The Worst Day Ever

By Arnold Barnett

On the evening of Sept. 10, 2001, I passed through Boston's Logan Airport en route to Seattle, where I was to give a talk the next day titled "Air Safety: End of the Golden Age?" In my carry-on bag were my laptop, various wires and batteries for my CD players. As the bag passed through the metal detector, I heard a beep and saw a light flash with the word "search." But no one searched the bag and, to my discredit, I said nothing about this apparent lapse in security.

I did give the talk on Sept. 11, to an audience filled with Boeing people, who were as stunned as I about the events that had just occurred.

Then I started to make my way home. I arrived 52 hours late via Salt Lake City, Atlanta and Providence (and valiant Delta Airlines). As a Bostonian, a New Yorker and an "expert" on aviation safety and security, I was devastated by the catastrophe, and suspect I will never fully get over it. But I've thought about many questions since Sept. 11. Let me present some of these questions below, and the tentative answers I have reached.

Could the Catastrophe have been Anticipated?

After the disaster, it was widely (and truthfully) reported from the aviation community that no one there imagined an event like the one that happened. But could that circumstance reflect a failure of our imaginations?

There were, after all, lots of events that could be interpreted as precursors of the calamity. In 1994, terrorists tried to hijack an Air France jet in Algiers, with the aim of using the plane to destroy the Eiffel Tower. (The plan was thwarted, but not without three passenger fatalities.) A disgruntled FedEx employee tried in 1998 to hijack one of the company's planes, intending to crash it into the company's Memphis headquarters. Hijackers had caused disasters on Ethiopian Airlines (1996) and in Mainland China (1994) that resulted in triple-digit death tolls (including themselves). Suicidal pilots apparently crashed two crowded jets in the late 1990s, with no survivors. And terrorists plotted in 1995 to destroy a dozen U.S. jets coming home from Asia. Their plans were foiled literally at the last minute: Having successfully exploded atest bomb on a Philippine Airlines plane, some of them were in line to board an U.S.-bound jet in Bangkok when the conspiracy was uncovered.

Thus, all the elements of the Sept. 11 catastrophe - the idea of using planes as weapons, suicidal individuals in the cockpit, and a willingness to take thousands of innocent lives — had historical precedent. And yet, it is too easy to connect the dots, and to suggest that it was only a matter of time until the World Trade Center was destroyed. While we had alarming facts at our disposal, it is totally human not to understand what they meant. We should not belabor ourselves because we could not think the unthinkable.

Could the Catastrophe have been Prevented?

The terrorists showed great skill, so it is natural to wonder whether even the tightest security rules enforced fully would have stopped them. But, on Sept. 11, U.S. domestic air security was so sloppy (see below) that we have little basis for assessing what stringent security might have done. To put it briefly, we cannot answer this question.

What were Security Arrangements like Before the Catastrophe?

A fair generalization about pre-Sept. 11 security measures is that they exhibited pervasive thoughtlessness. Some interrelated examples illustrate the point.

Early in 1998, airlines began using a computer-based formula (CAPPS) to identify potential terrorists based on dozens of variables. About 5 percent of passengers met the profile (and were designated selectees). If a selectee did not board his flight, his checked luggage could not travel (unless it was cleared by an explosives detector, which was rarely possible because detectors were so scarce).

Prior to the introduction of CAPPS, there had been a less elaborate profiling system, based on fewer variables. But, once a selectee was identified, special attention was paid not only to his checked luggage, but also to his carry-on baggage, the contents of his pockets, and his general demeanor during questioning by agents. (I know about the procedure, having been designated a selectee in Jacksonville and at Dallas Love Field.) In other words, the change in the procedure for choosing selectees was accompanied by a drastic cutback in what was done about selectees.

What was the justification for this cutback? Was there an elaborate analysis, which indicated that selectees could not threaten aircraft except through their checked bags? Or was the policy change made almost as an afterthought, based on a general sense that one shouldn't hassle people directly? The consequences of the cutback may have been monumental: Carol Hallett, president of the Air Transport Association, has suggested that reduced scrutiny of selectees "may be directly responsible for the events of Sept. 11."

The introduction of CAPPS was noteworthy for other reasons. In the proposed rulemaking published in the Federal Register, the FAA noted that the system would not be required for planes with fewer than 61 seats. There was some suggestion thatplanes were less tempting to terrorists than others (never mind that the last act of sabotage in the Western Hemisphere was the bombing of a commuter plane that killed 21 people). But an obvious question arises: When a public document specifically exempts regional jets from security measures, might it not be encouraging an open season on such planes?

The exemption is especially lamentable because it was so unnecessary. The typical regional jet/commuter plane might carry 30 passengers. If 5 percent of them are selectees, we are talking about perhaps two people, maybe one of whom would have checked a bag. Observing whether that person actually boarded (or removing his suitcase in the unlikely event that he did not) would entail trivial effort. Did people ever consider this point before disseminating a security rule that excludedplanes?

