Airport security is a simple process, at least for most people who have ever been on a commercial flight: Present identification, pass through a scanner at the ticketing booths, board the aircraft. It's a system that carries millions of passengers every day and it does work most of the time. But a recent occurrence at Houston's airport showed just how many can be in that chain when an opportunist is up to no good.

Abdulrahman Oriyomi wanted to go from Houston to LA without having to pay for a ticket. That was an audacious, alarming series of events a slow-motion security breach that culminated in a complete evacuation of the aircraft, a three-hour flight delay, an FBI response and an explosives detection dog searching a grounded United 737. Just because one guy somehow bluffed, walked past and tailgated his way through multiple layers of a system that was built to prevent this.

How He Managed to Pass TSA the First Time

The story starts at the TSA checkpoint where it wasn't smooth sailing, but it wasn't anything that was disastrous either. The boarding pass issued by Oriyomi was a problem at the screening kiosk. Instead he was taken away to another kiosk where it apparently worked out and he was allowed to pass. How the passage was possible is not yet clear, but it is assumed that some extra data was obtained in the United system at some point in the screening process, and was sufficient to meet the requirements of the identity verification procedure, or perhaps it was one of the myriad exceptions that happen daily in millions of screenings.

This is the first time the system has had a crack. TSA's job is to confirm the identity and to compare the traveler to a reservation, and to screen against security databases. During that process, an unticketed passenger's "possibly fake" boarding pass with missing information and a bogus QR code wasn't identified, investigators said.

Another and One and One are two Attempts, One Success

Oriyomi was not immediately taken on board a flight inside the terminal. He walked around, talked with United staff at one gate and tried to get on a flight to Los Angeles from gate E16. There he did what he was supposed to do-his boarding pass scanned twice; after arguing with a gate agent, he was turned down. Clean result, but with no follow-up. No security alert was raised. There was no one who could follow him thereafter.

Some hours later he was at another gate to observe the boarding procedure and the times when agents were engaged in other boarding operations. When his turn came, he put himself at the rear of the boarding line and, while the gate agents were distracted, he assumed they were holding a boarding pass and headed down the jet bridge to Los Angeles on United 469.

Once Onboard: A Lavatory-Hopping Game of Hide and Seek 

On board the plane things quickly got out of hand. This flight was completely full, leaving no seat unoccupied to take a quiet seat. Oriyomi, sitting in the aisle, wasn't sure if it was his seat, the woman beside him commented. He went to the washroom and came back 15 minutes later, and there he found the legitimate passenger sitting in the seat he had taken. As the plane started taxiing, he sought refuge in another lavatory, having been turned away from his seat.

A passenger reported to the flight attendant. He told crew that he was "Mr. Lopez" which did not show up on the flight manifest. In an almost cocky and hilarious moment, he asked if he could sit in a jump seat for the flight. The crew made the plane back to the gate.

Where the system failed And where it held

This incident is a good example of layered security, as some layers worked as expected and others did not. So here is an unvarnished appraisal of how things went wrong:

• TSA checkpoint: An unticketed passenger was let on board with a possibly forged boarding pass (as a result of a system exception or a documentation failure, not detected in real time)
• First gate attempt (E16): The boarding pass scanner rejected the fake pass on both of its attempts and the gate agent refused him entrance a true success, with no indication of an alert or escalation of security in the follow-up.
• (2nd gate attempt) D4-Gate agent, momentarily distracted, did not visually check the boarding pass, allowing tailgating onto the jet bridge (critical failure point)
• On board crew: Once notified by a passenger, the crew of the aircraft responded appropriately, returned to the gate and activated the comprehensive security response.

This isn't an isloated event

What is so special about this incident is it's not an isolated occurrence. Several aviation security incidents have been reported over the past few years, including a few with Delta flights. A passenger flew from New York JFK to Paris without a boarding pass and during the transatlantic flight, he moved from the lavatories until the plane landed in Europe. An unauthorized passenger was also spotted as the plane taxied for its Seattle-Honolulu Christmas Eve flight, which was delayed until the individual was discovered in the terminal restroom. Another passenger took a picture of a passenger's boarding pass, which was marked as "all boarded" and the passenger boarded despite the alert being flagged, which was overridden by a gate agent.

Arrest and what came after

In another puzzling element of this case, Oriyomi wasn't immediately arrested after the incident on May 18. He was questioned by officers, who asked for his true name and a United confirmation number and he was let go, but started recording law enforcement and airport activity as he left. He was arrested several weeks later, charged with a felony with regard to disrupting a critical infrastructure facility.

It takes a while for the arrest to be made after the incident.It takes a lot of time for the arrests to be made after the incident. The extent and disruption of the incident three hours, full evacuation of the aircraft, a bomb squad search and a federal investigation is not something that's hard to explain, if it had been at the wrong time, it would have been at the right guy.

The Bottom Line

A man with a fake boarding pass and no ticket boarded a full flight on United Airlines from Houston to Los Angeles after a short inattention span of a gate agent, who had just turned him away at a different gate, an hour earlier. The incident caused a three-hour delay, and the aircraft was completely evacuated, along with the FBI, an explosives sweep, before the flight could resume. It is part of a pattern of occurrence at large airports across the United States that shows a common weakness: multiple layers of security can be successful if they all are, but if one is not, the whole process is compromised. Abdulrahman Oriyomi was arrested weeks later on felony charges, but the more pertinent question is how to make changes to stop the next one.