Air Canada Sues Over Misuse Of Employee Password

Anonymous Coward writes "What do you do when you let an employee go? You kill their password and ID, right? Air Canada didn't, and they're now in court because the employee went to a competitor, wrote some cool automated scripts using the ID/password, and grabbed some company data." Interesting story, because Air Canada authorized the employee to access this website and book tickets for himself as part of his severance, but they apparently provide a little more data on that site than what is available to the public.

Comments

If you deal in garbage, you might attract flies.

[LostCluster]

To airlines, a space-available ticket is something that's being plucked out of the garbage. It represents what they allow most of their employees to do... fly for free when there's an empty seat that's going to be going to be going somewhere. Of course, the critical mistake was that in order for somebody to know if there's going to be space-availalbe, they have to publish on this site how full or not full the plane currently is.

So there's where the dumb idea play comes in. If they had just let him have some free coach tickets through the customer side the operation then all they'd have to do is give him some limited-use coupon codes. Or they could have given him cash in his severance package. But no, they had had to go with these theoretically near-zero-cost cost tickets... and now look where they are.

Calling a spade a "spade" are we?

[LostCluster]

Some of Canada's largest pension funds as well as Toronto conglomerate Onex Corp. and several U.S. vulture funds have been mentioned as possible replacement investors in the airline.

Was that a typo... or is The Globe and Mail public on it's low opinion of venture capital operations?

Re:Calling a spade a "spade" are we?

[asreal]

Yes, they meant vultures. Air Canada is dying, and these funds are just waiting for them to keel over before they swoop down for the feed. Thus, vulture funds.

Re:Calling a spade a "spade" are we?

[Zocalo]

Actually "vulture capital" is a legitimate term for people that buy failing companies in order to asset strip and so on. Quite literally picking over the bones of the corporate carcass for stray morsels of value. If you are in Utah you can see some circling over Salt Lake City waiting for SCO to finally croak.

Re:Calling a spade a "spade" are we?

[qvanderm]

Not a typo. Vulture Funds specialize in 'distressed' investments. A money-burning operation like Air Canada certainly qualifies.

Re:Calling a spade a "spade" are we?

[jonwil]

Hopefully someone will come in, buy up the rights to any unix code SCO may actually own and GPL the whole thing. (Unixware, System V etc)
That would be the fitting end to all this lawsuit crap.

Re:Calling a spade a "spade" are we?

[Jeff DeMaagd]

there's gonna be assets left in SCO?

I would guess not much more than office equipment, furniture and an unread copy of "Litigation for Dummies".

What was the TOS? Was there even one?

[LostCluster]

We may see an interesting test case for the validity of website terms of serivce here, or maybe even what happens when a website forgets to cover a form of abuse in the TOS.

Afterall, the site that was involved here was designed for an internal audience, one that'd not dream of feeding info to a competitor.

But they couldn't simply delete this guy's account because he was entitled to use that site for the next five years to book free air travel as part of his severance package. If he was told not to give the information to his new employer, that's one thing. But if he wasn't, then who can say that infomation given to an ex-employee without any contract still counts as a trade secret?

So, if there isn't a TOS on the page in question... things could get really interesting.

Re:What was the TOS? Was there even one?

[Tirel]

Terms of service are displayed so that the provider can discontinue the service to that particular client if he breaks them, it's never used to sue anyone. He didn't seem to hurt their website significantly (after all, it was months before they noticed it?) so there's nothing illegal in that.

OTOH, if he signed (and not just viewed or clicked on a button), a confidentiality agreement, then he's fucked.

Re:What was the TOS? Was there even one?

[tehcyder]

He must surely have signed some sort of compromise agreement when he left, or else where does the fact that he had five years' access come from?

And if the agreement was drafted without a clause saying he couldn't reveal information to a competitor, then the company's legal/HR team should be fired, not this bloke.

Re:What was the TOS? Was there even one?

[oconnorcjo]

Terms of service are displayed so that the provider can discontinue the service to that particular client if he breaks them, it's never used to sue anyone. He didn't seem to hurt their website significantly (after all, it was months before they noticed it?) so there's nothing illegal in that. OTOH, if he signed (and not just viewed or clicked on a button), a confidentiality agreement, then he's fucked.

