The timing of this one couldn’t have been much better.
I’ve spent the last couple of days working on a Raspberry Pi project, designing and 3D-printing a mounting system for a Raspberry Pi that is eventually going inside an old Macintosh Classic II case.
Then, while I’m doing that, I come across a video discussing the prohibited-items policy for the 2026 New York City mayoral inauguration.
And sitting there on the prohibited list were two names that immediately caught my attention:
Flipper Zero.
Raspberry Pi.
Yes. Raspberry Pi.
The little general-purpose computer I’m sitting here building a mounting system for was specifically named as something you weren’t supposed to bring to the event.
Reporting on the inauguration confirmed that both devices were individually named on the prohibited-items list. Other prohibited items were much more conventional categories: weapons, explosives, drones, large bags, alcohol and similar items. Meanwhile, ordinary laptops and mobile phones weren’t similarly listed.
And this is where my previous work in both security and IT makes the whole thing distracting to me.
Because I think they’re approaching the problem backwards.
Tell Me What I Am Allowed to Bring
For a controlled security environment, sometimes it is considerably easier to tell people:
These are the things you’re allowed to bring inside.
Anything outside that list either stays home or gets specifically reviewed and approved.
That’s it.
You don’t have to build an encyclopedia containing every potentially troublesome electronic device ever manufactured.
You could write something along the lines of:
Personal cellular phones and ordinary consumer cameras are permitted subject to security screening. Laptops and other computing equipment are permitted only where authorized for credentialed personnel. Specialized computing, radio, development, testing or communications equipment requires prior approval. Any electronic equipment outside generally permitted categories may be denied entry at the sole discretion of event security.
There.
Problem solved.
You brought your phone because you’re going to communicate with people, take some pictures and record some video?
Fine.
You are a photographer carrying authorized camera equipment?
Fine.
You’re media and you have authorization to carry a laptop?
Fine.
You walk up with a bag full of development boards, radios and testing equipment nobody was expecting?
Now we’re going to have a conversation.
And maybe the answer is simply:
No. You’re not bringing that in.
You were the person who decided to bring unusual electronic equipment into a controlled security environment without getting it approved first. That’s not security’s problem.
A Raspberry Pi Isn’t a Hacking Device
This is where the published list starts looking technically ignorant.
A Raspberry Pi is a computer.
That’s it.
It happens to be a very small, inexpensive and extremely flexible computer.
Can somebody use one maliciously?
Of course.
Give me the appropriate software, interfaces and peripherals and I can use a Raspberry Pi for network testing, wireless experimentation, automation, USB functions and plenty of other things that could reasonably concern somebody responsible for a secured event.
But here’s the problem:
I don’t need a Raspberry Pi to do those things.
A normal laptop can perform an enormous amount of security-testing work. A deliberately configured cellphone can perform security functions. There are numerous other single-board computers and development platforms available.
That contradiction was noticed when the prohibition was originally reported. Laptops and smartphones weren’t on the same prohibited list despite being capable of performing many of the computing tasks apparently associated with the concern over Raspberry Pi.
So if you tell me:
“No Raspberry Pi.”
Okay.
I won’t bring a Raspberry Pi.
What exactly did you accomplish?
You Banned a Name, Not a Capability
That is the security problem.
If the threat you’re concerned about is unauthorized network activity, define unauthorized network activity.
If you’re concerned about unauthorized radio equipment, define the equipment you’re restricting.
If you’re concerned about penetration-testing equipment, require authorization for penetration-testing equipment.
If you’re concerned about additional computers being brought into an event, limit computers to specifically approved personnel.
But don’t assume you’ve eliminated the underlying capability because you’ve learned the name Raspberry Pi.
There are Raspberry Pi alternatives everywhere.
There are Orange Pi systems.
There are BeagleBone boards.
There are countless ARM development boards.
There are microcontrollers.
There are custom boards.
And there’s the perfectly ordinary laptop that somebody can carry around without attracting nearly as much attention.
From a security standpoint, that’s the equivalent of saying:
“We’ve banned this particular hammer because somebody could hit something with it.”
Okay.
What are you doing about every other object capable of accomplishing what you’re worried about?
The Flipper Zero at Least Makes More Sense
The Flipper Zero is somewhat different.
It is specifically designed as a compact platform for experimenting with several kinds of electronic communications and access technologies, including RFID, NFC, infrared and sub-GHz radio. That makes additional scrutiny at a controlled event much easier to understand.
If I were working a security checkpoint and somebody arrived with one, I could understand asking:
Why do you need this inside?
That’s a reasonable security question.
What I don’t like is making the next leap:
“Flipper Zero is prohibited, therefore we’ve solved the problem.”
No, you haven’t.
You’ve prohibited one commercially recognizable implementation of those capabilities.
Someone interested in causing trouble isn’t necessarily going to walk through the checkpoint holding the exact device you put on your poster.
That’s the entire reason threat assessment exists.
I’ve Worked Under Rules That Actually Made Sense
I’ve worked in environments connected to defense contracting where photography restrictions were very simple.
No photography without authorization.
That makes sense.
The rule wasn’t:
No Nikon.
No Canon.
No Kodak.
No Sony.
No iPhone photography.
No Samsung photography.
That would be ridiculous.
