American Airlines Is Third Company To Share Data

crem_d_genes writes "American Airlines has become the third U.S. airline to admit sharing passenger records with the government. They were proceeded in admissions by Northwest Airlines and JetBlue Airways. At the heart of the matter is the implementation of the of U.S. Transportation Security Administration's (TSA) use of the provisions known as CAPPS II. Some privacy advocates have expressed strong dissent with this plan. Some concerns have even been brought up in Congress, though for different reasons. The Department of Homeland Security has a site entitled CAPPS II: Myths and Facts."

Comments

Good

[after]

If it'a a matter of security for me and the people that I travel with, then they can share my data. I am sertainly not opposed to this, I dont want some shmuck who got through to blow up my airplane.

Re:Good

[Liselle]

That's the attitude they are probably counting on. Not that it's a bad thing: the majority of folks have nothing to hide. Privacy is nice for some things, but there is a point where it crosses over into paranoia. The sibling AC is correct, your unpopular view is either going to be modded down, or the mods are going to have an Over-rated fight this morning.

Personally, I think the government is barking up the wrong tree with airplanes. What they should really be more worried about is the nation's subway systems. I hang my hat with the MBTA (Massachusetts subway system), and believe me when I say this: it would be trivial for someone to blow up a train. The collateral damage from an explosion going off at Park Street during rush hour would be devastating. But that's not really on-topic, I guess. :P

Re:Good

[vegetablespork]

Personally, I think the government is barking up the wrong tree with airplanes. What they should really be more worried about is the nation's subway systems.

Don't worry--I'm sure Ashcroft and company are hard at work on a national database to be checked against a swipe of your National ID (a.k.a. "standardized driver's license or state ID") when you board any public transporation. At that point, known terrorist (or deadbeat dads, or those with unpaid parking tickets, or people with questionable political affiliations) can be arrested and searched.

In about ten years, we'll have an internal passport system for air, land, and sea transport that would have made Soviet Russia proud.

Re:Good

[general_re]

The problem, however, is that not only does it not work, it actively decreases security.

Another argument put forward against passenger screening in particular is that terrorists will adapt to the screening methods in order to slip through the system. See Samidh Chakrabarti & Aaron Strauss, Carnival Booth: An Algorithm for Defeating the Computer-assisted Passenger Screening System, at http://www.swiss.ai.mit.edu/6805/student-papers/sp ring02- papers/caps.htm. Again, this concern should be taken into account when developing applications but does not argue against research and development, or deployment, with adequate accounting for the problem. First, there are obviously ways to defeat any system. Nevertheless, they are worthwhile because they raise the cost of engaging in the terrorist act by requiring avoidance strategies. Not only do such avoidance strategies increase 'costs' to the terrorist but they also provide additional points of potential error on the part of the terrorist that may lead to discovery. Obviously, if we were to take this critique too seriously on its face it would support the conclusion that locks should not be used because locksmiths (or burglars with locksmithing knowledge) can defeat them. Second, to the extent that we are talking about researching adaptive machine learning based algorithms, an important research objective would be to try to anticipate these avoidance methods in application, algorithm and system design, including by building in both variability and random outcomes (for example, by combining random searches with CAPPS II).

- K. A. Taipale, "Data Mining and Domestic Security: Connecting the Dots to Make Sense of Data," 5 COLUM. SCI. & TECH. L. REV. 2 (December 15, 2003)

Re:Good

[Anonymous Coward]

Indeed, Soviet Russia never took the fingerprints of foreign visitors. But I bet they would have, had they thought of it...
Well done, US, for out-Sovieting the Soviet Union. I won't be going to the US for some time, but of course, all my American friends are very welcome to escape to the Free World and have a beer on me, whenever....

Re:Good

[TTL0]

i disagree.

1) it could come out that they get busted on the test run and reveal the whole plot.

2)the longer it takes for them to find a successfull canidate the better chances are that they get stopped and the longer it takes to put together an attack.

3) so lets say the get a guy who is the anti-sterotype of a terrorist - he may do other things that trigger the system.

in the end there is nothing you can do to stop a terrorist or any other criminal for that matter. but you can make it harder for them.

EU better watch out

[SkunkPussy]

Myth: CAPPS II will track where and when I travel and will store that information.

