Congressman Calls for Arrest of Security Researcher
Christopher Soghoian writes "Yesterday, I published a tool that allows you to Create your own boarding pass for Northwest flights. This was an attempt to document the fragile and broken state of identity/security for domestic flights in the US. Today, Congressman Markey (D-Mass) has called for my arrest." From the ABC article: "'I don't want to help terrorists or help bad guys do bad things on airplanes, but what we have now is what we in the industry call security theater. It's made to make you think you're secure without actually making you secure,' Soghoian said. 'As a member of the academic research community, I consider this to be a public service.' Soghoian admits that he hasn't actually tried to use one of the boarding passes yet."
Or, gee, the terrorists could just have someone else buy a plane ticket, or buy it themselves, or buy for a different flight, whatever.
The whole thing is ridiculous. It's ridiculous that this is thought to be some newly discovered weakness, and it's ridiculous that the powers that be are actually getting upset over it.
So, some guy said he should be arrested. Does that mean anything?
The wide spread use of e-commerce has expedited the adoption of regular printouts as tickets, receipts, passes and other situations I can't think of right now.
Are people so dumb as to not realize, how simple their official 'logos' are to create using an image processing software? Agreed, most of these 'receipts' merely provide a number, which acts as an 'index' in some internal database somewhere.
But this guy does have a point. Merely admitting a person holding a an easily reproducible printout of an 'eticket' or boarding pass is just lame.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Listening to the radio this morning, they said Newark airport staff failed 20 of 22 tests involving guns and bombs being smuggled past security by undercover agents. Airport "security" is a joke, and a distraction from real issues. When they stop taking away your toothpaste and maple syrup in the carry-on luggage, maybe then I'll take something about airports seriously again.
Oh You POS
It's astounding that Markey thinks that the website which prints fake boarding passes is creating a loophole. Politicians may not have a grasp of technology, but it only takes common sense to see that the loophole exists independently of any specifictool which creates the document to exploit it.
The prosecutors would never file a criminal case, because it would be quickly thrown out on First Amendment grounds? Wouldn't it?
With a supreme court with 7 republican appointees? I doubt it.
Avoid Missing Ball for High Score
Much like the guy who looks at your boarding pass, you're trusting your life to something that's just a goddamn piece of paper.
I doubt it. It's hard to see how faking a boarding pass can be considered some kind of "political speech," which is about the only kind of speech that has near-absolute protection under the First Amendment.
Otherwise, you know, you couldn't be prosecuted for faking a bill of sale for a car, or a life insurance policy, or printing counterfeit currency, or most other forms of fraud that involve a printed document -- and you surely can.
The emperor generally does not like having his nudity pointed out. Many in government know they are bit players in a pointless security theater, but react violently when told that. I suppose they like to feel that what they do is important and useful (read TSA agents, pretty much the entire DHS, etc). After all, how would you like it if your entire job consisted of going through a dance routine designed to make the clueless public feel as though the government is doing something to keep them safe?
I suppose Congress is a bit different, I have no problem believing most of the genuinely are clueless and believe wholeheartedly that keeping lighters, tweezers, and bottles of water off airlines is critical to our national security. That also seem to really believe that torture and massive surveillance is an effective way to combat terrorism, further displaying a total lack if understanding. The Republicans (at least those loyal to the Whitehouse) are in a unique position where they have to pretend all of this fluff is important, but somehow selling the ports to Middle East companies, looking the other way on illegal aliens, and ignoring Bin Laden to focus on the mess we created in Iraq are perfectly acceptable.
Finkployd
1. Arresting the messenger doesn't help security- it makes people more afraid to point out security holes.
2. Security holes don't shrink by pretending they don't exist
3. Just before elections isn't the best time to make people in Silicon Valley rethink democrats on security. Markey has usually been thoughtful on security- he should rethink his policy of calling for arresting the messenger.
The 9/11 hijackers all had valid boarding passes. What do fake boarding passes have to do with security?
I live ze unknown. I love ze unknown. I am ze unknown.
Check out Edward Markey's voting record. He's one of the most liberal members of congress. His call to arrest this innocent security researcher further proves that the Democrats are authoritarians just like the Republicans. Only Greens and Libertarians appear to have any respect for free speech and other civil liberties.
------ Take away the right to say fuck and you take away the right to say fuck the government.
And what do you think the TSA's response to this will be? My money is that they decide to no longer allow people to print their own boarding passes. It will be paper ticket or nothing (and yes I'm aware that these can be forged too). So no more checkins at the gate -- stand in line along with those that have baggage to check. Just great.
