Journalists reporting on his arrest referred to him as an airport shuttle driver from Denver, but Najibullah Zazi is, by certain standards, a New Yorker.  Born in Afghanistan, Zazi moved with his family to Queens as a young teenager. He attended Flushing High School and ran a coffee cart in the financial district.

He returned to the Middle East several times, but the final trip took him back to Afghanistan where he planned to join the Taliban.  Zazi held a US passport and an intimate familiarity with New York City, making him an excellent candidate for a suicide mission. Al-Qaeda soon recruited him for precisely that purpose.

At a camp in Waziristan in August 2008, Zazi learned the art of terrorism. He took detailed notes and retrieved them later via email.  He learned how to handle an AK-47, and fire a rocket-propelled grenade. He also learned to concoct a deadly and temperamental mixture known as “Mother of Satan.” Made from household items and relatively simple to manufacture, this homemade bomb earned its nickname by frequently blowing up insurgents before they reached their targets. It was this formula that Zazi planned to detonate, as instructed, in the New York City subway last September.

The details of Zazi’s capture remain the trade secrets of intelligence officials.  The courts have sealed the terms of his plea agreement. Also not known is whether Zazi and his co-conspirators would have succeeded had law enforcement not, by chance, uncovered the plot. But it is not impossible to surmise how Zazi might have exploited the many weaknesses in MTA security given the chance to carry out his attack.

If the would-be bombers had entered one of the city’s 468 subway stations with backpacks full of homemade explosives—as four men did in London in 2005—would a random baggage check by police have stopped them at the turnstile?  Would surveillance equipment have caught them on the platform or would they have passed under the blind eyes of the system’s hundreds of dead cameras?  Would a passenger or transit worker have seen something and said something or, as in London, would no one have noticed anything out of the ordinary?  And if the bombers had eluded the FBI and NYPD, would the Metropolitan Transit Authority—devastated by a budget shortfall and facing deep personnel cuts—have been in any position to catch them?

US authorities have consistently overlooked mass transit security.  Nearly half of all recent terrorist attacks have targeted transit systems, according to the Center on Terrorism at the Manhattan Institute, yet transit authorities nationwide have received only around one-sixtieth of the federal counterterrorism funding that has gone to secure airports and commercial planes.

“On the positive side, terrorist attacks on commercial aviation have declined significantly after reaching a high point in the 1970s, bringing some relief to travelers, airlines and governments,” reads a report published by San José State University’s Mineta Transportation Institute. “No such relief has occurred for those who use surface transportation, however.”  That analysis, published in October 2001, had little impact after terrorists turned passenger jets into.

New Yorkers have lived with the memory of 9/11 for close to a decade now, many with a kind of shrugging fatalism.  Even in light of the Zazi plot and the hundreds of fatalities in train bombings in London, Madrid, and most recently Moscow, residents still take five million subway rides per day.  Except for times of high unemployment—like now—ridership has risen steadily since the mid-1980s.

In his 2009 State of the City address, Mayor Michael Bloomberg assured the city that the recession would not affect security. “It all begins with public safety,” he said, “the bedrock of society that makes economic growth possible. Today, according to FBI statistics, we remain the safest big city in the country, an achievement that we should never take for granted.”

But at the end of last year, the MTA announced that its $11 billion operating budget had a $343 million shortfall, one that swelled to $800 million after state-level reductions and an unexpected drop in tax revenue. The Transit Authority has slashed services, and staff cuts—including workers who monitor the turnstiles—are a possibility. The century-old tunnel system is vast and cumbersome to modernize (though perhaps not as cumbersome as the bureaucracy that manages it). Given all these challenges, the subway may be more vulnerable than ever.

* * *

Najibullah Zazi and his accomplices, according to recent press reports, planned to carry bombs onto packed, rush-hour trains at Times Square and Grand Central Station. The plan would require no briefcase-full of cash or underworld connections, just a trip to Home Depot.

Zazi’s chemical of choice was triacetone triperoxide, the same explosive believed to have been used in the London Underground bombing. Triacetone triperoxide, or TATP, can be prepared with commonplace substances—hydrogen peroxide and acetone, the main ingredient in nail polish remover. The mixture also needs an acid catalyst. Sulfuric acid from batteries usually does this job, but even lemon juice will work.

Recipes for TATP usually call for boiling the chemicals down to more concentrated forms, but according to James Crippin, a forensic scientist who trains law enforcement in explosives detection, three-percent disinfectant-grade peroxide will blow up as easily as pure peroxide; you just need more of it. Najibullah Zazi testified that he had produced two pounds of TATP for his attack. (It’s not clear whether his co-conspirators had made their own TATP or whether Zazi planned to share.) Hydrogen peroxide at 40 percent by volume can be purchased at an online beauty supply store for only $7.77 per gallon. Acetone goes for $17 a gallon and the same amount of sulfuric acid in the form of drain cleaner costs $80. Not including kitchen tools, a two-pound bomb could cost less than $2,000 to make.

