"Clear" Air-Travel Pass Data Stolen From SFO

Kozar_The_Malignant writes "A laptop containing the unencrypted security data for 33,000 travelers using the Clear system was stolen at San Francisco International Airport on July 26, according to CBS5 Television. The Clear system allows travelers who register and pay a $100.00 annual fee to speed through airport security by using a smart card at special kiosks in some airports. TSA has suspended new registrations in the system, which is run by a private contractor, Verified Identity Pass, Inc., a subsidiary of GE. The laptop was apparently stolen from a locked office at SFO. The company has now decided that it might be a good idea to encrypt the data in their systems. They are in the process of notifying customers that all of their personal data, including name, address, SSi number, passport number, date of birth, etc. has been compromised."

Comments

Security theatre

[BWJones]

To have a company intimately involved with *security* not apparently able to manage their own security in a manner that protects the country and their customers is a joke. Fine... having a laptop stolen is common enough and I don't fault them, but having unencrypted data of 33,000 of your customers on that laptop is a crime.

  I never liked the idea of handing over private information in the security theatre that our nation has become, but events like this where private companies motivated by the lowest common denominator really get under ones skin. Why the data was stored in unencrypted formats is inexcusable. I don't know what the penalty should be for something like this, but it should be commensurate with the potential damage it could cause.

The whole point of outsourcing information and jobs like this to the private sector is to get the job done better and more efficiently. When the government then has to police these private companies like the TSA is apparently having to now do, the concept is made moot. So.... our options are to continue to live the security theatre with private companies like this or turn the job back over to the government (who's job it to ensure safety of travel and should not have been in the business of verifying identity for air travel anyway).

Or... we could go back to the way things were when I could carry pocket knives on planes. (I also remember when you could carry long guns on planes back in the late 80's/early 90's.)

Re:Security theatre

[boaworm]

Yea, and this also brings some interesting light to the issue with "If you have nothing to hide, why don't you want to provide us with your [biometrics|passport|id|*]" argument.

Refusing to give away address, email, phones, SSID along with fingerprints is almost considered a crime in itself right now, since if you are not planning on terrorist activities, you don't have anything to hide, have you!?

But here, perfectly innocent people suddenly have all their personal information spread to criminal groups or whoever end up being the buyer of this information.

Scary stuff...

Re:Security theatre

[Cruciform]

The whole point of outsourcing information and jobs like this to the private sector is to get the job done better and more efficiently.

That might be the point for you, but for the government officials there are other points to consider:

1) Who bid the lowest.
2) Will the company chosen contribute enough money to my/our campaign in the future.
3) Is there a way I can profit from my choice of contractor.

The idea that someone would believe a company is chosen for its actual merits is ludicrous.

Re:Security theatre

[BWJones]

Yeah.... You have nothing to fear except fear itself..... and incompetence. So, just hand your data over to us and we'll verify that you are who you are which really does nothing for national security anyway because there is nothing that prevents someone from getting "cleared", then carrying out a crime later.

Re:Security theatre

[nasor]

That was my first thought as well. When some random company that sells carpet or bulldozers or hamburgers makes stupid decisions about data security and customer information is stolen, yeah, it's idiotic. But these guys are supposed to be a security company.

Re:Security theatre

[Anonymous Coward]

The idea that someone would believe a company is chosen for its actual merits is ludicrous.

Well, choosing a company based on something abstract like merits is illegal because it's often used to hide #2 and #3. Price is the only consideration you are allowed. Yes, it's stupid, but it's the way the taxpayer demands it be done.

Honestly, do you think larger corporations are any different? Deals are always given to good old boy friends who will give you something later. It's not even illegal, like it is in government.

Re:Security theatre

[rk]

The whole point of outsourcing information and jobs like this to the private sector is to get the job done better and more efficiently.

That's the ostensible reason, the one they use to sell it to those who distrust government spending like libertarians, fiscal conservatives and some old-school Republicans.

The real reason is usually to privatize the profit centers, while continuing to keep the cost centers public, so the old boy network can continue to get slopped at the public trough.

Re:Security theatre

[greedyturtle]

This is a brilliant paper that sums it all up. It was posted on ./ a few years back, couldn't find the ./ story but I did find the paper:

I've Got Nothing to Hide and Other Misunderstandings of Privacy

Re:Security theatre

[Profane MuthaFucka]

Corporate Death Penalty! It's an option that is seldom used, but should be used more and more.

When corporations break the law and are found guilty, their existence as corporations should be ENDED.

Re:Security theatre

[Anonymous Coward]

When a company makes others vulnerable to identity theft by not securing our most personal data, I've always thought that the appropriate punishment would be to allow each person affected to walk into any office of the company and take any one item from the company. This would give the company a very similar risk for the loss of this data as we have by making them suffer a potential loss of unknowable size which is exactly the same risk you have when your identity is stolen. When the risks are not equalized, the company has no real benefit from protecting the data of the customer because the company suffers very little when the data is compromised.

Re:Security theatre

[QuietLagoon]

To have a company intimately involved with *security* not apparently able to manage their own security in a manner that protects the country and their customers is a joke.
.

Does the phrase lowest bidder mean anything? :(

Re:Security theatre

[Devil's BSD]

Refusing to give away address, email, phones, SSID along with fingerprints is almost considered a crime in itself right now

I have no problem giving you my SSID, it's the WPA2 key that I have a problem giving out ;)

Re:Security theatre

[samkass]

That's only true in the very last stage of bidding on government contracts. The key is to have the requirements written "properly". I put the last word in quotes because every contractor wants their special value-add to be made a requirement of all bid requests-- that way they're always cheapest and win the final bid. By the time the final wording is written into any request for proposals, the winner is usually no surprise.

Re:Security theatre

[Intron]

Happens all the time. Then another corporation buys all their assets for cents on the dollar, the stockholders get screwed, and surprisingly, the new company is run by the same guys who ran the old company.

Re:Security theatre

[bluesk1d]

Brilliant idea! Let's have all the other innocent employees lose their jobs, pension, and benefits and put loads of extra stress on social services like unemployment! We also get to take the economic hit when all the sharehoders lose their investments - Woo hoo! What is your name? I would like to write you on the ballot when I vote for president.

Re:Security theatre

[bob_herrick]

This is a local story to me. On the TV news last night one of the security company's staff was interviewed. He asserted:

o Only publicly available information - name, address, etc. was on the laptop.
o No private data such as SSID and credit card information were on the laptop

This does not excuse the lack of security, but it might make those that had their data on the laptop feel better, if true.

Re:Security theatre

[lelitsch]

The whole point of outsourcing information and jobs like this to the private sector is to get the job done better and more efficiently.

Bzzzz. Next. The whole point of outsourcing is to drive down salaries while providing a windfall for former, current, or future campaign contributors. Otherwise, why would be the VA be able to buy cheaper meds than Kaiser Permanente?

Re:Security theatre

[AP31R0N]

While we're at it, let's remove the armed guards from places like the White House and CIA. They infringe upon my privacy when they ask me to show ID, and limit my movements like i'm some kind of prisoner. It also pisses me off when i walk up to someone's house and the door is locked. i'm not going to STEAL anything, i just want to look around and sniff some panties. Besides, they should feel bad if they have something to hide from me. Or something worth stealing, like that Bose Wave Radio (those are so cool). And why can't i borrow your car for a few days? You paranoid freaks think i'm going to keep it or damage it somehow. It's the presumption of guilt that i resent. While we're at it, when i ask a doctor for Oxycontin and viagra he shouldn't invade my privacy by asking me what it's for. That's between me and the people i'm inviting to my orgy next Friday. If i want to bring my C4 collection in my carry-on, that's my right. If we criminalize carrying C4 on planes, only criminals will have C4 on planes.

Re:Security theatre

[Anonymous Coward]

Making it feel like a crime before it actually becomes a crime, so we fail to notice what has become of our personal information.

Re:Security theatre

[Bob9113]

hahahaha - excellent post

(please pardon this superfluous one)

Re:Security theatre

[maxume]

So your argument is that because some things that are called security are necessary and beneficial, anything that is called security must be necessary and beneficial?

Re:Security theatre

[wkk2]

A locked door is nearly worthless in an airport. Key control is probably ridiculous. One office, in a major airport, kept a spare key behind a picture in the hall. I was so mad I sent them a realty type lock box for the key. I don't think it was ever used because the door had an "L" ADA type handle and the management wouldn't allow the lock box to be screwed to the wall. Another airport routinely checked out the wrong key for service. I think security took great pleasure in running people back and forth across multiple concourses like trained rats. SSNs and birth dates should be encrypted no matter where they are stored.

Re:Security theatre

[amn108]

Japanese were/are ahead of the world with the CDP, as far as I am concerned.

In Japan, you pull off something like that, and it's Harakiri Time!

Re:Security theatre

[demachina]

"Price is the only consideration you are allowed. Yes, it's stupid, but it's the way the taxpayer demands it be done."

That USED to be the only consideration before the Bush administration came to town, that and if you had a token minority or woman in your executive suite you could win by exploiting affirmative action.

But, the Bush administration has been constantly sole sourcing and otherwise steering contracts to friends and contributors for 7 and a half years. There is a well oiled machine of Republican connected lobbyists who hooked companies up with a fast path to contracts. Karl Rove apparently tried to turn the entire executive branch in to a political tool where government contracts were being steered to "good Republican" companies and as tools to get Republicans elected for bringin home the bacon to companies in their districts. Many of the contracts in Iraq, both in supporting the military and rebuilding Iraq(rebuilding it very badly it turns out), were done that way.

Maybe its illegal but if no one enforces the law what does the law matter. The Bush administration had complete contempt for the law in little things like torture, spying on Americans, hiring and politically motivated prosection in the DOJ etc, what makes you think they care about it in government contracting. If they dominated the executive branch, including the DOJ, and the Congress, which they did from 2000-2006 they knew no one would investigate anything, or enforce any law. Some private citizen or public interest group would've had to blow the whistle. When they've tried the Federal government has been very effective at smacking them down. I recall a number of instances where Federal contract monitors and auditors have questioned the performance and billing of politically well connected contractors, and if they didn't shut up and rubber stamp the payments the Bush administration just fired them and put someone in the job who would stop asking questions. There was an instance of this reported a couple weeks ago.

Even since the Democrats regained control of Congress the Bush administration has been very good at frustrating every attempt to investigate all their law breaking.

If the Republicans had managed to stack the courts a little better, and hadn't been so incompetent and corrupt that they started losing elections again in 2006 the law would have been pretty much history in the U.S.

Re:Security theatre

[Free the Cowards]

I think that what this really shows is how stupid it is that this information is considered "private". Come on, birthdays? Dozens of people know my birthday, not counting the many government and private organizations who have the information in their databases. And a social security number is just nine digits that get assigned to you at birth, why should that be private?

Currently, society is essentially authenticating by username only. It's stupid, anybody who works with computers knows that it's stupid, but we persist. If we're going to authenticate people we need the equivalent of password authentication. Authenticating people based on some basic information that anyone can discover with a little work is just plain dumb.

Re:Security theatre

[Dekortage]

I haven't made it far through the article, but it's good so far...

"...in a more compelling form than is often expressed in popular discourse, the nothing to hide argument proceeds as follows: The NSA surveillance, data mining, or other government information-gathering programs will result in the disclosure of particular pieces of information to a few government officials, or perhaps only to government computers. This very limited disclosure of the particular information involved is not likely to be threatening to the privacy of law-abiding citizens. Only those who are engaged in illegal activities have a reason to hide this information. Although there may be some cases in which the information might be sensitive or embarrassing to law-abiding citizens, the limited disclosure lessens the threat to privacy. Moreover, the security interest in detecting, investigating, and preventing terrorist attacks is very high and outweighs whatever minimal or moderate privacy interests law-abiding citizens may have in these particular pieces of information.

"Cast in this manner, the nothing to hide argument is a formidable one. It balances the degree to which an individuals privacy is compromised by the limited disclosure of certain information against potent national security interests. Under such a balancing scheme, it is quite difficult for privacy to prevail.

...

"Many commentators had been using the metaphor of George Orwells 1984 to describe the problems created by the collection and use of personal data.51 I contended that the Orwell metaphor, which focuses on the harms of surveillance (such as inhibition and social control) might be apt to describe law enforcements monitoring of citizens. But much of the data gathered in computer databases is not particularly sensitive, such as ones race, birth date, gender, address, or marital status. Many people do not care about concealing the hotels they stay at, the cars they own or rent, or the kind of beverages they drink. People often do not take many steps to keep such information secret. Frequently, though not always, peoples activities would not be inhibited if others knew this information.

"I suggested a different metaphor to capture the problems: Franz Kafkas The Trial, which depicts a bureaucracy with inscrutable purposes that uses peoples information to make important decisions about them, yet denies the people the ability to participate in how their information is used.52 The problems captured by the Kafka metaphor are of a different sort than the problems caused by surveillance. They often do not result in inhibition or chilling. Instead, they are problems of information processingthe storage, use, or analysis of datarather than information collection. They affect the power relationships between people and the institutions of the modern state. They not only frustrate the individual by creating a sense of helplessness and powerlessness, but they also affect social structure by altering the kind of relationships people have with the institutions that make important decisions about their lives."

It's a great analysis of the issues, laying out what the heck privacy really is, anyway.

Re:Security theatre

[Anonymous Coward]

(I also remember when you could carry long guns on planes back in the late 80's/early 90's.)

You certainly can carry firearms on planes, provided that you have a license to own a gun, and the guns are declared, unloaded, in locked containers and in your checked baggage.

Hunters do it all the time.

Re:Security theatre

[jimbolauski]

It's high time we created a P.I.P.A. Personal Identity Protection Act, where the companies that have your personal information are responsible for it's protection. This alone would stop Blockbuster from asking for my info to rent a movie.

Re:Security theatre

[krbvroc1]

The company in question was founded by Steven Brill who founded CourtTV and American Lawyer magazine.

He is from NY state and is a solid Democrat from what I can tell (according to his campaign contributions).

Re:Security theatre

[XenoPhage]

The key is to have the requirements written "properly".

And that's part of the problem. The government, in many cases, outsources because it does not have the expertise to do the job. Not having the expertise also manifests itself in the lack of details in the requirements document. Just requiring a security company that can secure stuff isn't good enough, you need to elaborate. In many cases, you may need to elaborate into details like what encryption algorithms are usable, what are not, etc. Stuff your average government lackey would know nothing about.

Re:Security theatre

[geekoid]

VA buys in much larger bulk. The VA also guarantees a min. purchase. This is also way meds are cheaper in Canada.

However, anybody who takes even the most cursory review of privatization would realize it cost much, much more the doing it in house.

Government employee : answers to you, the people.
Contractor : answers to shareholders.

Re:Security theatre

[Anonymous Coward]

From Clear's website.

http://www.flyclear.com/about/clear_ceosmessage.html

Second, we think we have a special responsibility to protect your privacy. Yes, we are using biometric identifiers such as fingerprints and iris images. Yes, your enrollment application will be submitted to the government for a basic security threat assessment before we can issue you a Clear card. But we do not believe the process and the questions stop there. We know that this kind of new idea and new process is bound to make many people uneasy about what we are doing with their personal information, especially at a time when every day seems to bring new headlines about identity theft. I started this company because I thought there was a right way to do something like this - a way that confronted privacy issues head on and embraced uncompromising dedication to privacy protection.

Guess it all went wrong, eh?

Re:Security theatre

[geekoid]

"The whole point of outsourcing information and jobs like this to the private sector is to get the job done better and more efficiently."

which never pans out.

Re:Security theatre

[Profane MuthaFucka]

You must be one of those morons who talks up private enterprise, but then conveniently forgets that corporations are not the only kind of business.

Let me spell it out for you, as I would to a child:

Corporation fucks up, you kill the corporation. IBM Corporation becomes IBM the private business. The investors get their money (whatever they can) and cash out, or they are private owners of the company. Tough to be them, they should have demanded responsible business practices. Now they're going to be held accountable as owners.

The company then loses all corporate status. It's a private company. If you're going to break the law, then you cannot get the blessing of the government as a corporation.

Remember, corporations exist only because the government says they exist. Suck on that.

Re:Security theatre

[fishbowl]

>having unencrypted data of 33,000 of your customers on that laptop is a crime.

It is a crime, and the person responsible, and anyone that knew or should have known that person had this data on a laptop, should be treated *precisely*, literally, as an enemy of the state, an enemy combatant during wartime, and the incident should be approached with strong suspicion that the loss was no accident. The people responsible will protest their innocence, as do all traitors, and we should be deaf to that.

This may have been an accident, but it is still the kind of accident that costs your freedom, if not your life.

Re:Security theatre

[Pictish Prince]

Reckless endangerment? Ideally it would be something that could fetch a hanging penalty. String a few of the fuckers up and the rest will quickly get their act together.

Re:Security theatre

[AP31R0N]

No. i'm not painting a false dichotomy, thanks for asking. Just a bit of hyperbole to illustrate the parent's paranoia and detachment.

Security must be proportional to the value of the target and the likelihood that it will be attacked. A 500 pound safe to protect a bag of skittles would be too much. Asking someone to show ID to get on a plane seems reasonable to me. Better identity confirmation systems might keep terrorists from killing a plane full of people.

Nice to see the almost automated partisan knee-jerk moderating system is still working. Don't like what someone is saying? Mod them as a troll! And remember, when Obama's sworn in, we switch from "security is the man keeping us down and scared, and letting the terrorists win" to "security is necessary sometimes, and sometimes security comes at the cost of convenience and privacy".

Bury my posts as trolling as fast as you can. It's not /. it's digg!