The CAPPS formula itself was supposedly put together by psychologists, criminologists, intelligence specialists and other experts. One wishes that an operations researcher had been on the team. The experts may have correctly concluded that no would-be terrorist could deduce all the variables in the formula, let alone the coefficients assigned to each. But they may have missed a crucial point that an operations researcher would surely have recognized. Someone wishing to "beat" CAPPS did not need to know the formula: All he needed to know was whether a specific combination of characteristics (e.g., type of ticket, form of payment, passenger's age and travel history) would avoid the designation of selectee. In mathematical terms, one did not need to know the exact equation of the yes/no threshold curve, but simply whether a particular point was to the left of the curve. To put it delicately, it was not terribly difficult to beat the old CAPPS system, and thus to put a suitcase bomb on a plane without getting on oneself. (CAPPS has been drastically changed since Sept. 11.)

Examples like these could be found everywhere in pre-catastrophe domestic air security. The most charitable explanation for the intellectual disorder was that the authorities did not really believe there was a terrorist threat to domestic airplanes. Thus, which particular rules were in place was as inconsequential as a dessert choice between apple or cherry pie. Such a threat assessment might seem naïve given Oklahoma City, Pan Am 103 and the first attack on the World Trade Center. But it would be even more unnerving to think that the authorities acted as they did despite believing that the terrorist threat was real.

What do We do Now?

Well, in a word, we think. We consider various ways to improve aviation security, first individually and then in terms of an optimal combination.

For example, two proposals that have been advanced since the catastrophe are:
- abandon advance seat selection on U.S. domestic flights
- institute 100 percent positive passenger bag match in the U.S. domestic system Advanced Seat Selection. The rationale for abolition is that, if a terrorist is assigned seat 7C, confederates who have access to the plane could leave a weapon for him there. If he doesn't know his seat until the last minute, the plan is far harder to execute.

Losing advanced seat bookings would be a heavy blow to air travelers. And the proposal is more radical than it sounds: To be logical, one would also have to end open seating, the underpinning of Southwest Airlines. Otherwise, the terrorist would simply arrange to board early and then race to seat 7C.

Already, flight crews are supposed to inspect seat backs and other areas between flights (ideally armed with sweeping devices that react to dangerous items). Assuming that such inspections are effective, how could the marginal benefits of ending advanced seating be remotely comparable to the costs? Though imaginative, this idea does not hold up well to scrutiny.

100 Percent Bag Match. Under this policy, a checked bag would only travel in an aircraft luggage compartment if it were identified with a passenger known to be aboard the plane. One hundred percent positive passenger bag match (PPBM) is already the universal policy in Europe, on all international flights and on all flights involving Washington's Reagan Airport. New York-based JetBlue Airlines decided in October 2001 fully to adopt the policy.

Despite loud assertions to the contrary, there is strong evidence that PPBM does not cause crippling disruption. Ryanair, a low-cost European jet carrier similar to Southwest, performs PPBM on all its flights, and maintains an 81percent on-time record despite 25-minute turn-around times (i.e. times at the gate between arrival and departure) and the miserable weather of northwestern Europe. A two-week 1997 experiment in the United States — involving 11 airlines, 8,000 flights, and 750,000 passengers — indicated that PPBM in the U.S. domestic system would cause departure delays averaging one minute (1/7 of flights would suffer delays that average seven minutes apiece). PPBM would cost about 40 cents per passenger enplanement, and would require no reduction in flight schedules. (See Barnett, Shumsky, Hansen, Odoni and Gosling, 2001; the test did not include some extreme conditions in which bag-match would be modified.) Five months of data from U.S. airlines about their over-water flights to Honolulu and San Juan (which were PPBM routes) revealed mean bag-match departure delays of less than one minute. That outcome was striking because these routes are "hostile" to bag match: They are usually flown with wide-body jets, and carry passengers who generally check bags and who often connect from other flights.

But what are the benefits of PPBM? It would not stop suicide bombers and would not have saved the World Trade Center. It is inferior to putting all luggage through explosives detectors or to having all bags carefully searched by experts.

All these things are true, but they do not destroy the case for PPBM. The Sept. 11 terrorists were suicidal but most terrorists historically have not been. (Did those who sent anthrax through the mail kill themselves?) It will be several years until we can put all bags through explosives detectors, and careful searches of all bags simply will not happen in the near term. Especially given the measures to fortify the cockpit, the luggage compartment could well be the soft underbelly of aircraft security. PPBM might not be perfect, but are the costs of implementing it so great that unaccompanied suitcases should be allowed to travel freely on domestic flights?