The making is the hard part. TATP is a highly unstable compound, and the more impurities it contains the more sensitive it is to heat or a sudden jostle. It needs no more sophisticated detonator than a nine-volt battery of the kind found in smoke detectors, and its scent usually eludes bomb-sniffing dogs. Portable detectors for TATP only reached the market in 2006. “It would literally be impossible to regulate and control the procurement of the precursive chemicals because they are so common,” said Crippin. Instead of trying to keep bomb-making instructions from publication, he advocates training for retailers who sell the ingredients.

Explosives like TATP cause damage in several ways. They generate a brief but intense flash of heat, which can scorch lungs, set fires, and cause smoke inhalation. The explosion itself is caused by a chemical reaction, an instantaneous release of gases which compresses the air around the bomb. The difference in air pressure creates a shock wave that can knock you out of your shoes, launch broken glass and debris in all directions, or throw a person against a rigid object—a subway pole, for example.

The force of a bomb—and, by extrapolation, the damage it can inflict—is measured in pounds per square inch (psi). It takes only five or six psi of pressure to knock down a wooden telephone pole or rupture a person’s eardrums. A force of 35 psi is enough to snap a neck. A hurricane-force wind strong enough to blow in a window creates pressure of less than one psi; the force of the explosion that destroyed the Murrah Federal Building in Oklahoma City was around 4,000 psi.

But the Oklahoma City bombing took nearly 5,000 pounds of ammonium nitrate fertilizer and diesel fuel to devastate a nine-story building. A subway bomber can detonate only as much as he can carry on his back or maybe push in a cart. According to the official account, each of the London Tube bombers carried between four and eleven pounds of explosives—easily enough to peel the roof off of a bus.

Though the potency of a peroxide-based explosive depends on the production method, a well-produced TATP bomb can be as deadly as TNT. By that standard, Zazi’s two pounds of TATP could collapse a wood-frame house. And in the confines of a subway car, the bomb could have been far more devastating. “If you are in an open space,” said Crippin, “the explosive force can dissipate, but the shock wave is going to bounce around inside of that car.” Bombardier and Kawasaki, the companies that supply most of New York’s “rolling stock,” use safety as a selling point of their rail cars, but neither was willing to discuss the effect of blast pressure on their vehicles. The images of twisted metal and shattered glass from the London bombing may be a fair indication.
* * *

At a small ceremony in Brooklyn in June 2005, Democratic assemblyman Dov Hikind unveiled 120 new security cameras in his district’s D, F, and N subway stations. Impatient with the speed of the MTA’s security improvements, Hikind made and end-run around the transit agency and used $1.2 million in state discretionary funds to install cameras at nine stations. (Hikind also advocates for the old-fashioned kind of facial-recognition software, lobbying to legalize ethnic profiling twice in the last five years.)

“When riders at these stations look up,” Hikind told his constituents, “and see these cameras everywhere at their stations, they know it makes a difference. They feel safer, and they are safer. But what about the rest of the system?”

New Yorkers had good reason to wonder about the rest of the system when, on July 7 during the morning rush hour, four men boarded London public transit—three on the Underground and one on a bus—and detonated backpacks full of homemade explosives. The London public, praised by security experts for its vigilance after decades of IRA bombings, apparently noticed nothing out of the ordinary. Cameras recorded their movements through the system but the men’s faces triggered no alarms. Though all four London suicide bombers, like the perpetrators on 9/11, were Muslim radicals, they were also British citizens and had been unknown to counterterrorist authorities when they were alive.

Excluding the bombers, 52 people died in the London attack, a small tally compared to the nearly 3,000 killed on 9/11.  But the very modesty of the plot made it troubling to authorities. Sept. 11 was a tightly coordinated hijacking. It required the terrorists to negotiate airport security, overpower flight crew and passengers, fly commercial airliners to their targets, and accomplish dozens of other preliminary actions detailed in the 9/11 Commission Report.  It also required between $400,000 and $500,000 in financing and the sustained zeal of dozens of accomplices.  The London bombing on the other hand was homegrown, do-it-yourself terrorism.  UK investigators estimated the entire endeavor cost only £8,000 (around $12,000) and that the men received no financial support from al-Qaeda or other terrorist organizations.  The only thing that stood between the bombers and mass murder was the condition that no one discover their plans. And no one did.

