So how DO you determine if something has a deterrent effect?
Since that's essentially impossible here, we can't show a deterrent effect. But we can use behavioral models to make reasonable guesses as to what might be a deterrent.
Another is that any security system needs people that think like bad guys. Those are the ones that you need to ask if your deterrence is working. I have seen time and time and time again a system attempt to implement a security policy, work months or years on it, and have it compromised or diverterted for other purposes within days of implementation. Sony's recent CD copy-protection issue is a great example. They very obviously didn't have anyone on that project to give a hacker's perspective.
None of this really shows a deterrent effect. It instead identifies security vulnerabilities. Clearly, installing a rootkit on your customer's computer is an astoundingly bad move (I don't know what Sony was thinking, either), but this is only a deterrent in the most trivially reductive sense (you will if you can, you won't if you can't).
Any hacker worth his salt is taking only minimal risks; a would-be hijacker takes extraordinary risks. The idea with a deterrent is to present a negative motivational factor in the form of an increased perception of risk, so the question is, does having air marshals on board do that?
As I said earlier, I think it's basically impossible to hijack a plane today. You'll have to deal with crew and passengers actively resisting you, get through the reinforced cockpit door, convince the pilot to disobey FAA orders (or kill him if you know how to fly a jet plane), and then you'll probably just get shot down. So I think, putting ourselves in the mind of a terrorist, this strategy sucks. The best result is killing everyone on the plane, so you're better off just blowing it up without exposing yourself to unnecessary risk of failure. It's simple decision analysis.
There's one exception I can think of, and that's if you can kill a few flight attendants and passengers, cow them into compliance, and yell through the door for the pilot to land the plane, you can engineer a hostage situation. If there are marshals on board, this strategy becomes very risky; again, better just to blow the plane up. On the other hand, if there aren't marshals on board, it's a viable strategy, and it works out better for us, since it puts fewer lives at risk.
So from my perspective, and in the absence of evidence to the contrary, it seems like many more air marshals that we previously did puts us at greater risk. I recognize that this is strangely counter-intuitive, and that it's not likely to change anyone's mind.
