TSA Lied About Protecting Passenger Data

According to the AP:

The Transportation Security Administration misled the public about its role in obtaining personal information about 12 million airline passengers to test a new computerized system that screens for terrorists, according to a government investigation.

The report, released Friday by Homeland Security Department Acting Inspector General Richard Skinner, said the agency misinformed individuals, the press and Congress in 2003 and 2004. It stopped short of saying TSA lied.

I’ll say it: the TSA lied.

Here’s the report. It’s worth reading. And when you read it, keep in mind that it’s written by the DHS’s own Inspector General. I presume a more independent investigator would be even more severe. Not that the report isn’t severe, mind you.

Another AP article has more details:

The report cites several occasions where TSA officials made inaccurate statements about passenger data:

  • In September 2003, the agency’s Freedom of Information Act staff received hundreds of requests from Jet Blue passengers asking if the TSA had their records. After a cursory search, the FOIA staff posted a notice on the TSA Web site that it had no JetBlue passenger data. Though the FOIA staff found JetBlue passenger records in TSA’s possession in May, the notice stayed on the Web site for more than a year.
  • In November 2003, TSA chief James Loy incorrectly told the Governmental Affairs Committee that certain kinds of passenger data were not being used to test passenger prescreening.
  • In September 2003, a technology magazine reporter asked a TSA spokesman whether real data were used to test the passenger prescreening system. The spokesman said only fake data were used; the responses “were not accurate,” the report said.

There’s much more. The report reveals that TSA ordered Delta Air Lines to turn over passenger data in February 2002 to help the Secret Service determine whether terrorists or their associates were traveling in the vicinity of the Salt Lake City Olympics.

It also reveals that TSA used passenger data from JetBlue in the spring of 2003 to figure out how to change the number of people who would be selected for more screening under the existing system.

The report says that one of the TSA’s contractors working on passenger prescreening, Lockheed Martin, used a data sample from ChoicePoint.

The report also details how outside contractors used the data for their own purposes. And that “the agency neglected to inquire whether airline passenger data used by the vendors had been returned or destroyed.” And that “TSA did not consistently apply privacy protections in the course of its involvement in airline passenger data transfers.”

This is major stuff. It shows that the TSA lied to the public about its use of personal data again and again and again.

Right now the TSA is in a bit of a bind. It is prohibited by Congress from fielding Secure Flight until it meets a series of criteria. The Government Accountability Office is expected to release a report this week that details how the TSA has not met these criteria.

I’m not sure the TSA cares. It’s already announced plans to roll out Secure Flight.

With little fanfare, the Transportation Security Administration late last month announced plans to roll out in August its highly contentious Secure Flight program. Considered by some travel industry experts a foray into operational testing, rather than a viable implementation, the program will begin, in limited release, with two airlines not yet named by TSA.

My own opinions of Secure Flight are well-known. I am participating in a Working Group to help evaluate the privacy of Secure Flight. (I’ve blogged about it here and here.) We’ve met three times, and it’s unclear if we’ll ever meet again or if we’ll ever produce the report we’re supposed to. Near as I can tell, it’s all a big mess right now.

Edited to add: The GAO report is online (PDF format).

Tags: , , , , , , , ,

Posted on March 27, 2005 at 12:34 PM • 31 Comments

Comments

Chris Walsh • March 27, 2005 2:23 PM

Many thanks, Bruce, for your voice on this. It needs to be heard, and yours, thankfully, is a voice that is listened to.

Your last sentence is especially troubling to me. Not all messes are accidental, unfortunately, and “in our post 9-11 world”, violating the law, lying to the people, and ignoring your contractual commitments to customers apparently are the price to be paid for freedom. I’d be happier if I thought this was just another example of large bureaucracies working at cross-purposes, and lawmakers unwilling or unable to exrcise oversight. This time, it might be more malignant. After the worst of it, maybe we’ll have another Frank Church.

Nylarthotep • March 28, 2005 5:42 AM

Thanks for the posting. This is one I didn’t catch anywhere.

Good luck with the working group. I really hope it gets back together and can drive some intelligence into this. These types of privacy issues and violations only fire people to be more and more paranoid about the government, and apparently justifiably so .

Nick Hawkins • March 28, 2005 9:10 AM

I hope you’re able to move forward with the working group and able to produce meaningful work that get people aware of the shenanigans of the TSA.

Tom Millar • March 28, 2005 9:30 AM

From the disturbing nametags on its employees (Bob 15479, Alice 42293 (!!!)) to this kind of completely thoughtless activity, is there any way the leadership at TSA could have any LESS self-awareness? If I were top at DHS I would be rolling heads left and right by this point – the most visible arm of the department seems obsessed with acting the goat whenever it can.

This is why I take Amtrak.

stomv • March 28, 2005 9:49 AM

Regarding the JetBlue FOIA requests:

What did they look like? I ask because I’d love to send one of my own, requesting to know what information the TSA has about me. What should this letter/form look like? What’s the procedure? What information would the TSA need to know about me in order to process the request?