Re:Security theatre

[mikael]

More importantly, what was the personal data on 33,000 customers doing on a laptop anyway?. Was this some kind of backup, or was one of their developers working from home? For that amount of data for that may people, the memory would probably take up less than 15 Mbytes of memory, which could easily have been stored in a memory stick plugged into a socket of the laptop.

Re:Security theatre

[Gilmoure]

So, the best way a company could expand would be to send members of it's management into the government?

Re:Security theatre

[geekoid]

". The government, in many cases, outsources because it does not have the expertise to do the job."

no true in most cases.
Often they are forced to do it, even if they have in house talent.

I am a government employee and I am very familiar with encryption. In fact, the government has a far wider knowledge then any single corporation.

outsourcing is about forcing a flaw ideology, even when in almost never works.

Re:Security theatre

[JCSoRocks]

What is it with planes? The only reason planes were so effective in 9/11 is because they TOOK IT OVER and FLEW IT INTO A BUILDING. That sort of thing won't happen again. I have a feeling everyone on the plane would fight it. Continuing to secure them like they're bloody fort knox is ridiculous. If the only reason we're worried about it is the potential for loss of human life... we're wasting our time. Why bomb one plane when you could blow up a whole airport terminal? Anyone remember Oklahoma city? Much more devastating than just a plane blowing up in mid-flight.

Don't get me wrong. I'm all about security where it's needed and where it's appropriate. I'd prefer not to be killed by a terrorist just as much as the next guy... but we've got to maintain some perspective here. You can't stop someone willing to commit suicide from killing people. Look at that guy in Japan that ran over people in a mall with a truck and then started stabbing people. He was armed with a KNIFE.

Throwing away our rights for the illusion of security depresses me.

Re:Security theatre

[Anonymous Coward]

Nice to see the almost automated partisan knee-jerk moderating system is still working.

Bury my posts as trolling as fast as you can. It's not /. it's digg!

I was going to mod you troll, but you genuinely seem to not understand the moderation, so I thought this might be more educational.

Your posts are moderated as "troll" because your argument is poorly reasoned, poorly expressed, and wholly inflammatory. You fail to address the claims of "security theater" (ie, why identity verification increases safety of travel), and instead provide a fallacious and derogatory argument.

Your blaming this on partisanship only demonstrates a total lack of cognizance of your churlish use of logical fallacies to further a point, and moderation as "troll" is well deserved.

This is slashdot, not digg, and I hope that we have the capability to hold discourse to a higher standard.

Re:Security theatre

[Muad'Dave]

Asking someone to show ID to get on a plane seems reasonable to me.

How does knowing a passenger's identity increase your safety aboard an airplane? I'd rather allow anonymous travel and require mandatory pat-downs than believe I'm any safer because some government hack knows the name of the guy that's willing to die so he can kill a few others.

So much for not needing 'papers' to travel inside the US.

Re:Security theatre

[LaskoVortex]

You got modded troll because you are not topical. You might be right about some things needing security, but to call someone paranoid because they don't want some incompetent company being irresponsible with personal information is absolutely trollish and you deserve to be -5. I tell you what, why don't you post all of your private info right here on /.? You have nothing to hide, right? If you do it right under your troll post and say why, I'll lead the charge to help you get modded to +5 insightful above--but something tells me that won't happen, because you DO have something to hide--and if you don't do it, I'll guarantee you that I won't call you paranoid.

Re:Security theatre

[lymond01]

My big concern is the government will redefine terrorism and, using the personal data they've acquired when last I purchased a drink at my local coffee shop, they'll put my in Gitmo and not even let me have a phone call.

DHS: "You've been charged with vocally disapproving of a political party and/or political party's representative and possibly doing so in a threatening manner."

Victim: "I called our president a complete genocidal psychopath for killing 600,000 Iraqis and over 4000 Americans. I just want him out of office. Surely you can understand that?!"

DHS: "Your excuses aren't important right now. You'll be locked up until the War on Terror concludes as you are a threat to our freedom. And don't call me Shirley."

Anyway, regarding data being lost, I think we should let capitalism take hold and when we give over personal information, we sign a contract saying they'll keep it safe or pay us X amount of dollars. Of course, then we'll likely never hear of breaches...

Re:Security theatre

[Waffle Iron]

Brilliant idea! Let's have all the other innocent employees lose their jobs, pension, and benefits and put loads of extra stress on social services like unemployment! We also get to take the economic hit when all the sharehoders lose their investments - Woo hoo! What is your name? I would like to write you on the ballot when I vote for president.

That looks like a really effective way to make sure that all employees, shareholders and board members stay properly focused on keeping the corporation in compliance with relevant laws and security practices. Sounds like a good plan to me.

Re:Security theatre

[johndmartiniii]

I just wonder how many of these incidents we are going to have to see before need for encryption is taken seriously by "security" pros. I agree, if I am going to have to give my passphrase up when going through security, then I should be allowed to keep my pocket knife. Or at least my fingernail clippers and water bottle.

Re:Security theatre

[burymore]

Careful requirements are certainly important, but so also is competence. No requirements document was ever complete. There will always be decisions to be made beyond the document, and they have to be made with proper respect for the fundamental objectives. The BP is correct: "To have a company intimately involved with *security* not apparently able to manage their own security in a manner that protects the country and their customers is a joke." If not something worse.

Re:Security theatre

[bluesk1d]

Honestly, there is no reasonable means for everyone from the board of directors down to the janitors and shareholders (especially those that are only indirectly invested through various funds) to ensure something like this. Joe employee isn't even privy to any shady moves the suits upstairs may be performing until it is too late. Expecting this kind of internal self-regulation checksum to work is pretty ridiculous. Perhaps we should institute full-blown racial profiling as an official national policy and tell all the innocents to just deal with it. If they don't like constant raids and shakedowns, they can root out the small percentage of troublemakers themselves to ensure everyone stays in line. How's that sound?

Re:Security theatre

[Duhavid]

"really does nothing for national security anyway because there is nothing that prevents someone from getting "cleared", then carrying out a crime later"

That was my first thought on seeing that such a program was in place. Heck, if someone wanted to cause problems with a plane, this is the program for them.

Re:Security theatre

[maxume]

Personally, I thought locking, hardened cockpit doors were a pretty good response to 9/11, and I didn't really understand why there were high strung 20-somethings with M16s in the airport the first time I flew after the incident (well, I did understand, they were there to make people feel better, but I didn't see that they would possibly be shooting at anything). Checking IDs probably makes it harder to kill a plane full of people, but I'm pretty sure that there are plenty of people walking around with officially issued identification that is falsified or inaccurate.

Re:Security theatre

[silanea]

[...] Better identity confirmation systems might keep terrorists from killing a plane full of people. [...]

Oh, really? And exactly how would such a system safeguard us from the prime group of people who carry out large-scale acts of terrorism in western countries these days, namely isolated cells of fundamentalists who

1. are self-taught and have not previously raised a flag with law enforcement and thus would not appear in any blacklist or watchlist and were free to enter any plane they wish and
2. don't care about legal consequences because they blow themselves to pieces anyway?

Besides: If you make the planes safe, the bad guys will simply go for the f...ing airport. They won't run out of targets in the foreseeable future, so maybe we should focus our attention on the underlying problem, ie. the fact that people want to bomb us, instead of giving up the very freedom we supposedly want to defend for a false sense of security.

Re:Security theatre

[Archangel Michael]

Then the stockholders should be more careful investing in companies run by the same people who've driven companies into the ground.

Put the ethics back in Stock by making the stock owners require it of the board and officers of the company.

When all people look at is Profits, then that is all that matters. When profits are threatened by corporate death penalty for illegal and ethical problems, then ALL the stakeholders will pay attention to ethics. But not until then.

Re:Security theatre

[EastCoastSurfer]

I'm not defending the Bush administration on anything you said. The thing is that the Clintons were pretty good at helping their friends and evading prosecution also. It seems to me it's not a Bush or Republican or Democrat thing, but a big government/politician thing. Standard practice in government seems to be "if you help me get elected (ie, give money), I'll make sure to help you later with contracts/pardons/information/whatever."

The process sucks and makes me agree more every day with a quote I once heard, "Any man who wants to be President, should immediately be disqualified from being President for that fact."

Re:Security theatre

[ROU Nuisance Value]

Oh I see, so it's still the *government's* fault that this private company completely screwed up really basic requirements for handling sensitive information. Like freaking encrypting it, for chrissakes. No, *government* picked the wrong company, because *government* is so completely stupid and corrupt. QED. Point #1 is a perfectly legitimate contract parameter; if they *didn't* go for the lowest price, all of the Free-Market Faithful like you would go ballistic. Point #2 is ignorant nonsense: Most of the people letting contracts and overseeing them in government agencies, not excepting TSA, are career civl servants who are neither politicians nor political appointees, and have no "campaign" to benefit from contractor contributions. Your point #3 is perfectly correct for corrupt civil servants. Now prove to me that there are more corrupt government officials letting contracts than corrupt corporate officers with the same power.

Re:Security theatre

[Anonymous Coward]

Just a point of clarity; The Democrats are not "in control" of Congress. They have a slight majority in the House. To be in control, you need a 2/3rds majority in the House and Senate so you have enough votes to halt parliamentary procedures, force votes, and over-ride vetoes.

Re:Security theatre

[dgatwood]

None of the Sept. 11th hijackers were in the U.S. illegally. All had legitimate forms of identification, and none used false identification. I doubt any were even suspected of terrorist ties.... We ask people to show ID as they get on airplanes for one reason and one reason only: to make people who can't see through the new sham measures feel safer.

Want to make people actually safer?

• Construct a non-privacy-invading millimeter-wave scanner. Build it in such a way that everything that passes through would get hit with a beam, but not in such a way that that you can see pictures, i.e. much blurrier, more scattered, more regional in nature. Sort out the data through basic math about the composition of the human body. See way more metal than you would expect (regardless of whether it is ferrous), set off red flags. Detect massing of large polymers, set off flags. And so on. Do this with computers, not through people watching a screen. Then, let the computer identify what general vicinity set off red flags with lights on a board with the shape of a human drawn from a couple of angles and ask them to empty the contents of their shirt pockets.
• Add mass spectrometry portals to detect dangerous chemical residues.
• Add shoe millimeter-wave machines that don't require passengers to remove their feet from the shoes. Step in, step out.
• Move all parking and drop-offs to a minimum of 1500 feet from any area where people congregate (terminal buildings, etc. Use conveyor belts to get people into the terminal. Have the mass spectrometer portals and a security person in an atrium at the midpoint of the belts. This should be a fairly quick procedure, so you shouldn't build up a line of any significance. You're just looking for bomb residue to reduce the risk of somebody doing a suicide bombing attack on the terminal.
• Make all personnel subject to the same security screening as passengers---no waving a badge and getting a quick pass through security.
• Figure out why people are doing these quick pass things and fix security so that they are not necessary, then give them the boot. The biggest point of security risk from an individual passenger safety perspective is waiting in line for the security checkpoint.

Re:Security theatre

[aztracker1]

I agree with you in terms of airport over-security... However, "so maybe we should focus our attention on the underlying problem, ie. the fact that people want to bomb us," line is simply an immature viewpoint. The fact is, no matter who you are, someone won't like you. There is absolutely no way to interact with the rest of the world without pissing someone off. Especially those that don't like you because of their own twisted sense of religion.

As to security... I think that keeping non-passengers farther from the gates, locking the cockpit doors, and the metal detectors are enough for the most part... If anything pisses me off, it's having to wait an hour or more in various lines in the name of security. I certainly didn't feel safe walking through LAX a few months after 9/11, and that was because of all the armed police, etc...

Re:Security theatre

[aztracker1]

There's a small issue with your theories... The fact that the Bush administration left more people in higher level positions from the previous administration than any other administration change in recent history. Also, it's not like the Clinton administration didn't have their preferred providers, most of whom are still getting a ton of government contracts. It's not a party thing, it's a greed thing, plain and simple, and the Bush administration isn't really any worse than any other administration has been in that regard.

Maybe you should actually look into a few of the things you are spewing instead of relaying the FUD and rhetoric your party tells you to. The congress-critters are solely responsible for things that have come down in the past decade or so. Republocrats, or is it Demoblicons, aren't to be trusted. It's that simple.

Re:Security theatre

[PachmanP]

Government employee : answers to you, the people.

lolz

If only. It really appears that govies answer to no one. Theoretically at least private compaines can fire the incompetent. It's alot harder for the gov to get rid of dead weight.

Re:Security theatre

[Anonymous Coward]

First, isn't it illegal to keep personally identifiable information like a driver's license or SSN paired with a person's name in unencrypted format??? I spent the last three years masking and encrypting my companies data for just this reason.

Second, according to CLEAR, SSNs were not in the dbase but DL, DOB, etc were, all of which should be covered by the regulations. According to the CLEAR site, an annual privacy audit by the company along with an external audit of privacy issues are suppose to be made. How was this OBVIOUS issue ignored?

Third, the laptop was found in a locker.

Re:Security theatre

[aztracker1]

I'd say, simply charge those responsible for treason... starting with the person said laptop was assigned to. Even if they don't get found guilty, or executed, it would at least be a start. The fact is, a lot of the stupid, corrupt and morally reprehensible acts performed by, and through our government could by all means be considered treasonous acts. Once a few people get executed for said acts, people will be a little more careful.

Re:Security theatre

[biglig2]

Also, in the UK we have known cases where terrorists planted someone in the organization that handles the enormous data sets so that they could make use of them.

Re:Security theatre

[magus_melchior]

The whole point of outsourcing information and jobs like this to the private sector is to get the job done better and more efficiently.

That's the "whole point of privatizing government operations" that was sold to us for well over a decade. The actual point is to:

1. Reduce costs (so the Republicans can collectively pat themselves on the back)
2. Increase private revenue at taxpayer cost
3. Remove government accountability-- at least, until the public outcry forces the Feds to regulate.

Notice that job quality is nowhere in the picture, as evidenced by Halliburton, Blackwater, and now the companies contracted by the TSA. Yet the loudest voices clamoring for smaller government would have us believe on faith that private companies will always outperform the government.

Part and parcel with the propaganda campaign to privatize everything is the tired McCarthyist accusation of calling anyone who opposes it a "socialist" (code for "Commie").

Re:Security theatre

[lgw]

No, this program creates no risk whatsoever, becuase it doesn't allow you to bypass any "security" whatsoever (to whatever limited extent the farce at airports provides security in the first place).

The Clear program gives you a cut in line. That's all it does.

Meanwhile you can still board a plane without ID by claiming you lost it (but if you refuse to show ID on principle, you won't be allowed to board).

Re:Security theatre

[Anonymous Coward]

I don't see why people even bother with the stock market. When will people realize that its a zero sum game where for every buck one guy makes, another loses a buck down the line, and actually put their money in better things?

Re:Security theatre

[demachina]

"The thing is that the Clintons were pretty good at helping their friends and evading prosecution also"

Not that I'm defending the Clintons but there is a big, big difference. The Clintons were under CONSTANT scrutiny from special prosecutors and a hostile Republican house. Ken Starr made a career out of trying to pin something on the the Clinton's and failed. The only thing Starr ever caught him for was lying about having sex with Lewinsky, and sex is something everyone lies about, especially when you are married. As I recall Henry Hyde and Newt Gingrich were both having their own extramarital affairs during the same time the were getting all holier than thou at Clinton for having one.

Special prosecutors were done away with just in time to give Bush and minions a free pass and they had NO supervision for their first six years because the Republican congress was a rubber stamp and they could use 9/11 fear mongering to shut up just about everyone. They were actually breaking laws that matter, torturing people, locking people up without habeas corpus, spying on Americans without a warrant, politically motivated prosecutions, pissing on the Constitution. Clinton wasn't even in the same league as Bush, Cheney and Addington. You would have to go back to Nixon to find a president with equal contempt for the law.

Re:Security theatre

[Anonymous Coward]

With an attitude like that, the terrorists have ALREADY one! /sarcasm

Re:Security theatre

[demachina]

"rhetoric your party tells you to"

One problem, I'm not a Democrat, I'm a registered independent, always have been. You won't get any argument from me that the Democrats steal lollipops from babies too, but I think you will be hard pressed to find any instance where Democrats have been as corrupt as the Bush and Nixon administrations.

Kind of sad the only way you can defend your apparent preference for the Republican party, after its been well established they've been on a spree of corruption and law breaking, is with the rabid attack dog defense.... Watch while I tear the Democrats apart, and dont look at all those crooks over there in my party. Its OK if we are crooks because the Democrats are too, that's just the way the system works.... NICE!!

I was reading on the Washington Post last night that voter registration for Democrats and Independents are surging while Republicans are plunging. They've lost something like a million registered voters in the last couple years. Independent registration is reaching a point that if they banded together they would be a real third party, something this country desperately needs, because you Republicans suck and so do the Democrats, I'm getting sick of listening to both of you, and its even worse the get to hold on to piece of the power because there are only two choices and they both suck.

Re:Security theatre

[RMB2]

I think the theater just went into a second act: the link in the OP now directs to an article entitled
Laptop Discovery May End SFO Security Scare

I wonder what kind of influence you have to have to get a news station to take down an unfavorable story...

Re:Security theatre

[lgw]

The Fly Clear program is not a security program - there's no "security company" here. This program allows you to cut to the frint of the security line for $100/yr It does not allow you to bypass any security checks. People are confused by the fact that the program does a background check - but that's just how they convinced the government to allow them to sell the service - that background check doesn't make you any more trusted.