A high body count is not the main objective of terrorism. The real goal, said R. P. Eddy, former director of the White House National Security Council and CEO of consulting firm Ergo, is to disrupt a secure society. “What’s worse: an attack on a building lobby where 150 people get killed or an attack on a train that kills 150 people?” asked Eddy, in a phone interview. “The train: that attack will have a much greater effect. The subway is the circulatory system of the city. It’s such a perfect metaphor; it’s almost silly. Disrupt it and it affects everything.” If the subway has to close, as it did briefly after 9/11, people can’t get to work, school, or hospitals. And by extension, if New Yorkers no longer believe that the trains are safe, the city’s economy stands to suffer. With so much at stake, one would expect the MTA to go to great lengths to keep its system secure. But the reality of the MTA’s security plans is a history of false starts, serial lawsuits, and organizational disarray.

* * *

Just months after the World Trade Center attacks, the MTA appointed Louis R. Anemone as its new director of security.  During Anemone’s 34-year career with the NYPD he had overseen Compstat, the system that held police commanders responsible for crime rates in their precincts.  Anemone retired in 1999 as chief of department, the highest-ranking uniformed officer on the force.  He brought in Nicholas Casale, also a police veteran, as his deputy director.

A consultant to the security team recommended that the MTA confer with a U.S. Army division specializing in information technology and integrated systems. Before long the MTA had agreed to install an ambitious security system that would surpass ordinary station surveillance. “The Army said, we will give you our technology,” Casale said in an interview, “because they had identified this as a primary target.”

The plan included “smart” cameras that could alert authorities to trespassers, devices to detect unusual sounds and changes in temperature, even a radar system to protect train yards from aerial attack.  The Army promised to stop unauthorized access to underwater tunnels (including by employees) with technologies that would disorient intruders and fire rubber bullets and “Spiderman glue” to halt them in their tracks. Paul Wolfowitz, the deputy secretary of defense, signed off on the project. The whole apparatus was expected to cost $250 million, less than half of the MTA’s $591 million security allocation.

Then a seemingly unrelated controversy sabotaged the plan.  In the spring of 2003, after a year of service, Anemone and Casale were fired from their posts.  The MTA refused at the time to comment on the firings, but Anemone and Casale claimed they were dismissed because of allegations of corruption they had made against other agency officials.  Casale had reportedly flagged $100 million worth of contracts to the district attorney’s office, calling the contracts tainted.

In addition to protecting the system from external dangers, Casale saw a large part of his mission as maintaining the internal security of the organization. The MTA’s ambitious capital projects brought in thousands of outside contractors, entrusting them with detailed plans and schematics. “You can build up all the walls you want to keep the enemy out, but meanwhile…”

Anemone and Casale demanded to be reinstated and sued the Transit Authority in 2005 for violating their right to free speech. Three years later, the case was thrown out of court by a Federal District Court judge. “Because of security concerns” the MTA declined to say what was wrong with the Defense Department’s plan, but William A. Morange, Anemone’s replacement in MTA security, declared it unachievable and started over.

* * *

It doesn’t take an absolute pessimist to think that securing New York’s transportation systems is, in general, unachievable. The subway alone is the fourth largest transit system in the world, with 840 miles of track and well over a thousand legitimate entry points. But the MTA is also responsible for 244 bus routes, the Long Island Railroad and Metro North commuter rails, and bridges and tunnels that accommodate 300 million vehicles each year. The average screening rate for airport security is one minute per person, but it’s called “rapid transit” for a reason. Screening passengers individually as they swipe their Metro cards isn’t feasible. The NYPD has tested hand-held devices built to detect chemical explosives at close range, but at present there is no large-scale apparatus available that wouldn’t cripple the movement of the city.

At the time of the London Tube bombings the agency had spent just $30 million of its federal security funding. They added 200 police officers to station patrols (an increase of 39 percent) and had begun deploying bomb-sniffing dogs in greater numbers. The MTA had also hired the public relations firm of Korey Kay & Partners to perfect the “If you see something, say something” campaign, combating decades of conditioning in which New Yorkers learned to mind their own business on the train.

In August 2005, with London still fresh in the public imagination, the MTA announced a $212 million contract with Lockheed Martin for an electronic security program even more sophisticated than the one proposed by the military.  The plans called for a blanket of 1,000 video cameras and 3,000 motion sensors that could recognize the faces of known terrorists and detect people carrying heavy packages or loitering (though presumably not on platforms). The project would also have enabled the use of cell phones in 277 underground stations so that passengers and transit workers could more easily alert the police of an incident.