The prohibited activity was unauthorized photography.
There could be equipment that shouldn’t appear in photographs.
There could be documentation visible on a wall.
There could be personnel or badges in the background.
There could be information that shouldn’t leave that controlled environment.
The security policy addresses the thing security is actually trying to prevent.
And if you have authorization?
Then an exception can be made.
That is what permits and credentials are for.
Security Doesn’t Require You to Guess Every Possible Device
This is especially important with technology because there is no way your prohibited-items list is going to keep up.
You put:
Raspberry Pi
on the list today.
Great.
What happens when somebody arrives with some board your security officer has never seen?
Does the guard Google it?
Does somebody stand there researching specifications while hundreds of people are trying to get through the checkpoint?
Does the device get through because it doesn’t say Raspberry Pi on it?
That’s unnecessary.
Instead:
These are the electronics ordinarily permitted inside.
Anything else requires review.
Now the security officer doesn’t need to be an electrical engineer.
The person doesn’t have authorization?
It doesn’t come through.
The person claims there is a legitimate business requirement?
Send them to secondary screening and determine whether the equipment is authorized.
That is considerably easier to administer.
This Is Basically Application Allowlisting
There is an amusing IT-security parallel here.
We’ve dealt with exactly this problem in computers forever.
One approach says:
Here is a list of all the bad things you’re not allowed to run.
Then somebody invents a new bad thing.
The alternative says:
Here are the applications authorized to execute on this system. Everything else requires approval.
That’s allowlisting.
Obviously the physical world requires considerably more nuance than an application-control policy, but the underlying concept is similar.
When you control the environment tightly enough, sometimes it is considerably easier to establish what belongs there than to predict every possible thing that doesn’t.
And Don’t Forget the Human Being
There’s another benefit to this approach.
Security still maintains discretion.
Even an otherwise permitted object can warrant additional investigation depending on circumstances.
Someone carrying a cellphone isn’t unusual.
Someone carrying ten cellphones wired into a battery pack with additional electronic hardware might deserve a few more questions.
Context matters.
That’s where trained security personnel come into the process.
The policy creates the framework.
The security officer evaluates what is actually standing in front of them.
You don’t replace human judgment with a shopping list.
The Timing Made This One Particularly Funny
And this is why this story hit me at exactly the right moment.
I’m sitting here building a Raspberry Pi system.
I’ve been designing the carrier in OpenSCAD, testing dovetails, printing components, mounting a fan and figuring out how the entire assembly is going to fit inside a Macintosh Classic II.
My Raspberry Pi isn’t preparing to attack New York City.
It’s preparing to live inside a Macintosh.
Yet I happen to see a video telling me that somebody specifically put the words Raspberry Pi on a security prohibition list.
And the security part of my brain immediately goes:
What exactly are you trying to prevent?
Because if you can’t answer that without naming the product, maybe you haven’t adequately defined the threat.
A Better Rule Isn’t Complicated
For an event like this, I’d rather see something simple:
Allowed without special approval:
Personal phones.
Normal consumer cameras.
Required medical electronics.
Other specifically listed personal items.
Allowed with authorization:
Professional camera equipment.
Laptops.
Broadcast equipment.
Specialized communications equipment.
Development systems.
Testing equipment.
Other business-required electronics.
Everything else:
Subject to inspection and approval by security.
And then maintain a prohibited-items list for things that genuinely make sense as prohibited categories.
Weapons.
Explosives.
Unauthorized drones.
Hazardous materials.
Whatever else the actual threat assessment requires.
That’s a coherent security policy.
Security Should Describe the Threat, Not This Year’s Buzzword
I don’t know what intelligence the organizers had internally, and neither does somebody watching a YouTube Short.
There may have been a specific reason behind those devices that was never publicly disclosed. Contemporary reporting said organizers had not provided an explanation for specifically singling out Raspberry Pi and Flipper Zero.
So I’m not going to pretend I know something that wasn’t published.
I’m criticizing what was published.
And as written, naming a general-purpose Raspberry Pi while apparently allowing other equipment capable of performing many of the same computing functions doesn’t make much technical sense.
It looks like a blacklist built around recognizable technology.
That’s exactly what security policy should try to avoid.
Define your environment.
Define what’s expected inside it.
Define what requires authorization.
Screen people and equipment appropriately.
Make exceptions through a controlled permit or credentialing process.
And reserve the right to tell somebody who shows up carrying something that doesn’t belong there:
No. You’re not taking that inside.
That’s considerably easier than trying to predict every piece of technology somebody could possibly misuse.
And best of all, your security policy doesn’t have to be rewritten every time somebody releases another single-board computer.
Description: While working on my own Raspberry Pi project, I came across the unusual decision to specifically prohibit Raspberry Pi and Flipper Zero devices from the 2026 NYC mayoral inauguration. Drawing on my previous security and IT experience, I look at why security policies should focus on permitted equipment, capabilities, screening and authorization instead of chasing individual technology product names. A Raspberry Pi can be misused—but so can a laptop, cellphone or countless other devices. Good security defines the threat and controls the environment rather than relying on the buzzword of the day.
Hashtags: #ITSecurity #RaspberryPi #FlipperZero #Cybersecurity #SecurityPolicy #TheGigmansLife