Slashdot Mirror
Charges Dropped In Fake Boarding Pass Case
An anonymous reader writes, "Investigators have dropped the criminal case against Christopher Soghoian after satisfying themselves that he acted without criminal intent. The grad student had created a web site capable of printing fake airline boarding passes. Soghoian is quoted: 'If they fix the airport security problems... then this entire process has been worth it. If they don't fix airport security, then... what was the purpose?'" Soghoian's blog has insightful comments about the divide between security researchers and government officials on subjects such as TOR.
That's good. I find it interesting though how fast it was dropped. Appearently, the status quo is that its ok to make a boarding pass generator, but its not ok to create DVD decrypting software. Granted, I understand why the latter generates more lawsuits, but still this is pretty much the end result.
Maybe we'll see a boarding pass generator in the next version of RedHat Linux.
If I were Chris, I'd thoroughly check and wipe the disks of the computers that the FBI gave back to him.
Help contribute to the Bloomingpedia article about Christopher
Unfortunately, the investigators who dropped the charges were unable to be reached as they were enjoying their cushy first-class-flight South Pacific vacations.
Where were you when the voynix came?
his life got turned upside down
Yes, but was it "flipped" as well?
Perhaps, while we sit here, he would like to take a minute and tell us.
If you can't print a fake boarding pass, you can always scribble something illegible on an old ticket with a magic marker. Ever had that happen? "Sorry your flight is delayed, we're transfering you to another airline, just show them this.." and you're thinking, wonder if this scribble will get me to Hawaii?
Don't the morons running this place realize that it isn't safe to forego shooting the messenger?
Sheesh, evil *and* a jerk. -- Jade
Can somebody explain US laws to me here? Is it or is it not legal to put up a website that helps to print fake boarding passes? If it is not legal, why was the case dropped? If it is legal, would it be ok to put the website online again?
I have a hard time to imagine what law could be violated by this unless somebody tried to actually use such a fake boarding pass to get on a plane or into a restricted area.
I could imagine that the mere act of printing a fake boarding pass *could* (depending on how it is done) violate the copyrights of the company. Anything else?
I bet he doesn't have all his computer equipment back that was confiscated from him during the investigation. Who needs a guilty verdict to punish him? Due process is dead.
I don't have a problem with ID checks, though the USCOA does. When I fly internationally, I am subject to ID checks at almost every port of call. That's just the way things are when you enter and leave countries. However within the U.S. there is no requirement that you submit to an ID check. It is your right to refuse this check. So anyone can claim to be anyone and get past the TSA checkpoint with nothing but a boarding pass. The No-Fly list is made useless by this simple loophole.
So what then? Change the Constitution so that we lose the right to security in our papers? I dunno.
But what I do know is that a not-really determined terrorist can plant a bomb anywhere outside the TSA security perimeter with impunity. In fact, a bomb can be placed anywhere in any city at any time and cause the type of destruction that generates terror.
Is the solution to negotiate with the terrorists? I dunno.
I don't like to give these crackpots any more legitimacy than they deserve, but if we are truly afraid of them wouldn't it help to find out what they want and then find a way to come to a mutual agreement?
If we're not afraid of them, then stop all this nonsense about making our country safer by strip searching grandma. The initial price of freedom is blood, but the recurring cost of freedom is risk. You can't have freedom without risk. You can reduce risk by reducing freedom and that's what the current tack is, but it's a mistake to assume that we have all agreed to this level of reduced freedom because a few fraidycats are unwilling to live in a risk-filled world.
Because obviously, anyone trying to publicise flaws in the system before anyone gets hurt is just as bad as a terrorist. Idiot.
The actions by any organization larger than, uhm, 200 people, are controlled by written procedures and norms, which are software. You'd, probably, learn this much in a management course (not that I tried).
The bigger the organization, the more likely you are to deal with someone who is merely executing the instructions — unable of, and unthinking about changing them. An organization like government, or a huge department like Homeland Security is all about it. A few "software engineers" and "analysts" high above devise the algorithms, some more "coding monkeys" codify it, and then it gets to run "in production".