Personally I think even if he is "squeaky cleen by the law", I still think he is a sleaze bag. Even if it was legally allowable, he knew his previous employer would not want him doing that and he abused the severance package that they gave him to F#(k them over. Seems like a person I would not want to hire in the first place and understandable why they let him go.

Re:What was the TOS? Was there even one?

[Cecil]

Would you please cut that shit out? "He stole"? What is up with this need to fit every computer crime into our existing little niches of criminal activity?

He used priviledged information in an unethical way that gave an unfair advantage to his new employer, which should be illegal if it isn't already. But he didn't steal. When you get fired by your employer do you try to prosecute them for "aggravated assault"? Stop stretching definitions, especially to the ludicrous extent that "theft" has been stretched. Look, I'm stealing your bandwidth right now! Ha ha ha!

*puts on his pirate hat*

Excellent newspaper

[Rosco P. Coltrane]

Some of Canada's largest pension funds as well as Toronto conglomerate Onex Corp. and several U.S. vulture funds have been mentioned as possible replacement investors in the airline.

Finally a newspaper that calls a cat a cat!

It's all about size.

[NickeB]

Of course you don't remove old IDs/PWDs, the larger the user database is, the cooler it looks.
Right?

Re:It's all about size.

[CoderDevo]

In fact, you shouldn't. You should just have a bit-flag on the accounts saying that they're not allowed to log in... you never know when somebody's coming back to the company and would need their account reactivated.

Actually, there is no harm in deleting the account. It is typical practice to delete all accounts 30-90 days after an employee leaves. My company maintains a database of past IDs and their owners for forensic & audit purposes. (That database is not used for authentication.) But we have no problem with re-issuing an ID to a new employee if the ID has not been used for a few years.

However, deleting or disabling the account would not have worked for Air Canada since they already agreed to give the ex-employee access to their space-available tickets website for the 5 years following his departure.

They could have instead analyzed website activity looking for anomolies, but that may not have worked either since they hadn't anticipated this type of misuse. A better solution would be to not give ex-employees access to any internal data at all. Instead, provide non-employees with only a phone number for a ticket agent who can book the flights for them. But then, that is more expensive. There is risk in being cheap.

I'm not sure if I understand

[PsiPsiStar]

It seems that the ex-employee used automated technology to access information that he was allowed to access. What makes this information confidential?

Maybe Lanford signed somthing, but the article doesn't mention what violation Lanford committed, aside from 'using confidential information' that he obviously had access to.

How effectivly can a company regulate the way that information it discloses can be used?

IANAL. Maybe there's some sort of quid-pro-quo regarding Lanford's receipt of something tangible like tickets which would make a confidentiality agreement more binding than a simple clickthrough liscense, but does anyone know what it takes for one of those buggers to hold up in court?

From the article;



The airline alleges Lafond's identification number was used 243,630 times between May 15, 2003, and March 19, 2004, to access the website.

"The continuous and massive use of Lafond's employee ID number and PIN to access the employee website could not be done by one individual and far exceeds any possible potential use by Lafond," Air Canada said.

Well, obviously he did use the information. It's just a matter of what he used it for.



"Such massive access to the employee website through one employee ID number could only be accomplished through automated technology."

Re:I'm not sure if I understand

[adamofgreyskull]

Would he be equally culpable if he repeatedly tried, on a smaller scale, to book free tickets from work which he cancelled at the last minute and his new employer was monitoring his PC without his knowledge?

Or in this case, what if his employer or some unknown party snooped his login and then proceeded to misuse it without his knowledge? Sounds like a reasonable defence...

Re:I'm not sure if I understand

[matth]

Tough bananas. As the account holder it is MY responsibility to make sure that the account is secure. Whatever is done on or with that account is my responsibility and I am ultimately responsible.

Same goes if Joe Smith user gets a virus on his computer that spamms the heck out of an ISP and the ISP gets on blacklists. Joe Smith user is ultimately responsible for the spam, and should be booted from the ISP (assuming the TOS allows it) for letting the spamer (knowingly or otherwise) use his account to send spam.

Re:I'm not sure if I understand

[Bishop]

I know it is hard for geeks to understand, but there is more to law then what is written down in black and white.

In this civil suit one of the arguments that will be put forward by Air Canada is whether the use of the information was "reasonable." Their argument will probably include examples of similar agrements all in a effort to convince a judge. It is unlikely that there is any document that states how many times a person can log into the site, or what they may use the information found on the site for. These statements are unecessary.

