Schneier on Security
A blog covering security and security technology.
« Hijacker Working at Heathrow Airport |
| Spying on Computer Monitors Off Reflective Objects »
May 20, 2008
Airlines Profiting from TSA Rules
Before 9/11, airlines and security personnel -- and I use the term "security personnel" loosely -- might have let a nickname or even a maiden name on a ticket slide. No longer. If you have the wrong name on your ticket, you're probably grounded. And there are two reasons for this: security and greed.
The Transportation Security Administration wants to be sure the same person who bought the ticket, and who was screened, is boarding the plane. But when there's an inexact match, the airline can either charge a $100 "change" fee or force you to buy a new ticket. In an industry where every dollar counts, the exact-name rule is the government's gift to cash-starved air carriers.
That's the situation Gordon was confronted with, even when it was obvious that "Jan" and "Janet" were one and the same. There were suggestions that a new ticket might need to be purchased. "We didn't let it get to that," he recalls. Instead, he asked to speak with a supervisor who could finally fix the codes so that the ticket and passport matched up. How did all of this happen in the first place? Turns out Jan Gordon had signed up for a frequent flier account under her informal name, so when she booked an award ticket, it also used her informal -- and inaccurate -- name.
There are two things to get pissed off about here. One, the airlines profiting off a TSA rule. And two, a TSA rule that requires them to ignore what is obvious.
EDITED TO ADD (5/28): To add some more detail here, the rule makes absolutely no sense. If this were sensible, the TSA employee who checks the ticket against the ID would make the determination if the names were the same. Instead, the passenger is forced to go back to the airline who, for a fee, changes the name on the ticket to match the ID. This latter system is no more secure. If anything, it's less secure. But rules are rules, so it's what has to happen.
Posted on May 20, 2008 at 6:51 AM
• 56 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
For some greed will always trump common sense, otherwise jails would not be needed 8)
Further it would appear from recent press items that the authorities have joined in on the basis of "if you can't beat'em join'em".
Seems that we must rename the term to _uncommon sense_ (leaving the real meaning intact)
I guess the restaurants and shops at the airport are also pleased with the ban on liquids and the increased amount of time you are forced to spend at the airport.
They need to profit from something.
As Jeff Macke (http://www.cnbc.com/id/15838052) would say.
Is the market open today? Then it's a good day to short/sell airlines!
Does the name of the day end in "d-a-y"? It's a good day to sell airlines!
Wow, but I can see that happening.
I work for a company that handles check-in and security for plane trips to Atlantic City. Most of the plane tickets are paid for by the casinos. So long as the last name and a first initial match the photo ID, we have no trouble clearing them. We've never charged anyone extra for anything (including incredible amounts of luggage for a two-night trip).
HOWEVER...at a nearby airline counter, I got to talking to one of the agents for a regular airline (I won't mention which one). They were all wearing tape measures around their necks. They now must measure any bags suspected to be too large. If they are too large (even like by an inch), the passenger is charged extra money. Their manager has told them that they must do anything they can to make more money.l
This is really nothing new. The airlines were thrilled with the original "show an id" thing because it helped them shutdown the secondary market in discount tickets while pretending that a third party ("the FAA") mandated a match (not actually true at the time). This is just a variation on that theme combined with the usual small minded need to show the passenger who is really in charge.
I'm not so sure about this one. Definitely the airlines should not profit from this, but it's the "TSA rule that requires them to ignore what is obvious" is what I find slightly troublesome. Employees acting under "common sense" can allow all sorts of social engineering to succeed. It would not be very difficult to exploit a policy of recognizing nicknames or similar names as "the same". So, I'm not as ready to call shenanigans on this issue as I am all the other TSA idiocy out there.
I have flown using tickets that were purchased using my middle name, which I am typically called; all my ID is in my full name. Even after 9/11, I had no problems with it, just explaining to the agents what had happened and showing them ID that gave my full name. (Perhaps my destination, Hawaii, had something to do with it?)
Maybe a black market can be created where plane tickets can be traded among people with like names.
My parents doomed me by calling me by my middle name. I have since lost my airline miles because I am no longer allowed to fly under my middle name and the airlines won't allow me to correlate new flights to the old account. But it's a small price to pay for all of the extra security we've been given at the airports, right?
