I'm in the middle of finishing up a paper on airport security right now. I hope to make it public in the next couple weeks. I've been doing a lot of research, digging out quotes, facts, figures, etc. I came across this fantastic quote from John Gilmore in a discussion at the Volokh Conspiracy:
At United they eventually offered me a choice of showing an ID, consenting to an unspecified but intensive search, or not being able to buy a ticket. My lawyer always told me to never consent to a search -- if they have the right to search you, then they don't need your consent.
+1.
--------------
Which brings me to the topic of today's blog entry. On Feb 7, TSA announced that they were partnering with the National Center for Missing & Exploited Children to help find kidnapped children. TSA will circulate information such as photos and descriptions of the abducted child, the suspect and vehicle - to all of their screening officers.
Why is this a bad idea?
1. TSA can barely accomplish their primary task - keeping bombs and weapons off airplanes. In Red Team style tests at New Jersey airport last year, TSA failed to catch 20 out of 22 attempts to smuggle prohibited items past checkpoints.
2. Children do not have ID, typically and TSA does not require them to have ID when they travel, even when with parents.
3. The vast majority of children travelling through the airport system have not been kidnapped. Just as the vast majority of passengers detained or selected for secondary screening by TSA are not terrorists. Thus, the chances are that most of the children/parents who are detained by TSA for being suspect child-nappers are going to be innocent.
Remember, a 1% false positive rate with 2 million passengers a day is still a lot of false positives.
4. Since children have no ID, if you do happen to steal a child - TSA has no way of proving that the kid isn't yours. Kids tend to look alike - esp. the younger ones - and a 10 dollar an hour TSA screener is certainly not going to be an expert on the subject.
Bruce Schneier believes that the no-fly list has not caught a single terrorist. However, it has caused serious inconveniece to a number of innocent travellers - Esp. Maher Arar, a Canadian citizen who the US renditioned to Syria and had tortured for a year after his name was incorrectly included on the no-fly list, thanks to incorrect intelligence provided by the Canadian government.
These are the kinds of false positives we have to face already due to the no-fly list. With the introduction of the Ambert Alerts at TSA, we now have a whole new class of potential false positives that will cause significant delay and hastle to passengers.
On the upside, perhaps after a few highly public wrongful arrests initiated by TSA staff, parents will stop flying as much - and thus significantly reduce my chance of having a screaming baby, or annoying seat-kicking child directly behind me on a flight .... just kidding ;)
Showing posts with label no-fly list. Show all posts
Showing posts with label no-fly list. Show all posts
Thursday, February 22, 2007
Tuesday, February 13, 2007
TSA has outsourced the TSA Traveler Identity Verification Program?
Feb 20 2007 Update: TSA took the site down, and has put it back up again. They've fixed a few of the problems, but the website is still outsourced, and still uses cookies (a violation of federal policy). See more here
Browsing TSA's website this evening, I came across a link to the new TSA Traveler Identity Verification Program.
"The TSA Traveler Identity Verification Program is designed to assist those airline passengers who have been delayed or prevented from traveling as a result of TSA's security measures."
The site is specifically aimed at passengers who have suffered from any of the following problems:
* Unable to print Boarding Pass at Kiosk/Home
* Directed to Ticket Counter every time I fly.
* Ticket Agent states that I am on a Federal Government Watch List
* Missed flight while attempting to obtain boarding pass
You can submit a handy-dandy form online to register your request/complaint.
Two things immediately jump out at me.
1. You are required to enter sensitive information from three of the following forms of identification:
A non-U.S. Passport, Voter Registration Card, Immigrant Visa, Driver's License, Birth Certificate, Government Identification Card, Naturalization Card, Military Identification Card, Certificate of Citizenship, DD Form 214.
These are very sensitive bits of info. A drivers licence number in particular, is often used by banks (due to Patriot Act provisions) to authenticate you when you open an account.
Worst of all - the form you submit doesn't go over an SSL connection! It goes plaintext over the wire. Heaven forbid you do this from an airport starbucks after being denied boarding, as anyone could sniff your info.