The "reasonable" test goes far beyond what has been written on paper. It appears all over civil and criminal law in every court that has ever been influenced by the British, and probably the other European powers as well. It is a giant catch all in some respects. This test is even found at the heart of modern justice in the phrase "...beyond a reasonable doubt."

Slashdot has reported on many cases where geeks have gotten into trouble when they have assumed that an act was permitted becuase there is no statement preventing said act. This is never the case. In all laws, and in all contracts there is always an implied element of what is reasonable.

Re:I'm not sure if I understand

[ratboy666]

Ok.

If this is a civil matter, you *may* be right.

If this is a CRIMINAL matter, you are very VERY wrong. Nothing to do with "...beyond a reason doubt." either.

And, just for your information, the US (I assume you are in that jursdication), does allow acts if there is no statement preventing said act. And that's in your constitution.

Not so in Canada, but I sure hope that AC has an agreement in place with the ex-employee. Without a mention of web site usage, they are pretty much fucked. Of course, this could be a last-gasp attempt at increasing AC stock price (what is it now? 1.10 CDN or so?) at WestJets expense.

Now, the ex-employee in question may or may not be a "geek". I'll leave that question alone. But if *I* were given marketing data, updated for five years, for my use *without* a rider restricting that use, I would sure use it. And, if sued, take it to the limit. $5 Million and any profits? Why, the counter-suit would be for the whole fucking company.

And that's why I think this is a very stupid move by the AC CEO. (and I fully expect that he expects a bail-out, and to keep his job).

Ratboy.

Thou shalt check thine logs...

[LostCluster]

The airline alleges Lafond's identification number was used 243,630 times between May 15, 2003, and March 19, 2004, to access the website

It took more than 10 months to realize that this account was hitting the site roughly 750 times per day? Somebody didn't bother to check the logs regularly... this should have smelled funny much faster than that.

Re:Thou shalt check thine logs...

[Willeh]

Or they just assumed he was a compulsive, obsessive control freak checking up on his flight every 5 seconds, and that was the reason they fired him in the first place.

Re:Thou shalt check thine logs...

[Tom]

You've never admin'ed a major site, have you?

I have (16k hits/min during the business day). Something like 750 hits per day is well below the line noise threshold for any large site. Unless you look for patterns like that intentionally, you'll never notice.

Re:Thou shalt check thine logs...

[Ami Ganguli]

Say 40k employees look at the site an average of once a month (I'd probably check it out once a week myself, so I think this is a low estimate).

Each time you log in you probably do five or so hits, for 200k hits a month, or over 6000hits/day.

750 extra hits a day should be noticed, but I doubt anybody cares enough about the traffic on an internal web site to find out why it's gone up by 12% or so. If it happened suddenly on our public site, I'd definately care, but if it happens on our Intranet it's just an interesting statistic.

Of course, somebody did notice eventually. But it doesn't surprize me that it took a long time to figure out.

Turnabout...

[Anonymous Coward]

The funny thing is, Air Canada is one of only a few corporate entities world wide that probably can't afford to sustain litigation against a private citizen =)

For the benefit of Americans who probably neither know the circumstances (nor really care I'm sure), Air Canada is Canadian's only remaining national airline (i.e. services all parts of the country as opposed to just a few very profitable routes; and does so with legendary rudeness, but that is another story), and it is quite bankrupt. Its chances of survival at this point seem pretty remote.

The moral is?

[Trailwalker]

The real problem is the lack of security awareness by Air Canada.

The imformation could have been obtained by noting the place and departure times of all Air Canada's fleights. The ex-employee just made it easier.

Too, it looks like a sinking ship in search of rats.

Re:The moral is?

[Beeswarm]

Wrong. The information in question would have to be the flight loads. This would tell you how many people are booked on a specific flight and how many overbookings are allowed. To an employee, this information would be used to plan their travel by seeing which flights they would most likely to get on as a space-available rider. To a competitor, this information would be useful for determining which routes are more profitible because the seats are always full, and which routes already have too much seat capacity.

Re:The moral is?

[stecoop]

Shouldn't we as consumers clamor to have overbooking information too? I would think that if a flight is overbooked than I should see the statistics to determine if I want to buy the ticket.

Also on the flight loads, if I really (read it twice) want that information, I could have a bunch of apprentices sit outside the loading gates and count the people that boarded having them record the plane and route. Viola - got your information legally.

