Security Overkill, Diaper-Changing Edition

I’ve been thinking a bit lately about security overkill. This includes not just the notion of “security theater” — security measures meant to inspire comfort by mere show of force/complexity — but the many instances in which someone places a layer of security between me and my everyday activities with no apparent benefit whatsoever.

My bank would surely argue that its many and various anti-fraud measures are valuable but in truth a) they are meant to protect the bank, not me; and b) they are cumbersome to the point of ridiculous. It’s gotten to where I can predict which credit-card charge will trigger the bank’s idiot algorithm and freeze my account because it didn’t like the Zip code where I used the card.

And security overkill has trickled down into the civilian world. When the class parents at my kids’ school send out a list of parent contact info at the start of each school year, it comes via a password-protected Excel spreadsheet. Keep in mind this list doesn’t contain Social Security numbers or bank information — just names, addresses, and phone numbers of the kids’ parents. I can imagine the day several months hence when someone actually needs to use the list and will find herself locked out by the long-forgotten password.

The most outrageous example of security overkill I’ve run across recently was at the 30th Street Station, the main train terminal, in Philadelphia. Here’s what I saw in the men’s room:

If you can’t make out the image — it’s a locked diaper-changing station with a handwritten message saying “see attendant for combination.” I’m sure we could dream up some bad things that might happen on an unlocked diaper-changing tray, and I’m guessing as with most security overkill this was inspired by one anomalous event that scared the jeepers out of someone (or got that someone’s lawyers involved). But still …

Please share your security-overkill stories in the comments below. And if you have pictures, send them to


They probably had a problem with people using them to do coke.


That's what I thought too.


My first guess is that this is to prevent vandalism, not terrorism. It's probably a lot of drunken fun to smash one of those platforms.


Our type of key (at work) for a single sheet glass door:,r:10,s:0
[Sorry for the unreasonably long link, I can't upload pictures in my post]

I understand your frustration with overly complicated and plain obsolete protective measures, especially since really sensitive digital information way too often isn't properly secured. (Our government, of the Netherlands that is, recently had a string of critical failures)

richard d

here. fixed


Idiots break these off or deface them so no one would dream of putting their baby on it. Security for the changing station, yes. Security in the sense you used it, no.


Well, security in the sense that if some idiot tears it off the wall, no one gets to use it.


I wonder how long it would take to just try every combination. I would be sorely tempted to just crack the combination the hard way and write it down next to the message.


Well my guess it is a four number combo. If I set the combo I would make it spell out a word using the numbers on a phone. What diaper changing four letter words would you choose?

Mike B

A lot of what might be mistaken for security theatre is simply nudge style behavioral economics. If you increase the cost of an act of theft or vandalism you will eliminate most so called crimes of opportunity. Remember that most physical security devices are easy to defeat for an attacker with a modicum of time, skill or effort. The reason that society isn't completely dysfunctional is because A) a majority of humans are honest and B) a majority of those that are not lack the basic skills, motivation and concentration to defeat security precautions.


There are two reasons for this:
#1 (human nature) People tend to become overprotective on the basis of a single adverse event.
#2 (US nature) Liability. In USA (and Canada) the threat of a liability lawsuit makes people do crazy things.


One time a guy name Richard Reid tried (and failed) to blow up a plane with a bomb planted in his shoe about 10 years ago.

Now, *every* single person that flies on a plane in a country with 300 million citizens has to take off their shoes before they can get on a plane.


Leading to amusing situations in other countries where people sometimes have to be reminded "You're not in the US. You don't need to take off your shoes..."

Josh Thurman

City mayors or other state officials who travel with security details.


As a foster parent, I can appreciate the password-protected file. There are certain bio-parents that are not allowed to know the location of their kids, for the kids' protection. I personally do not want an abusive father of one of these kiddos tracking them down at my house angry that they were taken away.

Sometimes, you simply don't know the reasons for the precautions that seem like overkill.

Random guy

And how would this potentially abusive parent get the password protected file? Anyone who forwards it to them would also forward the password.

Password protection doesn't encrypt the file, you can still view the data with programs other than Excel. So some abusive, non-custody having file would still be able extract the super sensitive information of name+phone number.

Or maybe this is what it is, some deluded parent type thinking they are protecting non-sensitive information when really they are just adding inconvenience.


The office building I work in Toronto has a sign on every floor: "No peanut product on this floor!"

I would understand if this was a daycare center where underange individuals need to be protected from their own ignorance but... come on... this is an office building where only adults go.

caleb b

Unfortunatly, people are pretty stupid. When I was a waiter, I personally had:

People ordering Bleu Cheese dressing, but sending it back bc they were lactose intolerant.
People 40+ years old order shrimp cocktail and then asking me if shrimp is a shellfish.
People sending back vodka on the rocks, or whiskey up, bc they said it was “too strong.”
People complaining that the parsley (or green onion) garnishment wasn’t cooked.

It is amazing what people don’t know.


Not sure if this qualifies as a *security* measure, as much as a CYA measure, but in Chicago we've had to deal with two announcements alerting us to the EL doors closing.

First, there are two chimes followed by a recorded voice saying "Doors closing." Then, the train operator announces, "Do not attempt to board, the doors are closing" (which, I might add, comes across as muffled jargon most of the time). Why the need for two announcements?

Because there were a couple of incidents in which negligent passengers tried to beat the closing doors and got caught in them (detailed well here:

As the article points out, passengers try to beat the doors because we intrinsically know that there is a 1.5-2 second delay between the recorded announcement and the doors actually closing. So now we have to live with two announcements which exacts a cost similar to Dubner's story on the emergency exit alarm he experiences in NYC.



What a huge pain in the butt, if you walk into the bathroom with your baby in one hand and the diaper bag in the other. Then, you see the locked changing table, and have to lug your kid (with a full diaper, to boot) and the diaper bag to the attendant, pick up an ADDITIONAL item (the key), and go back to the bathroom... then afterwards bring the key back to the attendant. Honestly, I'd rather just change my baby's diaper on the floor.

Seems like this causes way too much hassle to people who actually need to use the changing table for its indended purpose.