Any ideas?

me • March 28, 2005 10:07 AM

Anyone else noticed your PDA gone missing after it was in checked luggage on an airline flight? I’d think it was coincidence — an expensive flashlight and a portable hard drive disappeared from the same internal box inside the luggage as well, and of course I couldn’t prove anything or even find anyone to report a theft to when I called back to the airline.

What a fine way to collect personal information, though, when you can just root through people’s luggage and take what you want if there isn’t time to just copy what you find.

John • March 28, 2005 10:23 AM

Does any of this dis-information really surprise anyone? This agency was created, basically, out of thin air in a matter of months following 9/11. The different groups not knowing what each other had as far as passenger data goes is not surprising. And once they find out they were wrong, they follow the other general rule of government, and that is to stick with the party line until proven otherwise.

Don’t attribute to Malice what could easily be attributed to ignorance and stupidity!

Later…

robert • March 28, 2005 10:48 AM

Just wondering, how does this effect European citizens traveling to the US ?
There is an agreement between the European government and the US about registration of passenger data, but it seems this issue only concerns internal US flights.
Am I right ?

Davi Ottenheimer • March 28, 2005 11:02 AM

@me
There have been numerous reports of a spike in petty theft from checked luggage since the TSA starting exposing our bags to their ill-trained staff for our “protection”. You would be wise to assume that under the new TSA procedures you should not check any items that are valuable and easily stolen — put them in carry-on and keep them with you at all times. It’s not the airlines you need to worry about, it’s the TSA.

Several people claiming to be anonymous ex-TSA employees have posted on the web that their fellow staff have occaisonally been caught in the act of pocketing valuables from luggage they are “inspecting”. Of course, not all are petty thieves and not all thieves get caught.

As Bruce and others have been blogging, increased emphasis on homeland “security” doesn’t alone make us more secure. In fact, in many cases we are far more vulnerable due to the DHS programs. Take, for example, the DHS Privacy Officer investigation into the JetBlue incident:
http://www.dhs.gov/interweb/assetlibrary/privacy_rpt_jetblue.pdf

Nuala O’Connor Kelly found that TSA employees violated the spirit, but not the letter, of the Privacy Act by assisting the Army and providing passenger records. An interesting interpretation since it was subsequently revealed that TSA employees had also obtained airline records for four of their own CAPPS II contractors and therfore violated the letter of the Privacy Act.

A clever pundit wrote recently that the priorities and “moral guidance” of the Bush administration has led the US into a domestic strategy that has more in common with Russia, Nigeria and Indonesia than Western industrialized nations like Germany and Canada. For example, would you rather hear your leaders argue about the righteousness of seizing absolute federal power and the immorality of gay marriage or about fixing inflation, healthcare and the runaway cost of living? Which one directly impacts your safety and security, especially when you have to surrender your belongings to people who can not trust, and who are most likely severely under-trained and underpaid temporary staff?

frequent flyer • March 28, 2005 11:02 AM

The TSA is a sick joke. They do whatever they want, cannot be questioned, and hey, only the Bad People have something to hide. And NEVER check anything valuable. Just throw it away, it?s more satisfying. I even had a good mobile phone lifted from my carry-on at the X-ray station. I got it back by creating a major fuss, which was risky. One of the workers ‘found’ it after I blocked the line.

watchdog • March 28, 2005 11:33 AM

Bruce… Love the blog. Quick FYI: The GAO was the General Accounting Office and is now the Government ACCOUNTABILITY Office.

Thanks.

No Kidding • March 28, 2005 12:52 PM

TSA – a bunch of people who don’t qualify for jobs where you must repeatedly say, “Ya want fries with that?”

Oh dear – the government lies to us? Come on folks, when has that ever NOT been the case? It doesn’t matter who’s in the White House, the federal government always lies to us, always has, and probably always will. The state governments now have to lie to us as well, as part of yet another federally unfunded mandate. Large municipalities do it too, and they wonder why their tax base is moving out?

OneManBoycott • March 28, 2005 1:08 PM

Doesn’t affect me anymore. I don’t have the resources to coordinate a national boycott of the airline industry, so I just maintain my One Man Boycott, and simply tell others about it.

If more people did this, and made it known that they do it because of TSA and it’s associated “features” (gate rape, no due process, petty theft, utter disregard for privacy, etc.), the airlines would see their business drop more, associate the cause, and may even bring its lobbying power to bear in Congress.

One can only hope that The People will look back on eight years of borderline-fascism under Bush and the previous eight years of borderline-communism under Clinton, and get the brains to vote Libertarian. Hey, I can DREAM, can’t I?

bryan • March 28, 2005 4:00 PM

The root of the problem (as you have hinted in the past) is that TSA’s mission is not do-able.

The implicit mission is essentially ‘to protect our transportation infrastructure from the vanishingly small percentage of persons who would use it to harm others’. It’s easy to see that TSA is having trouble coming to grips with this when you read their explicit mission and vision statements. Sorry I can’t link these; go to http://www.tsa.gov and click “About TSA” to read them. Laughably vague!

