TSA matching ID's

[renderman]

http://abcnews.go.com/Travel/bill-or...ory?id=9005125

TSA wants ID's to match boarding passes exactly, but airline systems can't handle apostrophes common in Irish and other names.

This article brings up the interesting point of any security model. What if the model is so poorly designed it can't handle a common type of name. In this case it's failing closed instead of causing an exception requiring further scrutiny.

Also not mentioned is what if someone has an exceedingly long name? I knew a person with 4 names and 2 hyphens. There is no way in hell you could fit all of that on a boarding pass.

Anyone have a name likely to have problems like this?

[jmac]

Re: TSA matching ID's

Even something as simple as capitalisation could also cause an issue. McD or McQ, etc. would more than likely be screwed up (again with the Irish or Scottish). I can honestly say that about 90% of the time its wrong for me and they either forget the capital on the 3rd letter or capitalise the 'c' in the middle.

Now I don't know if capitalisation is an issue to the TSA (I guess it depends if they're using Windows or Linux :) ) but if they're going to have an issue with apostrophes or hyphens then capitalisation is about the same level of ridiculousness.

[eris]

Re: TSA matching ID's

Airlines routinely break off the last two letters of my husband's first name. It NEVER matches his ID because of this. Has to do with the spacing of his first, middle, last which is ridiculous really. Even one of his credit card companies did it and that has caused no end of issues when a retailer actually bothers to ask for matching ID. It isn't like it is a strangely long name either.

[noid]

Re: TSA matching ID's

This will move us several huge steps forward in our plans to keep Klingons and the Old Gods off airplanes. I for one welcome the move.

In other news, the TSA still manage to find a way to fail without even trying. Good job!

[streaker69]

Re: TSA matching ID's

This will move us several huge steps forward in our plans to keep Klingons and the Old Gods off airplanes. I for one welcome the move.

In other news, the TSA still manage to find a way to fail without even trying. Good job!

There's actually a much larger segment of the population this affects other than ancient gods and Klingons. Many Hawaiian names contain an apostrophe, and the inter-island flights over there are about the same as getting on a city bus.

Speaking of the idiocy of the TSA, when my wife and I were on our Honeymoon in Hawaii, we were in line to board our flight from Maui to Oahu, and we had a TSA agent put a red mark on our tickets. While we were at the gate waiting for the flight we got to talking with another couple and they mentioned that they've been 'randomly' selected for extra searches for every flight they've had because all their tickets were one-way tickets, because she worked for the airline and got discounts for buying the tickets that way. We told them about our red mark and they told us that was there to tell the gate agent to pull us aside for a 'random' check.

Since it was an inter-island flight, seating is first come first serve, so the four of us were about 1st in line, with them ahead of us. Sure enough, they got pulled aside for a random check, but we didn't, probably because it would have looked silly to have the first four people pulled aside for random checking. But they did give us a funny look when they saw our ticket with the red mark.

We were nice though and saved seats for the other couple since they were one of the last to board.

[Thorn]

Re: TSA matching ID's

...
TSA wants ID's to match boarding passes exactly, but airline systems can't handle apostrophes common in Irish and other names.
...

A lot of mainframe databases don't play nice with non-alphanumeric characters, especially the legacy systems. Part of the problem too, is "what exactly IS that character?" (Apostrophe? Single quotation mark start/left? Single quotation mark end/close?) and "what exact character set do we agree on?" Alphanumerics are easy assuming you just stick with the US English, but it can get real complex once you step away from the basic A-Z and 0-9.

...
This article brings up the interesting point of any security model. What if the model is so poorly designed it can't handle a common type of name. In this case it's failing closed instead of causing an exception requiring further scrutiny.
...

Your assumption about the security model is inverted from the TSA's poin of view though, so you're assumptions are incorrect, at least from the way the TSA looks at it. You (as a passenger) want to get on the plane you've bought a ticket to travel on. However, think about the TSA's mission. They don't care about passengers reaching destinations or even getting on planes. They care about airplanes being highjacked or bombed. Failing closed means that some passengers don't get on planes, but the plane is safer.

...
Also not mentioned is what if someone has an exceedingly long name? I knew a person with 4 names and 2 hyphens. There is no way in hell you could fit all of that on a boarding pass.
...

That's a straight forward matter of field length (and printing room on the boarding pass). What is more complex is the the North American and European airline reservation model is based on FIRST_NAME = GIVEN_NAME and LAST_NAME = PATERNAL_FAMILY_NAME, and there is an assumption that government-issued identification will follow this same model. Unfortunately, many other countries and cultures have a different model where FIRST_NAME = PATERNAL_FAMILY_NAME and LAST_NAME = GIVEN_NAME. There are also other models (e.g. Iberian and Chinese, if I recall correctly) that incorporate maternal names, paternal names, and other things such as the city of birth. Individuals who come from such cultures may use several different combinations of names that are all valid, but don't fit the assumed model. Those kind of assumptions can cause all sorts for problems for officials trying to interpret IDs.

[valkyrie]

Re: TSA matching ID's

http://abcnews.go.com/Travel/bill-or...ory?id=9005125

TSA wants ID's to match boarding passes exactly, but airline systems can't handle apostrophes common in Irish and other names.

