9 ms·

How the NSA obtains and uses airline reservations (2013)

187 points by spaceboy 10y ago

sandworm101 10y ago
That NSA was tracking flight data was no great reveal. When we fly we share that fact with countless international organizations. Government boarder services. Airport secuity. Credit card companies. Insurers. And certainly the airlines. Anyone who thinks that air travel was ever private, pre or post-911, doesnt appreciate the number of information systems involved with moving people across boarders via aircraft. The data was always open to whatever organization could express a reasonable need.
- wheelerwj 10y ago
  just because it is this way doesn't mean we can't do better.
  - seanp2k2 10y ago
    Sure, but rolling this back now, especially in this political climate, seems exceedingly unlikely.
  - sandworm101 10y ago
    But to what advantage? Before governments knew who was arriving on thier shores travellers would be held for days, even months, sometimes on dedicated islands. Even in the 90s, 10+ hours to clear customs and immigration was not unussual in many countries. Today, law enforcement and immigration officials can rely upon advance data and do away with lengthy in-person background checks for all. This is why land crossings, which are unannounced, take so much longer and are more unpredictable than air crossings. Fly to Dubai. Then try driving to Dubai. Same boarder, vastly different inspection.
    - nemesisj 10y ago
      Spoken like someone who rarely crossed borders in the 90s. I spent significant time crossing borders in the 80s and 90s and it never took much time. This was primarily between PR China and the USA so not your friendliest border but also involved land crossings between Hong Kong and PR China. Most of these tickets were purchased in cash months in advance. I'm not sure why you think it was so onerous without info sharing.
      - sandworm101 10y ago
        Try Saudi, or russian boarders, or vietnam. I spent a great many hours in long lines to see stonefaced boarder guards carrying more bullets than brains.
  - cloakandswagger 10y ago
    What would be better in this case? Should anyone be able to show up to an airport, pay for a ticket and board a flight anonymously? I'm a pretty staunch libertarian and even I can see the benefit here. Until we reach the border-less, one-world utopia that so many people seem to be gunning for, it's valuable to know who is coming/going from your country.
    - hrehhf 10y ago
      > Should anyone be able to show up to an airport, pay for a ticket and board a flight anonymously? Yes.
    - ryanlol 10y ago
      >Should anyone be able to show up to an airport, pay for a ticket and board a flight anonymously? This is the reality in large parts of EU, I've flown several times without having my real name on the ticket. Hell, when I fly private it's even better. Show up at airport, meet pilot, get on the plane, hand the pilot a pile of cash. No passport control or security at any point, and this isn't just EU. So far no massive disasters have resulted from this.
      - refurb 10y ago
        Hmmm... I've flow a ton in the EU and always had to show ID that matched the name on the ticket. I did fly in SE Asia a few times where no ID was required and the name didn't have to match.
        ryanlol 10y ago
        >Hmmm... I've flow a ton in the EU and always had to show ID that matched the name on the ticket. Yeah, those are the rules. However, the only place where your passport and ticket will be compared is at the gate and they certainly never look very carefully.
    - icebraining 10y ago
      At the very least, the DHS shouldn't have free reign over flights that don't actually go into, from or even over the US.
  - deleted 10y ago
    [deleted]
- mindslight 10y ago
  I agree with your general point, but we really need a better approach to saying these types of things. In general, it seemingly comes across as justification, hipsterism, or even a personal attack. When really the intent is more "I wish you had listened to me earlier, but I am glad you're here now. Let's try to rationally tackle this problem within its longer term context, rather than being alarmed over a single news cycle". Similarly, Snowden didn't really reveal much that wasn't already known or trivially inferable from what was. But qualitatively, what he did was a "great reveal". It doesn't actually matter what had been keeping people from being aware - overt conspiracy ("classified"), or just their own cognitive dissonance. What matters is that many more people are now aware of the surveillance society.
- EternalData 10y ago
  Valid, though travelsWith is something that I didn't think the government would be able to systematically canvass unless they had access to passenger manifests.
adekok 10y ago
I first heard this 13 years ago. A friend visited an airline, and had a set of cables pointed out to him: "That's the feed to the NSA". I thought it was well known that the NSA had feeds into the airline reservation system. We know for sure that the CBP gets data from all flights which overfly the US, or which might overfly the US. There are well known stories about planes making unscheduled landings in the US (emergency, storm, delays, etc). Cue CBP opening the front doors, walking down the aisle, and pulling one guy off the plane. "Sorry sir, you are forbidden to enter the US, and you have just done so illegally. You're under arrest". Except for most people, we haven't cleared customs, and haven't tried to enter the States. So the rest of the passengers are "OK". Mostly. This is known as having your cake and eating it, too.
