Feeds

Data on 10m Northwest fliers handed to NASA for ‘testing’

And brainscans planned to nail shifty thinkers

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Documents obtained by EPIC (Electronic Privacy Information Center) under the US Freedom of Information Act reveal that a second US airline, Northwest, handed over passenger data to the feds without the passengers' knowledge. The agency in question, NASA, was given data covering a three month period covering passengers travelling in July, August and September 2001, and held it for two years. EPIC estimates that there could be in excess of 10 million PNRs (Passenger Name Records) involved, on top of approximately a million that, it was revealed back in September, had been handed over by Jetblue.

One airline passing over data could have been an exception, but one of the major US airlines also doing so suggests there may be a pattern. The European Commission only recently agreed to airlines passing PNR data on EU citizens to the US, on the basis that there would be adequate safeguards on the use of that data, and it has also agreed to the data's use for 'testing' purposes, again because the US can be trusted. Well, as privacy class actions roll against the US airline industry, one does rather begin to wonder about that, and feels that Frits Bolkestein maybe ought to start wondering too.

Aside from the strong likelihood that any US airline involved in this and similar exercise is about to be dipped in ordure by outraged US passengers, and the (slight) possibility that the Commission will remember where it put its false teeth, or the (stronger) one that the European Parliament will toss the deal, the nature of NASA's activities are of interest.

EPIC, here, hosts a clutch of FOIA documents on the matter. The email correspondence is entertaining, particular as it slowly dawns on NASA that, Houston, we might have a privacy problem here, but take a look at the Northwest Airlines briefing presentation.

This shows that NASA was working on data mining, that this work had relevance to CAPPS follow-ups, and that it envisaged a system using biometrics to check both with a central database and to match the booked passenger with the flying passenger (page 12). So far, so fairly prosaic, but the requirement "must detect people who may pose a threat but are unknown" is a tricky one. So, what about "non-invasive neuro-electric sensors"? The NASA presentation says it is working on this interesting technology in collaboration with an unnamed commercial partner. Such a system, if deployed, would likely work in conjunction with data mining and biometric screening in order to kick up people who might be having suspicious thoughts, or seem suspiciously nervous.

That's the kind of notion that makes you suspiciously nervous just thinking about going to the airport - there goes your holiday, friend...

NASA has claimed that it terminated the research programme in late 2002 on the basis that data mining was not a viable line of investigation. However, it has denied EPIC the release of other records, on the basis that these are "inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency." So it's not currently clear how far this went, and what other agencies were involved.

The approach and objectives match those of CAPPS II and similar too closely for us to view this as an abandoned project. It must address privacy and Big Brother issues "to the extent possible", and it must recognise that some agencies may be unwilling to release sensitive data on known threats, but "they may be willing to do red-light/green-light processing on passenger biometric, UID or name."

This is recognisable as one of the ways the planned all-singing, all-dancing, all-surveying US systems of the future are intended to operate. All of the people with nothing to hide get checked out and green-lighted, hence they speed through the system (no, we don't believe this bit either). The feds can then concentrate on the amber and red lists, which we suspect will generate a whole new class of innocent but redlisted passengers who only fly when they're sufficiently desperate to face taking three days (or who knows, three years) to check in. ®

Related links:
Washington Post report of the Northwest disclosure
Commission agrees US access to EU citizen personal data
Congress threatens two hi-tech Gestapo programs

The essential guide to IT transformation

More from The Register

next story
Kate Bush: Don't make me HAVE CONTACT with your iPHONE
Can't face sea of wobbling fondle implements. What happened to lighters, eh?
Assange™: Hey world, I'M STILL HERE, ignore that Snowden guy
Press conference: ME ME ME ME ME ME ME (cont'd pg 94)
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
Ballmer leaves Microsoft board to spend more time with his b-balls
From Clippy to Clippers: Hi, I see you're running an NBA team now ...
Online tat bazaar eBay coughs to YET ANOTHER outage
Web-based flea market struck dumb by size and scale of fail
Amazon takes swipe at PayPal, Square with card reader for mobes
Etailer plans to undercut rivals with low transaction fee offer
Call of Duty daddy considers launching own movie studio
Activision Blizzard might like quality control of a CoD film
US regulators OK sale of IBM's x86 server biz to Lenovo
Now all that remains is for gov't offices to ban the boxes
XBOX One will learn to play media from USB and DLNA sources
Hang on? Aren't those file formats you hardly ever see outside torrents?
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.