Re:Security theatre

[dgatwood]

Well, yes and no. You're right that in the short term, focusing on why people hate us won't solve anything. However, in the long term, that's the only solution that will solve anything. There are some definite problems in the way we treat the rest of the world that we as a country should be working to solve, all of which in the long term are a much more effective tool at combatting terrorism than anything we are currently doing.

• We could be less stingy when there are international crises that require aid.
• We could be more open with our immigration policies so there are fewer people who see us as a walled garden of selfishness.
• We could let Israel fend for itself, or at least not prop them up with more and more powerful U.S. weapons technologies to help them in their retaliatory strikes against Palestinian targets. "An eye for an eye, a tooth for a tooth" leaves everyone blind and wearing dentures. Supporting a government that behaves that way is just plain bad foreign policy and makes us look really bad in the world in much the same way that Britain's government is starting to look really bad for supporting our government.
• We could also do things to raise the world education level. Spend a few hundred million to build an Islamic institution of higher learning in the newly rebuilt Iraq. Equip it with all the modern conveniences, hire teachers who truly understand the Qur'an and don't twist its teachings into a tool of hatred, and make it an inexpensive way for people of all countries in the Middle East to get a good education without any brainwashing.

And so on. There are so many things we could and should be doing that really all come down to focusing on why the people want to bomb us. Instead of doing things to improve upon the fundamental problem, like a bad doctor, we're focusing on treating the symptoms. Focusing on finding and stopping terrorists is like giving somebody a Tylenol for a brain tumor. We need to get down to the root cause of the problem and fix it, not mask the symptoms while the patient dies a slow death.

Re:Security theatre

[Anonymous Coward]

The whole point of outsourcing information and jobs like this to the private sector is to get the job done better and more efficiently. When the government then has to police these private companies like the TSA is apparently having to now do, the concept is made moot.

Congratulations, you have just discovered reason #2 why privatization is NOT more efficient than public ownership of high-impact utilities. Reason #1 is that government departments don't have to charge a fee over and above cost.

The reason it is *sometimes* more efficient to privatize is because *if there's functional competition* for the government contract, private industry is highly motivated to keep costs low. The problem is, keeping costs low sometimes gets in the way of competence.

In other words, no, privatization is not an automatic efficiency gain. You really have to carefully balance things to determine when government is better at managing things than industry.

Re:Security theatre

[turbidostato]

"It's a great analysis of the issues, laying out what the heck privacy really is, anyway."

And then, I call Mr Godwin and his law. It's very interesting that kind of analysis and it's my opinion that this is the real path to go. But just for those that are more for "practical matters"...

During the 20's and then in 1933, Germany made various census including religious identification, that would help to better fit government with the sentiments of the population (like adjusting calendar free days).

Germany was by the day a cult, enriching country... but then 1933 came. Hitler (the somewhat elected Government) then found better ways to take advantage from the census, specially the religious part.

Fast forward: 1984, Saraievo. A nice place in a nice developing country. Nice enough to host that year winter Olympic Games... who could expect what would happen just eight years latter, again, with a very important weight on private data?

Morale: once your data is processed and stored, it is stored and processable. Do you have a crystal ball to read the future and know how such data will be used within the next, say, 50 years? (yes, your sons can be forced to pay for your "sins" too).

Re:Security theatre

[Anonymous Coward]

Not that you could tell by their voting record, anyway.

Re:Security theatre

[NormalVisual]

provided that you have a license to own a gun

No such thing in most states.

Re:Security theatre

[toiletsalmon]

"Continuing to secure them like they're bloody fort knox is ridiculous. If the only reason we're worried about it is the potential for loss of human life... we're wasting our time."

Which is why they're not wasting their time at all.

Think about it. The people at the top (politicians, big money executives, etc) are not stupid. Otherwise, they wouldn't have gotten to where they are today. Since we know that they actually DO know what they're doing, the only other alternative is:

They've never been worried about protecting the people. They're ONLY worried about protecting the AIRPLANES.

Knowing that helps you understand alot of what's been going on for the last 7 years.

Re:Security theatre

[ignavus]

You are way too pessimistic.

I reckon if you put everyone on the right combination of sedative drugs - Mogadon or something - you really could get a totally secure society.

I say the government should keep trying. If they keep taking away our liberties, they will eventually score the right combination of serfdom and slavery and mental incapacity that will *ensure* our security.

Just give them some more time and quit complaining.

Re:Security theatre

[zQuo]

I totally agree! The parent put it very well.

9/11 is very unlikely to ever happen on a passenger plane again. The main reason planes were vulnerable on 9/11 was that there was a former air policy to "cooperate with any airplane hijackers" at all costs.

Why isn't the parent's perpective more prevalent in mainstream media?

Re:Security theatre

[Acapulco]

Continuing to secure them like they're bloody fort knox is ridiculous.

Exactly. Specially when "protecting them like fort knox" means protection of the kind the Springfield Nuclear Power Plant uses, in that episode where Mr. Burns goes through a series of high-tech doors, face-scanned, palm-scanned and introducing a password in a keypad, finally to reach the control board....that has a, literally, unprotected backdoor.

When I read stories like this this episode comes to my mind everytime. They scan your socks, even strip-searches in extreme cases, and then they leave the data unencrypted....hilarious...sorta...

Re:Security theatre

[Dravik]

The US provides more aid during disasters than everyone else combined. Nobody else has the logistical capability to get there. Those UN people, fly in on US transport; the water they hand out, purified by US ships; The help from other nations that gets there eventually, between a quarter and a third of that bill is also paid by the US. The US also accepts more legal immigrants than anybody else in the world. World education, again the US provides more than anybody else.

Re:Security theatre

[Dravik]

From what I've seen, many time the governments specifications are much too detailed. Instead of describing what they want done, many times the government specifies how they want it done. This leaves companies in a quandary, do you send a proposal that describes the best, and many times the cheapest, way to accomplish a task or does your proposal fulfill the specifications despite their bad implementation?

Re:Security theatre

[griffjon]

Please stop; you're being reasonable.

Re:Security theatre

[dgatwood]

As a total dollar amount, sure, the U.S. seems to give a lot. I used to think that was pretty good until I saw the cold, hard math. Total dollars is just not a very interesting metric when you consider how wealthy the U.S. is as a nation. Per capita, the U.S. provides much less disaster relief money than any of the other major world powers, and as a percentage of our GNP, it's even more laughable.

Remember the parable of the widow who gave her two coins in the synagogue. People perceive that we a nation give of our excess while so many others give in spite of their need. It's like a billionaire giving $500 at a charity auction. Even if it is more than all the other people combined, if that was his only donation to any charity, people will still call him stingy. The poor woman who gives the two pennies that would have helped help feed her family... she is the one we should aspire to imitate as a nation.

Re:Security theatre

[Anonymous Coward]

We ask people to show ID as they get on airplanes for one reason and one reason only: to make people who can't see through the new sham measures feel safer.

There is another reason: so that the .gov can see who's moving where...

Re:Security theatre

[olliM]

Construct a non-privacy-invading millimeter-wave scanner. Build it in such a way that everything that passes through would get hit with a beam, but not in such a way that that you can see pictures, i.e. much blurrier, more scattered, more regional in nature. Sort out the data through basic math about the composition of the human body. See way more metal than you would expect (regardless of whether it is ferrous), set off red flags. Detect massing of large polymers, set off flags. And so on. Do this with computers, not through people watching a screen. Then, let the computer identify what general vicinity set off red flags with lights on a board with the shape of a human drawn from a couple of angles and ask them to empty the contents of their shirt pockets.

What does the millimeter-wave-scanner have to do with privacy? "Oh-no someone will see me naked"? How is someone seeing the shape of your body any worse than them padding you to feel if there are weapons.

If humans are better at detecting stuff than computers, use humans. Or better yet, combination of both.

There are many severe privacy issues related to flying, but this isn't one of them.

Re:Security theatre

[Crotch Jenkins]

Showing an ID to a mongoloid in a suit at the airport does nothing to decrease the odds of an airplane being blown up, no matter whether the ID says "Billy Crystal" or "Abdul al Mohammad, al Qaeda Ninja Master". You know what would decrease those odds dramatically? Actually screening everything that gets on the plane. Adding armed guards and/or properly securing the cockpits would also be beneficial. A little laminated plastic card accomplishes zero, and you're an idiot for thinking otherwise.

Re:Security theatre

[jobin]

This is a brilliant paper that sums it all up.

You're just saying that because it references Bruce Schneier!

Re:Security theatre

[stewbacca]

I agree with your sentiment. The problem is that the people who participate in this program do so voluntarily (and pay $100 a year for the , errr, benefit). If everyone was forced to have this pass then your post would be spot on.

Re:Security theatre

[stewbacca]

This is slashdot, not digg, and I hope that we have the capability to hold discourse to a higher standard.

I know this will be modded troll, but I must respond. Slashdot has very overt tendencies and biases (FOSS, libertarianism, privacy advocates, etc.) that doesn't align very well with the general population. To sit here on your slashdot soapbox and declare slashdot users as somehow being better because of some mythical "higher standard" is disingenuous to say the least. The "higher standard" you mention simply means that you must agree that FISA, DRM, and George Bush are BAD, and Linux, OpenOffice and Ron Paul are GOOD, no discourse allowed, for fear of being modded troll.

Re:Security theatre

[Dravik]

Your right if you don't count military aid, which excludes those ships who made clean water in the Philippines, and only count government foreign aid. When private donations are counted the US is more generous than anyone else in the first world.

Re:Security theatre

[stewbacca]

And exactly how would such a system safeguard us from the prime group of people ... have not previously raised a flag with law enforcement and thus would not appear in any blacklist or watchlist and were free to enter any plane they wish and

Only because people like you keep fighting against things like FISA does this even become an issue. You know, with FISA, we would be allowed to collect on suspects and identify them even with no previous criminal activity--which is kind of the whole point of the terrorist watch lists.

Re:Security theatre

[david.peace]

Sooooo, if you have nothing to hide, then I want your complete, COMPLETE medical history: super extensive/intrusive blood/fluid/serum tests, total genome sequencing, family history going back to the mid 1800s (including that crazy, institutionalized uncle and your cousin with AIDS...), whether you've ever been treated for STDs, whether you are at risk for Alzheimer's or cancer or Lou Gherig's... Just everything, okay?

Re:Security theatre

[pzs]

I like the link on the right: people who read also read:

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=896790&rec=1&srcabs=998565

Re:Security theatre

[dgatwood]

Since that directly contradicts every article I've ever read on the subject, I'm going to have to say [citation needed].

Re:Security theatre

[mrogers]

Why bomb one plane when you could blow up a whole airport terminal?

Because bombing a plane is more terrifying - many people are scared of flying, few are scared of airports.

Anyone remember Oklahoma city? Much more devastating than just a plane blowing up in mid-flight.

And much less terrifying. I don't know anyone who gets nervous walking into public buildings.

Look at that guy in Japan that ran over people in a mall with a truck and then started stabbing people. He was armed with a KNIFE.

Yup, he killed more people than any of the London tube bombers. No backpack full of explosives, no elaborate plan, just a truck and a knife. But I bet people in Japan didn't spend the next year breaking out in cold sweats whenever they went to the mall.

Re:Security theatre

[greedyturtle]

From the paper, one of the best lines evar:

"Understanding this relationship between law and taboo ultimately yields fuck jurisprudence."

Re:Security theatre

[lsatenstein]

With little information such as date of birth, ssn, etc, Someone can do some internet probing, particularly with credit agencies, etc. and before you know it, they have stolen your identity and milked your bank account dry. They could even sell your house out from underyou.

Re:Security theatre

[Dravik]

The following link covers all my assertions except the one dealing with military aid. I consider the exclusion of military provided assistance to be common knowledge. Sources with links for all numbers in that article are at the bottom of the article. http://www.heritage.org/research/tradeandforeignaid/wm630.cfm

Re:Security theatre

[sjames]

Truly. Considering that the prime threat they're supposedly guarding against is necessarily a suicide attack, it's not as if the bomber will care about the criminal repercussions after the attack. Necessarily, nobody who is a threat will have a history of suicide attacks.

Re:Security theatre

[sjames]

If they want to be sure a terrorist won't take over the plane, they should be passing out weapons as you board rather than screening for them. That way, the terrorists (if any) will be vastly outnumbered by well armed people who just wanted a quiet flight and are now ticked off.

I'm only half joking.

Re:Security theatre

[sjames]

With a pat-down, you can see who's doing the patting and if they're uncontrollably drooling at the time.

The devices may not reveal a lot of detail, but if the people watching the scanner were of a higher mentality than early adolescents getting a thrill watching the scrambled playboy channel, they'd have better paying jobs.

Re:Security theatre

[silanea]

[...] "so maybe we should focus our attention on the underlying problem, ie. the fact that people want to bomb us," line is simply an immature viewpoint. [...]

Oh, is it? Cutting down on the number of people you piss off by your own actions out of ignorance, selfishness or outright carelessness certainly would not be a bad idea, would it? Especially in light of my last point, re unlimited targets.

You secure the planes, they bomb the airports.
You secure the airports, they bomb the train stations.
You secure the train stations, they bomb the cinemas.
You secure the cinemas, they bomb the supermarkets.
You secure the supermarkets, they bomb the schools.
You secure the schools, they bomb the playgrounds.
You secure the playgrounds, they bomb the churches.
You secure the churches, they bomb the post offices.
You secure the post offices...

You can take it only so far before your whole country is simply choked to death. So at least to me it seems smarter to keep people from wanting to harm you than to erect countless barriers that are sure to keep you in, but ultimately fail to keep your enemies out.

Re:Security theatre

[aztracker1]

How about this, we capture, and confine the people building and deploying the bombs to civilian locations... I'm not saying that political solutions are a bad idea... I am only saying that in many cases, they simply won't work in and of themselves.

Re:Security theatre

[silanea]

I'd love to see that happen, but that's what actually started this discussion: How do you catch a first-time terrorist with 100% certainty without creating an Orwellian society? How do you balance the need for survival of the few (ie. those unfortunate to die in an attack) with the need for freedom and privacy of the many (ie. the rest of society)? Where do you draw the line? Which powers can you surrender to the state before the state becomes a bigger threat to your life and livelyhood than the terrorists from whom the state wants to protect you? (Practical example: No-fly lists. Judging from the reports about false positives and the absence of a comparable amount of reported valid hits the lists seem to me as an utter failure. But quite some people critical of the US government have ended up on it. Coincidence? I hardly think so. Power corrupts after all.)

The anti-terrorism measures currently enacted in western countries do little to deter terrorists (most failed attacks post-Madrid were foiled not by law enforcement using their new powers but by inexperience and even outright stupidity on the culprits' part) but seriously undermine democratic principles and violate fundamental rights. The balance has been lost.

So instead of making our governments stronger I'd go for making our enemies weaker. Just makes more sense to me.

Re:Security theatre

[aztracker1]

Sorry, but I'm a libertarian at heart.. not a republican.

What?

[snl2587]

The company has now decided that it might be a good idea to encrypt the data in their systems.

Then they've clearly hired the wrong people for the job. But since when is news like this anything new?

Re:What?

[omeomi]

Then they've clearly hired the wrong people for the job. But since when is news like this anything new?

But they were the ones who bought enough congressmen and senators to get the job...surely you're not suggesting there's a better way to choose government contractors?

Re:What?

[RetroGeek]

The company has now decided that it might be a good idea to encrypt the data in their systems.

Then they've clearly hired the wrong people for the job. But since when is news like this anything new?

And it goes on and on.

This sounds like a class action suit waiting to happen. Maybe 20 years ago it was, um, ok, not to encrypt data as it was stored on a mainframe behind several layers of physical barriers. But today with highly portable computing, companies MUST realize that anything that is stored CAN be compromised. There have been enough stories about stolen data that this is not new any more.

If a company had to pay out billions in a suit, then other companies may take notice.

I say may, because C-level people tend to be really stupid about where to spend money. Other than themselves of course...

Let me just say.

[Anonymous Coward]

HAH!

Does nobody use disk encryption?

[jandrese]

If you have customer (or business!) data on a laptop, there is really no reason at all to not have full disk encryption on it. Laptops are stolen all of the time and this is the sort of publicity your company does not need.

Re:Does nobody use disk encryption?

[AJWM]

WTF was data like this doing on something nice and portable like a laptop anyway? I bet it was in an Excel spreadsheet (the database of choice for PHBs everywhere) too.

(And yes, it should have been encrypted.)

Re:Does nobody use disk encryption?

[xgr3gx]

I know really. It's always laptops with critical data.
A laptop should be nothing more than a client to the critical data. (Obviously with proper login and security to connect to whatever hosts the critical data)
Bah! So dumb!

Re:Does nobody use disk encryption?

[jandrese]

In my experiance, that works great until you have to go somewhere with crappy connectivity. Sometimes real life will make a mockery of your best laid plans.

Re:Does nobody use disk encryption?

[rbanffy]

"It's always laptops with critical data."

It's mainly because nobody can easily steal a heavy server. And, unless the server is physically missing, they probably won't realize the data was copied in the first place and, so, won't notify anyone.

Re:Does nobody use disk encryption?

[amn108]

Elaborate please?

Re:Does nobody use disk encryption?

[ddusza]

It's getting to the point where anytime some company asks me to sign up for any service that requires such sensitive data, I am going to require either a tour of their data center (on their dime) or some documentation as to what security procedures and standards they implement. My first reaction also was "why was it on a laptop and not a server somewhere", but AJ beat me to it.

Re:Does nobody use disk encryption?

[steelfood]

Passwords can't be saved if your access is controlled by something like a RSA secureID. Include a user-generated portion (like a password or PIN), and hide it within the secureID number, and it becomes even more secure.

