Schneier on Security
A blog covering security and security technology.
« Secrecy and Security |
| Texas Cars with RFID Chips? »
April 8, 2005
More Uses for Airline Passenger Data
I've been worried about the government getting comprehensive data on airline passengers in order to check their names against a terrorist "watch list." Turns out that the government has another reason for wanting passenger data.
Although privacy experts worry about the government gathering personal information on airline travelers, Delta Airlines is handing over electronic lists of passengers from some flights to help stop the spread of deadly infectious diseases.
The lists will allow health officials to notify more quickly those travelers who might have been exposed to illnesses such as dengue fever, flu, plague, SARS and biological agents, the Centers for Disease Control and Prevention told a congressional panel on Wednesday.
It's the same story: a massive privacy violation of everybody just in case something happens to a few.
As an example of the CDC's notification efforts, Schuchat cited the case of a New Jersey resident who returned from a trip to Sierra Leone in September with Lassa fever. The patient flew to Newark via London and took a train home. Only after he died a few days later did the CDC confirm the disease.
CDC worked with the state, the airline, the railroad, the hospital and others to identify 188 people who had been near the patient. Nineteen were deemed at-risk and 16 were contacted; none of those contacted came down with the disease. It took more than five days to notify some passengers, Schuchat said.
It's unclear how this program would reduce that "five days" problem. I think it's a better trade-off for the airlines to be ready to send the CDC the data in the event of a problem, rather than them sending the CDC all the data -- just in case -- before there is any problem.
Posted on April 8, 2005 at 9:14 AM
• 7 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Excellent... it's all coming together.
So let's have the passengers walk through a long hallway that has a battery of scanners that checks not only for explosives, firearms, weaponry of any sort (including extra long fingernails); but also checks for disease, stds, cancer, psychological influence, guilt, arousal. We certainly wouldn't want someone boarding plane after taking an overdose of viagra... and when something is detected that violates a passenger policy they get sprayed with an enabling agent that glows a certain color when they come out of the hallway. This then puts them onto a sorter system filled with winding conveyer belts that lead to various places based on their color of circumstance. For the especially bad they get dropped through trap doors into oversized vials for further analysis. Al the while playing a loud willy wonka theme in the background.
Oh goodness, I am salivating.
Hmm, I tend to think that the CDC use of the data is not "just for a few" less than a hundred years ago a flu pandemic killed something like twice the number of people that had died in the First World War. Back in 1918 when it happend only a very tiny percentage of the population traveled.
Avian Flu is starting to be picked up by humans with something like a 70% fatality rate, if it does mutate to become virulant whilst in aerosol form then with modern transport we could easily see deaths in the 100Million+ region.
This has been discused in the US before with regard to infectious TB and people from countries where it is endemic (basically some people who are infected travel to an area where they will get health care and stand a chance of surviving, it's kind of understandable).
Although I don't like the idea of targeting people for whatever reason, I think this is so far the only case where it has some justification.
Here I disagree with you Bruce. One of the largest real threats to the modern world is a huge flu pandemic fueled by air travel. In the event of an outbreak minutes -- literally minutes -- count and translate directly into deaths.
The CDC should get the data by default, but statutory safeguards, including judicial oversight, should prevent it from being used for anything other than epidemic containment.
I am not a professional epidemiologist, but I deal with them often and I think I speak for the profession here.
"Security is a tradeoff" and I think you have underestimated the threat to security of an exponentially growing outbreak.
I don't think I've ever significantly disgreed with you before though!! :)
1. Lawmakers regularly strike balances between public health and privacy: in some states positive STD lab results trigger the involvement of the health department and the notification of sexual partners.
2. The hypotheticals involving influenza are apt. What's contemplated isn't a DHS boogeyman, it's a statistical certainty (given a sufficiently broad event horizon).
3. This program is being contemplated in relatively sober times. One need only imagine the immediate aftermath of, say, a dozen cases of Marburg in Philadelphia to realize that what's proposed is appropriate (and better than what we'd get in after-the-fact legislation): give CDC electronic access to records on demand. Then log, audit, prosecute, and imprison abusers of this privilege as necessary.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.