- jjoonathan 10y ago
  Wow. I wonder if it was opportunistic or planned. Either way, brilliant job of manufacturing consent. I'm both horrified and impressed.
  - kobeya 10y ago
    That's not consent, manufactured or otherwise.
    - jjoonathan 10y ago
      I've seen people get upset about overreach when the US asked to have a plane diverted / tried to strongarm extraditions / etc. I'd bet a large sum that this story was reported as "...detained while attempting to enter US..." and that nobody batted an eye upon reading it. That is the manufactured consent I was referring to.
- 65827 10y ago
  So much of the conspiracy theory hearsay turned out to be true in the past 20 years, it really makes you think. Or not so much. Whatever.
  - 10y ago
pasbesoin 10y ago
Now I'm waiting for the story about how they are vacuuming up the output of all those license plate readers. Meaning, there is no current such story I'm aware of. But I'm certain it's being worked on. And if not by them, directly, that they are ensuring they have a feed from/to the resulting system. We encounter little in the way of stories about all this data collection, that demonstrates these agencies' claimed restraint. At this point, you pretty much have to figure, if and when they can, they will. P.S. Think that "domestic" jurisdiction will stop them? I'll just remind you, among other things, of the stories about just how much of the U.S. can be interpreted as being withing 100 miles of an international border. The CPB's jurisdiction within that territory, per reported documents. And the CPB's "need" for data analysis of people transiting its... "system". I'm just speculating... But so far, it seems almost no speculation has been too outlandish to be eventually realized.
- terminado 10y ago
  Well, there's that one alleged program with the name "Perfect Citizen" which seems to touch upon using the power grid as backbone SIGINT & data transport infrastructure: https://yro.slashdot.org/story/12/12/23/2119225/nsa-targeting-domestic-computer-systems https://yro.slashdot.org/story/12/12/23/2119225/nsa-targetin... https://it.slashdot.org/story/10/07/08/1449254/us-plans-cyber-shield-for-private-companies-and-utilities https://it.slashdot.org/story/10/07/08/1449254/us-plans-cybe... These are dated as old as 2010-ish...
- makerbraker 10y ago
  Federal funds for license plate readers are granted on the basis of data sharing. https://www.aclu.org/files/FilesPDFs/ALPR/new-jersey/alprpra_officeofhomelandsecurityandpreparedness_trentonnj_1%20(5).pdf https://www.aclu.org/files/FilesPDFs/ALPR/new-jersey/alprpra... See the 2nd page, 2nd to last bullet point.
- nol13 10y ago
  im guessing will prob just piggy-back on the system that tracks the rfid chips in your tires
  - 10y ago
Canada 10y ago
This recent CCC talk demonstrates that airline reservation data is wide open: https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carmen_sandiego https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...
- will_pseudonym 10y ago
  This was an amazing talk. Thank you for sharing.
- TazeTSchnitzel 10y ago
  Somehow, that not only the NSA has it, but basically anyone, is reassuring.
  - cinquemb 10y ago
    I think that one of the interesting aspects of this talk was explaining that the airline companies really have no incentive to fight abuse beyond recognizable fraud. I mean, someone could build some really interesting services on top of these holes, one I was thinking of is that for customers who do not check into their flights before a certain period of time, somehow one could get those flight codes and change the information, and then people nearby the airport can hitch the ride while everything looking good from the perspective of the airline company or even a Frequent flier miles as a service, where someone just creates accounts by automatic means, and scans for trips that don't have ff codes applied and uses "their" code for it and passes those miles to someone else for a price. As we amass more and more data, and devices get cheaper to leak stuff, i wouldn't be surprised to see some interesting power shifts from traditional incumbents (the NSA's of the world, to more lean operations who are increasingly in a position to mine/exploit similar large amounts of information at scale).
ClearAsMud 10y ago
Did NAZI daz comzing.
lwf 10y ago
The "timestamped IP address", 172.24.96.31, is in the private network RFC1918 space — I doubt that was the IP address of the end-user. :)
tyingq 10y ago
The Secure Flight program isn't a secret, and already shows that every flight that originates, terminates, or flies over the US has its data sent to the US Government. This is a bit short of what's being shown in the article, as it doesn't send the whole PNR. However, it does make it clear that data connections exist, and already share flight and passenger data...the bulk of what's interesting in the PNR. See this doc[1] for examples of what is sent. [1]https://www.trams.com/home/support/notice/tsa_secure_flight_program_-_gds_format_samples https://www.trams.com/home/support/notice/tsa_secure_flight_... Edit: Worth noting that if you already have the PNR record locator, and the information already sent via SecureFlight, it's fairly easy to get the rest of the PNR data.