Fact: For U.S. persons, information will only be kept for a short period after completion of the travel itinerary, and then it will be permanently destroyed.

So all the passenger data that the EU is leeching to US is being permanently stored - i.e. US is building a database of all EU citizens who have ever travelled to US. scary.

I can't believe the EU sold us out.

Re:EU better watch out

[heironymouscoward]

Technically no laws are broken: data on EU citizens is protected only within the EU and the US Privacy Act only covers data on US citizens.

A European visitor to the US is now (along with nationals from many 'visa exemption' countries) being fingerprinted, photographed, and logged in numerous databases.

As the largest and most powerful nation on Earth, the US can do this. What amazes me is not that the EU allows it (what choice does it have?), but that it does not reciprocate. I'd like to see a special queue at Brussels airport where visiting American tourists are finger-printed, photographed, and generally treated like criminal suspects. /me thinks the concept of "tolerance and personal liberty" would soon find a new meaning.

We live in dangerous times: the State is seeking levels of control over our lives that would allow it to eliminate many hard-won liberties, such as the right to travel freely.

Re:EU better watch out

[jeffkjo1]

I'd like to see a special queue at Brussels airport where visiting American tourists are finger-printed, photographed, and generally treated like criminal suspects. /me thinks the concept of "tolerance and personal liberty" would soon find a new meaning.

You've got the right idea, as did Brazil, when it started doing this. Amazingly, when they did, US Lawmakers started an uproar about how unfair it was.
Sigh.....

Re:EU better watch out

[Savage-Rabbit]

As the largest and most powerful nation on Earth, the US can do this. What amazes me is not that the EU allows it (what choice does it have?), but that it does not reciprocate. I'd like to see a special queue at Brussels airport where visiting American tourists are finger-printed, photographed, and generally treated like criminal suspects. /me thinks the concept of "tolerance and personal liberty" would soon find a new meaning.


I agree, it really sucks how the US Govt. seems to think it can to to others with imputity what is a crime when it is done to their own people by other nations. But not all European countries are that docile. In my own country the Govermnent decided to install a security suite partly because of post 911 security demands by the USA and partly because of Shengen. This includes face reckognition system. The thing had been running for just under a month when the US embassy paid a visit to our foreign ministry to complain about the fact that US czitisens were being photographed as well as the the mere mortals. They demanded that American tourists alone among all visistors to our country be exempted from this. They got a very delicately formulated 'get lost' as an answer. It seems to me that if the USA wants to submit foreign visitors to draconian controls the practice should be applied to their own nationals with the greatest of enthusiasm.

Re:EU better watch out

[letxa2000]

I hate to state the obvious, but measures should be based on potential usefulness and potential threat, not on retaliation.

Do I think it's cool that foreigners have to go through this added security? No! My wife is Mexican and on her last trip to the U.S. she had to be fingerprinted and photographed (to their credit she said the INS person was very friendly and the fingerprinting/photograph process was extremely quick). But the reality is that after 9/11 the U.S. has some serious justification for wanting to know who is entering the country. A bunch of anonymous faces is no longer acceptable. Why? Because the terrorists came from overseas, including from Europe (Germany). How many terrorists in Europe have come from the U.S.?

Further, getting the personal information ahead of time allows the government to research those that enter before they arrive. I suppose an alternative would be for arrivals to stand in line in immigration for 6-8 hours while their information is reviewed on arrival after Finally, the U.S. isn't asking for anything that is out of line with what other countries often ask for. I don't know about Europe, but for me to live in Mexico (I'm an American) I had to fill out an application with a bunch of personal information, including my fingerprints. To bring my car into the country I had to provide a credit card. I do not consider this inappropriate: I am a guest in their country and they have a right to ask for this information. If I don't want to provide it, I have the right to not live here.

I don't support collecting information on domestic travelers (which is what this thread is really about), but I do support the government having all the information possible on who is coming into the country. This is justified based on where past threats have come from. Countries such as Brazil which decide to institute retaliatory security procedures against Americans despite the fact that no security threat has been demonstrated to be of American origin are just practicing sour grapes and, quite frankly, will not be getting any of my tourism dollars. I understand their frustration but if they can't see the difference between a real threat to security in the U.S. and sour-grapes retaliation against Americans, I'll spend my money at home.