Re:The moral is?

[AlecC]

Shouldn't we as consumers clamor to have overbooking information too? I would think that if a flight is overbooked than I should see the statistics to determine if I want to buy the ticket.

With budget airlins such as Ryanair and easyJet, you already do, in a way. Prices vary accirding to load. As the flight fills up, prices rise. As the flight date apporaches with lots of empty seats, the price falls. They are using the price carrot to get the max income from those who gotta go when they gotta go, but to suck in price sensitive travellers to fill otherwise empty seats.

Also on the flight loads, if I really (read it twice) want that information, I could have a bunch of apprentices sit outside the loading gates and count the people that boarded having them record the plane and route. Viola - got your information legally.

At a mind-boggling price. It's not the information on one flight from one airport that is valuable, it is lots of flights from lots of airports. Employing apprentices may be cheap - but not that cheap, compared to sucking it out of a database.

Rights? Clearly abused.

[ruprechtjones]

"Using that confidential information, WestJet adjusted its own schedule, planned its expansion into new routes and adopted pricing strategies to force its larger competitor out of certain markets, Air Canada alleges."

This is an insider-information case, and he should get what's coming to him. Pure and simple. He abused a quirk, he and WestJet really don't have a strong case here.

Terms and conditions...

[adamofgreyskull]

I guess it depends on what terms and conditions were specified when they gave him the login and password. If he had to sign an agreement when he got them..presumably they would still be in effect as long as the Login/Password was active.

If the use of the login and password was specified in an employment contract though, would he still be bound to the Ts&Cs after he left?

Re:If you deal in garbage, you might attract flies

[Beeswarm]

Hey, space-available tickets are a very good deal for the airlines and the employees who work for them. I probably would not be working for an airline if it weren't for the fact I've been to Europe twice, Japan once, and Mexico more times than I can remember in the last four years, all working at a salary barely twice the minimum wage. The Reservation center I work at has an extremely low turnover rate by call center standards, and most of my co-workers travel abroad on a regular basis. And the company gets lots of happy workers just by giving away the seats they can't sell.

Re:Rights? Clearly abused.

[danheskett]

But it's insider information he was explicitly allowed to have.

Air Canada fired him. Laid off. Not any longer employed but continued to give him access to information they wanted to keep private. They have, however, no reasonable expectation that this information would be kept private unless of coure it was previously arranged in the severance or rider contract.

Insider information isn't illegal perse. For example, if I went and physically counted the number of people getting on and off Air Canada planes at different times, and recorded that and sold it to WestJet things would be just fine. It's called market research.

The real issue here isn't insider information. It seems to be in my opinion trade secret.

Re:Rights? Clearly abused.

[iMMersE]

How do you know that he didn't just automate checking which flights had empty seats on them, so he could take advantage of his free tickets?

Sure, it looks likely that he passed this information onto his new employer, but unless you are the defendant, how can you be so sure?

The world needs more people who don't just jump to conclusions from reading one newspaper article.

Dealing with this right now

[beacher]

I'm currently working on a project like this as we speak. My company's website is getting nailed from a handful of IP addresses that do nothing but datamining. We've come to the conclusion that captchas would penalize joe user and we're going to move forward with some applications that throttle requests by IP. We don't keep private information outside of account specific data...

My company is looking at it in a different way tho - We've figured out what click sequences are used and we're going to address the business need that these few bots have identified. If these 3rd party bots are selling atomic or aggregate data, well, why not cut them off at the source and sell the data for less?

The company failed in 2 areas - 1) keeping sensitive inside information from their outward facing internet site and 2) They should have rescinded the ID. I'm not sure about making their data available to the competition, but thats an inevitibility that they need to account for.
-B

Re:Dealing with this right now

[Anonymous Coward]

shutting it off is the weak minds way to resolve the issue.

identify the bots and slowly poison their data instead. thats how a man should do it.
whenever the bot is digging into your data, instead of real data feed it fake garbage data instead. poisoned garbage data should however only be slightly off not to make it obvious that it is garbage data. the point is : it should take long to realize that the data is posioned. When they realize the data is poisoned they should not be able to tell what data is real and what is poisoned so they will have to throw ALL data away.

So that when the finally realize they have been poisoned it will be too late to do anything about it.