Obviously, PPBM strikes me as a security measure that is long overdue. Yet U.S. air carriers oppose the policy with an intensity that seems incomprehensible. Airlines that perform PPBM on all flights from New York to London tell us that they cannot do bag match on any flights from New York to Los Angeles. Both the security head and the president of the Air Transport Association—the advocacy group for U.S. carriers—have made the astounding statement that PPBM would add "zero" security benefit (Do they also believe that PPBM is useless on international flights? If so, they should announce that, in the aftermath of Sept. 11, U.S. airlines want to abolish a universally accepted security measure.)

What are the Tradeoffs between Security vs. Safety?

Obviously, we have to think hard about how new security measures can heighten the risks of accidental crashes. Steps to prevent allowing a jet to devastate an urban center could, if communications fail, cause an innocent plane to be shot down. (Recall Korean Air #7 and the Iranian Airbus accidentally destroyed by the U.S. Navy.) If jets landing at LaGuardia are kept further away from the skyscrapers of Manhattan, then LaGuardia landing patterns could get closer to those of JFK, raising the risk of mid-air collisions. And "free flight" policies— which might increase airborne safety (see Barnett, 2000) — could now seem less attractive, given that greater discretion for pilots could make it harder to determine when malevolent hijackers have seized a plane. Some difficult decisions lie ahead.

When will the Passengers Return?

We have some previous information on this topic, but its relevance to this period is unclear. Fear of terrorism reduced air travel during the 1991 Gulf War, but the war ended quickly and no planes were actually sabotaged. After the 1989 DC-10 crash at Sioux City—which was the third disaster seemingly caused by shortcomings of the plane — new bookings on the DC-10 plummeted (Table 1). The "boycott" was largely temporary, dropping by three-fourths within two months. However, fears caused by mechanical problems might not be comparable to those caused by terrorist acts.

Table 1.

Estimated Changes in New DC-10 Bookings on Competitive Routes After 1989 Sioux City DC-10 Crash (Relative to Pre-Crash Levels)

- First Two Weeks


- Next Two Weeks


- Next Two Weeks


- Next Two Weeks


Source: Barnett, Menhigetti and Prete (1992)

We do know that, post Sept. 11, traffic has stabilized at levels far below those a year earlier. The number of missing passengers was just as large the last week of October as the first week (around 25 percent), and that projected traffic for Thanksgiving is off 27 percent. Flight frequencies have been cut, but seat supply has not been a "binding constraint," rather, the numbers reflect reduced demand. It is noteworthy that average fares paid have fallen sharply, suggesting that "true" drops in demand are even larger than the observed ones.

When should the Passengers Return?

This is a hard question, not least because there is no reliable way to estimate the mortality risk of air travel today. The crashes on Sept. 11 killed more planeloads of passengers than all U.S. domestic jet crashes the prior decade. (If crashes are weighted by the proportion of passengers killed, U.S. domestic jets suffered 4.00 "full" jet crashes on Sept. 11 and 3.39 in the previous decade.) Including those who perished on the ground, the catastrophe killed more people than all earlier U.S. jet crashes combined. How to weigh available data to make a projection for the months ahead is unknowable.

One could argue for approaching the issue another way: Passengers should make their returns conditional on specific actions by the airlines that improve security. Suppose that a high school, for example, is negotiating with an airline that hopes to transport a student group. The school could ask the airline to commit itself in writing to (say) a guarantee that no unaccompanied suitcases will travel with the students. One high school might have little leverage, but what if lots of high schools joined together in imposing conditions? More generally, is it inappropriate for passengers to use their economic power to influence the conditions of their transport? U.S. aviation has done a spectacular job on safety issues, from maintenance to pilot training to air traffic control. But it has never distinguished itself on security matters, and it has no right to ask for our blind faith now.

Final Remarks

After the catastrophe, I found myself thinking of the lyrics of the song from The Fantastiks : "Try to remember the kind of September when no one wept except the willow." Will we ever again fly with the serenity that we felt on Sept. 10, 2001? Will we be able to stop airline terrorism, or will it be as enduring an aspect of life as armed robbery? I really don't know, but we have no alternative but to try. The catastrophe caused many thousands of deaths, and the bereavement of hundreds of thousands of loved ones. The economic casualties of the calamity number in the millions. In the name of the victims, we must do whatever we can so that there are no more victims.


- Barnett, A., J. Menhigetti and M. Prete, "The Market Response to the Sioux City DC-10 Crash," Risk Analysis, March 1992.
- Barnett, A., "Free-Flight and En Route Air Safety: A First-Order Analysis," Operations Research, November-December 2000.
- Barnett, A., R. Shumsky, G. Gosling, M. Hansen, and A. Odoni, "Safe at Home? An Experiment in Domestic Airline Security," Operations Research, March-April 2001.

Arnold Barnett, the George Eastman Professor of Management Science at MIT, has done aviation safety research for 23 years. He has also worked as a consultant to 13 airlines, five airports and the FAA. In 1997, NBC News described him as "the nation's leading expert about the safety of air travel." Barnett has researched such topics as mortality risk of air travel and public perceptions about air safety.