Re:Does nobody use disk encryption?

[JCSoRocks]

*peels sticky notes off of monitor and throws them in trash*... *whew*. I should be safe now!

Re:Does nobody use disk encryption?

[PachmanP]

*roots through JCSoRocks' trash can*
*finds 15 pay pr0n site passwords and usernames*
**
*profit?*

Re:Does nobody use disk encryption?

[Anonymous Coward]

Ah, an excel spreadsheet password! So /that/'s where the second password in the "two levels of passwords" comes in! Now I feel safe . . .

How many times does this need to happen

[Gat0r30y]

Before they require hardware based encryption for drives containing this sort of data? It seems completely ridiculous to me that they would keep sensitive data like this on an unencrypted drive.
One word of this: Incompetent.

Re:How many times does this need to happen

[nasor]

The ridiculous thing, in my option, isn't that people aren't careful with "personal information" - it's that banks, credit card companies, etc. all like to pretend that knowing a social security number magically proves that you are who you claim to be. I shouldn't have to keep my information secret just because it makes things convenient for some company that wants to give credit cards/loans/whatever worth thousands of dollars to people that they have never met, via the mail. That's an idiotic business plan, and it shouldn't be my problem that people try to scam them.

Re:How many times does this need to happen

[Jasin Natael]

I KNOW! I won't even store my own SSN / Passwords, etc. on my personal computer on my desk at home, much less on a laptop or cellphone. And yet these people are in possession of what amounts to an "identity brief" for tens of thousands of their paying customers, and leave it all conveniently accessible in a single unencrypted file on an unencrypted drive in an unsecured laptop?

Here's hoping it's just a disgruntled employee trying to call attention to the insecurity, rather than actual criminals who will use this to persecute the victims.

Re:How many times does this need to happen

[zappepcs]

Well, not only that, but shouldn't that laptop have a tracing program on it? One of those services that helps you find the stolen laptop?

A new security industry created by the government's drive to snoop in all our lives has proven exactly why no one is to be trusted with your ID info. period. Makes you wonder who the real terrorists are? Bin Laden must be laughing his last lung out.

The weakest link in your security is always a human and since humans work for the NSA, DHS et al, there is NO reason to trust them with anyone's data never mind your own.

Before 9/11 this would not have happened because this business would not have existed. There is no justification for it's existence that makes any logical sense at all.

Re:How many times does this need to happen

[zappepcs]

Not only that, but WTF is it with laptops with totally confidential material doing disappearing from LOCKED offices at a business that is arguably supposed to be one of the safest places in the USA? All of our security efforts aimed at making air travel secure and people can walk in and steal valuable computer assets from locked spaces? Yeah right!

I'm starting to have doubts about this story, big time.

Re:How many times does this need to happen

[QuantumRiff]

Exactly. Why is my Social Security number needed to purchase a cell phone and contract? Does my insurance company need it? Why do credit checks have to be run for everything nowadays? I would honestly prefer giving something like my fingerprint at the store, as long as the employee also had to give theirs, as a way of certifing "yes, they pressed their thumb, I watched them, and they were not coerced".

I think that the best thing that can happen is that more ID's are stolen, as in millions, as in IRS or some states database. If they can no longer be trusted, they will no longer be used..

Re:How many times does this need to happen

[Blakey Rat]

Before they require hardware based encryption for drives containing this sort of data? It seems completely ridiculous to me that they would keep sensitive data like this on an unencrypted drive.

What makes you think it's not required now? Out of curiosity.

Their not having done it has nothing to do with whether or not it's required, it just means:

One word of this: Incompetent.

Re:How many times does this need to happen

[nasor]

Actually, I don't really have a problem with cell phone companies, insurance agencies, etc. using a social security number to keep track of customers. It's a unique identifier that's useful for distinguishing people who have the same name (and maybe even the same address), so keeping track of customers with it seems appropriate. The problem is that they like to pretend that knowing person X's social security number magically proves that you are in fact person X, which is absurd.

Re:How many times does this need to happen

[lubricated]

many cell phone companies will allow you to skip the credit check and just put down a deposit.

Re:How many times does this need to happen

[rastos1]

> Why is my Social Security number needed to purchase a cell phone and contract?

Because when the police comes to them and says: Tell us who called school XY with phone number ABC today at 12:34:56 with bomb threat, they want to answer that with unique identifier of person that owns the cell phone.

At least that is my understanding of reasoning. Yes, it is BS.

locked doors...

[halfEvilTech]

"The company has now decided that it might be a good idea to encrypt the data in their systems"

because apparently before locked doors was good enough

Directed to the Systems Administrator of VIP, inc.

[gcnaddict]

You've got social security numbers of thousands of people on company laptops and you didn't make it a policy to encrypt everything?

Seriously?

$128, not $100

[langelgjm]

From the "Clear" link: "Clear's first year price is $128."

I'd say that's a bargain to have your identity stolen!

Re:$128, not $100

[krbvroc1]

The extra $28 was added to include a year of credit monitoring I think.

Re:$128, not $100

[seanonymous]

They charge a one-time fee of $28 to encode your data with an encryption algorithm known as 'plain text.'

Re:$128, not $100

[Anonymous Coward]

The $28 fee is a one time (at least one time as long as your sub is maintained) fee for TSA to do a background check on you. The annual fee is $100. You only pay 128 the first year.

If you really went to the Clear website...you wouldve read that. But then you probably didnt read the TFA either so its all balances out in /. terms.

Re:$128, not $100

[oyenstikker]

It is also a bargain for terrorists to bypass security.

Re:$128, not $100

[Anonymous Coward]

Actually, the $28 was originally passed on to the TSA office that ran background checks... after review, it was determined that the TSA checks did not in fact require that $28. So the fee requirement from TSA was eliminated.

So now the price is $100. Which is all for them.

That will teach people not to give out information

[Anonymous Coward]

Who am I kidding. No, it won't.

This doesn't surprise me very much...

[gparent]

... especially since at my workplace, they are starting to think about encryption laptop hard drives, that contain personal information about government related investigations related to people working without permits and that kind of deal.

The thing is, though, they're only encrypting the new tablet PCs we just bought, not the older Thinkpads we used - And the database is imported from the web, which means the unencrypted laptops contain the same data the encrypted ones do...

I have a feeling we'll see even more of these in the near future.

Jailtime

[Dog-Cow]

The CIO of this company and everyone involved in the IT policy with regard to security should be in jail forever. There is absolutely no excuse for this at all. SS and Passport information? This can cause headaches that never end for the poor victims.

Just further proof that this Administration only cares to ruin lives.

Re:Jailtime

[Anonymous Coward]

The CIO of this company and everyone involved in the IT policy with regard to security should be in jail forever.

Back up there. For all you know, there were people within the company who were calling for proper security controls but were ignored. That's certainly what happened at my last job: our IT team continually raised the subject of full-disc encryption on laptops and we were continually ignored, right up until a laptop with a demo version of our software was stolen from a trade show. Apparently that was high-profile enough that the board of directors finally woke up and ordered full-disc encryption for every laptop, although of course by then it was too late.

Re:Jailtime

[Tsunayoshi]

Um, get past the identity theft victims...now the thief has the ability to fake credentials for 33K people who get to go through much reduced security at airports.

To pull the terrorism card: how much would a terrorist organization pay to have the ability to bypass almost all security checkpoints at the airports that participate in the program?

The smart thing to do (from an airport security standpoint) would be to remove all 33K people from the program and make them go through normal security again like everyone else.

Re:Jailtime

[Anonymous Coward]

GE actually started pushing out full-disc encryption to their laptops over a year ago. However, I believe it was up to the individual business to decide exactly when it is pushed out.

Re:Jailtime

[Dog-Cow]

Perhaps I should have been more clear. I meant anyone involved with making the decision to ignore security. And the CIO, even if he had nothing to do with it. He should have.

Re:Jailtime

[Roberticus]

...Just further proof that this Administration only cares to ruin lives.

I wouldn't go that far. But I would say it adds to the considerable body of evidence that this administration only cares about giving lucrative, exclusive contracts to private companies to have them do what should probably be the government's job in the first place.

Re:Jailtime

[ptbarnett]

Um, get past the identity theft victims...now the thief has the ability to fake credentials for 33K people who get to go through much reduced security at airports.

No, the security is the same -- at least for now. You just get through it faster.

The mandate is to reduce the level of scrutiny eventually, but Clear verifies the identity through biometric means (iris and/or fingerprints).

It has to be said

[areReady]

All aboard the FailPlane!

With Pic!

Step 1: Encryption

[Spy der Mann]

A laptop containing the unencrypted -

NEXT!!!

Re:Step 1: Encryption

[Anonymous Coward]

Quick - Check the TSA "confiscated laptops of the day" or Ebay... Maybe we'll be fortunate and the guy who grabbed it tried going through the regular TSA lines...

On another note, for us poor fools that travel for a living, and got sucked in by the 'try Fly Clear free for a year!', what's our best options?

Call up the 3 credit agencies and say, "fraud alert"?

Not sure what else i can do... or sign up for the service where the guy tells you his social security number on the TV. (Although I believe someone did transfer money from him to a charity...)

I'll just post as an anonymous coward... since I'm feeling rather vulnerable today ;-).

Re:Step 1: Encryption

[cshake]

Even if the data was encrypted, do you really think that the key wouldn't also be on the hard drive?

If encrypted data is shared by multiple in a company such as this, everyone that has access also will need to have the key. Making every employee memorize an encryption key is not feasible right now (at least when there are non-technical people that need the access), so chances are really good that the laptop user would have the password saved somewhere.
If the key was contained on a usb fob, chances are good that the user would keep it in the same laptop bag if not still connected - most people aren't security minded.

Realistically, the only sort of protection that the data could have even if it was encrypted is the strength of the user's windows password, which isn't that hard to break if you already have physical access.

Re:Step 1: Encryption

[Spy der Mann]

Even if the data was encrypted, do you really think that the key wouldn't also be on the hard drive?

You could use a password *AND* an USB-stored keyfile to protect a truecrypt partition. Miss one, and you can't access it.

How does this system improve security, anyway?

[Reality Master 201]

Assuming this system allows them to reliably identify a person, so what? Do they do extensive background checks and continuous monitoring to ensure that the people aren't involved in terrorism? Or if I have no obvious problems in my background and enough money to pay for it, can I get treated differently too?

Does it basically come down to people paying to not have to stand in line with the rest of humanity at the airport?

Re:How does this system improve security, anyway?

[oldspewey]

Does it basically come down to people paying to not have to stand in line with the rest of humanity at the airport?

Ding ding ding!

Re:How does this system improve security, anyway?

[Kadin2048]

Does it basically come down to people paying to not have to stand in line with the rest of humanity at the airport?

Yes.

It's precisely the same idea as the "jump the line" passes available at Disney and most other big theme parks. Waiting in line is for plebeians.

Re:How does this system improve security, anyway?

[jchawk]

You must be new here. But welcome. You absolutely get treated better when you have more money. You can't be surprised by this?

Re:How does this system improve security, anyway?

[metlin]

Does it basically come down to people paying to not have to stand in line with the rest of humanity at the airport?

Pretty much.

And that's a big bonus for business travelers. I fly at least twice a week, and on some weeks, it could be way more than that. So, I spend a lot of time standing in lines at the airport and spending time with idiot passengers who do not know how to pack. Before I get in line, I have my wallet, phone and everything else in my bag, I usually carry no liquids (buy 'em where I go or leave 'em at the client site), I wear a belt and a watch that can go through the metal detector with no problem and all I need to take off are my shoes and my laptop.

Some airports have various lanes for experienced and regular flyers, families, etc. But unfortunately, it is not based on your frequent flyer status, but rather you as a passenger are allowed to choose on your own. This is a big problem because Joe Idiot who flies twice a year thinks he is as "experienced" as your business traveler who flies several times a week and can breeze through. Of course, some airports have status-based lines, which are awesome (Gold, Platinum etc).

So, something like Clear is extremely useful - in fact, a lot of companies will let you charge that in as an expense (the way you can expense your membership to various airline clubs). If you are a frequent flier, the usefulness of not having to stand in line and breeze through is tremendous.

It also means half hour more that I can spend sleeping in on those early mornings that I have to fly out. Especially when you have a 6 AM flight (which I do, on every Monday) and have to get up at 4 AM. Or if I am just spending 2 days with a client, I want to make full use of my time there, and not waste it standing in line with idiots. That goes a long way for some of us.

Re:How does this system improve security, anyway?

[nasor]

That was my first thought as well. How do they know that a terrorist wouldn't just add himself to the list? Or, if that's not possible, simply impersonate someone who is on the list? Since apparently the list of all 33k people is now floating around, they would have plenty of choices of people to impersonate.

Re:How does this system improve security, anyway?

[Dog-Cow]

You don't even have to be experienced; you just need a modicum of sense. Of course, how many people have that?

Re:How does this system improve security, anyway?

[amn108]

Why, you must be new to moral and some logical thought?

You fucking absolutely NOT get treated better with money. In fact, you get treated RELATIVELY better when you have more money, because depending on situation it may be favourable or disastrous. That makes all the difference. You cannot fucking buy a "terrorist pass" onto a plane, because that monumentally idiotic. If that was allowed, seeing as terrorists possess formidable funds, they should be welcomed aboard the plane with explosives and offered whiskey, cigars and three-course meal? I doubt this is the policy in the U.S. of A.

It's not just a line, its a Security line. Which means every person may have the intention of blowing another 200 passengers up and the means to accomplish it. You can't jump THAT line. Then you can as well put up a big poster saying "Terrorist? Pay up in cash, and skip the security line!"

Re:How does this system improve security, anyway?

[bugs2squash]

Blame Clear for losing the data and making all of us less safe, but blame TSA for creating the environment for Clear to flourish so that they can fuck the rest of us over. Clear offloads the TSA from having to "perform" as they can always point out that there's a "short line for anyone that wants it".

The fact that a scheme like Clear's is so useful is a red flag that the rest of the system is incompetent.

Your example of a 6AM flight is a good one. I often take a 6AM flight from my regional airport and the line for security is huge. Yet everyone in the line booked a ticket in advance and there was no reason the TSA could not have know that there would be a huge backlog.

Re:How does this system improve security, anyway?

[smellsofbikes]

You've hit upon the actual problem with this whole scheme: if you build a two-tier security system (whether you call it Clear or racial profiling or whatever) you annoy the people in the lower tier because they're being 'profiled' for extra checking -- they're false positives and they resent it and tell you that you're a racist or something.
But the reason it's a Very Bad Idea isn't because of them, it's because of the false negatives, the people who figure out how to get into the less-checked, higher tier. If you're a nogoodnik and you have nogoodnik associates, you just keep trying, using different associates, until you get some people into the higher-tier group, and once they've managed to get through the system once or twice, you now have enhanced access. It's like the social equivalent of a software backdoor, and it's why two-tier systems are not only irritating but can make a system less secure.

Re:How does this system improve security, anyway?

[Anonymous Coward]

You cannot fucking buy a "terrorist pass" onto a plane, because that monumentally idiotic. If that was allowed, seeing as terrorists possess formidable funds, they should be welcomed aboard the plane with explosives and offered whiskey, cigars and three-course meal? I doubt this is the policy in the U.S. of A.

You must be new here! But welcome. And congratulations on figuring out the real policy in the good ol' U.S. of A. (even though you prefaced it with "I doubt". Doubt no more!

Re:How does this system improve security, anyway?

[nasor]

I don't really understand the obsession with having lists of people who can fly/can't fly/require extra screening/whatever. You know how they check your identity at the airport? The look at your driver's license. Are we really supposed to assume that these terrorists are willing and able to learn to fly a passenger airliner, but aren't able to conjure up a fake ID good enough to fool the community college dropout TSA "guard" who glances at it, checks to make sure it's the same name as the name on your ticket, and then passes you through? I don't really know how hard it is to buy or make a good fake ID, but I'm guessing it's about a billion times easier than, say, learning to fly a plane. For keeping under-aged kids out of bars, okay, looking at the driver's license seems reasonable. But stopping determined terrorists? Give me a break. Oh, wait, it DOESN'T even stop kids from getting into bars. But, yeah, surely it will still stop those terrorists...

Re:How does this system improve security, anyway?

[45mm]

When it was originally announced, the Registered Traveler program was going to allow those in the program to bypass security altogether, and it was sanctioned by the TSA. Since the idea never really took off, and only a handful of airports actually have the kiosks, the TSA is rumored to be dropping support ... so yes, it really comes down to paying over $100 to not stand in line.

Re:How does this system improve security, anyway?

[amn108]

Ha-ha, very funny.

Re:How does this system improve security, anyway?

[hwsb]

careful, your dinging may seem suspicious and get you flagged for 'additional screening'

Re:How does this system improve security, anyway?

[smellsofbikes]

I'd say getting my driver's license was about 300 times easier than getting my pilot certificate, yeah.

But the thing is: the driver's license requirement at the airport has *nothing* to do with security. All it does is prevent you reselling your ticket to someone else -- because, as you say, it's comparatively easy to get fake ID, and all the people we've so far managed to track down after they'd committed their special Big Crime, had in fact gotten fake ID's.
That's precisely why companies like this Clear group can charge extra money to try and actually verify your identity and trustworthiness, because they're going above and beyond the cheap state-issued picture ID and doing some nominal background checking. That's the very basis of their whole business model: that they vouch for the people they put on the trusted list. (But as I said earlier, all that means is that any potential nogoodnik would just figure out how to game *them*: all it does is move the point of failure to another location, while extracting money from people, and as a business model, that's usually pretty successful, until it breaks, by which time the people who came up with it are rich and gone.)