Re:Dealing with this right now

[beacher]

You do have a firewall, right? Absolutely

So that when the finally realize they have been poisoned it will be too late to do anything about it.
Not ethical and impractical. Just how many requests does it take before you start poisoning? 1000 per hour? We get that many hits from AOL and they come in through a gateway. If we were poisoning legitimate users data, that would be unacceptible.

Why don't you go the ebay way and provide an API into your web site, then change the format slightly every month so breaking the web crawlers? After all, you may as well make money out of the data miners. We have *extensive* APIs into most of our systems. We're trying to get the bots to use and license the APIs. I have been talking with some of the developers to try to put some unicode inside (human readable but bot breaking).. They may be looking into this. We don't make any money off the data miners.

Re:Rights? Clearly abused.

[ruprechtjones]

The real issue here isn't insider information. It seems to be in my opinion trade secret.

I'm sorry, you are correct. This is a trade secret issue. If Air Canada can cough up the paperwork saying he was only allowed to use his insider information to book his own tickets and absolutely nothing else, then it's an open-shut case. If not, then it'll be interesting to see how WestJet's lawyers defend this dude.

The Funny Part

[Fortress]

For me, being Canadian, the funniest part of the whole article is how Air Canada's suit is looking for lost profits. Air Canada hasn't made a profit in decades, being a quasi-Crown corporation that can depend on the govt bailing them out when they run out of money.

Seems to me that Air Canada will have to pay WestJet money for "lost profits," since they spared them from losing money on those flights!

Re:The Funny Part

[Snosty]

On a slightly related note I was booking a flight from Vancouver to London last year and found the cheapest flight in the area was from Seattle to London via Vancouver on Air Canada. Booking the direct flight from Vancouver to London on Air Canada was nearly twice as expensive as taking a commuter flight from Seattle to Vancouver and then getting on that same direct flight to London.

Why not skip the Seattle leg and get on in Vancouver? If you miss the first leg of a flight you are not allowed to make the second leg even when in this case there was an 8 hour layover in Vancouver. As Seattle is only 2.5 hours drive from Vancouver it is conceivable someone could miss the flight from Seattle to Vancouver and still quite easily make the flight from Vancouver to London by catching the train north.

My point, anyways, was that I was pissed that an airline subsidized by Canadian taxpayers was offering flights to Americans at just over half the price they were offering it to Canadians.

And before any of you idiots ask the price difference had nothing to do with the exchange rate. ;)

Re:The Funny Part

[Anonymous Coward]

... corporation that can depend on the govt bailing them out when they run out of money

What's wrong with that? That's how they do it in the USA.

Re:The Funny Part

[swv3752]

Airporrt fees come into play. Different Airports charge different amounts. Checkin fees are higher than transfer fees.

Re:The Funny Part

[bluGill]

Thats not nearly as bad as the time My sister wanted to go Minneapolis-Washington D.C., and found the cheapest fare involved a plane change in Paris, France! She decided not to do that, but seriously considered spending a day in France both ways to see the sights, it would still save money. (IIRC she didn't have enough vacation time saved up)

Terrible Journalism

[Tedium Unleased]

How do we know they were 'cool' scripts. If he was such a great scripter, why was he let go.. or is simple web crawler enough to pass for 'cool' these days. Perhaps they were among some of the most inefficient scripts of all time, rivaling those found in the Hall of Terrible Programming.

Did'nt thay had some thing like this

[anandpur]

You are entering an Official Air Canada System, which may be used only for authorized purposes. Unauthorized modification of any information stored on this system may result in criminal prosecution. The Government may monitor and audit the usage of this system, and all persons are hereby notified that use of this system constitutes consent to such monitoring and auditing.

Everything not forbidden is permitted?

[hwestiii]

The story digest may have this completely wrong. It says "What do you do when you let an employee go? You kill their password and ID, right?"

The activity in question appears to have been facilitated by access granted as part of his severance package. As the article notes: "As part of his separation package when Lafond left Canadian Airlines in October 2000, he received two space-available airline tickets per year for five years. These tickets are booked through the private website."

The article is actually a little hazy on the details here. Though it doesn't specifically say so, it seems to imply that the separation agreement gave the terminated employee direct access to this private web site through a user name and password. One can imagine other ways this could be done that didn't involve direct access to the employee, like through a dedicated fulfillment provider, for example.

