Schneier on Security
A blog covering security and security technology.
« New Book: Schneier on Security |
| UK Ministry of Defense Loses Memory Stick with Military Secrets »
September 15, 2008
Change Your Name and Avoid the TSA Watchlist
Shhhh. Don't tell the terrorists:
The U.S. Department of Homeland Security wrote a letter to Labbé in 2004, saying he had been placed on their watch list after falling victim to identity theft. At the time, the department said there was no way for his name to be removed.
Although Labbé wrote letters to the U.S. department, his efforts were in vain, prompting him to legally change his name.
"So now, my official name is François Mario Labbé," he said.
"Then you have to change everything: driver's license, social insurance, medicare, credit card -- everything."
Although it's not a big change from Mario Labbé, he said it's been enough to foil the U.S. customs computers.
Posted on September 15, 2008 at 1:25 PM
• 30 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
The plain English meaning of "theft" is that the victim no longer possesses what was stolen, but the thief does.
I've been wondering how "identity theft" fit with that. Now we know!
Looks like Foxdie is coming...
I'm sure the resemblance of François Mario Labbé's name to the author of "Diet for a Small Planet" is pure coincidence.
Maybe someone in the government remembered him, noticed that he changed his name, and figured:
1. It's the perfect way to tell between fake (potential terrorist) Labbe and real Labbe; and
2. Even though our software caught this, let's give the poor guy a break and put his new name on a whitelist.
You never know!
I've been wondering if you could work this the opposite way, by changing your name to, say, Michael Chertoff or Edward "Kip" Hawley, and then get yourself *on* the no-fly list.
What about identity thieves that steal identities then legal change those identities! Aha! And they change those names to other names they have already stolen (Jim Red becomes Mark Stone and Mark Stone becomes Jim Red)! Then they give the "new" id back to their "old" owners! That will mess with TSA's head...(its messing with mine, advil time...)...
This is my favorite part:
Liberal Senator Colin Kenny says his son, a lawyer, has the same problem and that Transport Canada is powerless to help.
Officials at the agency said "'it's not my problem, go and talk to the Americans,'" Kenny told CBC News.
Isn't Kenny part of a sovereign government? Isn't there something they could do -- like refuse to cooperate with a system so completely broken? Or is he just a state senator for the 51st state?
Somebody should change their name to 'George W. Bush' or the name of a top judge and then do something innocuous, but likely to get their name on the list, and something might actually get done about this stupid list!
The problem occurs when trying to enter the US, so Canada being a sovereign government doesn't mean they can make the US stop being stupid to people who enter the US.
Wonder how many people would agree to change their name to Dick Cheney just to see how the system reacts?
As discussed in 2004, it is like someone thinks Kafka's "The Trial" is a playbook for American security policy rather than a fictional thriller:
"In the book, a vast faceless bureaucracy constructs a huge dossier about a person, who can’t find out what information exists about him in the dossier, why the information has been gathered, or what it will be used for."
The book's ending is not pretty.
Doesn't Canada forward data to the US on passengers flying into the US? Isn't that the backside of the system? Can't they play games on their cooperation with this system? Or add some bureaucratic foolishness that tends to inconvenience American flyers?
This is an old game. Even little countries know how to play this - but Canada seems to lack the chutzpah to do anything. Like I said, 51st state.
Getting W or Dick Cheney on the list won't matter. Those guys never have to deal with the consequences.
Also works, based on my own experience: Book a ticket using your middle name, middle initial, or full name: Jonny middlename smith.
Used to be I couldnt check in online etc etc, this method fixed that.
Wouldn't this be the easiest way to catch the ID thief? As soon as "Mario Labbé" flies, they know they have the fake Mario Labbé, and he can be arrested.
$10 Bucks says he's back on the list now.
So if Osama changed his name to for instance Osama Bush Laden he could just travel without hassle.
Since the info they can see include the previous names, also from other countries, do they simply ignore those fields? Too much vertical scrolling for TSA?
It is probably a good time to get a brand new identity - go down to Texas and pretend to be a flood victim. Look dirty and bedraggled, splash some booze on your T-shirt and show up at a shelter, claiming that you had some menial job, lived in someone's garden shed and lost everything. Eventually, you should be able to get a new SIN and other papers. This should be a lot easier than trying to get a green card.
Part of the problem is that passenger info has to be turned over to US security if the flight passes through American airspace. About 3/4 of all Canadian flights do. So in the case the Senator's sons, they can't even fly within Canada.
Sigh. Back when TSA was threatening to put anyone who showed up without ID onto the no-fly list late, you could have a lot of fun. Show up, claim to be a friendly rival -- and watch as your friendly rival spends the rest of his life trying to fly. hahahaha.
This actually works: a colleague of mine from the US, has a rather common name, and apparently this name is on the list. He was stopped and checked at security checkpoints more frequently than statistically possible, when he had to fly for his work.
Someone suggested to add his middle initial to his name when making reservations and checking in... Bingo, no more checks for him since.
That hurts my head to think they don't parse the name fully and that a extra character or two (valid as it may be) can completely break it. Would the same work for someone named Joseph and uses Jos.?? Albert / Bert? Jr. Sr. III?
Here's an idea. Execute a long string of name changes, accumulating valid IDs along the way. End with your original name, so you don't have to really change everything. Using the names of each of a bunch of famous people you hate, get on the list. Resume life as yourself. Hilarity ensues.
(Okay, okay, in most places it takes too long to change your name, for this to happen in a reasonable amount of time. Fine. I didn't say it was a GOOD idea....)
@curtisk: Bingo. That's kinda the point of the whole ridicule we've been subjecting the No-Fly List to for, well, as long as it's been around. Between the ineffectiveness and the side-effects, the entire concept is just so incredibly stupid, as a security measure, that the only explanation that makes any sense at all, is that it's not really for the sake of security, but part of a process to desensitize people to a planned police-state. (No, I don't believe that myself -- government actions don't HAVE to make sense of any kind, and this is merely the latest example.)
A more likely explanation is the list is purely a bureaucratic CYA. If they were to stop using the list and some terrorist (or even someone vaguely resembling a suspicious person, like the artist formerly known as Cat Stevens) actually DID get on an airplane under his/her own name, then the public outrage against the bureaucrats would mean Heads Would Roll. Since bureaucrats are quite aware of this, and since current public against the list is diffuse and not directed against any one in particular, the safest course of action (from a CYA viewpoint) is to leave the list in place, regardless of how stupid or ineffective it is demonstrated to be. In other words, no bureaucrat ever got fired for continuing a stupid but ineffective "security" policy, but some HAVE gotten fired for removing policies that bear some trappings of security.
I think this could open opportunities for a new recession-proof business.
Want to be able to fly without hassle? Buy yourself a new name!
We can change your name to Bruce Schneier for $500, Michael Jackson for $50, or Dick Cheney for $50000. Call now, operators are standing by!
Those recommending someone change their name to "George Bush" or "Dick Cheney" should really consider whether those people are even going to fly regular airlines.
They'll take their private jets.
There is a vector of attack here, however, as I am willing to bet that not everyone in the higher ups of the US Gov't has their own private jet.
If this avoidance of the No Fly List is possible, then the whole No Fly List is more useless the it already was. If regular people can change their names, the "so called" terrorist suspects can also change their names and avoid the No Fly list.
A quick search on Google shows there are a number of companies in different countries that will facilitate a change of name for a small fee, including providing customised forms for hundreds of companies and govt. organisations.
Identity infringement, then?
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.