Don't Come Here

[Jameth]

From the Department of Homeland Security:

Fact: For U.S. persons, information will only be kept for a short period after completion of the travel itinerary, and then it will be permanently destroyed. The prescreening process will be conducted anew each time you fly.

Sometime I hate my country. So, those of you who aren't from here: yet another reason to not come. Does the government not understand the manner in which science progresses? This is just going to destroy the US research community, which was once the greatest in the world. Goodbye, conferences.

Game Over

[CaptainZapp]

A European visitor to the US is now (along with nationals from many 'visa exemption' countries) being fingerprinted, photographed, and logged in numerous databases.

Yup, but this stops at the end of September. Except Canadians every terr^H^H^H^Hforeigner will be fingerprinted upon entry to the US.

If I'd be the US tourist industry I'd be in the process of shitting my pants from fear.

From a personal perspective: I've travelled the US about 15 times and spent a significant amount of my tourist Euro there.

This change of procedure however has the stench of assuming that I'm a criminal and doesn't give me the warm fuzzy feeling that I'm welcome.

I might be a tad over sensitive here (given the rotten track record of privacy protections in the US I'm not sure though), but I don't believe that I'm the only ex-US visitor with that view..

Re:Game Over

[bogado]

When talking about entering a foreinger country I never have this "warm feeling of welcome". I always keep thinking about the dozens of historys I have heard about people being traped and humiliated before entering a country, and this is not only in the united states.

My mother was locked in a small room in the Paris airport, revisted several times, and she didn't speak a word of french or english for that matter. She didn't know what the hell was happening, my father that was there already in a work related trip did not know what was happening.

I have heard of people having to return home without so much as a reason from buth the US and the UK.

But remember that I am not talking about the reception after you actualy enter the country, I was very well received in both Paris and Madrid.

Criminal background checks

[tpm999]

On the website cited in the article it states that they aren't going to run a criminal background check on everyone. If that is the case, how are they going to know if you have an outstanding federal or state warrant. The only way I know to do that is through the NCIC (National Crime Information Computer) system and that will also show your criminal history. Does anyone really believe what the government says?

Re:YRO? Seriously?

[fuzzybunny]

RTFA, didya?

The issue isn't as much the sharing of data with the gub'mint (although that _is_ a valid discussion, it's one for elsewhere); it's the fact that a contractor gave it to other companies at the government's bidding without AA's knowledge or consent.

And regarding your "conclusion", this poor schmuck's paranoia is not trumped by "the government" wanting to know that I'm travelling from point a to point b. What have CAPPS & friends (fingerprinting/photography at airports, massive visa lines at embassies, whatever) done besides terribly annoy a lot of possibly desirable immigrants and tourists, who'll now go vote with their wallets and go elsewhere? "Let 'em", you may say. "Fine, they will" I reply.

Security is a process

[meme_vector]

Security is a process. Find a hole in the process and the pieces you have bypassed are meaningless. At airports the assumption is that your ticket was matched to your ID at the metal detectors before entering the "Secure Zone" where the gates are located.

Even the name "Secure Zone" implies that by virtue of being there, everyone near the gates is authorized and not a threat.

So all a terrrorist would have to do is buy/steal a ticket (or boarding pass for that matter) for a name that passes CAPPSII and then get into the secure zone.

Every pen test we read about shows how easy avoiding the checkpoints are. Once at the gate, you show your boarding pass and walk onto the plane. O'Hare and many other airports no longer check the ID again at the gate.

Alternately, you just avoid the gate completely and have your team access the plane directly from the tarmac or via the ramp by penetrating one of the lower, non-public levels of the terminal.

So 9/11 isn't behind us. Another one is possible just a soon as the assets are in place and the timing is right (like just before the next presidential election)

Figures

[Bruha]

Reason I really hate the idea of your "Credit Rating" saying how secure you are is the fact that just becuase someone has bad credit does not mean they're a bad person.

So all the people that have been laid off due to bush's bad economic policies and a war we did not want are now bad people becuase they've had to default on loans or worse.