So basically bad guys can exploit employees common sense and get into the plane by different name. Or someone elses name. Is that a big deal?
It gets even worse if your name wasn't originally spelled with the Latin alphabet. Transliterating from other alphabets, or writing systems, can create different spellings.
Marriage (or other name changes) can be another issue.
This has happened to me, but I managed to talk my way on the plane. I think that would work 99% of the time.
Marriage can be difficult because of other things than just name change. My last name is very typical of Poland and ends in -ski. According to my language's rules my wife would be called -ska. You think that will not cause problems? I heard of Poles who were looked at with suspicion because of that *before* 9/11.
My company credit card left off a space between my first name and middle initial, which in essence changes my name on the ticket if I used that card to book or check in.
I've been stopped at least three times at security or the booking counter but so far have been able to explain it and they have not made me re-purchase a ticket.
I guess I'll need to watch airline stocks more closely to determine how likely that will stay accurate in the future.
I have a surname in which there is an O and the name is also commonly spelled with an E in that place, many times I have correctly filled my name in the little squares on the papers used to apply for drivers liscense, credit card etc. and it is not uncommon at all that my O has been changed to an E by the person who transcribes this, so I have often had my name misspelled by some one elses fault on my ID. I usually did not object to this, since people who really know me do not need my ID and those for who require me to show ID deserve the obscurity of it. I figured that if I need to get over the obstacle, I can always point out that the transcriber erred, but the people who require ID are usually not doing me any favors so it has to work in my favor sometime.
I just changed my name (because of marriage), and I was able to have my name changed on all of my frequent flyer/hotel/car accounts by sending them a copy of my marriage license or my new driver's license. The credit cards were easier, I just called them up and they changed them over the phone. Go figure.
I agree with you about the absurdities of the airline security business. However this in not new at all. Having a unusual family arrangement I have the following:
*A family name that is a easy to miss spell (Laurence, not Lawrence).
*Parents with a different last name that is also easy to misspell.
*A nickname because my first name does not match my gender (it did in old english, just not now).
Yes, this is a bit much but it is my daily life. As a result I have experience with airline not being happy with my tickets since the early 90's. I am good at keeping them straight nowadays since I buy all my own tickets. CNN's statement that this is a NEW problem is not accurate.
This problem is not isolated to airlines. I have been accepted into women's studies programs ( checked the "M" box and yes I am a man) when applying to college, helpful data entry clerks have often "corrected" my last name (I have to send my Auto title back to the state a third time to fix that).
The solution seem to me on figuring out how to preserve one's privacy while being able to prove identity. Is suspect the solution is in some soft of certificate scheme. That way you remove the name and connect identity to transactions. No clerks, no interpretations. Of course I suspect I will never get my dream unless the public schools start teaching crypto theory and people stop being seemly powerless to candy bars.
@ Laura R
"The credit cards were easier, I just called them up and they changed them over the phone. Go figure"
I recon it could have something to do with not wanting to lose your custom to their competitors...
Thru incompetence and idiocy US Airways an egregious offender along these lines. When I got married my spouse and I hyphenated our names. Making the name change with most airline frequent flyer accounts was easy. US Airways was another story. It took over four years before they would update our account information, despite our repeated communications in every form possible. For some time I had a photo ID in my "maiden" ("bachelor"?) name. After that it got trickier.
My (anglo) BIL changed his name in accord with Puerto Rican convention: First HisLast HisMomsMaiden, addressed as Mr. HisLast. He has a hellish time with airplane tix.
Actually, the thing to get pissed about is that the TSA ID check and the no-fly list are completely useless for keeping bad guys off planes given that the TSA agent has no way to verify that the name on a web-printed boarding-pass hasn't been altered. I grind my teeth every time they check my ID with the little purple [UV?] light. Difficult to forge ID or trivial to change piece of paper...hmmmm...which will be attacked first, I wonder? At the moment, all the ID/boarding-pass check accomplishes is to keep extra (honest) people out of the gate area.