We are the users. And we get worked-up about the bugs. In this case, the bug is a security one, where a presented certificate is accepted without checking with the issuer.
Somebody thought, that it would be good to limit the crowds next to the gates to people with boarding passes. Checking, that the pass is valid (as airlines do at the actual gates), either did not occur to the coder at all or was deemed too expensive...
The new release will, hopefully, have a fix. If not, than, certainly, the next one. Nothing, you've never heard before.
In Soviet Washington the swamp drains you.
It was made perfectly clear during the meeting that parts of the US government, at least the two represented at the meeting, strongly disapprove of Tor - and in particular, thought that research universities such as IU, MIT, Georgia Tech, Harvard and others have no business supporting such projects.
Basically, what we are talking about here is the "parts of the U.S. government" working to turn the country into a police state.
Got them for under $1 each.
To my dismay, they can't read standard bar codes. ( I was hoping to label my books with bar codes )
To my amusement, and dismay, I figured out WHY they wouldnt read standard bar codes.
Some airline sold them to a liquidator. With their custom code in the flash memory to scan their baggage and boarding pass tags.
I wonder what their thought processes where?, something like:
Got them for under $1 each.
To my dismay, they can't read standard bar codes.
To my amusement, and dismay, I figured out WHY they wouldnt read standard bar codes.
Some airline sold them to a liquidator. With their custom code in the flash memory to scan their baggage and boarding pass tags.
It wasnt too hard to learn all this. Every scanner had several stickers on it with diagonal red stripes and phrases like
"/// SECURITY DEVICE #xxxxxxxx/// "
"/// USER MUST HAVE SIGNED CONFIDENTIALITY AGREEMENT A8R55-2/// "
"/// FIRING OFFENSE TO REMOVE FROM RED ZONE (UNION HBK, PG 37)/// "
"/// DEADULUS & EARHART AIRLINE CUSTOM FIRMWARE VERSION 1.22"/// .
I wonder what their thought processes where?, something like:
""/// DEADULUS & EARHART AIRLINE CUSTOM FIRMWARE VERSION 1.22"/// . "
Those are antiques! You might just try to re-sell them on eBay. Daedalus Airlines, in particular, had their assets sold of decades ago when the last wax-attached bird features fell off the last airliner. Both airlines declared bankruptcy, and eventually merged with the old Glenn Miller Airlines to form the Oceanic Air we know and love today. You know, the one with the slogan "Getting halfway there is all the fun". They're also the first airline to consider electrified wings in order to keep the gremlins off.
Where were you when the voynix came?
Didn't the CIA take an interest in TOR at one point? Kinda hypocritical that the guberment is against it now.
Who are you? The new #2 Who is #1? You are #617565. I am not a number, I am a free man! Muhahaha.
"Soghoian said fake boarding passes wouldn't be an issue if identification was required and checked to travel. The student said he has been able to get on four flights without showing ID."
I fly across country every other week and have well over 100,000 miles under my belt this year a lone and I have never once gotten through security without my ID. Wrong boarding pass, yes, but it still had my name and matched my ID. And since we have no National ID how does one make sure the the people paid $8 an hour know how to check every state and military ID and look for fakes?
Printing devices are just machines used for printing fake boarding passes, and they all know it. So it's time to get paid for it! -Department of Homeland Security
The most important thing to do in your life is to not interfere with somebody else's life. -FZ
Trust is what makes a modern society function. To destroy a modern society, you destroy trust. In many ways, that has been the aim of the terrorists attacking the US. We trust boarding passes. Pointing out that they are not trustworthy is simply beyond the point. Trust is an ephemeral thing, and yet it is an essential thing. Printing out fake boarding passes to show that they are not trustworthy doesn't help to increase security; in fact ..... the terrorists win when you stop trusting people.