Re:How does this system improve security, anyway?

[aztracker1]

You cannot fucking buy a "terrorist pass" onto a plane

You can if you own the plane...

Re:How does this system improve security, anyway?

[discogravy]

Douglas Adams' joke is our reality. Now all we need is a president with two heads...

Re:How does this system improve security, anyway?

[torrentami]

This is painfully depressing for me. I am a member of Fly Clear. There's no question that this whole system is just a way for people to pay $100 to skip the security line. As I describe it to people, it's "First Class" for the security line. The background checks and vetting and biometrics are all just a smokescreen for being able to pay to skip the line. It in no way offers any additional security and we all just end up going through the same x-ray metal detectors and x-ray machines. On the other hand, as someone who gets on a plane every week, it's completely worth it. Until now... Earlier in the year, my personal info was stolen from an unencrypted, unsecure laptop from our HR outsourcing company, Administaff. I got a nice letter from them apologizing for it. Now I'm two for two.

Re:How does this system improve security, anyway?

[againjj]

The literature I saw at SFO said that there will be "a background check", but gave no additional information. The Clear website gives even less. I believe they do a cursory check through public records and if you pass, they give you the card.

Re:How does this system improve security, anyway?

[Kadin2048]

You don't even need to own the plane; a chartered business jet would make one hell of a mess, particularly if it were loaded full of explosives.

But you don't see the TSA goons rectal-probing people who fly GenAv, because that's how people with money, and therefore power, travel. They stick to what's safe: harassing people whose "pull" within the system is limited to whining to their member of Congress and voting, neither of which have nearly the same effect as a large quantity of cash.

hundred bucks

[seanonymous]

So it's the same price as mobileMe, and it provides users with the same level of frustration. Who says government contractors can't compete?

Lack of proper management

[ds_job]

Please tell me that there is going to either be prison time or a huge *personal* fine for the CEO of the tinpot company who thought that a lock and key was enough security. I'n not talking about firing the person who left it there or proped the door open to do the vacuuming, but the person at the top who says "Yes, this is cost effective and proper." We need to have people at board level think twice about storing our data so shockingly badly.

Re:Lack of proper management

[oyenstikker]

CORPORATION, n. An ingenious device for obtaining individual profit without individual responsibility.
- The Devil's Dictionary

Re:Lack of proper management

[krbvroc1]

I want to know why the TSA awarded a contract that did not require encryption? If TSA did and the subcontractor violated those terms, go after them. I imagine they will be back operating in a short time after the subcontractor promises to be do better.

Re:Lack of proper management

[Anonymous Coward]

Ahahahahahahahahahahaha..... yeah, that made my day.

Re:Lack of proper management

[Anonymous Coward]

Please tell me that there is going to either be prison time or a huge *personal* fine for the CEO of the tinpot company...

(shuffling of papers with Chapter 7/11/13 all over them, along with the one-way e-ticket to the Cayman Islands...) Company? Errr...What company?

Think he'll use his Clear card en-route to his perma-vacation spot?

Skeptical

[PPH]

I'm becoming quite skeptical about this whole 'stolen laptop' B.S. After the first few big news stories, I'd expect most corporations to have strict guidelines in place to prevent this sort of thing. And a policy of coming down hard, very hard, on violators.

I wonder how much one can get per personnal record for selling this sort of data to organized crime. And cover your ass by reporting a stolen laptop.

Re:Skeptical

[oldspewey]

Strict guidelines are all well and fine, but when you have hundreds or thousands of employees running around with corporate laptops there is simply no way to guarantee that everyone will comply.

When people are running around at the airport, hopping in and out of cabs, running from meeting to meeting, and generally trying to keep ahead of their workload, they get sloppy.

Re:Skeptical

[lathama]

Sad to say but I think that you are on to something. I get several emails offering to buy and sell contact lists on email all the time. I wonder exactly what the product line looks like for these groups that buy and sell lists? "For an extra $500 you get matching SSN"!!! "Need us to sort the data, we will stop by and pick up your laptop with cash payment and completed police report."

Re:Skeptical

[Anonymous Coward]

They can do a bit better by having the person to pay for the lost laptop. All of a sudden, everyone would be extra careful as it would come out of their pay cheques.

Re:Skeptical

[Anonymous Coward]

Why did they need information fo 33000 people on the laptop?

That just makes absolutely no sense.

Re:Skeptical

[Volante3192]

It's because everyone else is of the "Well, it won't happen to me, it only happens to the other guys" mentality.

What those execs fail to realize is they ARE the 'other guys' to everyone else.

If I proposed something like this to the companies I help support, I guarentee the first question I'd get would be "How much would it cost to impliment?"

Re:Skeptical

[oldspewey]

Not too sure that idea is going to fly with 99% of IT workers out there.

Boss: "Here's a laptop we expect you to carry all over the country. Make sure you work at least 14 hours a day, and check your email compulsively between the hours of 7AM and midnight. Oh, and by the way if you lose the laptop it's coming out of your paycheque."

Me: "I have a better idea. I'll just come in and use a desktop machine in the office from 9 to 5 every day."

Re:Skeptical

[nasor]

I wonder how much one can get per personnal record for selling this sort of data to organized crime. And cover your ass by reporting a stolen laptop.

Or perhaps more likely, simply losing the laptop (or accidentally ruining it by spilling your soda on it, or whatever) and trying to cover your ass by reporting it stolen.

Re:Skeptical

[Anonymous Coward]

Strict guidelines are all well and fine, but when you have hundreds or thousands of employees running around with corporate laptops there is simply no way to guarantee that everyone will comply.

When people are running around at the airport, hopping in and out of cabs, running from meeting to meeting, and generally trying to keep ahead of their workload, they get sloppy.

Actually... When you've got hundreds or thousands of employees running around with corporate laptops it actually gets easier to guarantee that everyone complies.

If you've got that many laptops out there to maintain I can guarantee you're going to have a decent-sized IT staff and budget. Which makes it very easy to implement large-scale policies to lock down individual machines, force full-disk encryption, keep data someplace central only accessible via VPN, etc.

If you've got that many laptops out there your only excuse for something like this is pure laziness.

It's the smaller companies who have a hard time keeping everything secure. Companies with just a couple dozen employees, who don't really have the resources for a dedicated IT staff. Who don't know how to set up a VPN, or understand the security risks of carrying this data around with them everywhere.

Re:Skeptical

[amn108]

Wrong. Running around and being sloppy means nothing because no matter how "corporate" laptop is, it does not store any copies of any sensitive information. The person carrying the laptop is no more allowed access to such records, than any other.

Please give me ANY reason why and how a corporate employee with a laptop, however sloppy he or she is, should be carrying a copy of 33k of personal records with him, regardless of what company he works for, his position in the company and the type of computer.

There is a chance such access is required on a humans part, but not in security area. A person I know close was working as a translator for the refugees in a European country. The information refugees gave that made them eligible for asylum was to remain strictly confidential, but since she had to translate this information to the government authorities on behalf of the refugees, and since she did translate it, it all went through her head and thus was potentially leaked, as it was entirely up to her to occasionally recall and reveal all kinds of intimate details on these refugees to her friends and what not. Which she did, occasionally. That's sloppiness.

I find it funny that when it comes to money, most respectful banks realized it long ago that true security should exclude human interaction altogether, and try to replace parts of the system where human hands are due with electronics.

Time to value privacy and offer it the same kind of recognition.

Re:Skeptical

[Hyppy]

So, not only is it going to be a horrible day when your house is broken into and ransacked for valuables, you also lose the next month's pay because your company wants to "crack down" on employees.

Re:Skeptical

[Jim Hall]

They can do a bit better by having the person to pay for the lost laptop. All of a sudden, everyone would be extra careful as it would come out of their pay cheques.

And what do you do if someone's laptop was taken from them at gunpoint, like in a mugging? (Yes, it happens.) Was it that person's fault the laptop was taken? (Hint: it's not.) Should that person pay for the laptop out of their paycheck?

Or what if the laptop was stolen from their home during the night, like in a robbery? (Yup, that happens too.) Should that person pay for the laptop out of their paycheck? It's certainly not their fault. They likely lost a bunch of personal possessions, and you want them to take an additional $3000 hit to their paycheck?

Life is a bit more complicated than the simplified world you think it is. Remind me never to work for you.

Re:Skeptical

[magus_melchior]

American companies-- especially those not in the tech industry-- by and large are very lax about information security on computing devices. Many managerial decisions result in poor security, including:

1. Cost cutting on software, equipment, and/or training.
2. Creating an environment too hostile to employees or too comfortable to upper management.
3. Hubris of the "it can't possibly happen to us" sort.
4. Active involvement in the trafficking of personal information, i.e. sales thereof to partners and marketing clients.

Re:Skeptical

[PPH]

Yep. I have a friend who is a broker (stock, not pawn). He has a corporate laptop. But the only thing he has in the way of company software is an app that runs a virtual desktop over a VPN to a server within the company firewall. It is similar to (but a Windows version of) an X desktop. The client runs inside the company and cut and paste between this app and other stuff on his laptop has been disabled.

At work, his desktop is similar, although he can generate reports on a customer by customer or stock by stock basis and paste them into documents. Attempting to walk out with a customer list would involve physically being inside the company and compiling the list manually (one customer screen at a time).

The IT folks who work within an internal firewall, where generic SQL queries can be run, are not allowed to bring their laptops inside that firewall. They can work from home (or Starbucks), but only over a VPN and virtual desktop similar to what the brokers have.

It would be possible for someone to run a query, sneak a USB drive inside and walk out with customer records, but it would be well outside normal work procedures, it would be logged, and people would get canned.

Re:Skeptical

[amn108]

That's the sort of things I am talking about. Good some people have gotten to the point of actually implementing the security, most other wannabe-security company experts have no clue about, or only read through while taking their coffee in the morning.

I am not a big fan of thin-clients though. I am for separating the code and the data, in a way that still makes possible for clients to off-load server workload. Thin-clients only run the display and input devices, but when you have overloaded servers and lots of employees that fetch data and make server CPU usage go up because of remote desktop connection specifics, it may get ugly. Instead, I think, the client should share the server workload and actually do some work itself, but keep sensitive data in memory only, possibly manually wiping the memory too before shutdown.

Maybe the TPM (Trusted Security Module) may come in handy soon, instead of pushing the worthless DRM crap everybody shouts here and there.

Re:Skeptical

[Anonymous Coward]

Never attribute to maliciousness what you can chalk up to stupidity... While I agree with you - you would EXPECT and hope that most corporations have strict guidelines in place to prevent just such an event from occurring, the truth is that it varies widely between industries. Companies only do what they are compelled to do - whether b/c of laws, regulations, shareholders, or customers. For some companies that think they have evaluated their options, the perception is that it's cheaper to NOT implement controls (such as full disk encryption) because "It won't happen to us." They truly believe it and want to put off spending on non-revenue generating projects as long as possible. Until there is enough consumer backlash or intervention by the government this will continue to occur. HIPAA, SOX, PCI, and the state data breach laws have brought things a long way in terms of awareness, but we still have a distance to go.

Good write up

[Faux_Pseudo]

This might be the best summery I have seen in some time. It has far more usefull informtaion than the linked news story. I want to personally thank the poster for that and suggest we could use a 'goodsummery' tag to balance the 'badsummery' tag that we so often see.

Re:Good write up

[jmcbain]

How about we use the tags 'goodsummary' and 'badsummary' instead?

Re:Good write up

[uqbar]

Ya might wanna get a spell check before you start tagging...

Re:Good write up

[Pope]

Because it's still Summer*?

*Southern hemisphere need not apply.

Re:Good write up

[Anonymous Coward]

Why would Mary care about the totals?

Re:Good write up

[Gorphrim]

Good idea, and while we're at it, in addition to goodsummery let's cover the rest of the seasons as well with goodautumnal, goodvernal, and goodwintry...

Re:Good write up

[Mies van der Robot]

Someone, please, please tag the Texas weather 'goodsummery'...I can't take this humidity any longer!

Re:Good write up

[magus_melchior]

As much as I want English to have a consistent glyphs-to-phonemes mapping, you'll have to tag it "goodsummary".

Re:Good write up

[Anonymous Coward]

It's "summary". You messed it up three times.

Kind of a coincidence

[oodaloop]

I was just thinking earlier today of signing up for that. I do a lot of travel and thought the cost might be worth it to cut down on wait time. Guess not.

Re:Kind of a coincidence

[ptbarnett]

I was just thinking earlier today of signing up for that. I do a lot of travel and thought the cost might be worth it to cut down on wait time.

I did sign up for it. It has saved me quite a bit of time. But now, I obviously regret it.

I just sent a nasty message to the "Chief Privacy Officer", but I'll be surprised if I get a response. I'm not sure I'll be satisfied with any response other than "I just got fired."

Re:Kind of a coincidence

[Anonymous Coward]

I just sent a nasty message to the "Chief Privacy Officer", but I'll be surprised if I get a response.

Oh, you'll get a response all right. Welcome to the terrorist watch list.

Re:Directed to the Systems Administrator of VIP, i

[Anonymous Coward]

He got the contract and I bet he is paid really well. Why would he do more?

It shouldn't matter, but it does

[sakdoctor]

Names, SSi number, date of birth .. we need to stop using all of these as ID right now.

My suggestion is this. At some appropriate age, say 16-18 where most countries seem to issue ID, we each choose and commit to memory a graph G, such that the chance of a collision in all earth population is close to zero. Then whenever we need to prove our ID for air-travel or whatever we just need to go though several rounds of identify proof where we generate an isomorphic graph H, and show EITHER isomorphism between H and G, or a Hamiltonian cycle in H. After a sufficient number of rounds your identity would be certain to the required probability and you could be on your way.

The technique to do this mentally could be taught in schools. It's THAT SIMPLE!

Re:It shouldn't matter, but it does

[spud603]

It's THAT SIMPLE!

You've never studied public policy, have you?

Re:It shouldn't matter, but it does

[amn108]

The technique may be simple, but I did not understand what you wrote at all.

Re:It shouldn't matter, but it does

[Anonymous Coward]

Did anyone come up with a class of appropriate graphs for this? If not, I'd rather stick to the tried and true: keep two large primes p,q in your head. Your identity is the product n=p*q. You prove your identity by computing x^((p-1)*(q-1)) mod n for arbitrary x.

Re:It shouldn't matter, but it does

[genner]

It's THAT SIMPLE!

You've never studied public policy, have you?

I have and it could work.

First youy have to give it a marketable name. Like the patriot graph.

Then you have to scare people. If you don't memorize your patriot graph the terroists have won.

Re:It shouldn't matter, but it does

[John Hasler]

> Like the patriot graph.

No. The Patriot Tree (Yes, I know it isn't a tree, but we're talking marketing now. Details don't matter.)

Re:It shouldn't matter, but it does

[genner]

> Like the patriot graph.

No. The Patriot Tree (Yes, I know it isn't a tree, but we're talking marketing now. Details don't matter.)

Exactly.
Everybody wants to support trees. If you haven't written your congressman already you must really hate the planet.

Re:It shouldn't matter, but it does

[vjmurphy]

I am not an isomorphic graph, I am a free man!

The system's name says it all

[copperconductor]

Dude, it's called "Clear" for a reason.

Re:The system's name says it all

[Anonymous Coward]

Dude, it's called "Clear" for a reason.

Because it is affiliated with Scientology?

waiting for the Big One: IRS loses taxpayer data

[peter303]

I think the only thing saving the IRS is that operates with COBOL software and nine-track tape and not many hackers can do those these days.

I forgot the exact country, but one of the major western European countries had a significant chunk of taxpayer ids stolen last year.

Misuse of privacy information

[pan0k]

Well, somebody better start suing. That's what I hate about all these companies and government agencies that have access to all our private information. They are giving out our private information for free and the only thing that they do to help or protect us is giving away free credit monitoring for a year or 2 instead of a person life time.

What was that info doing on a laptop?

[Animats]

What was that info doing on a laptop? That in itself is very suspicious. Nobody should have a full list of the "approved people" outside of an database where each access is logged. That's info a terrorist group would want. It gives them a list of people who won't be searched. Those are the ones to exploit to get something past security.

The laptop disappeared from a locked room at an airport. This wasn't an ordinary laptop theft. TSA has to assume that the database is now in hostile hands. So now everyone with a "Clear" card should be subjected to extra searches.

Let's check out the "Clear" privacy policy. "Clear and its subcontractors, pursuant to legal agreements, have a comprehensive information security program to ensure the privacy of Clear applicants and members as well as the integrity of our systems. We apply ID's and passwords to insure that access to systems and data is only on a need-to-know basis. We use encryption (a strong data coding process) for all program sensitive data communications." ... "In the highly unlikely event that a member is the victim of identity theft (defined as the taking of a member's personal information so that fraudulent transactions are made in the member's name) that is the result of any unauthorized dissemination by Clear or its subcontractors, or theft from Clear or its subcontractors, of the member's personal data collected by Clear, we will reimburse the member for any otherwise unreimbursable monetary costs directly resulting from such Identity Theft. In addition, Clear will, at its own expense, offer any such member assistance in restoring the integrity of the member's financial or other accounts." ... "Clear has appointed an independent, outside Privacy Ombudsman, Law Professor Paul Schwartz, noted privacy expert and advocate. He will be identified to members as the person to contact if a member has a privacy complaint or privacy problem with administration of the Clear system or fidelity to our published Privacy Policies. The Independent Privacy Ombudsman is empowered to investigate all privacy complaints, gather the facts, and respond to members, as well as to post responses publicly and prominently on our website."