Common sense is a weapon that terrorists use to circumvent security. The only way to protect the Homeland from that weapon is to deploy as many systems as possible that use strict, mindless, automatic Zero Tolerance pattern-matching and reject (or subject to Secondary Screening) anything that doesn't match. Just as a sufficient number of monkeys with typewriters can eventually produce a Shakespeare play, a Homeland Security bureaucracy with enough mindless droids WILL win the Global War on Terror!
Kudos to United's group sales desk for being an exception, then. When I got tickets for a trip to a convention in Japan last year, the agent noted that the name I gave for my SO was a shortened form of a common name, and asked me to make sure I was giving the precise name that was on his passport. (Now, if their Web site had been able to handle the group code in the first place, I suppose this all would have turned out differently.)
It only matters that the name on your photo ID matches the name on your credit card and on your ticket. So if you have a problem, you should be able to fix it in advance.
Our lists for the charters are a little tricky, because travel agents for the casino trips can really mess things up. But, we usually fix it on our end without charging anyone anything extra.
A current auction on Tradera (Swedish eBay subsidiary) is for a return flight from Stockholm to Chicago for someone named Magnus Persson. There are 1062 people with that name in Sweden, 200 of them are registered with Tradera, and 6 are currently bidding.
Details in Swedish: http://www.svd.se/nyheter/inrikes/...
It's enough to drive you crazy.
It may seem easy to see when there is a simple mistake or a nickname on a ticket, but the way names vary and nicknames work is different in different cultures.
If someone presents a ticket that says "Abdul Mohamed" and ID that says "Abadul Mohammed bin Mohammet" does it match? I've no idea. I don't have knowledge of Arabic names and I made that all up. But if the guy whose ID says "Reginald James McRalleigh" gets through with a ticket reading "Jim MacRally" why should Abdul be denied?
If the ID says Alexandr Petrovich Borisov are you going to let Sacha Borisov on board?
"There are two things to get pissed off about here. One, the airlines profiting off a TSA rule. And two, a TSA rule that requires them to ignore what is obvious."
Nope. The only thing to be pissed at is the cause of both problems: stupidity made manifest as regulation.
If airlines were free to solve this problem in the most efficient way, then all of us could spend our airfare dollars at whichever airline offered the best solution. The other airlines could then copy the best practice, or suffer from lower sales.
As usual, short-sighted regulators with unwarranted confidence in their abilities to provide good solutions to problems fall victim, for the umpteenth time, to the law of unintended consequences.
And each of us gets to enjoy the hassle and cost of the poor, improperly incentivized thinking of a few bureaucrats.
But hey, we wanted government to do more. And they're doin'!
I opened the thread to make this exactly notice Aviatrix just made. Peoples' names differ from culture to culture.
Bruce, for me Jan and Janet are different names. And more, I perceive the first one as a male name, luckily the second one seems to be a female one to me :)
Do you have an idea that Alexander and Sasha are the same name for the speakers of Russian?
If that's not enough, think about Chinese names :)
If a man traveling with a passport in the name 'Alexander Borisov' is traveling with a female child named 'Oksana Borisova', will he be assumed to be abducting the child?
And the really sad part, whether by the name Jan or Janet, they have no idea if that is Jan or Janet under the skin. All the paper can still be forged or counterfeit.
Ha ha ha.
With a name like "Davi" I get hassled like this constantly. People are endlessly putting a "d" on the end of my name and telling me "Sorry about truncating your name. We've corrected a computer error for you."
Likewise, I've travel with friends who are called one name by their parents, another by their boss, another by their priest, another by friends, etc. and they say it's all just part of their culture to have so many names.
The problem is that people often find uniqueness where there is none due to culture/system gaps, and on the other hand try to remove/reduce uniqueness when they see it to make things familiar/friendly (normalized).
Honestly, I think this is a hugely serious issue of identity management highlighted by databases and we're just seeing the tip of the iceberg.
My wife is in a situation where she has a two word, hyphenated first name and no middle initial. At least that's how her parents planned it and I believe it's also laid out that way on the birth certificate.
However, there continue to exist many systems that cannot handle the hyphen or a space between the names. As examples (not her real name) Ann-Marie, Ann Marie or AnnMarie have all been used, as well as the fallback Ann M.