Don't piss off The Angry Economist
It was made perfectly clear during the meeting that parts of the US government, at least the two represented at the meeting, strongly disapprove of Tor - and in particular, thought that research universities such as IU, MIT, Georgia Tech, Harvard and others have no business supporting such projects.
I wonder how they feel about TOR being a naval research project.
I will not set foot into an airport until they stop forcing us to pose for the nude-body scanner.
Call me shy or puritanical or what you will, but I do not want naked pictures of me in a federal database. Given the ease with which such biometric-identifying information could be abused or stolen by hackers, this practice does not make me feel safe.
It makes me feel oppressed.
So if I ignore the security trying to stop me from boarding the plane with my large toothpaste tube, intending only to brush my teeth after dining on their airplane food, then I shouldn't be arrested? The criminal charges apply only to people boarding with criminal intent for their toothpaste?
Look, the charges against this guy are bogus. The criminals are the people in the TSA who treat us like dirt on a cop's beat, while leaving these gaping security holes for actual attackers to exploit. Who try to cover their asses by arresting people who out their incompetence. The whole simcurity industry is a mafia, shaking us down with fear and intimidation while leaving us undefended.
But the lawyers, judges and legislators who decide justice based on unknowable (philosophically, perhaps even nonexistent) "intent", are worse than criminals. They're destroying the entire rational basis for justice, based on testable evidence and disprovable legal theories, in favor of arbitrary mind reading. Even if they didn't "intend" to do that, they've done the damage.
Just like security rules can protect us only from actual acts and results, not forgive well-intentioned acts that might create insecurity anyway. Should the law allow me to bring my pressure-detonating bomb prototype on an airplane, just because it never occurred to me that it would destroy the plane in flight? What if I did that a few times? What if I just got on the plane so drunk that I abused the passengers, making a mess in the aisle, a few times a month on business trips, intending only to "relax" my nerves before the flight?
The law should protect us from too-risky actions and actual danger. Including the incompetent actions of the TSA which can't accept warnings from researchers that boarding passes are insecure. Not dwell in the imaginary world of "good intentions".
--
make install -not war
They mention fake airline itineraries, not boarding passes, but would a fake, used boarding stub also get you in trouble?
OT: having an affair is sleazy, but not illegal. If that alibi company is used to cover a crime, do they have any liability?
This issue is a bit more complicated than you think.
Chalk one up for the citizens!
There has long been a sharp division of opinion on the merits and failings of TOR... So Soghoian's observations aren't anything new...
---GEC
I'm but the humble pupil, seeking to snatch the scratchbuilt pebble from the master's fully articulated hand
There is nothing to fear. It is just a small fragment of MS-DOS assembly code. "B8 00 4C" is "mov ax, 4c00h", and "CD 21" is "int 21h". It is a MS-DOS system call that exits your program (system call number 4c) with a status 00 (the lower byte of ax). Now everyone knows...
I haven't used Windows for a long time, but I wonder if it still comes with an MS-DOS debugger?
I once had a signature.
It seems to me that requiring a boarding pass is less about increasing security and more about reducing the number of people passing through the security checkpoints. Can you imagine how long the lines would be if friends and loved ones were still allowed to see you off/meet you at the gate?