Yet there's no announcement of the security breach on the Clear web site.

Re:What was that info doing on a laptop?

[verbamour]

"Hello, Paul Schwartz' office, please hold..."

Re:What was that info doing on a laptop?

[Anonymous Coward]

Mod parent up.

Another thing - suppose this laptop is recovered, and someone has added some names and data to the DB - ones that can be later used as covers?

Re:What was that info doing on a laptop?

[Ephemeriis]

What was that info doing on a laptop? That in itself is very suspicious. Nobody should have a full list of the "approved people" outside of an database where each access is logged.

This is really what surprised me the most in this entire story. What the hell is that kind of information doing on a laptop at all? That information should be stored in a central database, with craptons of logging going on, only accessible through secured VPNs. There is absolutely no reason that any machine should have a local copy of it.

Re:What was that info doing on a laptop?

[mpapet]

What was that info doing on a laptop? That in itself is very suspicious.
There's **lots** more of this data around in the wild. This is standard operating procedure in most identity management contracts.

Nobody should have a full list of the "approved people" outside of an database where each access is logged.
And still they do. Why? Mostly because there's no reason why not. There are no consequences for doing it this way. In fact, that's a pretty cheap way of running the whole process at an airport.

Re:What was that info doing on a laptop?

[Bob9113]

Excellent, though-provoking post. Thank you.

Re:What was that info doing on a laptop?

[TheWizardTim]

You still get the normal airport search, you just get to skip the line. That's all this does. You still have your bags x-rayed, and you still have to remove your shoes and all metal from your body. I just signed up for this, because I almost missed my last flight due to the extra long line at the airport. Now I am having second thoughts.

Re:What was that info doing on a laptop?

[Anonymous Coward]

Still no mention- they claim 'a software update':

Important Notice

We are currently updating our software and are unable to process enrollments at this time. Click here to enter your email address so we can notify you once enrollment is available.

Re:What was that info doing on a laptop?

[ptbarnett]

Now I am having second thoughts.

See my post earlier. According to Clear customer support, only people currently going through the application process were listed on the stolen laptop. And another poster reports that a separate news interview claimed that only publicly available info (name, address) was included.

Re:What was that info doing on a laptop?

[surfdaddy]

The real privacy policy is as follows (not intending to be humorous): "Clear is putting a statement on the web that will soothe you. We really have no significant program, but in the even that a major breach occurs, we are willing to risk bankruptcy and we believe that this risk is outweighed by the benefits in getting major government contracts."

Re:What was that info doing on a laptop?

[45mm]

Clear members still undergo the same scrutiny as any other passenger ... they just have a special line.

Re:What was that info doing on a laptop?

[againjj]

Yes there is:

Important Notice
We are currently updating our software and are unable to process enrollments at this time. Click here to enter your email address so we can notify you once enrollment is available.

It's just, well, let's say "understated".

privacy policy

[Anonymous Coward]

Their privacy policy is an interesting read
http://www.flyclear.com/privacy_fairinfo.html#idtheft

Re:privacy policy

[bugs2squash]

From the PP...

"We have our Chief Privacy Officer conduct a yearly privacy and data security audit, with her report presented to Clear's CEO and its Board of Directors. This Annual Audit, including any problems identified and steps to be taken to resolve those, is made available to Clear members wishing to have this."

Someone who is a Clear member, please request a copy of this report and post it...

Oh wait, I can do it - I have this list of member details...

That's okay...

[Anonymous Coward]

Our company was being audited for security, and the auditors lost their papers with information on logins, etc. As a result, we had to change all of our passwords.

Re:That's okay...

[jacquesm]

a security audit does not require you to give up your logins / passwords, if it does you're likely being social engineered.

Re:That's okay...

[Anonymous Coward]

WHOOOOOOSSSSSHHH

Though you do deserve your informative mod, there are still a lot of people who don't realize that NOBODY should have access to your login or password. Ever. If someone calls or walks in and acts like they're a sysadmin or an auditor and demands your credentials, you better call security.

Re:That's okay...

[jacquesm]

I realized there was the possibility of this being a joke, but then since the poster decided to be anon I figured he/she might be serious.

Before people get ideas :)

Oldest trick in the book: "hello, sysadmin here, is your password still 'twinky' ? ", "no, oh, it's 'ratsass', sorry about the messup, have a nice day now"

Re:That's okay...

[Anonymous Coward]

You don't need to social engineer or have bad auditing practices to find yourself in possession of sensitive information such as user accounts. I've never once walked away from a security audit w/o having compromised at least one user account.

Auditors losing information like this is BAD news. Imagine if you lost a copy of the key to your front door along with a map to your house and a blueprint with all the valuables circled.

Oh NOW Encryption is a Good Idea?

[Greyfox]

Why do these fucktards always seem to decide that it's a good idea to encrypt their data after a laptop, computer, hard disk or tape backup containing the personal information of hundreds of thousands of people gets lost? There need to be more legal penalties for these companies' shoddy IT practices! Perhaps a CEO/CTO should do some jail time to drive the point home...

Re:Oh NOW Encryption is a Good Idea?

[amn108]

yepp.

Re:Oh NOW Encryption is a Good Idea?

[Dog-Cow]

There's no punishment to a CEO worse than the stock price falling. Until officers of a company face real punishments in the face of such crimes, they will always choose to cut the bottom line over improving security. Anyone basing decisions on trivial cost/benefit analysis would come to the same conclusion.

What's needed is an increased risk. I think a mandatory tour of duty in Iraq or Afghanistan would do nicely.

Mod Parent Informative

[mpapet]

Concise, well written.

NOW?...

[whisper_jeff]

The company has now decided that it might be a good idea to encrypt the data in their systems.

NOW? They're NOW deciding that it might be a good idea to encrypt the data? Ok, I don't work in the industry and all but even I, as an uneducated outsider, knows that it's a good idea to encrypt that sort of data. Jebus... That should have been one of the first priorities in developing their systems and procedures...

Re:NOW?...

[rbanffy]

That sort of data didn't belong to a notebook either.

That sort of data should be protected by blast-proof concrete walls of a high-security data-center, behind armed and well trained guards that shot first and that won't miss.

After all, compromises to that data would allow people to zip through security at airports with minimum security checking. That's really scary.

Current Consumer Reports Magazine

[BitterOldGUy]

disagrees with you (Sept 2008) Government is by far the worst offender for IS leaks.

See page 32.

Re:Current Consumer Reports Magazine

[cmat]

I wonder how that number is affected when one considers that the government is more likely to be required to report these types of crimes whereas a private company is not (for the most part).

Re:Current Consumer Reports Magazine

[BitterOldGUy]

I wonder how that number is affected when one considers that the government is more likely to be required to report these types of crimes whereas a private company is not (for the most part).

There you go - you bring up a very valid point. It's the same if a company who doesn't do business in California or any other state that requires disclosure when a data breach has happened.

Re:Current Consumer Reports Magazine

[geekoid]

No it's not, most of those breeches are flaws in contractor design.
If I remember, it's also a raw count. Considering the size of the government, a raw number is inaccurate.

Compare the government against every private business, then you have a fair comparison.
Unfortunately, it's nearly impossible to know private breeches.

I don't get it

[jjohnson]

I don't understand why data like this was on a laptop in the first place. Encrypted or not, it seems problematic to have copies of databases floating around, flying with executives, packaged up neatly in a form that makes it easy to steal (i.e., a freakin' laptop).

What am I missing that I don't get why this database was allowed off the core server that hosts it? Simply from a data integrity standpoint it seems like a bad idea to let multiple copies move around.

It smells

[Carson Napier]

This whole thing stinks anyway. That pass is BS and nothing more than a scheme cooked up to get people through airports faster and easethe load on the TSA people. It is TOTALLY a compromise in airline security allowed by means of a $100 bill. Yes, encryption is a good idea, just like breathing is a good idea.

Re:It smells

[Overzeetop]

You, apparently, are under the false impression that the TSA offers a heightened level of security for flying. If I flew much, I'd opt out of the theater for $100, too. Then again, so would most terrorists. If you only ever commit one act of terrorism, then die, there's not much non-profiling background to search.

Irony

[FrankSchwab]

I guess my question is....

Could a terrorist organization exploit this information to be able to get someone on a plane who wouldn't have been able to before? A fake passport/drivers license in the name of a trusted passenger who knows all the personal information he should. In any kind of rational security process, each and every one of the CLEAR passengers would now be on the TSA Watchlist, subject to extra scrutiny.

Talk about blowback! Talk about (Alanis Morissette be damned) irony! An intrusive system designed to help trusted passengers bypass an intrusive search for terrorists, allows those same terrorists to bypass the search.

Re:Irony

[Anonymous Coward]

"Could a terrorist organization exploit this information to be able to get someone on a plane who wouldn't have been able to before?"

No. And the reason is that the Cleared Traveler / Registered Traveler program are just theatrics. There is no difference in the level of security screening people in these programs are subject to. They are paying to stand in a different line reserved for program participants. It's essentially the same thing that some airports have with a first class only security lane.

Re:Irony

[ptbarnett]

Could a terrorist organization exploit this information to be able to get someone on a plane who wouldn't have been able to before?

Currently, no. All Clear does is get you to the front of the security line. There's no difference in the level of scrutiny.

However, the mandate for the program is to eventually reduce the level of scrutiny for "registered travelers". But, a stolen identify won't help because the system uses biometric scanners (fingerprint and/or iris) to confirm that the card holder is the person that actually enrolled.

Unless someone figures out how to fool the biometric sensors, the security isn't compromised.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Here's a social security number

[Profane MuthaFucka]

393-43-5435

Re:Here's a social security number

[c00rdb]

Here's one too: 867-5309 ..oh wait

I see dollar signs

[amn108]

Blame capitalism!

That shit never worked, man.

Oh Please

[mpapet]

Having worked the contractor side of Identity projects, I promise you the story as provided in the summary is the working norm.

Unsecured computers in the field with live identity information? Check.

Multiple copies of identity information floating around? Check.

Many **totally** unaware employees in the field with private data? Check.

Many **totally** unaware employees at the contractor's office passing private data? Check.

It boggles my mind anyone would believe it's better than that. The contractor suffers no consequences and the burden falls on the individual.

Which, is why the rules, regs, and standards for handling private information is ***perfectly*** designed in the U.S. Not that any of you would get off your collective asses and do anything to change it.

Re:Oh Please

[JD-1027]

Private information today seems pretty much like a can of worms. It's GOING to get out at some point, it seems.

I almost wonder if we should be concentrating a bit more on ASSUMING it's going to get out, and design our society (ha!) so that the damage is minimal when it does get out.

Collaborators...

[Anonymous Coward]

Collaborators with the enemy get what they deserve.

Re:Collaborators...

[Dog-Cow]

You are clearly wrong. Bush has been collaborating with terrorists since he took office, and all he'll get is half a dozen SS agents protecting him for the remainder of his life. Hardly what he deserves.

Re:Collaborators...

[Anonymous Coward]

Be careful what you write here - this is *not* a designated "free speech area".

In case you were wondering...

[rickb928]

You can NOT make this shit up.

I wouldn't be fired if this happened to my laptop. I would be charged, sued, and ostracized, and find a new line of work. Probably with the phrase 'biggie-size' involved.

Almost as ludicrous as electonic voting...

Wrong

[langelgjm]

The annual fee is $100. You only pay 128 the first year. If you really went to the Clear website...you wouldve read that.

Oh, really? Once again, from the Clear website:

How much does it cost to become a Clear member?

Clear is available for $100 plus a $28 TSA vetting fee, for a total of $128 per year. Lock in these prices by purchasing a two-year membership for $256 or a three-year membership for $384.

You will also provide a credit card number, but you will not be charged the annual fee of $128 until you are approved for membership.

Looks like $128 to me.

Re:Wrong

[Anonymous Coward]

http://www.btnmag.com/businesstravelnews/headlines/article_display.jsp?vnu_content_id=1003831648

Also from the horses (ass...err) mouth: http://www.tsa.gov/press/releases/2008/0724.shtm

Burn to you, for out of dateness, and Clear for not updating their website.

The summary is very wrong...

[_14k4]

Important Notice

We are currently updating our software and are unable to process enrollments at this time. Click here to enter your email address so we can notify you once enrollment is available.

Clearly this is simply just a Java SDK upgrade or something.... :P

Re:Directed to the Systems Administrator of VIP, i

[Aliencow]

Like the sysadmin really had a say in this. He probably asked for that a thousand times.

next time...

[harvey the nerd]

One can hear it already, "we encrypted it, it'll never happen again". Next time, "its okay, we encrypted all the records with 1024 bits" and then have to admit the key was on a sticky note over the screen of the stolen laptop or in an attached thumb drive. Clear's name is now Mudd but the whole "airport security" business is a dangerous hoax (constitutionally and economically, too).

It will be interesting to see the fallout from this episode of "Security Theatre".

Re:Good write up (NOT!)

[Anonymous Coward]

This must be sarcasm... I guess...

That 'summery' was the only place I saw any reference to 'SSi number' being compromised. I saw one report on tv that specifically said that social security numbers were not on the pc. And here is another reference that says the same thing: http://www.ktvu.com/news/17098410/detail.html

The real question is...

[Anonymous Coward]

Why was the data of 33.000 individuals recklessly carried around on a laptop at the airport? Internet and encryption, have they heard about it?

Where are the Corptards now?

[Anonymous Coward]

So CorpTards(tm) where's all your blather about businesses being able to run things more efficiently/securely than government.

Corps can often do things cheaper, but that's because they usually cut corners to save on costs. Just take that from someone who has worked for them and knows what they're like.

(Anonymous Coward is one of the foremost experts on corporate culture)

mod parent up.

[HockeyPuck]

Mod parent up, this paper is relevant and is pretty good.

It's not a big deal......

[Slugster]

With any luck, the DHS will find it.
~

Re:Directed to the Systems Administrator of VIP, i

[Hyppy]

I think you are mistaking the job titles of "System Administrator" and "Someone Who Has More Than A Passing Chance Of Affecting Change In Policy"

Get rid of these bozos NOW!

[sribe]

OMG! The only, ONLY appropriate response is to temporarily shut down the program, fire the contractor, ban them from future work on this, put it out for bid again and start over.

Re:Get rid of these bozos NOW!

[geekoid]

I disagree.
Sue this contractor and bring the work in house.

Re:Get rid of these bozos NOW!

[tugboat0902]

As a medical professional in the midwest I have had my personal information stolen 3 times in the last 12 months. In order to sign up with insurance companies, medicare, medicaid and etc., I have to provide name, office address, home address, SSN, personal and professional history and in some cases even a photo. They provide a really, really nice privacy policy that says they won't share any of this information, but they accept no responsibility for its loss. Today, I have three really great credit monitoring services (for one year mind you) and that is the extent of the liability I can extract from an insurance company, or even the federal government, for the loss of my information. It seems really retarded to me, but who am I to complain? (hears jack-boots in hallway---)

Re:Get rid of these bozos NOW!

[sribe]

Yeah, okay, my reply was hasty in that "put out for bid" should include evaluating bringing it in house, and unclear in that I did not mean to rule sanctions for the contractor that go beyond firing. The point was that they should be fired, ASAP, even at the cost of shutting down the program for a while--no excuses, no second chances.

Re:Get rid of these bozos NOW!

[sribe]

As a medical professional...

How ironic, considering the mass of overbearing rules and conflicting interpretations that you yourself must try to comply with!

CLARIFICATION, breach was limited.

[ptbarnett]

I'm replying close to the top, so that this will show up as early as possible.

This is from Clear customer support: consider the source and apply the appropriate amount of salt.

The only personal information that was compromised was for people who were in the midst of the application process. If you are already enrolled and have received your card, your personal info was not in the laptop that was stolen.

At this point, Clear is not planning to notify existing members that their personal info was not stolen. However, I strongly suggested that they rethink that policy, and notify all members of the extent of the breach. The news story quoted in this article doesn't make the distinction between pending applications and enrolled members.

Re:CLARIFICATION, breach was limited.

[Anonymous Coward]

"The news story quoted in this article doesn't make the distinction between pending applications and enrolled members."

That's a really fortunate, mitigating factor in this instance. Of course, if a security company can't be trusted to secure data representing users in the process of being enrolled into the program, then why in the heck should it be trusted to secure the data for those users that do get into the program?

In other words, yes, it matters in terms of the extent of the breach (i.e. that it is limited), but that the breach could occur at all exposes a very serious problem. It's especially serious when you realize that everybody currently enrolled went through the "pending application" stage at some time. If the "pending application" data is insecure, then it's all insecure. Checking your data inputs is standard security practice, and apparently the inputs are untrustworthy, because if someone could steal the laptop with unencrypted data on it, then they could also get into it and modify it and you might not even know it happened.

*POOF* Your enrolled database is compromised too.

Re: CLARIFICATION, breach was limited.

[joe_n_bloe]

So it's like winning the "bend over" lottery I guess.

Re:CLARIFICATION, breach was limited.

[Anonymous Coward]

I'm replying close to the top, so that this will show up as early as possible.

This is from Clear customer support: consider the source and apply the appropriate amount of salt.

The only personal information that was compromised was for people who were in the midst of the application process. If you are already enrolled and have received your card, your personal info was not in the laptop that was stolen.

At this point, Clear is not planning to notify existing members that their personal info was not stolen. However, I strongly suggested that they rethink that policy, and notify all members of the extent of the breach. The news story quoted in this article doesn't make the distinction between pending applications and enrolled members.

that doesn't render you bums any less culpable for having data unencrypted in the first place.