Wanted: witty unique signature. Must be willing to relocate.
There IS brilliance behind his idea. Perhaps you didn't read it... but basically, you can fly on a fake identity without any screening of your actual identity.
1) Go to 7-Eleven and buy a pre-paid credit card with cash using a fake name. This will be the name you fly under.
2) Buy a ticket with this credit card.
3) Print out an ADDITIONAL ticket for your real identity. He gives you an HTML form to do this.
Now, show up at the airport. Go through security with the fake ticket... it will match your ID, but since it's not in any computer systems, they won't check to see if you're on the no-fly list. When at the gate, provide the ticket you actually bought. Nowadays you don't need an ID at the gates anymore -- just have your ticket scanned and hop on the plane!
Now, I'm not exactly sure if you can check bags. If you have to go to the counter before security, they ask for your ID. But if you can avoid that (and you can now, as far as I know), you can fly on a fake identity.
my blog
Individuals simply cannot point out the obvious flaws in what passes for National Security. While we as individuals are supposed to have some kind of freedom in this way, we don't.
Now, lets get to the reasons why this was the dumbest thing to do.
1. It puts egg of the face of every big federal contractor muscling their way into the "homeland security" budget.
2. We're at war with an enemy and tactical end that won't ever be defined. To maintain that heightened state of fear and social control, this individual must be criminalized. (he's helping the terrists after all.)
3. No contractor has a product ready to replace it. It will be a tough day for the contractors that have to explain this to gov't types.
4. It fires off a "something must be done" storm, that no politician really wants. They've got too much fund raising to do.
5. Whistle blowing is contrary to the nation-state's goals. An individual this smart and not working for the State must be criminalized in order to maintain the heightened state of fear and sustain a compliant population.
Never, and I mean never, should an individual take it upon themselves to publish this kind of information.
Except if you want to be known as "notorious" and probably a felon in prison for a couple of administrations at least.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Get real. Although 2000 AMERICANS is a significant percentage of AMERICA, 2000 PEOPLE is not a significant percentage of HUMANITY. Even if terrorists were somehow able to construct a functional nuclear device, smuggle it into a major city and manage to detonate it and kill 100,000 people, it's still meaningless as far as humanity is concerned. A great tragedy, the country would be pretty numb, almost everyone would know someone who died and those people who were in city would have their lives unjustly ended early. BUT, humanity will go on. Even 10 bombs, or 100! Anyone who wants to make a nuclear bomb bad enough can get the info needed to build one. So why not publish it online so everyone knows how to make one, then the security guards actually know what one looks like, the person who finds it knows how it works and then more people can think of solutions to stop them.
Instead, the current mindset is to limit the information, and therefore the people working to solve the problem, thus leading to no solutions being found. That is why this is a huge farce. Lawmakers are using a tragedy to not only take and spend money but to take away our freedoms and increase their own power. And in the end, as is shown here and will be continually shown TIME AND TIME AGAIN in the future, all of their so called "security measures" will prove to be just as easily bypassed.
The real reason was to limit the number of people who get in to the boarding area so they need less employees to clean toilets and carpets, less wear on carpets, less seating required, etc. because all of those employees will have to be security checked. It's security compartmentalization. It doesn't MATTER if a small number people start printing out boarding passes to get behind the gates. They always could. It's just preventing the flocking of sheep in places where they have to be served, and thus creating a bigger security risk in the form of authorized employees. In addition, that means fewer faces for a facial recognition algorithm to search and of course a captive audience for any food services deep in the terminal.
This information does not lower the security of the system. It was already very low. Just as bolt cutters will never be banned even though they can cut locks, this guy shouldn't be arrested because he is generating an HTML file. PEOPLE make terror, not tools. The more information people have, the less likely they are to fear the government, and thus the less likely they will want to cause insurrection. Information, like humanity, wants to be free. One might argue that the whole middle east is based on a problem of information--people there are affected by real-world conditions on the ground and they don't understand that it's not US (americans) that are causing those problems. It's their leaders and our leaders, keeping the real information from them. If everyone knew what everyone else was thinking, we'd know for sure that politicians and governments are all liars and are using us for our money and slave labor. As long as that's being done for the collective GOOD, so be it, but when it's used for the collective harm and benefits only those in power, you have what's called a Dictatorship. Which is not what America is supposed to be about.