I wonder if the airline computers can tell the difference between George Bush, George W Bush and George H W Bush?
At least in AA, United and in Europe there still is some common sense. So if Michael has his tickets issued to Mike, or Daniel to Dan, those are ok as long as everything else matches (like the credit card to that name).
When the instructions call for 'full name as spelled in passport' is that supposed to include ALL the first names/middle names? What when e.g. a Swedish person has 4 first names and a hyphenated last name? Or what do the Swedish royals have in their tickets, since they have even more first names...
The rules are bad for the simple reason that any half competent terrorist can obtain a clean identity from a number of countries. Indeed, as suicide bombers rarely have previous convictions of any kind, they can travel without any great difficulty using their own passport.
Terrorists are rare. Doing nothing *is* an option.
I have a 14 character hyphenated last name. I have never in my life had a ticket that could fit my entire name on it. (In fact, the name on my driver's license takes up two lines, which confuses people more because they never look at the second line). To date I haven't had anyone get upset about it, but we'll see.
Its something that I dread, I have *two* middle names which is not particularly uncommon -- I have a Sri Lankan friend with a total of ten names, and he uses them all when a form asks for "Full name". Probably buffer overflows the census system :-)
Trouble is, most software is American and insists everyone is American and has one and only one middle name, so periodically I find that one or the other of my middle names vanishes from someones records. My passport shows all four names (first, two middle and surname), so it would be all I need for American software to prevent me complying with American security -- Luckily I have absolutely ZERO interest in visiting the US, and with each mindless new security ruling in that country the likelihood of me changing my mind gets lower and lower.
On a similar note, I have a friend with no middle name, and in order to be ALLOWED to be entered into her University records system she had to be given a middle initial of X! Good luck to her if she ever tries to fly to the land of the free.
There are other things that i have noticed going through airport security, and these are all little loop holes that the airlines enjoy much to the chagrin of the little guy.
When you have been randomly selected for the infamous "random search" more commonly known as "the bend over and take it" or the "cavity search", you wont be able to print your boarding pass online, additionally the automated terminals at the airport also wont be able to print out your boarding pass.
You will be instructed to have an attendant help you at which point you'll be directed towards yet another line and at that point Your boarding pass will have SSSS printed at the top. It isnt a strip search, it has just taken on many negative names because of the added scrutiny. Make sure you take off anything metal because any little glitch will ensure that you progress deeper into the hell of procedures that these monkeys with metal detectors have to follow, which i might add are grossly invasive procedures of screening you.
My point is that all these TSA Screenings are meant to delay you and make your life impossible, I'm sure that if i was to have missed my flight, due to TSA, neither the airline or TSA would have cared.
I suspect that there are other such little tricks and loopholes that leave us holding the bag. For once it would be nice for the music to stop and for them to be the ones left standing up.
Am i the only one who feels powerless when these bastards rifle through all your personal belongings, making you feel as if your some common criminal?
I'm usually on here posting as devils advocate to others similar rants, because i'm all for preventing another terrorist attack, and i guess a little scrutiny is something i can deal with. But words couldnt describe the anger created when you literally feel like you are at the mercy of a police state and for no good reason. It almost makes me think, "hey you want a hijacking, here ill give you a god damn hijacking you TSA Basterds."
Of course i am not a criminal so i would never so much as dare as to raise my voice to these basterds, you are completely at their mercy. Shutup - do as you are told - or they will bury you with criminal charges.
I went through one of these gross invasions of privacy and scrutiny recently, without incident, even though I was ready to do a jason bourne on them.
They even had to run my wallet through the xray machine seperately twice.
Please folks, dont be fooled, security theatre is Bullshit. I am sure that any determined attacker could still hijack a plane. What about all those hundreds of thousands of checked luggage that they dont screen.
TSA is a DISASTER AREA. SCREW YOU TSA.
Legally interesting. When I got a mortgage in New Jersey, one of the papers I signed was a statement that name1 was the same person as name2, witnessed by the lawyer, etc.
If this is enough for a mortgage, it should be enough for an airline ticket.
