Feeds

Data on 10m Northwest fliers handed to NASA for ‘testing’

And brainscans planned to nail shifty thinkers

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Documents obtained by EPIC (Electronic Privacy Information Center) under the US Freedom of Information Act reveal that a second US airline, Northwest, handed over passenger data to the feds without the passengers' knowledge. The agency in question, NASA, was given data covering a three month period covering passengers travelling in July, August and September 2001, and held it for two years. EPIC estimates that there could be in excess of 10 million PNRs (Passenger Name Records) involved, on top of approximately a million that, it was revealed back in September, had been handed over by Jetblue.

One airline passing over data could have been an exception, but one of the major US airlines also doing so suggests there may be a pattern. The European Commission only recently agreed to airlines passing PNR data on EU citizens to the US, on the basis that there would be adequate safeguards on the use of that data, and it has also agreed to the data's use for 'testing' purposes, again because the US can be trusted. Well, as privacy class actions roll against the US airline industry, one does rather begin to wonder about that, and feels that Frits Bolkestein maybe ought to start wondering too.

Aside from the strong likelihood that any US airline involved in this and similar exercise is about to be dipped in ordure by outraged US passengers, and the (slight) possibility that the Commission will remember where it put its false teeth, or the (stronger) one that the European Parliament will toss the deal, the nature of NASA's activities are of interest.

EPIC, here, hosts a clutch of FOIA documents on the matter. The email correspondence is entertaining, particular as it slowly dawns on NASA that, Houston, we might have a privacy problem here, but take a look at the Northwest Airlines briefing presentation.

This shows that NASA was working on data mining, that this work had relevance to CAPPS follow-ups, and that it envisaged a system using biometrics to check both with a central database and to match the booked passenger with the flying passenger (page 12). So far, so fairly prosaic, but the requirement "must detect people who may pose a threat but are unknown" is a tricky one. So, what about "non-invasive neuro-electric sensors"? The NASA presentation says it is working on this interesting technology in collaboration with an unnamed commercial partner. Such a system, if deployed, would likely work in conjunction with data mining and biometric screening in order to kick up people who might be having suspicious thoughts, or seem suspiciously nervous.

That's the kind of notion that makes you suspiciously nervous just thinking about going to the airport - there goes your holiday, friend...

NASA has claimed that it terminated the research programme in late 2002 on the basis that data mining was not a viable line of investigation. However, it has denied EPIC the release of other records, on the basis that these are "inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency." So it's not currently clear how far this went, and what other agencies were involved.

The approach and objectives match those of CAPPS II and similar too closely for us to view this as an abandoned project. It must address privacy and Big Brother issues "to the extent possible", and it must recognise that some agencies may be unwilling to release sensitive data on known threats, but "they may be willing to do red-light/green-light processing on passenger biometric, UID or name."

This is recognisable as one of the ways the planned all-singing, all-dancing, all-surveying US systems of the future are intended to operate. All of the people with nothing to hide get checked out and green-lighted, hence they speed through the system (no, we don't believe this bit either). The feds can then concentrate on the amber and red lists, which we suspect will generate a whole new class of innocent but redlisted passengers who only fly when they're sufficiently desperate to face taking three days (or who knows, three years) to check in. ®

Related links:
Washington Post report of the Northwest disclosure
Commission agrees US access to EU citizen personal data
Congress threatens two hi-tech Gestapo programs

Secure remote control for conventional and virtual desktops

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Apple CEO Tim Cook: TV is TERRIBLE and stuck in the 1970s
The iKing thinks telly is far too fiddly and ugly – basically, iTunes
Huawei ditches new Windows Phone mobe plans, blames poor sales
Giganto mobe firm slams door shut on Microsoft. OH DEAR
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Forget silly privacy worries - help biometrics firms make MILLIONS
Beancounter reckons dabs-scanning tech is the next big moneypit
Microsoft's Office Delve wants work to be more like being on Facebook
Office Graph, social features for Office 365 going public
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.