I recently tried to see about better insurance rates than my current state farm insurance. I was quoted rates 2-3 times what I'm currently paying. This was with Progressive, Nationwide, and Geico. After some digging around and a credit alert from equifax about the inquiries (Paying for that credit watch finally pays off) I call Geico and ask for a manager and after asking them why I get a quote 3x my state farm premiums they said I dont have enough credit for lower rates. I'm ask him what my credit has to do with my driving habits and he said people with bad credit are usually bad drivers. Personally I think this is bull and I ask him if those studies are publically available and he said no.

So my point here is that there may be studies about this and maybe there's a point to the higher rates. However I've been in one wreck when I was 16 and 10 years later I've never had a ticket, accident, or even looked at funny by a cop for bad driving. But now they'll use the same lame excuses about how I'm a security risk becuase of low credit despite having never caused a problem for anyone.

Just remember if you like me have less than perfect credit wear shoes you can slip on and off easily and be prepared to find your luggage ruffled through and items missing on the other end.

Last time I flew my baggage was opened 3 times on it's way from Fargo International to Dallas Tx. Once when I arrived at the airport they opened it and when I got home and reopened it I found 3 seperate inspection notes in there. God knows why it was inspected all those times but I really dont like that many people leafing through my luggage.

I sure hope they liked smelling the dirty laundry in there :)

Re:More Perspective

[phoenix.bam!]

Because CNN Doesn't cover a car accident for seven weeks straight. Anyone remember TWA flight 800? Of course you do, it was all over the news for longer than it should have been. Aircrashes attracted attention while car accidents attract negative attention (I bet you get annoyed when a car accident delays your commute.)

Re:Perspective - and privacy...

[gillbates]

So I'm applying for a home loan, and the broker requests my name and SSN. That's all.

Within minutes, he's reading back to me recent payments, credit card balances, bank account info, etc... basically, my entire financial history. He knows that we were late on our electric bill in November, and comments on how nice it is that our car payments are so low.

Anyone who thinks that CAPPS II is a serious invasion of privacy is seriously naive. The average person no longer possesses any privacy to speak of. The sad fact of the matter is that you can be tracked no matter where you go:

• Your credit card purchases and ATM withdrawals track where you go and how much you spend.
• Even the small bills ($20) are tagged with RFID's, so cash no longer guarantees privacy. Plus, it's not likely that you'll find a good job which pays cash only.
• Your grocer records your every purchase, linked to your discount, bank, or credit card. The FBI can have this information simply for the asking...
• Your library viewing habits are now subject to Federal review, thanks to the PATRIOT act.
• Your medical practitioner is bound by law to turn over your medical records in cases where they suspect certain crimes have been committed. (Child abuse, for example. And yes, most practitioners consider any injury beyond a minor scrape or bruise "potential" child abuse.)
• Your ISP and phone company are required to possess the cabability to intercept your communications. The FBI can eavesdrop on these with no oversight or accountability whatsoever.

So, in light of the above, does CAPPS even matter? Even before 9/11, the FBI could get very detailed information about a person simply by asking people around the suspect. For example, in the Ruby Ridge fiasco, the FBI knew the suspect's daughter's menstrual cycle - the school nurse volunteered the information!

Hate to say it, but your privacy is already gone. A person cannot function in today's society without consenting to monitoring of their every move. Why does CAPPS matter when the FBI already knows what you eat, which movies you watch, which books you read, how much you owe, and with whom you associate? CAPPS is more or less a "feel-good" government program - it's designed to assuage passengers' fear of flying while providing jobs to people who would otherwise be out of work.

credit card data?

[Anonymous Coward]

CAPPS II uses, in part, credit card data to determine who should be classified as "yellow" or "red". OK, what exactly would they be looking for? Large purchases of fertilizer? Obviously they would end up flagging farmers, so that would be ridiculous. What purchases would make one more likely to be a "terrorist"?

Here's a disturbing possibility: donations to groups that sound "subversive". I've given money to groups like Iraq Body Count, which tracks civilian casualties in Iraq. And Voices in the Wilderness, which opposed the UN sanctions on Iraq and worked to prevent the war. And of course that most subversive organization, the ACLU, which is actively fighting the existing "no-fly list". I hope I'm wrong about this, but think about the implications if donations to groups like these are enough to prevent one from flying.