But those plans too have become ensnared in legal disputes and public outcry.  The subway now has 4,313 surveillance cameras installed by a subcontractor, SteelBox, Inc., throughout the system, but fewer than half of them work, according to recent revelation in amNewYork. Part of the problem is that the existing fiber optic cables are too old to handle the cameras’ transmissions and must be replaced. Lockheed has walked away from the project and accused the Transit Authority of not providing their workers necessary access to tunnels. The MTA in turn claims the defense contractor’s work failed to live up to promises.  The two organizations are now suing each other for breach of contract; the project is a year and a half behind schedule and more than $200 million over budget. While those lawsuits still wend their way through the courts, the Moscow bombing in April reminded everyone that mass transit is especially vulnerable to cheap, low-tech attacks.

Not everyone agrees that advanced technology is the answer. Bruce Schneier, the author and technologist who coined the pejorative term “security theater,” had some advice for transit officials after the recent bombing in Moscow: save your money. “A far better strategy,” Schneier wrote, “is to spend our limited counterterrorism resources on investigation and intelligence—and on emergency response. These measures don’t hinge on any specific threat; they don’t require us to guess the tactic or target correctly. They’re effective in a variety of circumstances, even nonterrorist ones.” These types of measures, in fact, were effective on 9/11—not because of MTA planning, however, but because of employee insubordination.

* * *

The last operator to drive a train through the concourse of the World Trade Center on September 11, 2001 made a snap decision to disobey MTA protocol—a decision that saved lives. Dispatchers had warned him of a “smoke condition” and instructed him to continue through the station without stopping. Neither the dispatchers nor the train operator knew what calamities were taking place above ground and the instructions were standard practice for situations involving dangerous fumes.

But the driver made a different call. Seeing the frightened faces of the people on the platform, he stopped and let them board. “The whole time I was trying to decide how to write this incident report…,” he told Noah McClain, a researcher at New York University. “And, I’m thinking ‘how am I going to word this that it sounds like I’m doing the [Transit Authority] a favor?’”

This episode typifies the conflict between regulations set by MTA leadership and the daily realities of subway workers. McClain, a sociologist, has spent six years talking to transit workers, and his research—begun in collaboration with Harvey Molotch, a sociology professor at NYU—reveals how inconsistency and overregulation make it difficult or undesirable for workers to put safety first. And in an emergency situation, confusion about protocol can only lead to disaster.

McClain found that workers who report suspicious packages and other security breaches can be written up for minor infractions such as not wearing the proper uniform or being outside their assigned work zone at the time of the incident. “If the culture of the organization is to be punitive, people have to be punitive in order to show that they are doing their jobs,” he said. “Violations will be written where violations can be written.” According to McClain, though most transit employees take their roles in security seriously, there is a strong sense that the MTA rewards their vigilance with demerits, managerial scrutiny, and lengthy paperwork. “Security is in huge part a labor relations issue,” McClain said. It should be in workers’ best interests to protect the system, but many small ways, it is not.

Confusion around evacuation procedure is another source of concern. If Zazi had succeeded in detonating a sack of TATP between Times Square and Penn Station, for example, hundreds of injured passengers might have been stranded in dark tunnels, deep below ground, dependent on transit workers to lead them to safety. Peter Foley, a Transit Workers Union official who until recently held a senior post in the MTA’s turnstile department, said that train operators, conductors, track workers, and cleaners all receive emergency training. But the MTA has never tapped the expertise of the roughly 7,000 Maintenance of Way employees who might offer the greatest expertise on the underground landscape. “We’re not trained,” Foley said. “We talk about it in the locker rooms—what are we going to do, you know?”

“I have talked to our members—the ones who are supposedly being trained,” said Warren George, the president of the Amalgamated Transit Union, testifying before the US Senate in 2007, “and they tell me a different story. They are scared, not because they know there is a threat, but because they feel out of the information loop, and they have no idea how to help prevent an incident or what to do if one occurs.”

Many lines already operate without a conductor, leaving only a single operator on every train. Now, to mitigate its enormous budget deficit, the Transit Authority plans to lay off some 500 station agents. The Transit Workers Union opposes the move, arguing that the cuts will save the MTA only $13.2 million, one tenth of one percent of its total operating budget. The cost to riders may be much greater: counterterrorism experts widely agree that transit employees who work regularly with passengers are likely to notice suspicious activity.

The staff cuts are only the most recent in a decade of short-sighted decisions by the MTA. The agency claims that “there has been tremendous progress under the 2000-2004 and 2005-2009 MTA Capital Programs in ‘hardening’ or strengthening the system physically to better withstand the impact of explosive devices.” But it’s 2010 and whatever “progress” has been made, it is far from what the MTA promised.

The attempt by a Taliban operative to detonate a car bomb in Times Square last week points to an emboldened insurgency and a growing threat to New York targets. Najibullah Zazi didn’t make it past the defenses of law enforcement, but how long will it be before another extremist does? And what will happen to New York when the system that keeps us moving comes to a fatal stop?

May 2010