So next time they go spouting off about some stupid new security measure that seems to be for the collective good but doesn't really do anything, look to see who benefits. Then you'll know if it really was done to protect YOU or to protect some rich factory or security company owner.
Cool! Amazing Toys.
Democracy is the problem. If stupid people are allowed to decide who gets to run the country, then more stupidity is the only possible result.
> Another politician calling for action in places without even thinking.
Oh, he's thinking - about how scoring a cheap point by making himself look 'tough' on people percievable as wrongdoers, will score him political points with an "Election Day drawing near".
That's a politician's priority - exploiting the uninformed electorate by pushing buttons regardless of the truth.
Politics is about number one, everything else is by the by.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
>
> So, I'll explain. The parent is referring to Bush on the Constitution: "Just a goddamned piece of paper".
And even if the quote was never substantiated, the point's valid. The information scribbled on a piece of paper is software, but software is only as trustworthy as the system it runs under. Whether it's a boarding pass waved under the nose of a sleepy TSA goon and a non-sentient optical scanner, or an end-run around the Constitution passed under the nose of a sleepy populace and two impotent branches of government.
+2, Funsightful.
Any journalist can tell you the news, but it takes a comedian to tell you the truth.
Dear Honorable Edward Markey,
I just read about your response to Christopher Soghoian's findings regarding online printable boarding passes being easily faked.
I have to say that I am appalled at what I am reading. Mr. Soghoian has found something that could allow terrorist to continue to harm Americans. This technique may have already been used, or plan to be used, but now we know about it and can do something about it.
Why? Because Mr. Soghoian was kind enough to expose this security flaw. Punishing someone that has put this much effort into giving us the knowledge to save more lives is asinine.
As a Quality Assurance Engineer, I know the importance of finding, and reporting, flaws. This man should be commended, not condemned.
I think it would be wise as a senior member of the Department for Homeland Security to withdraw your previous statements as you have gained "an insightful perspective" on this issue after responses such as mine.
Scaring others into not telling us where our security flaws are will only lead to more opportunities for our enemies. How can you not immediately see this?
Or should I put you on the list of government employees that pretend like they care, but would rather play political games instead?
Sincerely,
Quincunx (real name used in the real letter)
I encourage others to write as well. If we let him know his error, give him an "out", then maybe bullshit like this won't happen again. Here's hoping.
Here's the send-an-email part of Honorable Edward Markey's web page
In other words, I think the professor's research is silly, and I think the congressman is equally silly for calling for his arrest.
Uh, so should they arrest Tom Clancy too? He wrote a book detailing how easily a single person could fly a plane into an important building (the capitol building during a presidential address to a joint session of congress, but whatever).
So, if the litmus test has become, "Using mass media to point out ways that terrorists might strike = terrorism," then Mr. Clancy, as well as any number of Whitehouse Spokespeople are terrorists and should be put in Guantanamo right now. I mean, come on, they got up there at the briefings and said that people could smuggle bomb supplies on in component form in water bottles... and we can bring water bottles on board again... so... THEY'RE WITH THE TERRORISTS!!!!!
Since this is patently absurd, maybe Mr. Windbag might want to slow his roll a bit, and consider using his brain before he opens his fucking hole.
Come read my stupid blagablog. Rants and Giggles
Ha!
Have you noticed all the less than friendly laws passed recently?
If they decide to do anything to him, they'll be shipping him off to a Southeastern Cuba vacation spot. It's a very exclusive resort, you can only show up by invitation (an invitation that you cannot refuse). How did the Eagles put it? "You can checkout any time you like, but you can never leave..."
How did the summary of the "Military Commissions Act of 2006" go?
1) The US Gov't doesn't like you
2) They arrest you and hold you at places undisclosed, without access to a lawyer (or even a phone)
3) They "encourage" you to confess. Although it cannot be "torture", it will be anything that isn't seen as torture by the current administration (are electrodes to the nads torture? Nah.)
4) Once you've given your spontanious confession, it will be used against you.
Now, on spontanious confessions. Most guys have spilled their guts to their girlfriends and/or wives, to get them to shut up (tactfully put, if I must say so myself). Now, what are you going to do against trained agents? You'll crumble in seconds. You'll confess to anything they tell you to, just to get you to shut up.
For a person publishing information on the Internet, where all the bad guys can get a hold of it, you are quite likely one of the bad guys trying to get said information to them quickly. (I'd think an email would have been better, but this is our government we're talking about). Since the document is giving detailed information on circumventing national security (ha!), he's a terrorist.