I don't know for sure but last time I flew, I flew Airtran and they had checkin online and you can print out the boarding pass at home. I'm pretty sure the print out was regular HTML and I could have easily changed the name. Even if it weren't HTML, you can print it out as a PDF file then edit the text. So Bob can buy a ticket then change then name to Charlie with an HTML editor and Charlie can easily go through security. Security can avoid this by typing the name or scanning the tickets which would recognize the fake but I'm pretty sure all they do is match the boarding pass name with the ID. Anyway, I think the whole name security thing is pretty lame. How hard is it for these organized terrorists not to get fake IDs like any underage college student? As a more useful academic exercise, has anyone thought about this: Bob buys a heavily discounted ticket to Hawaii on Airline XYZ but becomes sick and can't go. Bob can't get a refund from the airline so would have to eat the ticket. Instead, he checks in online and prints out the online boarding pass and gives it to his buddy Charlie. Charlie then buys two full fare fully refundable oneway tickets on the same flight. He also checks in online and prints out his boarding pass. Now Charlie just goes through security with his boarding pass + ID. They don't check ID at the gate (only scan your ticket) so to board the plane he hands Bob's print out to the gate agent and he gets on the plane. After his vacation, Charlie refunds his own ticket and gives Bob a beer for using his ticket. I wonder if a crime is even committed because you went through security legitimately under your own ID and boarding pass. You took a seat that wasn't yours but the non-transferability is up to the airline to enforce and not the government. It's no different than if I buy a ticket to a concert and give to my friend, even if it says non-transferable. Usually they require ID at willcall to pick it up but don't check again through the gates. Anyone? Good way to save those non-refundable fares!
I looked it up. I'm confused - what harm do he cause on an airline? Other than delaying it for a long time.
I hadn't heard that, but it makes a lot of sense. After all, while it would produce more terror to blow up a Wal-mart in the Middle of Nowhere, USA that's certainly no where near as big or meaningful as the 9/11 attacks.
I was having a conversation with my friends about this and the other point they made was the 'human factor.' After all, if a suicide bomber is giving his life to a mission, I'm sure he'd rather go down in history as one of the guys who participated in 9/11 than one of the many dudes who blew up some wal-mart's across the country. Now, I realize that car bombs go off every day in Iraq, but like you said, it's the low-level terrorism that people sort of get used to. Even on the news now they report it as "another day of deadly attacks in Iraq - 2 carbombs, a shooting and one suicide bomber" - nowhere near they amount of coverage of 9/11. Now, I'm no psychologist, but I sense there's a little bit of egoism and megalomania in these guys...they wanna be heroes, they wanna be martyrs, they don't wanna be just some cannon fodder for some 'greater cause.'
He's practically a part of the Bin Laden family, what don't you get?
In your preoccupation with terrorists, you have forgotten about the immense threat posed by Vampires (Vampyres?) to the populace at large, and especially on airplanes flying through the perennial dark, so far removed from the rest of civilization. The boarding pass issue is still a problem, but checking IDs is definitely effective against the Noble Dead. Obviously, that's what the Airport Security Moguls were thinking when they instituted the check, since everyone knows that terrorists all have photo IDs just like all the rest of the Living.
"But wait!" you say, "What about the recently 'converted' who still have their photos from before they were introduced into the ranks of darkness?" True, the check won't stop them, but they're not the real concern here. What's really important is to prevent the Master Vampyres, who are all at least a couple centuries old, from boarding. They're the ones who can cause real havoc.
I wonder what the differences would be in this story had this guy been "Muhammed al-Maqmood" instead of Christopher Soghoian?
Probably get the usual terrorist plot stuff I suppose.
Just like that video where a white guy goes on a bridge by himself and starts snapping pictures. Nothing happens, so he leaves and comes back dressed as a sheik, complete with long white robe and head covering. He then proceeds to do the exact same things he did prior without the costume. Within 2 mins he is accosted by security officials and told to leave the bridge.
Does anyone else think "Muhammed al-Maqmood" wouldn't have gotten off so easily?
Live forever, or die trying.
Welcome to the collective. Please turn in your life. You can pick up your hot grits in room 404.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
When ordering your ticket online, specify any safe name, "John Robert Smith", as the passenger and pay with your credit card in your name. The passenger name does not trigger any alerts and the transaction goes through. Before you print your boarding pass at home, simply save it as HTML/PDF and modify the name to be your true terrorist name matching your official terrorist ID card. You then can proceed through security and the gate because the boarding pass still has the legitimate coding even though the name had been changed. You are on board ready to blow it up. Note that baggage would need to be handled through curbside where they simply check your ID as opposed to ticket counter where they bring up your actual record which would not match your ID.