Feeds

Data on 10m Northwest fliers handed to NASA for ‘testing’

And brainscans planned to nail shifty thinkers

  • alert
  • submit to reddit

Intelligent flash storage arrays

Documents obtained by EPIC (Electronic Privacy Information Center) under the US Freedom of Information Act reveal that a second US airline, Northwest, handed over passenger data to the feds without the passengers' knowledge. The agency in question, NASA, was given data covering a three month period covering passengers travelling in July, August and September 2001, and held it for two years. EPIC estimates that there could be in excess of 10 million PNRs (Passenger Name Records) involved, on top of approximately a million that, it was revealed back in September, had been handed over by Jetblue.

One airline passing over data could have been an exception, but one of the major US airlines also doing so suggests there may be a pattern. The European Commission only recently agreed to airlines passing PNR data on EU citizens to the US, on the basis that there would be adequate safeguards on the use of that data, and it has also agreed to the data's use for 'testing' purposes, again because the US can be trusted. Well, as privacy class actions roll against the US airline industry, one does rather begin to wonder about that, and feels that Frits Bolkestein maybe ought to start wondering too.

Aside from the strong likelihood that any US airline involved in this and similar exercise is about to be dipped in ordure by outraged US passengers, and the (slight) possibility that the Commission will remember where it put its false teeth, or the (stronger) one that the European Parliament will toss the deal, the nature of NASA's activities are of interest.

EPIC, here, hosts a clutch of FOIA documents on the matter. The email correspondence is entertaining, particular as it slowly dawns on NASA that, Houston, we might have a privacy problem here, but take a look at the Northwest Airlines briefing presentation.

This shows that NASA was working on data mining, that this work had relevance to CAPPS follow-ups, and that it envisaged a system using biometrics to check both with a central database and to match the booked passenger with the flying passenger (page 12). So far, so fairly prosaic, but the requirement "must detect people who may pose a threat but are unknown" is a tricky one. So, what about "non-invasive neuro-electric sensors"? The NASA presentation says it is working on this interesting technology in collaboration with an unnamed commercial partner. Such a system, if deployed, would likely work in conjunction with data mining and biometric screening in order to kick up people who might be having suspicious thoughts, or seem suspiciously nervous.

That's the kind of notion that makes you suspiciously nervous just thinking about going to the airport - there goes your holiday, friend...

NASA has claimed that it terminated the research programme in late 2002 on the basis that data mining was not a viable line of investigation. However, it has denied EPIC the release of other records, on the basis that these are "inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency." So it's not currently clear how far this went, and what other agencies were involved.

The approach and objectives match those of CAPPS II and similar too closely for us to view this as an abandoned project. It must address privacy and Big Brother issues "to the extent possible", and it must recognise that some agencies may be unwilling to release sensitive data on known threats, but "they may be willing to do red-light/green-light processing on passenger biometric, UID or name."

This is recognisable as one of the ways the planned all-singing, all-dancing, all-surveying US systems of the future are intended to operate. All of the people with nothing to hide get checked out and green-lighted, hence they speed through the system (no, we don't believe this bit either). The feds can then concentrate on the amber and red lists, which we suspect will generate a whole new class of innocent but redlisted passengers who only fly when they're sufficiently desperate to face taking three days (or who knows, three years) to check in. ®

Related links:
Washington Post report of the Northwest disclosure
Commission agrees US access to EU citizen personal data
Congress threatens two hi-tech Gestapo programs

Choosing a cloud hosting partner with confidence

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
US court SHUTS DOWN 'scammers posing as Microsoft, Facebook support staff'
Netizens allegedly duped into paying for bogus tech advice
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Verizon bankrolls tech news site, bans tech's biggest stories
No agenda here. Just don't ever mention Net neutrality or spying, ok?
NATO declares WAR on Google Glass, mounts attack alongside MPAA
Yes, the National Association of Theater Owners is quite upset
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.