Special Report in the Guardian... boarding pass privacy and identity theft concerns

[Deviant Ollam]

anyone else see this article in last week's Guardian?


Q. What could a boarding pass tell an identity fraudster about you? A. Way too much

A simple airline stub, picked out of a bin near Heathrow, led Steve Boggan to investigate a shocking breach of security.

This is the story of a piece of paper no bigger than a credit card, thrown away in a dustbin on the Heathrow Express to Paddington station. It was nestling among chewing gum wrappers and baggage tags, cast off by some weary traveller, when I first laid eyes on it just over a month ago.

The traveller's name was Mark Broer. I know this because the paper - actually a flimsy piece of card - was a discarded British Airways boarding-pass stub, the small section of the pass displaying your name and seat number. The stub you probably throw away as soon as you leave your flight.

the piece describes how the relatively small (and considered by many to be worthless) piece of paper, discovered in a dumpster dive, allowed the author and a his coputer-savvy friend to easily uncover the taveller's personal info, private statistics, etc etc.

this is all made possible, the article claims, by the fact that the american-implemented CAPPS "security" system operates by culling and maintaining vast databases of personal info. information that has absolutely no relevance to your flight (banking details, home life, etc) is tossed about by a wide range of computers, all of which have varying security.

this sort of thing pisses me off to no end, and it is the reason that i will likely plan a flight out to defcon with lots of lead time in order to make a fuss at the airport and possibly demand the right to fly without showing ID. (something i'm told it's possible to do under certain circumstances)

in any case, it's a great example of how baloney, feel-good "security" measures do more to harm us than protect us.

[robosycho]

The only issue is that while not relevant to the flight, some of it is important for security measures. Perhaps they should separate the systems? If you have a flight, they can check you at the security station separate from your flight entirely rather than having everything lumped into one? And I would like to know how its possible to demand that you be allowed to fly without ID. Of course, you could just shred the ticket into even smaller pieces... But thats just another thing to remember when flying, so its not very helpful if you forget.

[renderman]

As with any database of information, all someone needs is a point at which to start. A boarding pass is no different than the other 1,000 things we're not supposed to throw away or let fall into bad people's hands.

The point of CAPPS (the theory anyways) is that all that personal info paints a threat picture. A guy with a house, 2.5 kids and a minivan is less of a threat than a guy with no assets, no fixed address, suddenly showing up with a 1 way, first class ticket. The logic is there, but seriously flawed since there is no verification of the information in the database and lord help you if it's wrong.

The other problem is that short of rectal... I mean retinal imaging, there's no way to tell 'john smiths' apart. If you happen to have the same name as some crook used as an alias, your screwed. Infants and even Ted Kennedy (does he even fit in one seat?) have been denied flights.

Any document linked to a database should be *COMPLETELY* destroyed after it's no longer needed. Even then, some companies don't make it hard for thieves to do thier thing...

http://www.cockeyed.com/citizen/cred...lication.shtml

[noid]

Heh, I just realized that the computer security expert is none other than Defcon's own Major Malfunction.

[Deviant Ollam]

And I would like to know how its possible to demand that you be allowed to fly without ID.

it's easily possible. you show up, give them your ticket, and say "i don't have any ID." i'm absolutely no security risk whatsoever to them. i'm not flying with checked bags, i'm more than willing to walk through the metal detectors and have a bomb-chem swab applied to my clothes or shoes, etc. they have determined that i'm not carrying a weapon or any explosives at that point. all cockpit doors are reinforced steel and locked during flight, so i'm not capable of doing anything to the plane. they have absolutely ZERO need for my identity in order to make the flight any "safer" for the crew or passengers.

Heh, I just realized that the computer security expert is none other than Defcon's own Major Malfunction.

hah! i didn't know that. so many people here in this community i know by nick only, and not real name. it makes for funny conversations during family dinners....

"well you know, a friend of mine has told me that we're already making black incursions into Iran."
"really? who's this friend of yours?"
"someone in the intelligence community"
"what's his name?"
"i can't say."
"he is so exceedingly classified?"
"uhm, no... actually, i only know him as <insert crazy handle here>"