Either way, it sounds like it all amounts to some pretty dumb corporate behavior on the part of Air Canada. Either bad security practices if they didn't cut off the guy's access, or bad auditting if all that use went unnoticed for so long.

Not how - but what.

[Saggi]

In Denmark where I live the rules are simple.

You don't get sued for accessing the website, with or without an illegal id. You get sued if you misuse information you gained in your former employment. It doesn't matter if it is in your contract, the commerce laws in Denmark forbid use of inside knowledge to harm other companies - as it clearly is happening in this case.

I would guess that Canada have some similar laws.

So how you obtain the information is irrelevant - even thou this case in interesting from a slash-dot point of view.

Re:If you deal in garbage, you might attract flies

[tarunthegreat]

It's not so much What Air Canada's doing, but how they went about it. There really doesn't seem to be much reason to give former employees access to private sites. Although it's not too clear in the article, the least they coulda done was create a separate network, with filtered data (i.e. a DB with just empty airline seats, and also coded in different ways so that you don't really have too much of a clue what's going on elsewhere...) Heck maybe the employee shouldn't even have visibility into what routes have empty seats, but just submit a request for an empty seat. (i.e. Instead of the system saying "we have 50 free seats to mexico today, take your pick" it should simply say " Mr. X, you have got the free seat to mexico today". ) How difficult would that be to do really? Even simpler is not allowing the former employees access to private sites, severance or not. This is simply laziness on Air Canada's part (hell we have to give these bozos free tickets, so let's just give 'em a little more access).Air Canada got what it deserves, and if anything, it should be Air Canada's investors suing Air Canada!

Re:If you deal in garbage, you might attract flies

[LostCluster]

They're a great deal for the employees, but revealing which routes have space-available seats shortly before takeoff is highly valuable data. That shouldn't be in trusted the hands of an ex-employee.

Had they simply upgraded him to a regular coach seat, there'd be no need to be giving him access to the employee-side site. This was a case of being cheap in the near term costing more in the long run...

reason window whatever

[spottedkangaroo]

This guy is the reason the IT industry is full of non-compete contracts... what a 100% total asshole.

Re:Rights? Clearly abused.

[schon]

According to this logic

Which logic is that? Certainly not any that was posted here.

if you leave your front door unlocked, and I walk in and take your stuff, it's OK, because you allowed me access to it

No. More like: if I gave you a key to my front door, and told you to take whatever you wanted from my fridge, and you come in, clean out the fridge, and sell it to the market across the street, then it's OK, because I gave you access to it.

Which it would be (because I have given you permission.)

he was clearly in the wrong with his actions

Not necessarily. If he had an agreement that he wouldn't give/sell the information to anyone, then you may have a point, but if there was no such agreement, then he's quite clearly not in the wrong.

I don't think this qualifies as insider information, but more appropriately called company proprietary, or company confidential information

If it was proprietary, or confidential, then the company should have had measures in place to keep it that way. You can't give something to someone with no strings attached, and then cry foul when they use it for something you don't like.

Always change passwords when employees leave

[Punk Walrus]

Back when I did contract work, I always told my employers, via public e-mail, to change the system passwords, and then listen which systems I had access to. This way, if they ever got hacked, I could always say, "Well, I *told* you to change them..."

I'm not sure anymore if that would help, but I know at least one company never changed their passwords because their vendors kept paging me, up to a year later, to "go into the system and make these changes." One of the vendor contacts and I had became good friends, and one day he begged, "We can't get in, and those bozos won't answer our pages." So I told them the last password I had, stating it probably wouldn't work. Nope, he got right in. Root access to a major gateway.

And the password was easy too, like abc123 "That's the combo on my luggage" easy. Considering this gateway controlled 48 T1 lines to a large call center, I shudder to think how it could be used if phreaked.

Uhhh..web traffic reports?

[lordkimbot]

'The airline alleges Lafond's identification number was used 243,630 times between May 15, 2003, and March 19, 2004, to access the website'

Let's see who's visiting our website last month...OMG!

How could a commercial website be so clueless?

Hello? Air Canada I.T. Department?

[bbq_jedi]

Quote from Wompom website:
" If AC really knew the truth they would realise that access had been made following the circulation of the PIN on airline chat lines earlier this year. WomPom even used it to verify its functionality."

http://www.wompom.ca/news/wp2004apr07.htm#1

Duh...

