security." While security is necessarily imperfect, it nonetheless can be configured in an informed manner designed to minimize risk. The preliminary step in this process is to reach an understanding of the nature and characteristics of the security risk, followed by an identification of specific strategies to mitigate or manage that risk. A general definition of risk focuses on the probability of incurring some type of loss. In the aviation security context, risk is most often framed as a complex interaction of three underlying factors: threats, vulnerabilities, and consequences. Although risk is a probabilistic construct, the ability to assign specific probability values to individual threats and vulnerabilities in the aviation security context is limited. Consequently, risk-based practices settle for categorical techniques and scoring methods to quantify threats, vulnerabilities, and security risk in less precise terms. A comprehensive risk-based aviation security strategy attempts to mitigate all three elements of risk. Risk-based passenger screening includes a number of initiatives that fit within this broader framework, but it focuses specifically on detecting and managing the threat element of risk. Risk is mitigated by identifying individuals who may pose threats and utilizing detection technologies to screen for weapons, explosives, and other threat objects. Vulnerabilities are identified through various assessment techniques and addressed through multiple layers of security, such as reinforcing cockpit doors, deploying air marshals aboard planes, and changing security protocols based on known or perceived threats. In contrast to threat and vulnerability, consequences are generally assessed in terms of their potential severity, often to derive a risk valuation and assess costs and benefits of specific security strategies. Consequences, however, are primarily mitigated by emergency management and response and post-incident recovery activities. These activities are primarily the responsibility of airports, airlines, and state and federal emergency management agencies, and are not a principal concern of TSA. Defining the risk environment and specifying acceptable and unacceptable levels of risk are key challenges in establishing an effective risk-based strategy for aviation security. With respect to air cargo security, TSA has made extensive use of risk scoring to assess risks and plan security strategy. With respect to commercial passenger aviation, however, the practice of risk scoring of individuals has been considered so complex and controversial that it has not been a central part of TSA's strategy. Rather, risk assessment of airline passengers is performed primarily through categorical processes, such as by assigning passengers to low-threat, unknown or elevated threat, and high threat categories after checking biographical data against terrorist and criminal databases. Risk-based techniques also examine some behavioral indicators, such as ticket purchasing characteristics and overt behaviors exhibited at the airport. These indicators are used to derive behavioral-based risk scores, but the validity of these methods has been questioned. Complicating matters further, there may not be agreement on what specific risks a risk-based security strategy should seek to mitigate. One example of this occurred following TSA's March 2013 proposal to allow passengers to carry small knives and certain sports equipment onboard aircraft, reversing a long-standing ban. The agency asserted that the threat posed by these items had diminished and that other security layers, such as deployment of armed air marshals aboard some flights, arming of some pilots through the Federal Flight Deck Officers (FFDO) program, and reinforcement of cockpit doors sufficiently mitigated the risk of a hijacking or terrorist attack posed by small knives, golf clubs, and baseball bats. Critics, including organizations representing flight attendants, pilots, and airlines, argued that TSA had failed to adequately consider risks unrelated to hijacking and terrorism, such as those posed by unruly passengers wielding knives and golf clubs aboard planes. After legislation was introduced to prevent TSA from lifting its ban on small knives, TSA announced that it would not proceed with its proposal. At the operational level, risk-based passenger screening stands in contrast to TSA's historical approach of prohibiting certain items aboard aircraft and instructing screeners to focus on enforcing those prohibitions. This comports with the concerns raised by former TSA administrator Hawley, who wrote of the dilemma faced by TSA screeners, "the fear of missing even the smallest thing, versus the likelihood that you'll miss the big picture when you're focused on the small stuff." Hawley's objections are shared by Raphael Ron, an Israeli expert on aviation security and counterterrorism. Ron asserts that reliance on prohibited items lists and detection technology reduces the security system's ability to respond to shifting threat landscapes; he notes that the box cutters used by hijackers in the 9/11 attacks were not prohibited items at the time. As he writes, "Terrorists love our detection technology because they can trust that it will not do what it is not designed to do and never did before. In a sense, our technology gives the terrorist a positive feedback on what to expect." Ron claims that there has never been a case in which a planned terrorist attack was prevented by the detection of threat items alone. Comments such as Hawley's and Ron's point to an approach that does not dispense with detection technologies, but integrates detection capabilities with other measures for assessing threats and minimizing vulnerabilities. Such an approach might depart from TSA's historical practice of using relatively rigid and inflexible measures to screen passengers in a uniform manner. They might require the agency to be more proactive, as opposed to largely reactive, with respect to specific threats and incidents, and to emphasize flexibility and unpredictability. Advocates of risk-based security frequently point to Israel, which employs demographic profiling, intelligence and law enforcement databases, and extensive security interviews to identify passengers deemed to pose high risks. These individuals are then subject to heightened screening measures and in-depth inquiries to assess any potential threat before they are allowed to board a plane. Despite continued threats, Israel has avoided any major terrorist attacks against its airlines and airports for over 40 years. The exact role that its methods have played in deterring or preventing such attacks is undetermined. Regardless, adopting an Israeli-style approach in the United States is considered to be problematic, both legally and pragmatically.