TSA is flailing about trying to find ways to sift that one pink grain of sand from the entire beach-ful of other-colored sand … without overly disturbing all the other grains of sand.

Of course the issue is political. Would the American public accept a plain-spoken, realistic assesment of the problem from our politicians? We don’t know, because it seems no politician has attempted to deliver such a thing.

Woody • March 28, 2005 4:25 PM

@Davi Ott.., RE: @me

What really, really worries me about this is checked firearms. Luggage is not to be locked, yet firearms need to be in locked cases, with the key in the owner’s possession.

Do they break the locks on firearms? Do they “inspect” firearms cases like this as well.

Having flown with a priceless firearm before (sentimentally so, was my grandfather’s), and no the hoops necessary to jump through to get it checked, it seems odd that they are so cavalier about opening luggage that’s supposed to be locked so that it can’t be opened accept by the owner.

One hopes at a minimum anything that is “inspected” is first x-rayed to verify it’s contents as properly “inspectable”, and that the firearm showing on the x-ray + the signed tag inserted by the owner & counter-agent that is hopefully readable via x-ray is enough to get it to bypass the “unlock and inspect it” portion…

B • March 28, 2005 5:44 PM

I worked at TSA for over a year, I can not disclose my name, but the situation is much worse than what you would believe. TSA doesn’t bring “security” rather than an illusion of it, but this is what matters, I can not say more about it, but if you dig deep enough you will figure out than the whole transport security administration is a joke, they flat lie to the congress and to the citizens they’re “protecting.” In any case, maybe you shouldn’t look into this anyway, some things better remain unknown.

Anonymous • March 28, 2005 6:30 PM

I’d actually prefer malice.
Stupidity and ignorance, esp stupidity,
are more dangerous. Not least because they are less predictable. And does it really matter to you if you are assaulted or stolen from malice or the same injuries occur from stupidity or ignorance.

piglet • March 28, 2005 6:53 PM

I wrote to the European Commission, asking them what they are planning to do to protect the privacy rights of EU citizens after an internal government investigation concluded that TSA lies and breaks the law. The EU Commission agreed to turn over EU passenger data but always maintained that privacy rights were guaranteed and that EU and US officials, would together oversee that the terms of the agreement are not violated.
@robert: What I hope is that many citicens will protest in order to pressurize those responsible, both in US and EU.

Consultant • March 28, 2005 11:37 PM

I was one of the many consultants that helped set TSA up in early 2002. What’s really frightening is that most of these error are not due to malicious intent but rather just plain, old incompetence.

Ken Kraemer • March 29, 2005 10:26 AM

Another case of smoke and mirrors about our national security programs. Do you think “America 2014” is becoming a reality?

piglet • April 23, 2005 3:15 PM

Response from EU:

auf Ihre Anfrage nach der Verletzung des Schutzes von Passagierdaten durch die US-Behoerde TSA haben wir vom Pressesprecherdienst in Bruessel folgende Antwort erhalten:

Der Bericht des Büros des Inspector General of the Departement of Homeland Security (DHS) vom März 2005 zur Verwendung von Passagierdaten durch die Transportation Security Administration bezieht sich auf Datentransfers, die zwischen Februar 2002 und Juni 2003 getätigt wurden, bevor das internationale Abkommen zwischen der EU und den USA in Kraft trat (28. Mai 2004). Nach dem Internationalen Abkommen ist nur das Bureau of Customs and Border Protection (CBP) der DHS berechtigt, Passagierdaten zu erhalten. Im Juni wird die Kommission weitere Gespräche mit den US-Behörden zum Abkommen führen.

Gabriele Imhoff – Presse und Dokumentation
Europäischen Kommission
Vertretung in Deutschland
Unter den Linden 78
D-10117 Berlin
Tel.: +49 (30) 2280 – 2820
Fax: +49 (30) 2280 – 2880

Anonymous • February 15, 2006 9:33 AM

It looks like normal Incompetence to me.
And its not very substantial :-

Told a technology mag that the data was fake – they were likely answering many Q’s and didnt know the reality but answered what they thought was right.

Weasel words about certain types of data in a congress hearing – thats daily

Something stays on a website for a year ? come on is that all youve got ?

VAughn • March 13, 2006 3:53 PM

Two new Briggs and Riley bags given to TSA at Houston’s IAH airport, with double name tags and TSA approved locks never made it to the plane. I had lsot a digital camera in checked luggage without locks. So I placed locks on the luggage and now they steal bags and all.
I thought these were the people hired to protect us and our valuables??
Is there any kind of background checks on the people they hire to do this job? If they will steal from luggage, they will do anything for money!!

S.H. • October 25, 2008 10:06 AM

I do so need some help. Can anyone direct me to a group that fights back against the depredations of TSA operatives. I mean really fights back –not just complains, blogs or runs to the political misleaders that people our government, top down — or bottom up, if you prefer. To clarify, TSA may and does fine individual airline passengers up to $50,000 (fifty thousand dollars), without having to go before any other than an administrative law judge, said “judge” serving as a a paid lacky of Chertof.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.