There are 2 issues here

[fudgefactor7]

Issue 1: Stupidity of the organization to not lock down permissions and/or kill the account/password.

Issue 2: Duplicity from the former employee accessing data he knew full well that he should not have accessed.

Both need to harbor the blame for their part.

Grain of salt

[Ctrl-Z]

Just be careful. These are only allegations, and one should take any claims that Air Canada makes about WestJet with a couple of grains of salt. They have a huge WestJet complex. Not that I'm saying that this kind of thing couldn't happen.

law

[Ryntis]

im not up on canadian law.. but if its anything like the US they better hope he signed his non-competition agreement nice and clear :)

Re:If you deal in garbage, you might attract flies

[Dun Malg]

Hey, space-available tickets are a very good deal for the airlines and the employees who work for them.

What you say is true, but you completely missed the point. By giving space-available tickets to an ex-employee, they opened themselves up to this sort of stuff. He wasn't saying that SA tackets are a dumb idea, only that it's dumb to give them to someone who doesn't work for the company anymore.

How about Professional Ethics?

[sillypixie]

Lawsuit aside, what about this guy's sense of professional ethics? Regardless of what TOS the AC site put up, or whether the guy could get away with it on a technicality, who wants that type of person working at their company?

And if I was his boss at WestJet, I'd be nervously trying to figure out what data this guy will 'volunteer' once he leaves his current employment...

It has been pointed out that the data he retrieved from WestJet, he retrieved after he left, and therefore didn't steal it - but the existence of the server, and the fact that he could access it - is information that this guy had a professional obligation to keep to himself.

I hope WestJet takes care of him, 'cause I can't imagine him working anywhere else now...

Pixie

FYI: Air Canada's IT was outsourced in 1994

[Stavr0]

IBM and Air Canada Expand Relationship Carrier to help design airline-specific systems in bid to recoup its IT costs

What does this say about outsourcing VS IT security ... and India too.

Re:If you deal in garbage, you might attract flies

[tuxlove]

It turns out they are a security hole. That makes them a bad idea, even if they are a way to save money for the airlines

That's a bit shortsighted, isn't it? These tickets are a great idea all the way around. It's how they give access to the information that's at fault, not the concept of zero-cost tickets. That's like saying that because you killed someone with your car, all cars are a bad idea. The problem here is that Air Canada's website allowed an individual to do 600,000 lookups (whateve the number was). There should be a reasonable limit, like 100 a day or less. There's no reason for any one person to have more than that, and with such a limit in place the program should be able to continue without a problem.

Flies? More like lame ass script kiddies.

[Glonoinha]

Jesus, write a script kiddie toy to use the existing front end to interrogate the back end once a minute for ten months? What the hell is that?

If you are going to hack, HACK. Hook up directly to the database back end and write some SQL to extract all the data at once and have it spit out nice neat reports summarizing the data. Run it once a day at most.

Somehow I think this guy was showing off to his boss the first week like some newbie - probably said 'hey check this out' the first day when showing it to him without thinking through the long term ramifications ... and it snowballed from there as some sort of clandestine 'upper-management wants to be a hacker' way. Then again it worked and helped them on the business side in a massive way so I guess it wasn't completely stupid. Except for getting caught, of course, hammering on the system day and night for 10 months and leaving an audit trail as long as your arm.

Re:If you deal in garbage, you might attract flies

[tuxlove]

it's dumb to give them to someone who doesn't work for the company anymore.

Yeah, someone who works for the company would never do anything nefarious with the information, would they? It just seems obvious that everyone with access to the site, employees or otherwise, should have limits placed on accesses. It's crazy to allow anyone hundreds of thousands of queries.

I'm all for timeliness of data

[Perrin7]

but logging into a website 32 times an hour for 10 months; is that really necessary to get the information Westjet is accused of using?

I would think a couple of times an hour at most would be all that is required to gather flight loads. I can't see a whole lot of passengers waiting until 2 minutes before the flight to book their tickets (it may happen once or twice, but over the course of months those will be anomolies). So either Westjet was being stupid and killed the goose that laid the golden egg, or there is a lot more going on than we being told.

Re:IgNobel

[Zardoz44]

Actually, there is CanJet, WestJet, Air Transat, JetsGo, Zoom, and possibly a few others. The difference is that Air Canada is really the only internation business airline in Canada, the others being national business or vacation-charter type.