187 points by spaceboy 10y ago

That NSA was tracking flight data was no great reveal. When we fly we share that fact with countless international organizations. Government boarder services. Airport secuity. Credit card companies. Insurers. And certainly the airlines. Anyone who thinks that air travel was ever private, pre or post-911, doesnt appreciate the number of information systems involved with moving people across boarders via aircraft. The data was always open to whatever organization could express a reasonable need.

wheelerwj 10y ago
just because it is this way doesn't mean we can't do better.
- seanp2k2 10y ago
  Sure, but rolling this back now, especially in this political climate, seems exceedingly unlikely.
- sandworm101 10y ago
  But to what advantage? Before governments knew who was arriving on thier shores travellers would be held for days, even months, sometimes on dedicated islands. Even in the 90s, 10+ hours to clear customs and immigration was not unussual in many countries. Today, law enforcement and immigration officials can rely upon advance data and do away with lengthy in-person background checks for all. This is why land crossings, which are unannounced, take so much longer and are more unpredictable than air crossings. Fly to Dubai. Then try driving to Dubai. Same boarder, vastly different inspection.
  - nemesisj 10y ago
    Spoken like someone who rarely crossed borders in the 90s. I spent significant time crossing borders in the 80s and 90s and it never took much time. This was primarily between PR China and the USA so not your friendliest border but also involved land crossings between Hong Kong and PR China. Most of these tickets were purchased in cash months in advance. I'm not sure why you think it was so onerous without info sharing.
    - sandworm101 10y ago
      Try Saudi, or russian boarders, or vietnam. I spent a great many hours in long lines to see stonefaced boarder guards carrying more bullets than brains.
- cloakandswagger 10y ago
  What would be better in this case? Should anyone be able to show up to an airport, pay for a ticket and board a flight anonymously? I'm a pretty staunch libertarian and even I can see the benefit here. Until we reach the border-less, one-world utopia that so many people seem to be gunning for, it's valuable to know who is coming/going from your country.
  - hrehhf 10y ago
    > Should anyone be able to show up to an airport, pay for a ticket and board a flight anonymously? Yes.
  - ryanlol 10y ago
    >Should anyone be able to show up to an airport, pay for a ticket and board a flight anonymously? This is the reality in large parts of EU, I've flown several times without having my real name on the ticket. Hell, when I fly private it's even better. Show up at airport, meet pilot, get on the plane, hand the pilot a pile of cash. No passport control or security at any point, and this isn't just EU. So far no massive disasters have resulted from this.
    - refurb 10y ago
      Hmmm... I've flow a ton in the EU and always had to show ID that matched the name on the ticket. I did fly in SE Asia a few times where no ID was required and the name didn't have to match.
      - ryanlol 10y ago
        >Hmmm... I've flow a ton in the EU and always had to show ID that matched the name on the ticket. Yeah, those are the rules. However, the only place where your passport and ticket will be compared is at the gate and they certainly never look very carefully.
  - icebraining 10y ago
    At the very least, the DHS shouldn't have free reign over flights that don't actually go into, from or even over the US.
- deleted 10y ago
  [deleted]
mindslight 10y ago
I agree with your general point, but we really need a better approach to saying these types of things. In general, it seemingly comes across as justification, hipsterism, or even a personal attack. When really the intent is more "I wish you had listened to me earlier, but I am glad you're here now. Let's try to rationally tackle this problem within its longer term context, rather than being alarmed over a single news cycle". Similarly, Snowden didn't really reveal much that wasn't already known or trivially inferable from what was. But qualitatively, what he did was a "great reveal". It doesn't actually matter what had been keeping people from being aware - overt conspiracy ("classified"), or just their own cognitive dissonance. What matters is that many more people are now aware of the surveillance society.
EternalData 10y ago
Valid, though travelsWith is something that I didn't think the government would be able to systematically canvass unless they had access to passenger manifests.

adekok 10y ago

I first heard this 13 years ago. A friend visited an airline, and had a set of cables pointed out to him: "That's the feed to the NSA". I thought it was well known that the NSA had feeds into the airline reservation system. We know for sure that the CBP gets data from all flights which overfly the US, or which might overfly the US. There are well known stories about planes making unscheduled landings in the US (emergency, storm, delays, etc). Cue CBP opening the front doors, walking down the aisle, and pulling one guy off the plane. "Sorry sir, you are forbidden to enter the US, and you have just done so illegally. You're under arrest". Except for most people, we haven't cleared customs, and haven't tried to enter the States. So the rest of the passengers are "OK". Mostly. This is known as having your cake and eating it, too.