Re:CLARIFICATION, breach was limited.

[Anonymous Coward]

Nice. Goes to show how much you can really trust the government.

I have this sneaking suspicion that these applications will be summarily denied, and the applicants placed on the terrorist watchlist for attempting and failing to obtain the card.

In any case, this whole security thing has gotten way out of hand. I can guarantee that if I had been on any of those 3 planes it would have ended up like the 4th, or landed safely. Up until post-9/11 I used to carry an 8-inch tanto-point blade, in addition to pepperspray and a few handy blunt objects. And yes I know how to use them, although I am also fairly dangerous using something as simple as a towel. I once asked why I was no longer allowed to carry personal defense items, and was told it was for "the safety of the passengers" and that the security would be provided by the government/airlines. I responded that their security didn't work so well in the past, and that last time a plane full of people followed the government's advice they ended up getting flown into a building. (I was "detained" for 3 hours and questioned without a lawyer present because I forgot to leave my mace in the car)

Seriously people, they can't even keep track of our baggage, they can't keep someone from breaking into a secured office with sensitive information and stealing, and they can't even figure out how to distinguish a 6 year old kid from a 47 year old man if they have the same first and last names.
What makes anyone think they are any safer now than on 9/11? The real story here should be:

"Thieves break into locked room in restricted zone in airport, TSA at a loss as to how security breach happened. TSA officals have not responded to questions as to how they can claim to make the entire airways safe if they can't even protect their own laptops."

Re:CLARIFICATION, breach was limited.

[Anonymous Coward]

"At this point, Clear is not planning to notify existing members that their personal info was not stolen."

I wouldn't want to risk being caught in a lie later on either.

hahahahahaha!

[mpapet]

Please tell me that there is going to either be prison time
No way. What's the crime? You clearly fail to comprehend that failure falls on the individual's shoulders. It's that way by design and it works great for everyone except the individual.

huge *personal* fine
What's the crime? Clearly you have *no idea* what role corporations play in sheilding liabilities.

firing the person who left it there
No one is getting fired. No one is getting a bad review. There are no consequences. Some dust will fly, but that's dying down by the end of the week.

"Yes, this is cost effective and proper.
Storing the data on a laptop that requires a username and password to get to the desktop is cost effective an proper. There. Does that make you feel better?

We need to have people at board level think twice about storing our data so shockingly badly.
Who's going to be in charge of that? You certainly won't do anything about it beyond your post. So the system works great.

When are you and the idiots modding you insightful wake up?

Re:hahahahahaha!

[QuantumRiff]

Honestly, I think it's time to institute a punishment for a corporation, the most severe punishment that can happen to something that can't be thrown in jail.. Revoke their charter, and nullify the entire company. The corporate death penalty, if you will.

If it happens more often, companies will start to realize that this isn't a matter of getting fined, which their insurance will cover, and their rates will go up a little, but that the company will no longer exist, and can't write paychecks, can't purchase goods, can't deposit money, and their assetts will be sold off to the highest bidder. Might make them a little more "caring" about important issues..

Now they'll encrypt it...

[EEBaum]

$50 says that they'll keep the key to the encrypted data on a post-it attached to the computer, or use "password" as the password, or have a file on the desktop called "key to encrypted data".

Re:Directed to the Systems Administrator of VIP, i

[tinkertim]

Not to worry, all sensitive information was encoded in pig Latin.

Make it a punishable offense.

[MaWeiTao]

I don't understand why there aren't penalties for this sort of thing. The way I see it this qualifies as criminal negligence because the ramifications for an individual of having their identity stolen can be severe.

If lose of personal data is somehow attributable to negligence on the part of the company, in this case the lack of encryption and maybe not securing the laptop properly, the company should be penalized. The most obvious would be a fine; lets say $10,000 for each account.

My bank, or companies they do business with have managed to lose a significant amount of customer information, not once, but twice in the past year. They mailed out notices and provided customers with some bullshit free access to credit monitoring for 12 months, later extending it to 18 or 24 months. And that's that, it's out of their hands.

But then what the hell do politicians care? With financial institutions like Countrywide giving out extra-low interest rate VIP loans to congressmen they have no incentive whatsoever to look out for our best interest.

Re:Make it a punishable offense.

[thisissilly]

The most obvious would be a fine; lets say $10,000 for each account.

Better yet, make the fine payable to each of the persons who's personal data is revealed. They improperly let your private info out, you get $10000.

The company has now decided that it might be a go

[Anonymous Coward]

ORLY?

Encryption actually IS required

[guisar]

There's are certification programs known as Privacy Act Registration and HSPD-12 which are part of the DIACAP process which REQUIRE hardware encryption of the full disk. DoD systems all have to meet these and it's a big deal if it turns out you tried to speed on meeting these requirements. Clearly, the TSA feels it's too good for it's own policies.

Re:Encryption actually IS required

[guisar]

Also, I just remembered the Privacy Act Registration is one of the very few laws which imposes upon contractors the very same penalties as DoD (and presumeably other government) employees- that is you can be held liable under UCMJ for violations. So, the folks who designed and deployed this laptop really should go to jail....

Re:Encryption actually IS required

[mpapet]

You would be right if the TSA *and their subcontractors* had to comply with DOD specifications.

AFAIK, the TSA is under the DHS, which has no reason to report or comply with DOD specs. This is a link to a pdf of the U.S. Gov org chart. http://bensguide.gpo.gov/files/gov_chart.pdf

Off topic:
It seems to me, instead of using the law enforcement infrastructure we have, the current administration ignored all of it, created their own "new" law enforcement and get to ignore most law enforcement precedent by claiming the DHS is "new" and has no precedence history.

Re: PHB

[Phrogman]

I expect the required rules for security of the data were likely in place and applicable to most employees. It would take a special kind of stupid to not have some security rules.

But those rules seldom are applied to upper echelon management who can simply say they want data X in a readable format (probably an Excel spreadsheet) put on that laptop for their trip etc. The higher you are in an organization it seems the less likely you are to think the rules apply to *you*.

Either that or this "theft" is a convenient way to explain how the data got into the hands of a commercial enterprise that purchased the data via a bribe on the side.

In any case, the CEO's of the company all the way down to the employee who lost the data should all be fined and given jail time. I know that won't happen, but it is what should happen.

Re:Directed to the Systems Administrator of VIP, i

[Anonymous Coward]

s/Affecting/Effecting/ thank you :)

great deal

[Anonymous Coward]

Where do I sign up so that I too can pay $100 to have my identity stolen?

Nelson

[LoudMusic]

Nelson Muntz, "Hah hah."

Private information stolen from CLEAR

[Anonymous Coward]

See, this is exactly why I gave them a fake name, address, and SSN when I enrolled in CLEAR.

Set it all free

[Anonymous Coward]

Let's put a nail in it -- names, addresses, SSN -- these are no longer valid for signing up for credit, new accounts, anything. Let's get it over with and publish everyone's at the same time but let's start with the politicians.

Imagine how fast new laws would be created protecting data if every member (and their families) of Congress and Senate had their personal info posted.

Gee, A private contractor

[geekoid]

fucked up.
What a surprise.

Privatization of government work is costing us far more then if the government agencies did this work.

 

Simple solution

[John Hasler]

Just add all those names to the no-fly list.

Re:Simple solution

[beej]

Parent is modded funny (because it is), but it's pretty much true, too! How can you trust any of the IDs on that list now? If you assume The Terrorists have the list, you must apply extra scrutiny to everyone on it, not let them pass by security unmolested.

Dumb idea anyway

[Anonymous Coward]

Good thing terrorists can't afford a $100 pass to bypass security.

By price is always a fail

[Anonymous Coward]

You can't specify enough objective criteria to keep a low ball bidder from cutting quality to meet an overly low bid. Best to define a budget and put someone in charge of getting the job done and let them run the show. One throat to choke with a decent budget will typically achieve actual results.

Comment removed

[account_deleted]

Comment removed based on user account deletion

IT is facing the same problem EVERYWHERE.

[ErichTheRed]

I'm not surprised this happened...well, maybe I'm surprised that a security company would leave that kind of data on a laptop.

Fact is, this happens everywhere and it's going to get harder to manage. Unless you start taking people's laptops and even their desktop PCs away from them, you'll never stop it. Add to that the fact that you can get 16 GB flash drives and 80 GB iPods. The only ways to stop this are to (a) encrypt data, or (b) take users' toys away. Neither happens without a huge fight.

Encrypting laptops is a really big challenge. If you let users do it themselves (using vendor software, Windows EFS or others,) then they hold all the encryption keys and could make it impossible for you to get the data back in the event they get fired or quit. Implementing enterprise encryption is another road, but has its own set of problems. You have to have a full-time admin to keep the public key infrastructure up, revoke and reissue certs, etc. You also need to spend a large sum of money -- RSA and others make huge bucks every year selling enterprise-level disk encryption software. This is a very hard fight to win until something bad like this happens. And even if you get the software purchased, convincing the execs that you also need someone to look after it is tough.

Plus, you cannot stop a developer from taking the customer database home on a 1 TB disk drive to write/test software against. Unless you're disciplined enough to scrub any dev data of any customer information, it will be used. Even if you tell them they're fired if they take home data, being fired isn't the permanent black mark it used to be. Not everyone's a professional.

So, either completely limit access to data, or take toys away. Everything else is just a band-aid. I odn't mean to sound defeatist, but unless you give employees some incentive to protect customer privacy, they won't do it. Security is a major pain in the butt...even I think so. The key is to make security "not a pain."

Re:IT is facing the same problem EVERYWHERE.

[ladydi89]

Oh BS. Use an FDE drive and lock down the USB ports so that they can't hook a mass storage device to it. You still run the risk of them putting the FDE password on a sticky, so better yet, give them a dumb terminal and force them to VPN in to access data. they won't be able to save anything locally and you can still lock it down to prevent mass storage devices from being used.

Re:IT is facing the same problem EVERYWHERE.

[Anonymous Coward]

Newp.

Windows or MacOS
PGP Enterprise with smartcard support, and an Aladdin eToken, with a policy to lock access after more than 5 password guesses.
Configure PGP Enterprise to make USB flash drives read only, encrypt before allowing data to be written, or deny access completely.

Voila, locked laptop, with no way a thief can bypass it. Should they try passphrase guessing, they will end up with no way in, due to the eToken locking.

Another idea is to use Vista Enterprise, a TPM chip, and BitLocker, having BitLocker require a PIN to start up. The user doesn't know the recovery key, so even if he is able to boot the machine and log in, he can't boot a USB disk to bypass corporate policies.

There are a lot of ways a large company can ensure that a laptop remains locked down, and if you throw LoJack for Laptops into the mix with its remote erase functionality, data can be zapped as soon as the machine gets an IP connection, assuming the laptop thief doesn't flash the BIOS and erase the hard disk first.

Targeted theft?

[ardle]

It's possible that is an "inside job", rather than an opportunistic theft. I mean, the laptop could have been "stolen to order". Identity criminals are getting more organised. Who knows what other data was on that laptop, given that it was being used by a security professional.

Re:Targeted theft?

[bugs2squash]

What's less damaging ?

oops - we fucked up and gave away your data, sorry, won't happen again...

or

oops - the whole basis for us being here at all is undermined because the process of background checking as a way to pinpoint troublemakers is fundamentally flawed. The background checks we make on our own staff are clearly as worthless as the ones we run on you.

I wonder what checks they do run anyway - I bet most of them are focused on ensuring that the check for $128 doesn't bounce.

Firefox is probably more picky about self-signed CA certs than these guys are about terrorists. Good job Clear have the TSA to indemnify them on that one.

Re:Targeted theft?

[ardle]

Actually, I wasn't thinking of terrorists at all, just old-fashioned organised crime, something like this. I'm sure criminals would be interested in the contents of a security professional's laptop. An airport would be a good place to find a security professional, even if he only visited occasionally. It's possible that this guy habitually left the laptop in that office. That kind of thing ;-)

Mandatory BOFH reference

[fcarolo]

Looks like someone used the same trick as the PFY, just three years later.

Not criminals, terrorists

[DryHeat122]

Everybody assumes that this data would go to criminals for use in ID theft mischief. What if terrorists used it to program their own Smart cards in order to "speed through airport security"?

You expect commercial interests to do dumb stuff like this out of greed or incompetence. Accordingly, the fact that TSA/DHS didn't certify this company's procedures tells you something about their competence/security.

Re:Not criminals, terrorists

[joedoc]

This isn't likely, unless the terrorist figure out a way to duplicate my iris and fingerprint. Clear was supposed to be issuing new cards this summer with photos attached, as well. I guess that might be sped up to some degree.

And where did you read that TSA/DHS didn't certify their procedure? TSA and DHS are the ones doing the background checks on all the applicants. I doubt very highly that this program would be used in as many airports as it has if there was no approval.

Re:Not criminals, terrorists

[Anonymous Coward]

TSA isn't doing background checks anymore. Thus the value of stopping any terrorist is now completely gone. You don't skip security you still go through it, you just skip to the front of the line maybe in some airports you have a "special line". You don't need all that fancy technology that costs $100 for something that simply says I paid money to get in front of the security line.

Re:Not criminals, terrorists

[joedoc]

Well, I don't know where you got your information, but...

From the Clear website:

Your information security is one of our top priorities. We have a wide array of security features to protect your privacy, confidentiality, and data-security rights. For instance, we purge Social Security Numbers once we transmit them to the Transportation Security Administration as part of the security screening process.

and, from this site:

Although airport personnel are responsible for viewing the Clear cards, TSA runs the background checks needed to issue the cards. It's worth noting that, according to Clear's privacy policy, the TSA holds onto the client's security information, performing continuous reviews. And because the TSA operates under the Department of Homeland Security, other federal agencies will have the same access to your information, a consideration many Big Brother-wary fliers may want to take.

So, unless something has changed since January (when the second quote was published), the TSA is still conducting those checks.

The loss of the laptop (now found, based on a story here this morning) doesn't make me feel that comfortable, especially based on Clear's claims of security in the first quote.

And, of course, you have they typical "BB is watching" complaints in the second quote.

But, as someone who's been required to have all this stuff checked and rechecked far deeper than anyone getting a Clear card, the idea that "other federal agencies will have the same access" to my personal information isn't really a big deal for me. Whatever the TSA has, it's probably nothing compared to what the DOD found for my security clearance. Hell, I got a couple of phone calls from people I hadn't seen in 20+ years who got a call from an investigator.

Then again, I'm one of those "nothing to hide" types. I don't enjoy the fact that this kind of things is necessary, but it is what it is. I hold back against things like this from other areas of my life, because I might see them as a true threat to my privacy. But I'm not losing any sleep over what the government knows about me, or anyone else. The fact is, no matter what you do, if your government wants to find out stuff about you, there ain't much you can do to stop it short of dying, if you even ever knew they were looking at you in the first place.

The key thing to remember is that there are LOT of people in this country. Since the federal government isn't very adept at doing enything (I've worked for/with them for 25+ years), I doubt they'd do a very good job of keeping a big database of dossiers on every citizen in the country. Any attempt at doing that would eventually be destroyed by agency infighting, lack of funding, crap work by contractors, and just a general lack of movement due to the size of the bureaucracy that would emerge from such a plan. That's not counting the political and legislative in-fighting over the idea, or the endless string of lawsuits that would follow such an announcement.

I don't see the need to worry. This would eventually collapse under it's own weight.

But I still jump the line at the airport. Suckers!

but they didn't lie about their use

[hackingbear]

The product name is "Clear" so why would anyone buying the product expects any level of obfuscation?

Too bad they didn't "make available" MP3s instead

[joe_n_bloe]

Unfortunately there's not a mouthpiece for a giant multibillion dollar industry available to sue people who "make available" personal information.

Nor are their investigators roaming the internet making warrantless searches for offenders.

Nor are there lobbyists sending Congressmen on junkets to ensure that maximally favorable and punitive laws are passed.

And when the government serves up your personal information, even through a contractor, you usually can't sue anyone, and if you do, it takes most of a decade. And you definitely can't bully the government for a settlement.

As usual, it sucks to be a plain old citizen.

Re:Directed to the Systems Administrator of VIP, i

[Tom9729]

s/Affecting/Effecting/

thank you :)

Effecting isn't a word.

MIGHT be a good idea to encrypt sensitive data?

[flajann]

This is why we can't trust the government nor any of its contractors to do anything right with regards to our privacy. This type of an attitude when 33,000 people are now in danger of identity theft, credit card fraud, and who knows what else?

More importantly, why is sensitive data *stored* on the laptop at all? Should it not be kept only on a secure server, and then only accessible across a secure encrypted VPN connection on an as-needed basis? With today's storage technology, yes you could store personal and sensitive information on every man, woman, and child in the US on your laptop, but what knucklehead would even consider this a "good idea"?

Homeland Insecurity -- making us all more insecure with each passing day. Let's get rid of them.

whoa...!!

[toby]

Nice society you're building there.

Is that considered normal in the US? Because it's contradictory to civilised principles elsewhere.

Re:whoa...!!

[jvkjvk]

Really?

No, really?

In what country are the rich not privileged? I'd like to visit.

Laptops get stolen, duh

[joe_n_bloe]

I'm not sure which is more commonly stolen now, laptops or purses. But most thieves won't *break into* your car to steal a purse.

Laptops can be and are stolen whenever they're out of sight of the owner. I don't know why it is that people don't get this.

VIP indeed

[maclizard]

Just like the VIPs in hollywood, the people involved in this program now have public lives.

Real-ID resistance

[Plugh]

Now perhaps a few more people will understand why we fought so hard to ensure that New Hampshire will not participate in the Real-ID system, or any de facto national ID card that may follow.