The war on terror will be won, it doesn't matter how many innocent (or mostly innocent) civilians get taken down with them.
{sigh}
What happened to the days where the boogy man was the red in a submarine just off shore with a stockpile of nukes?
It's just a new boogy man, to make the government look like it's protecting the people. They never do ask, why are the bad guys screwing with us in the first place. Oh ya, because we've been screwing with them for decades.
Serious? Seriousness is well above my pay grade.
I am not a lawyer but I deal with Internet crime issues, law enforcement, prosecutors on a regular basis.
As do I, you have absolutely no idea who I am in real life and assumptions are unwarranted. Granted "successfully prosecuted" would have been a better term, since you can pretty much be prosecuted for anything as long as a judge can be found to go along with it.
You are completely sidestepping the question of intent, but more important is the question of use. You are free to print up all the flight tickets and Amex travellers cheques you desire. The illegal action is attempting to pass them off as real. Again, US currency is a different story. Don't even talk about printing them, the secret service takes it very seriously.
In this case we have a person who provided a php script to aid in the manufacture of forged plane tickets. This is completely outside of the realm of currency and into the area of homeland security (which is the only reason it is getting notice). In this case, the person's intent (which is clearly to raise awareness of major flaws in the system, not to blackmarket tickets to terrorists) would come into play. Obviously they may try to prosecute him, but any defense attorney with half a brain would shoot down the "terrorist" accusation. You also have to look into the political aspect of this. Clearly the feds are a bit pissed at him for pointing out major weaknesses in the air traffic system that they have spent billions trying to convince the public is secure (without actually doing anything meaningful or even competent to actually secure it). However, do you really think they would want to draw even more attention to this by going after him? The website will likely get shut down (if not already, I haven't checked) but I highly doubt he will face prosecution. Frankly, they actually want to pretend they care (or know anything) about security, thanking him would be in order. As I said elsewhere though, the emperor generally does not like his nudity pointed out. And as I am sure you well know, the law enforcement community does not like some of the more absurd aspects of what they do thrown in their face, so I'm sure there will be some saber rattling.
Finkployd
The theory you seem to be proposing here might be worth a shot if you were a defense attorney defending a case. It is not a good idea to rely on such theories if you want to stay out of prison. Much better to consider the theories that a prosecutor might use and steer clear of possibly illegal activity.
Steer clear of illegal activity???? HELL no! That's the dumbest idea I've ever heard. As good citizens we have a responsibility to ignore and break bad laws...
// TODO: Insert Cool Sig
This whole story is stupid. The fact that documents can be forged is not news, the fact that some guy made a website for doing it faster is not news, and the fact that security at airports is a giant joke to anyone dedicated to getting stuff past it is not news either.
I put a lot more faith in my fellow passengers' desire to rip a terrorist to pieces with their bare hands on the plane once he or she announces themselves than I do in the ability of the TSA to effectively screen people. And it's not becuase the TSA are all idiots; thay have a tough job that they try to do very quickly -- if they really wanted to screen everything effectively, it would take hours to get through security.
Dude, I think I can see my house from here.
You think this is just a move to alter political perception?
Why make your political opponents seen in a bad light when you can make them not seen at all?
I doubt the Bush administration vehemently argued for and got the ability to declare U.S. citizens on U.S. soil enemy combatants for providing "material support" to terrorist organizations, not to use it.
More or less all the administration has to do is accuse this man of conspiracy to provide material support to a terrorist organization - quite reasonable considering his actions - and they can ship him off to Git'mo indefinitely. They now "can" bring these prisoners to trial. But they don't have to. They can hold him there indefinitely and release him out in the Virginia countryside after the 2008 election and have done no legal wrong.
You don't arrest enemy combatants. You detain them.
We're at war, after all.
There must be some hidden reason for the seemingly obvious misjudgment.
More like a misconception. This country really needs more so-called conservative justices. By "conservative", I don't mean conservatives pushing their agendas from the bench (like O'Connor), I mean justices who follow the Constitution (like Scalia).
It's no surprise that Kelo went the way it did. You're thinking is that "liberals are for the little guys, conservatives for business". But, in reality, having the power of central planning is crucial to the liberal agenda. Kelo was exactly what the liberals needed: the power for government officials to confiscate your personal property in the name of a "greater good" by calling it a "public purpose" (not public use, however, as the 5th Amendment says).