But haven't we already established in a prior post to this blog that you can board a plane in the U.S. without showing *any* ID? My understanding is that you just have to submit to an extra level of screening.
I do agree with Jim. If you need a match between a name on a ticket and the name of a person (say for blacklisting, I'm not discussing this), then I can imagine a lot of things that can go wrong if the names don't match. And, if you let the employee decide under "common sense" that somebody can board with, say, a nickname that is loosely coupled with the name and a maiden name instead of the name on the ticket, then the whole control becomes useless. Because, as you know, these are the loopholes and weaknesses that a criminal mind or a social engineer would try to exploit. So if the rule is useful and enforced, it will cause some trouble and complaints, including that "it is against common sense", as it usually happens.
Get it right YOU DO NOT NEED ID TO FLY.
refuse to show ID for domestic US travel. You are not required to show ID you can simply go to extra screening.
Why would the airline even issue a ticket using a name not matching the person's passport or gov ID?
I think the fault here is with the airline failing to close a TSA security requirement when issuing tickets.
The solution would be to apply the exact same check during ticket purchase as TSA does during screening.
In the window of time, beginning in 2007 and ending in 2008, wherein my ID said "Holzman-Tweed" and my ticket said "Holzman" because that's what my credit card said, I was allowed to fly several times.
Ha! Like I always say, if the reason for something is either flimsy or not obvious, it must be about the money.
First off, most of you should shut up and stop whining.
You chose to use nicknames and "What [you] want to be called" when ever you see the instructions for "Print your name here". Your nickname and what you want to be called (as apposed to what your name is) is NOT you name. Fill out forms where your name is being asked with your LEGAL name.
Second, 99% of the time IF you still don't have your legal name on your boarding pass, YOU STILL WILL BE ABLE TO FLY. Yes, you will be selected for additional screening. If you don't like it ("JC", I am looking at you) DON'T FLY!
Flying is not a right and if you don't like the security, take the bus or train (or book a cabin on a ship).
Most of the posts I read when something about the TSA is brought up are the same people that complain when they have to take their shoes off. I have news for you: the TSA COULD be doing a lot more but your constant whining prevents them.
In summary: put your legal name down and you still can fly without it.
I don't fly that often, but If I remember my experiences correctly, my ID was checked against my boarding pass only twice. Once at the very beginning of the TSA queue, where they TSA drone uses a marker to check your boarding pass ( I always print multiple copies in case I have to go back to my car an re-enter the security area) and the second time is walking through the medical detector. I specifically remember the airline personell telling us that we do'nt need to have our IDs out.
So if you are in the situation of having the name on your boarding pass and your ID not match, I would think if you are checking in online, you could print the pass to a file and then open the file and change the name to match your ID and you've got a matching boarding pass.
Of course if for some reason your deception is discovered, you'll probably never be heard from again.
>So basically bad guys can exploit employees common sense and get into the plane by different >name. Or someone elses name. Is that a big deal?
So what? What are they going to do when they get on the plane? Bore us to death with their speeches about jihad?
Everyones already been screened for weapons (too bad you can't be bumped off a flight for BO or halitosis) and the cockpits locked.
Stop being sheeple.
Right. Got it. The most important thing is BLIND COMPLIANCE WITH THE RULES, regardless of how pointless the rules actually are.
Putting down your legal name shouldn't be a big thing (if you are running from the law/the ex/the mob, you probably shouldn't be flying for other reasons). As long as the airlines can figure out this concept (not a sure thing, I grant you).
On the other hand, if someone can't handle such simple rules as "use your legal name", are they fit to be crammed next to unfortunate people for several hours? I'd really hate to sit next to some of the ranters about how God gave them tickets because he wanted them to fly.
Are these terrorist boogeymen actually trying to get on planes all the time? Are they really stumped by the TSA and these ID requirements? Al-Qaeda, if we really need to live in complete fear of them, rarely uses the same trick twice. This charade is meant to placate the masses and keep copycats from trying the same exact thing. It won't do much to stop a good plan that is well executed.
TSA's 3-1-1 rule also equals more profits for airlines. Since American Airlines is now charging for all checked luggage, how are we supposed to carry liquids on the plane without paying that $15-$25 surcharge?
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.