This article brings up the interesting point of any security model. What if the model is so poorly designed it can't handle a common type of name. In this case it's failing closed instead of causing an exception requiring further scrutiny.

Also not mentioned is what if someone has an exceedingly long name? I knew a person with 4 names and 2 hyphens. There is no way in hell you could fit all of that on a boarding pass.

Anyone have a name likely to have problems like this?

This topic was originally addressed by yours truly back in May, 2009 and can be found in DefCon Community archives. Yes, I have a name that horks the system, just as many others apparently do. Thorn, I suggest you get consulting big bucks for your understanding of the problems associated with this narrow-minded play at security theater.

Regards,

valkyrie

[Thorn]

Re: TSA matching ID's

Thorn, I suggest you get consulting big bucks for your understanding of the problems associated with this narrow-minded play at security theater.

I should!

None of this is exactly new or unknown in law enforcement; I dealt with some of these ID and database problems back in my prior career. The TSA is just adding another layer of complexity to it, and IMO, trying to get legacy airline databases to conform to the way they think it should be is going to fail. The fact of the matter is though, the TSA doesn't seem to have any incentive to reduce false positives, and seems to be driving efforts that will do nothing but increase false positives.

[valkyrie]

Re: TSA matching ID's

I should!

None of this is exactly new or unknown in law enforcement; I dealt with some of these ID and database problems back in my prior career. The TSA is just adding another layer of complexity to it, and IMO, trying to get legacy airline databases to conform to the way they think it should be is going to fail. The fact of the matter is though, the TSA doesn't seem to have any incentive to reduce false positives, and seems to be driving efforts that will do nothing but increase false positives.

Agreed. As was earlier noted, there is no incentive on the part of the TSA to get my butt into an airline seat. The TSA merely exists to make a traveler suffer indignities that are all part of security theater and to force airlines to spend money on their legacy systems that probably could be better expended elsewhere in their business chain. I expect a major fail.

Regards,

Valkyrie

[Angel x Jess]

Re: TSA matching ID's

So.. what other options would the TSA have other than redoing their entire system? Is there an easier way to incorporate a global initiative for airlines instead of just a continental one? It seems like this is just one more way for people who think they know what they are doing to make the lives of those who do know what they are doing more complicated. I for one hate airports enough already. The last thing I need is a pointless check for something that has absolutely nothing to do with any previous suspicion.

[AgentDarkApple]

Re: TSA matching ID's

To me, it sounds like a way for TSA to help the airlines rip people off. From the article: "The Transportation Security Administration will soon insist on matching passengers' boarding passes to their IDs - including any apostrophes hyphen and initials." People probably don't tend to notice the "initials" part.

I have my first, middle, and last names on my mil ID, license, and passport (as do thousands of other people). But when you book a flight, some airlines discard your middle name/initial all together. So if the airline by default lists me as First Last instead of First Middle Last and refuses to change it due to their weird ticketing policies, I'm going to get screwed. I can just think of all sorts of issues with this policy. The O'Names or the Hyphenated-Names are the more obvious issues, but it doesn't stop there. I know of Asian people who might really be named something like Kim Jong Il, but decide to go by a more "Western" name like "John Kim". I also knew a guy who, no kidding, had FOUR middle names - his initials ended up being EOEGGB. In most cases, his full name will not fit on an ID/license or a boarding pass, so he has to default to E____ O____ B_____ . However, on something like a passport, he would have all 6 names. I hope the kid never has to leave the country, or he is going to have issues with TSA! I guess this will also be the end of companies booking flights for employees, as the company may not know EXACTLY how the person's name appears on his/her ID.

[streaker69]

Re: TSA matching ID's

To me, it sounds like a way for TSA to help the airlines rip people off.

Ok, I followed everything else that you said, because it follows basically what everyone else has said. But, I'm failing to see how this applies. How is this going help the airlines rip people off?

[AgentDarkApple]

Re: TSA matching ID's

Ok, I followed everything else that you said, because it follows basically what everyone else has said. But, I'm failing to see how this applies. How is this going help the airlines rip people off?

A lot of airlines will not re-issue a ticket with a different name once you have booked the flight. Unless someone changes the policy, if the TSA will not let you on the flight due to issues with the ID not matching, then you will likely have to buy a new ticket. I've actually heard of a similar problem before with a girl who got married and her husband had booked their honeymoon flight with her FirstName NewLastName, but since her ID still said FirstName MaidenName, she couldn't fly with that ticket.

[theprez98]

Re: TSA matching ID's

Instead of trying to get the same exact name on every ID, how about try a different approach: use different variations of your name on different IDs. Then pick the one that matches whatever the airline spits out.

My DL does not have my middle name/initial on it, but my passport does...

Probably not practical, but still.

[Thorn]

Re: TSA matching ID's

This topic was originally addressed by yours truly back in May, 2009 and can be found in DefCon Community archives.

https://forum.defcon.org/showthread.php?t=10400

Here's the original thread. I'd forgotten how much we'd discussed a lot of the same issues.