Scalia, on the other hand, follows the Constitutional principle that the federal government can only regulate interstate commerce ("commerce among the states," as is in the Constitution). Using that principle, it would be Unconstitutional for the federal government to prohibit the growing of Marijuana on private property. States could still outlaw it, of course, but the feds couldn't do a thing. Does that sound "conservative" to you? Nope, but it is what the Constitution says.
This is not about your party, the Constitution gets in the way of BOTH parties, but it's not for the parties, it's for the PEOPLE. So back the Constitution, because it's just in the way of the Democrats and the Republicans. It's time for both parties to face the hard truths: you can't execute unwarranted searchs (too bad, GOP). And Democrats: stop trying to control guns, unless you want to try to pass an Amendment. The Constitution says these things, plain and simple. Oh, and when you get a chance, read the 10th Amendment, too.
Right now the idea that we are following the Constitution is a joke. We cling to a few scraps of the Bill of Rights, and ignore much of the rest of it. Congress "Authorized the use of force"?! What is that supposed to mean? What about a declaration of war? Meanwhile the Supreme Court passes arbitrary edicts fabricated out of thin air, like "privacy" meaning that it's Unconstitutional to ban abortions. I don't think it's a good idea to ban abortions, but why did 9 people make that decision for the entire country, when it's clearly a state issue?
Social scientists are inspired by theories; scientists are humbled by facts.
Handing out a "living wage" stipend just guarantees that none of the grunt work will ever get done in this country. A huge portion of the country would sit at home and subsist off their "allowance" while the garbage went un-collected, concrete blocks went un-loaded, and ditches remain un-dug. The value of money comes from our use of it as a placeholder for man-hours applied as work. The fed does not loan the gov't enough money to support the entire population anyway. I could continue, but your argument is so full of idiotic holes it'd actually be easier to point out where you're right and call the rest crap.
If a job's not worth doing, it's not worth doing right.
Soooooo.... if I get my butt hauled off to Guantanamo, how do I get myself a court hearing so that I can present the evidence showing that I am a U.S. citizen and therefore entitled to Habeus Corpus?
Face it. So long as we say, "Everyone has a right to habeus corpus, except for group X," then all the government needs to do is claim you're a member of group X to deny you access to the courts.
Final note: We are not at war. Legally, we are not at war, because Congress has not declared war. Morally, we cannot declare a war that amounts to a war against anyone, anywhere who might be plotting violence against us. That leads directly to a state of eternal war, because we cannot even conceive of a future state of affairs that could be called "victorious."
The U.S. knew the war was over when Lee signed his surrender at Appomattox. How will we know that the "global struggle against islamofascism" is at an end, that America is safe, and we can demand these so-called "war powers" back? Who is going to have to surrender their arms to make that day come? The answer, of course, is nobody. This "war" won't end with a resounding military victory or the fall of some great tyrant. It only ends when the people of the U.S. rise up and take back the liberties they traded for false security.
November 7, people. Mark it on your calendars.
You want the truthiness? You can't handle the truthiness!
Depending on your definition...
Judicial activism to me is any decision which is pretty obviously wrong. See Kelo v. New London for an example of judicial activism. Thomas is an activist in that he believes that when Congress declares war, President Bush becomes King Bush. As far as I can tell, the Constitution does not grant the President any extra powers during times of war. He is simply Commander-in-Chief as he always has been. His activism has put him to the right of Scalia, specifically his dissenting opinion in Hamdan v. Rumsfeld in which he conveniently forgets that it is Congress who must suspend habeas corpus and not the King.
I'm gave at least one other person gets it.
The recent act might, or might not, remove habeus from citizens or not. I've heard people say that it removes it from anyone who's classified a certain way by the administrtion, and that there's nothing in there stopping citizens from being classified that way. I've heard others argue that that's insane and the courts would never interpet it that way.
Well...I want to know how the fuck the courts are supposed to rule on it. In fact, I'd like to know how they were supposed to rule on the fact you were a citizen now.
We should NEVER, under ANY circumstances, make it legal to hold ANYONE, or any class of people, without access to the courts, because the second that happens we can merely assert that person X is in that category, and hold them, even if they clearly aren't, and they can't dispute it. Full stop.
It doesn't matter if they can only hold non-citizens without access to a court if citizens can't get to court to demonstrate they are, in fact, citizens. Anyone who doesn't understand that simple logic is a complete fucking moron, period.
If corporations are people, aren't stockholders guilty of slavery?