jjoonathan 10y ago
Wow. I wonder if it was opportunistic or planned. Either way, brilliant job of manufacturing consent. I'm both horrified and impressed.
- kobeya 10y ago
  That's not consent, manufactured or otherwise.
  - jjoonathan 10y ago
    I've seen people get upset about overreach when the US asked to have a plane diverted / tried to strongarm extraditions / etc. I'd bet a large sum that this story was reported as "...detained while attempting to enter US..." and that nobody batted an eye upon reading it. That is the manufactured consent I was referring to.
65827 10y ago
So much of the conspiracy theory hearsay turned out to be true in the past 20 years, it really makes you think. Or not so much. Whatever.
- 10y ago

pasbesoin 10y ago

Now I'm waiting for the story about how they are vacuuming up the output of all those license plate readers. Meaning, there is no current such story I'm aware of. But I'm certain it's being worked on. And if not by them, directly, that they are ensuring they have a feed from/to the resulting system. We encounter little in the way of stories about all this data collection, that demonstrates these agencies' claimed restraint. At this point, you pretty much have to figure, if and when they can, they will. P.S. Think that "domestic" jurisdiction will stop them? I'll just remind you, among other things, of the stories about just how much of the U.S. can be interpreted as being withing 100 miles of an international border. The CPB's jurisdiction within that territory, per reported documents. And the CPB's "need" for data analysis of people transiting its... "system". I'm just speculating... But so far, it seems almost no speculation has been too outlandish to be eventually realized.

terminado 10y ago
Well, there's that one alleged program with the name "Perfect Citizen" which seems to touch upon using the power grid as backbone SIGINT & data transport infrastructure: https://yro.slashdot.org/story/12/12/23/2119225/nsa-targeting-domestic-computer-systems https://yro.slashdot.org/story/12/12/23/2119225/nsa-targetin... https://it.slashdot.org/story/10/07/08/1449254/us-plans-cyber-shield-for-private-companies-and-utilities https://it.slashdot.org/story/10/07/08/1449254/us-plans-cybe... These are dated as old as 2010-ish...
makerbraker 10y ago
Federal funds for license plate readers are granted on the basis of data sharing. https://www.aclu.org/files/FilesPDFs/ALPR/new-jersey/alprpra_officeofhomelandsecurityandpreparedness_trentonnj_1%20(5).pdf https://www.aclu.org/files/FilesPDFs/ALPR/new-jersey/alprpra... See the 2nd page, 2nd to last bullet point.
nol13 10y ago
im guessing will prob just piggy-back on the system that tracks the rfid chips in your tires
- 10y ago

Canada 10y ago

This recent CCC talk demonstrates that airline reservation data is wide open: https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carmen_sandiego https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...

will_pseudonym 10y ago
This was an amazing talk. Thank you for sharing.
TazeTSchnitzel 10y ago
Somehow, that not only the NSA has it, but basically anyone, is reassuring.
- cinquemb 10y ago
  I think that one of the interesting aspects of this talk was explaining that the airline companies really have no incentive to fight abuse beyond recognizable fraud. I mean, someone could build some really interesting services on top of these holes, one I was thinking of is that for customers who do not check into their flights before a certain period of time, somehow one could get those flight codes and change the information, and then people nearby the airport can hitch the ride while everything looking good from the perspective of the airline company or even a Frequent flier miles as a service, where someone just creates accounts by automatic means, and scans for trips that don't have ff codes applied and uses "their" code for it and passes those miles to someone else for a price. As we amass more and more data, and devices get cheaper to leak stuff, i wouldn't be surprised to see some interesting power shifts from traditional incumbents (the NSA's of the world, to more lean operations who are increasingly in a position to mine/exploit similar large amounts of information at scale).

ClearAsMud 10y ago

Did NAZI daz comzing.

lwf 10y ago

The "timestamped IP address", 172.24.96.31, is in the private network RFC1918 space — I doubt that was the IP address of the end-user. :)

tyingq 10y ago

The Secure Flight program isn't a secret, and already shows that every flight that originates, terminates, or flies over the US has its data sent to the US Government. This is a bit short of what's being shown in the article, as it doesn't send the whole PNR. However, it does make it clear that data connections exist, and already share flight and passenger data...the bulk of what's interesting in the PNR. See this doc[1] for examples of what is sent. [1]https://www.trams.com/home/support/notice/tsa_secure_flight_program_-_gds_format_samples https://www.trams.com/home/support/notice/tsa_secure_flight_... Edit: Worth noting that if you already have the PNR record locator, and the information already sent via SecureFlight, it's fairly easy to get the rest of the PNR data.