Great Another Fee

[g0bshiTe]

The Clear system allows travelers who register and pay a $100.00 annual fee to speed through airport security by using a smart card at special kiosks in some airports.

We now see the real reasoning behind the TSA. To charge extra for a service that really we don't need.

Re:Great Another Fee

[joedoc]

The TSA doesn't get the fee. The cards are not a government-issued product. You pay a $28 enrollment fee one time, which is paid the the TSA for the background check. The $100 goes to Clear. By the way, the best $100 I ever spent on travel. You have no idea.

Uh-oh Spagetti-O's!

[Puffy Director Pants]

I think they hired Homer Simpson for yet another job requiring competence, diligence and a fanatical devotion to the Pope. When will they ever learn!

Wow, just seems like it was yesterday...

[inotocracy]

..that something similar happened, and yet again these companies get off with a "my bad" letter.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Directed to the Systems Administrator of VIP, i

[Pictish Prince]

Yes it is, o non compos mentis.

From the perspective of a Clear user...

[joedoc]

I enrolled in the Clear program back in March. My reasons were very specific: I got tired of fighting long security lines at the airport, and since I work away from home and travel back and forth a lot, the convenience of this system is more than worth the $100.

I work in DC, and live in Jacksonville, FL, and I normally travel back to the District on Monday mornings. i was stunned to see how long the security lines were at Jax International, even at 6:15 in the morning, and with a full slate of TSA scanners and personnel on the job.

There is nothing like being able to walk past a line of three or four hundred flyers, skip right to the head of the line and be at the gate with enough time to hit the head and grab a coffee. I have zero stress when flying now.

That being said, I'm certainly upset about the laptop theft, and the "inside job" theories might have some truth to them, considering this was supposed to be in a locked office. I don't necessarily buy the "stolen to order' conspiracies, but it is worrisome. I'll continue to do what I always have - monitor all my accounts, credit reports, etc. and hope this gets solved in a quick and reasonable fashion.

As for the necessity to hand over a lot of private information, let me explain what the procedure is:

When you apply for a Clear card on line, you provide the same information, initially, that would would ordering a product: name, address, phone, and a credit card for the screening fee only ($28 which goes to the TSA). Part of the on-line application process is providing your SSN. In this care, it's a necessary evil, since Clear has to access information only you would know. I would assume they're getting this off credit reports or public records. You answer three or four questions, and if the answers are satisfactory, you move on to the next step. You print out a document with a registration number.

That step requires an appearance, in person, at the local airport with the Clear service counters. They check your registration, and you have to provide two forms of identification. One can be any government-issued picture ID. The other, however, must be a government-issued birth certificate or a valid passport. I tried to use a birth certificate issued by the hospital where I was born in 1955, but they refused to accept it. This required me to order a new BC from the state where I lived, and finsish the process another day.

Once that's finished, you stand at a kiosk and have all your fingerprints and one iris scanned. They save two or three of the fingerprints and the iris, and the data from both are eventually encoded into the chip on the smart card they issue you.

The wait for the card can be nearly a month.

As protective as I am of my privacy, I really didn't have a lot of issues with what I had to do to get this. I am an IT contractor and former federal employee, and I have a high security clearance. I had to give up a lot more during that investigation, including having family, friends and neighbors interviewed about my character. Since this is a requirement of the job, I have nothing in my past to hide, and it means a much higher salary, I'm not going to raise too much of a stink.

Clear, on the other hand, didn't get anything from me that isn't easily available (or steal-able) to anyone with a few dollars and a couple of private detectives on the Rolodex. Go to one of these "free credit report" sites and request to see what's on that thing. You have to answer some of those questions I mentioned before, and what they have is pretty interesting, and deep.

I'd be lying if I said this laptop theft doesn't worry me. I have the feeling that the idiot who stole it probably won't even look on the damn thing, and it will turn up, drive slicked, in some pawn shop.

In the meantime, I'll keep a close eye on everything sensitive (I get lots of practice at work).

And I'll still be jumping the line at the airport.

Re:Directed to the Systems Administrator of VIP, i

[Anonymous Coward]

idiot

Re:Directed to the Systems Administrator of VIP, i

[Tom9729]

Yes it is, o non compos mentis.

No it's not.

Nice Latin by the way. :-)

The laptop has been found

[origamy]

So reports the SF Chronicle in an article from the AP:

(08-05) 11:59 PDT San Francisco, CA (AP) --

The company that runs an airport security prescreening program says they've found a laptop containing the personal information of 33,000 people more than a week after it apparently went missing.
...

Re:The laptop has been found

[Anonymous Coward]

"it was not in an obvious place..."
Happens all the time. Cleaning crew stashes item, waits to see if it's reported lost. If so, leaves it be; if not, away it goes....
We caught a cleaner at our firm doing just that by setting up a small video recorder and letting him think the secreted property went unreported.

Laptop Found

[DaveLatham]

They found the missing laptop in the room where it was supposed to be:

http://www.sfgate.com/cgi-bin/article.cgi?f=/n/a/2008/08/05/financial/f102608D05.DTL&tsp=1

goodvernal

[Anomalyst]

Does jim varney being dead affect it in any way?

what's the point of the service anyway

[Anonymous Coward]

Customer data on a laptop in a locked room is kind of odd. The fact it (or one that looks like it) was recovered IN THE SAME room a week later is even more suspicious. When you combine what the TSA just decided to do last month you wonder what is its future?

http://www.tsa.gov/press/releases/2008/0724.shtm

If the TSA is no longer doing background checks it no longer really has any security value. Then you really don't need to collect that much information about someone because it basically becomes a "skip to the front of the line" card with maybe some discounts at airport shops. You don't need that much data, you don't need the biometrics thing because it doesn't really matter who has one. It becomes little more than your frequent shopper card at your local grocery store.

Don't believe me? This is what one of Clear's competitors is resorting to:

http://www.secureidnews.com/2008/08/04/redskin-fans-can-flo-into-stadium

Re:Directed to the Systems Administrator of VIP, i

[Pictish Prince]

Thanks, but it truly is a word. Check the dictionary.

same for OK

[tacokill]

It's not just Vermont, you liberty lover.

Oklahoma and a few other states are against it too.

The laptop has been found

[virtigex]

It was found in the same office that it was left in.

Airport security is a total joke

[jfern]

The only reasonable thing that they did after 9/11 was lock the cockpit doors. Everything else is BS designed to make you think that they're doing something useful.

free open source solution?

[phaetonic]

1) Setup a web app using php and mysql
2) Use SSL cert
3) Have server hosting this data in a secured data center

You can run reports and grab data when needed, and even export data to an excel spreadsheet using the MySQL GUI tool if you don't want to code the export in php.

Drunk Drivers...

[zentigger]

...kill more people every year than a couple of crached planes. If the same amount of funding and resources went into preventing drunk driving we would all be a whole lot happier (and probably healthier because no one we be able to drive anywhere...)

Look at the state of fear people live in now. Terrorists don't have to crash planes into buildings anymore. They have already won by subverting the government propaganda machine into cultivating an environment of terror.

Re:Drunk Drivers...

[Jawn98685]

Alcohol-related traffic fatality statistics are not anywhere near sexy enough for Fox News, you insensitive clod. How are they supposed to get ratings or do any real fear mongering with run-of-the-mill "family of four killed by drunk driver" stories? I mean, really. Think of the ad revenue, man, or the expectations of Fox's higher-ups in the U.S. government's propaganda department. We can't whip the sheep into step with softball crap like that now, can we?

anonymous coward

[Anonymous Coward]

SAN FRANCISCO (AP) â" The company that runs an airport security prescreening program said Tuesday they've found a laptop containing the personal information of 33,000 people more than a week after it apparently went missing.

The Transportation Security Administration suspended new enrollments to the program, known as Clear, after the unencrypted computer was reported stolen.

Officials with Verified Identity Pass, which operates the Clear program, said the laptop was found Tuesday morning in the same office where it supposedly had gone missing.

The program allows passengers to pay to use special "fast lanes" to avoid long lines at airport security checkpoints. The laptop contained the personal information of applicants to the program.

Re:Directed to the Systems Administrator of VIP, i

[Tom9729]

Thanks, but it truly is a word. Check the dictionary.

Woohoo, grammar wars!

If you're going to prove me wrong you could at least link to the proper page. :-)

SOX applies here?

[Sunshinerat]

I was under the impression that Sarbanes Oxley would take care of this. If you are doing something you should not be doing according to your guidelines and policies, the CEO/CFO go to jail.

This is true if you mislead your investors, apparently not if you mess with your customers.

I see no difference...

Update - They found it (oops)

[Anonymous Coward]

http://www.cbc.ca/cp/Oddities/080805/K080506AU.html

"U.S. company finds missing laptop with security applicants' data

SAN FRANCISCO - The company that runs an airport security prescreening program in the United States say it has found a laptop containing the personal information of 33,000 people more than a week after it apparently went missing."

It's nothing new, and i've stated the solution....

[socz]

Like i've said before, technology isn't going to solve our airport problems, we need people power that are well trained, happy to do the job and have an incentive to keep the job.

Once again the weak link aren't the people doing the work, but the people who think up the way to do the work.

Airline tickets to North Carolina: $432
Towncar service to air port: $86
Clear system access to speed up airport process: $100
Getting your information stolen and ready for identity thieves: Priceless

THere should be a law..

[JustNiz]

There should be a law that says all personal data on any media including hard drives must be encrypted to military grade at all times.
Just having persistently-stored unencrypted personal data should be a crime, and anyone that looses personal data should have to pay significant damages to each of the people identified by the data.

The Real Problem

[Javagator]

In the US, the SSN is essentially a national ID. It wasn't intended to be. What happened? In a modern society, you need a universal means of identification. The SSN is the only nation wide number that almost every adult has. It became the national ID by default.

By not recognizing this, we continue to leave it insecure. There should be an additional password associated with your SSN. That password would be in a secure national database, and it would be unlawful for a commercial entity to store that password on a computer. They would only be able to verify that the SSN and password match by accessing the national database.

Illegal aliens would not be able to get a job with my SSN, and identity thieves would not be able to get a credit card with my name and SSN. If I suspected anything, I could change my password.

Unfortunately, if you mention a national database, some people go crazy.

Laptop found

[TornCityVenz]

According to a radio burb I heard about 15 mins ago the laptop has been located. They also mentioned that it had acually been missing for a week. Strange we only heard about it just before they located it.

SAFEBOOT at GE

[nevermindme]

Guess this GE owned bussiness is getting lax about securing laptops compaired to the other GEs my associates have contracted at. GE Corp and several GE divisions no longer issue unencrypted and force install a product called SAFEBOOT that does 256 bit encryption to almost all of the volume. This reqires a passord at startup to load the OS. Unfortunatly if they have stolen a unlocked active laptop with safeboot its a 99% likelyhood that the startup password matches one of the other passwords in the PHB cache. GE aquires bussinesses every day of the week and it is quite a process to intergrate bussinesses into the fold but there is no excuese for any laptop to walk out of the build room that is not at least volume encrypted. Any company licened or built program requiring a local database need be rebuilt in a seriose way. GE has literly 10k plus Citrix/Remote Desktop servers just to support their moblie workforce and has deployed and had a 1/1 ratio of VPN users and RSA hardtokens to laptop users.... at least i AM TOLD. Shame on the program manganger, the IT manager that let unencrypted data be stored localy, shame on the CIO and shame on the CEO for not taking the last 6 years of articles in the WSJ seriously.

Re:Directed to the Systems Administrator of VIP, i

[Anonymous Coward]

I'm a programmer for a company with thousands and thousands of customers and their SSNs. If I could set the policy, our customers SSNs would be protected too. Unfortunately, I can't, and they're not.

In most companies, understanding security and pushing for improvements brands you as a tinfoil-hat nutjob. About the best you can do is set up the email and paper trail so that when the CEO or HR director loses their laptop, they stand absolutely zero chance of being able to point a finger at you or claim it was anybody's fault but their own.

The flip side is: Don't EVER give your SSN to a private company. They will not protect it.

QED

[bill_mcgonigle]

I have a feeling everyone on the plane would fight it.

You have a feeling? This was proven an hour and twenty minutes after the first plane hit the Twin Towers, by ordinary Americans correctly assessing the security situation over a field in Shanksville, PA.

Then we hardened the cockpit doors to make double-sure. Everything since then has been a distraction.

No Pay For Performance

[bill_mcgonigle]

"The whole point of outsourcing information and jobs like this to the private sector is to get the job done better and more efficiently."

which never pans out.

We pay for failure. What do you expect?

I suspect if we only paid for working product, with payment upon delivery/agreed validation, government contractors would get alot better. Or, rather, only the good ones would survive. Yes, part of that is having a better specification process.

Right now to be a government contractor the primary qualification is having a large team of lawyers and accountants.

Moral Responsibility

[bill_mcgonigle]

Like the sysadmin really had a say in this. He probably asked for that a thousand times.

Any competent, ethical, sysadmin in this position would have quit in protest, making very large noises about why he was doing so, especially pointing out the real risk to American lives (allowing the premise of the system for the sake of argument) and then blowing the whistle.

Re:Moral Responsibility

[mac1235]

I have children to feed, you insensitive clod!

Re:Moral Responsibility

[bill_mcgonigle]

I have children to feed, you insensitive clod!

Exactly. Thanks. :)

Re:Directed to the Systems Administrator of VIP, i

[supernova_hq]

And the ironic thing is he is probably going to be the one blamed for the leak!

Let me just say...

[symbolset]

Many here are complaining of incompetence in the TSA and other government agencies.

Let me express my affinity with Sam Clemens, Thomas Jefferson and many others when I say: I prefer them this way and so should you. You have no idea how abhorrent the government could be with the trillions of dollars at their disposal. Let us pray they don't become more effective. Please?

What once was lost

[JustOK]

CNET is saying the laptop wasn't stolen: http://news.cnet.com/8301-1009_3-10008094-83.html?part=rss&subj=news&tag=2547-1_3-0-5

It was just misplaced...

Obligatory

[vegiVamp]

> This is slashdot, not digg, and I hope that we have the capability to hold discourse to a higher standard.

Ymbnh.

incompetence in Homeland Security contractors

[alizard]

is par for the course. I wouldn't be surprised if there was a thief, who put it back in the office after copying the data and making a few little additions. . . e.g. adding the entire membership of al-Queda to the list of people who get fast-tracked through security.

Another issue...

[lord_sarpedon]

It concerns me that credit card numbers and social security numbers are these all-important pieces of "your identity" that must be carefully safeguarded at all costs. Nobody can know! Except all those entities that ask for then. Like these 'Clear' guys. And exactly 9,267 waiters.

Proof of identity that is equivalent to the identity itself, in entirety, hmmm? Why can any number of people impersonate you, but are trusted not to? Why can your identity be "stolen" from a third party?

I cry for the day when society at large discovers what the sweet loving fuck a private key is, and perhaps even a respectable comprehension of what defines "secure." Security is not so just because your government and the man in the uniform assures you that things are _better_ now, or even simply that the status quo is _perfectly fine_. It's a small subset of your typical Americans (in my experience) that when presented with the latest breakthrough in airport security, have a response beginning with "Couldn't they still just..."
Most are sheep. And a lot of the smarter ones still feel just a teensy bit better.
It doesn't take a hacker's mindset to poke holes in the elaborate security handwavings presented day to day. Do they not care?

Identity is a funny thing here. People are scared shitless of a big brother style national ID card, but line up for state drivers licenses, of which fakes are made plentiful to satisfy the desires of even the most low budgeted of teenagers. Supposedly the government knows you exist if you have a birth certificate. SSN supposedly optional, but I'd love to see someone try. But the government as well as everything private seems to forget who you are from building to building - each asking you again for that same basic info. In practice most things are just as anonymous as they are online. Go ahead, lie about whatever you want. See if they notice. I'm Nat Tellin half the time.

Think for a moment about how you would create a 'new' identity. How terribly possible it is to simply disappear, and pop up again somewhere else as a new person. Bonus points for looking totally benign under scrutiny - perhaps you 'immigrated' from Canada using some thin mask of false credential. Just as long as you keep telling the same lies to all the right people, really. At what point have you succeeded? Genuine but falsified photo id? SSN? Credit history?

All that defines you is ability to provide a series of opaque alphanumeric values that you freely give to most anyone, but are next to impossible to verify.

Citizen: Do not question the fundamental issue

[andersen_hc]

Do not question the fundamental issue that this is morally wrong and you are being slowly squeezed into a little cage, without resisting us. Instead, we promise we won't do it again. Oops, heh, sorry!

Plan B, please.

[mwhelan]

When the physical security of airline passengers is at stake, wouldn't it be a good idea to have a Plan B that gives an agency the option to destroy data if a breach is suspected? If that laptop hadn't turned up, or in the case that the laptop was stolen, breached and returned, the data contained within could make it easier for dangerous people to travel undetected. This puts anyone who travels by plane at risk. Even full-disk encryption isn't a failsafe. The option to remotely destroy data seems like a reasonable one when it comes to people's lives. http://pcsecurityblog.beachheadsolutions.com/2008/08/06/tsa-fails-to-secure-trusted-traveler-data/

Re:Directed to the Systems Administrator of VIP, i

[Anonymous Coward]

From your own second link: "There is a verb "to effect". It is quite rare, but useful in business writing. It means "to bring into being."". The flow of the sentence obviously indicates that the idea is to bring changes of policy into being. Thus, effect would be the appropriate verb for the situation.

"Someone Who Has More Than A Passing Chance Of Effecting Change In Policy"