Non-Canadian airlines will fly in and out of Canadian cities, but there are a bunch of regulations preventing them from being true competition for Air Canada. For instance, Delta can't fly from Toronto to Vancouver to Tokyo. We have to fly from Toronto to Chicago to Tokyo instead. Something like that, as I understand it.

In any case, some of the smaller airlines (like Air Transat) have been constantly growing and adding new routes, but it takes a while.

binary is for computers, not humans

[Doc Ruby]

Air Canada is liable to those whose data (and lives) they protect, for leaving the door unlocked on a busy street. And the ex-employee is liable for trespassing, regardless of their posession of an old key, once disinvited from the premises, to say nothing of theft and privacy invasion. Corporation vs. ex-employee is a false choice: they're all guilty.

Re:If you deal in garbage, you might attract flies

[Sacarino]

Of course, the critical mistake was that in order for somebody to know if there's going to be space-availalbe, they have to publish on this site how full or not full the plane currently is.


Sorry, wrong!

Many airlines when you call to wait-list yourself on a flight will do just that.... You don't get any details about how full the flight is.

If you want to get particular, this is called Non-Revenue Space-Available. I can list myself on a flight that operates 4 months from now that may only have 4 people booked on it. Or, I can list myself on a flight that departs in 15 minutes that's oversold by 2 seats. If there's enough no-shows on the flight, I get a seat. The whole concept of non-rev travel means that if there's an open seat and you're ready to go, you can get it.

The value of that empty seat is $0 the moment the aircraft door closes, hence the airlines willingness to to allow employees or interline agreement employees to travel for free.

The ability to get listed on a flight is a totally seperate event from letting the guy have access to their reservations/booking system. That's just piss poor security procedures on the part of Air Canada.

I work in an airline dispatch office, so this is something I have some familiarity with.

Re:If you deal in garbage, you might attract flies

[Anonymous Coward]

Riight, and if a woman is raped, you blame her for wearing revealing clothes, and if someone comes into my house and steals my TV, you blame me for leaving my door unlocked.

Complete nonsense. Using a non-sequitur to evoke an emotional response may pass for debate in Canada, but not here in US, eh.

The company explicitly gave the ex-employee access to the site with the private data, apparently without establishing limits on how often the site could be accessed or (slightly more questionable) how the information could be used. The only limitation mentioned by the article was that only two tickets could be booked per year. Although the ex-employee's actions appear unethical, it is not even clear that he violated any usage agreement that came with the ID/password.

Re:If you deal in garbage, you might attract flies

[trg83]

That's a very interesting observation. Air Canada was indeed negligent here, but how many times have you written code to limit such a thing? When you're trying to get something working and bug-free, it's hard to think of every nefarious thing someone could do with your application. I think this is more an issue of a webmaster failing to look over logs in order to later take corrective action.

Re:If you deal in garbage, you might attract flies

[RobinH]

The company explicitly gave the ex-employee access to the site with the private data, apparently without establishing limits on how often the site could be accessed or (slightly more questionable) how the information could be used. The only limitation mentioned by the article was that only two tickets could be booked per year. Although the ex-employee's actions appear unethical, it is not even clear that he violated any usage agreement that came with the ID/password.

Ahh, so if you give your neighbour a key to your garage so he can borrow your lawnmower, and he rifles through all your old bank records that happen to be stored out there, and sells the info to someone else, then he's just doing what any red blooded American can be expected to do (screw his neighbour), and it's your fault for trusting him... is that it? Now I see how it works with you foreigners.

Just kidding. Boy, you really got me with that "eh" joke. I didn't see that one coming... when did y'all b'come so quick-witted down thar anyway?

Re:If you deal in garbage, you might attract flies

[Loozrboy]

I've actually had the opportunity to use these "space-available" tickets from time to time (my dad worked for an airline), and unfortunately "there are / aren't some free seats" isn't enough information to plan your trip... your seat basically isn't confirmed until all the paying customers are physically on the plane, so knowing whether there are 2 or 20 seats available the day before makes a big difference as to how likely you are to end up stuck at the airport.

That having been said, since I wasn't an actual employee I couldn't use the web site myself, I had to call and speak to a human operator. They'd tell me the actual number of open seats, but it seems unlikely WestJet would be able to do this 240,000 times without somebody catching on :P. (of course, then Air Canada would have their former employees suing them over interminable hold times, but that's a whole different problem.)