The relevant bit of code in question: form method=POST action=/pivf.htm
Now, they do at least have a ssl webserver running at https://rms.desyne.com/. But they're using a self-signed cert.
Update: I want to make it clear. I've only tested this by pressing submit on an empty form, and by viewing the source code to the form. To tell for sure, I'd have to submit a request to TSA - with bogus data.. and my now finely tuned "will TSA investigate me for this" radar tells me that submitting false information to an official government request form is a bad bad idea.
I searched the source for the words "https" - nothing.
I also found the 'form method' section, where it describes how the form is submitted.
It's quite possible that the creators of the website have created some kind of url-rewriting javascript sneaky tricks - although Occam's Razor leads me to believe that a simple mistake on a web designer's part is far more likely....
2. Unlike the rest of the TSA website, this is served from a different domain: http://rms.desyne.com/
Which means that a private company is running this site...
The whois database shows as follows:
Administrative Contact, Technical Contact:
Desyne, Inc. dns@DESYNE.COM
Desyne Web Services, Inc.
PO Box 143
Boston, VA 22713
US
(703) 391-2400 fax: (703) 391-2550
Record expires on 21-Mar-2015.
Record created on 20-Mar-1996.
Database last updated on 13-Feb-2007 21:32:10 EST.
This begs the question: Who are these guys, why don't they know how to use SSL and how were they awarded this sweet contract?
Why can't TSA do a simple form submission themselves?
Browsing TSA's website this evening, I came across a link to the new TSA Traveler Identity Verification Program.
"The TSA Traveler Identity Verification Program is designed to assist those airline passengers who have been delayed or prevented from traveling as a result of TSA's security measures."
The site is specifically aimed at passengers who have suffered from any of the following problems:
* Unable to print Boarding Pass at Kiosk/Home
* Directed to Ticket Counter every time I fly.
* Ticket Agent states that I am on a Federal Government Watch List
* Missed flight while attempting to obtain boarding pass
You can submit a handy-dandy form online to register your request/complaint.
Two things immediately jump out at me.
1. You are required to enter sensitive information from three of the following forms of identification:
A non-U.S. Passport, Voter Registration Card, Immigrant Visa, Driver's License, Birth Certificate, Government Identification Card, Naturalization Card, Military Identification Card, Certificate of Citizenship, DD Form 214.
These are very sensitive bits of info. A drivers licence number in particular, is often used by banks (due to Patriot Act provisions) to authenticate you when you open an account.
Worst of all - the form you submit doesn't go over an SSL connection! It goes plaintext over the wire. Heaven forbid you do this from an airport starbucks after being denied boarding, as anyone could sniff your info.
The relevant bit of code in question: form method=POST action=/pivf.htm
Now, they do at least have a ssl webserver running at https://rms.desyne.com/. But they're using a self-signed cert.
Update: I want to make it clear. I've only tested this by pressing submit on an empty form, and by viewing the source code to the form. To tell for sure, I'd have to submit a request to TSA - with bogus data.. and my now finely tuned "will TSA investigate me for this" radar tells me that submitting false information to an official government request form is a bad bad idea.
I searched the source for the words "https" - nothing.
I also found the 'form method' section, where it describes how the form is submitted.
It's quite possible that the creators of the website have created some kind of url-rewriting javascript sneaky tricks - although Occam's Razor leads me to believe that a simple mistake on a web designer's part is far more likely....
2. Unlike the rest of the TSA website, this is served from a different domain: http://rms.desyne.com/
Which means that a private company is running this site...
The whois database shows as follows:
Administrative Contact, Technical Contact:
Desyne, Inc. dns@DESYNE.COM
Desyne Web Services, Inc.
PO Box 143
Boston, VA 22713
US
(703) 391-2400 fax: (703) 391-2550
Record expires on 21-Mar-2015.
Record created on 20-Mar-1996.
Database last updated on 13-Feb-2007 21:32:10 EST.
This begs the question: Who are these guys, why don't they know how to use SSL and how were they awarded this sweet contract?
Why can't TSA do a simple form submission themselves?
Subscribe to:
Posts (Atom)