29 ms·

The FBI is secretly using Sabre as a global travel surveillance tool

642 points by AndrewBissell 6y ago

skim_milk 6y ago
I work in the travel industry as a programmer (god only knows for how much longer) - I can tell you that Sabre and other GDS's are only used if you go through a travel agent or use some online reservation systems. If you book through the airline's systems or on online reservation systems they likely use the airline's systems to track travel instead of GDS since the GDS wants to take a big cut of every ticket sale. And obviously only legacy travel companies like Hertz and Mariott integrate with GDS's, new travel companies Uber and Airbnb likely don't have any relationship with Sabre. You're only likely to be in a Sabre system if you've been booked by your company through a travel agent and rent using legacy car/hotel companies also through your company's travel agent.
- ta17711771 6y ago
  So, corporate bigwhig types who don't understand technology?
  - skim_milk 6y ago
    Having travel agents for companies is actually a good idea, having someone work to set up travel for workers saves a crapload of time and money for everyone and better done if its outsourced to someone that knows travel. Lots of board and CXX whigs book their vacations through their agent on their company's dime as a part of their benefits package which is actually a great deal for them. I'm more of a thrill seeker so I wouldn't use one but the average person who just wants a stable planned-out vacation that they only get once a year it's a really good idea.
    - BryanBigs 6y ago
      At my old SP500 firm, Corp travel agents were always - and I mean ALWAYS - worse than what I could get from the airline directly. Why? Internal accounting. Some part of HR got to count part of the "fee" as revenue, billed against my travel budget. Insane. Once that became common knowledge, my coworkers and I were 'strongky encouraged' by our department head to buy travel with our Corp cards. This led to a strongly worded memo from the head of HR at FY end demanding we stop the process. That led to meetings, committees, more dueling memos. Great use of everyone's time. I am so glad I don't work there anymore.
      - Spooky23 6y ago
        Yup, that's pretty common with legacy contracts. Internal accounting bullshit ruins all sorts of things. I worked at a place where "thou shalt" use some stupid travel agent to buy intercity train tickets. You had to call the company and pick up the paper ticket in some inconvenient place between the hours of 10-3, closed from 12-1. The ticket cost ~$5-10 more than buying it at the train station, split between the travel agent and procurement group, unless you purchased it a month in advance, and could be used for 6 months. The "hack" was that business units with lots of travel would buy 100 at a time every couple of months, and you'd need to find a secretary with a stash to get a paper ticket. I would ply them with my wife's baking to ensure a steady supply. Not surprisingly, many tickets were wasted unused (in pursuit of saving the $5), or people took unnecessary trips to avoid wasting money on tickets (and wasting 3x more in per diems, etc). The next innovation was to declare that the trip was an emergency, and then you could buy the ticket from the conductor, in cash. The penance for less hassle is that you had to write a sad tale about why attending a training class met some standard for "emergency" travel.
      - cosmie 6y ago
        My company used to be like that, but was acquired last year and the company that acquired us has such a refreshing travel process: - Booking fees are itemized and stated up front. $3 for bookings handled 100% via the online reservation system, $25 if you ever have to talk to an actual agent. - The online reservation system shows publicly listed rates as well as negotiated rates, and you're free to choose what you want within policy. The negotiated rates were virtually never the cheapest, but they also tended to come with a lot more flexibility (i.e. no change fees, refundable up to time of departure, 24 hour cancellation of hotel reservations, etc). Those two aspects, combined with the fact that the travel would ultimately be booked to your card on file anyway (generally a corp card for anyone traveling frequently), pretty much negates any incentive to go outside of the official travel system. Depending on the trip and your travel budget, you can either go with the riskier but cheaper options or go with the more flexible but also more expensive options. The default booking fee is tiny enough to be understandable, and the incremental $22 fee ends up well worth it in the situations you need to call the travel team's 1-800 number to get you out of a bind. The old system didn't bother me much as I was used to it being The Way Companies Are. But after being spoiled here, I dread the day I end up in another travel-heavy job and have to go back to the more typical Big Corp travel process.
    - Xylakant 6y ago
      I've seen engineers with a three digit hourly rate spend multiple hours trying to achieve double digit savings.
  - cosmie 6y ago
    Corporate bigwig types (whether technical or otherwise) are generally not booking their own travel - that's what executive assistants are for. I'm a technologically literate corporate peon, and still booked >$15k in travel last year through SABRE via our online corporate booking system, and about $10k in bookings executed manually by our travel team. The online bookings still routed through an internal travel agent for final approval and execution of the booking, but I never actually interacted with anyone. The manual bookings were the only time I ever spoke with an agent, and it was almost always to handle an itinerary that was too complex for the UI of the online booking system to accommodate.
- walrus01 6y ago
  You think US intelligence doesn't have access to other major airlines' back end databases, or things like major hotels' reward programs, airbnb, uber, lyft?
  - monksy 6y ago
    They have PNRs https://arstechnica.com/tech-policy/2014/05/ask-ars-can-i-see-what-the-feds-know-about-where-ive-traveled/ https://arstechnica.com/tech-policy/2014/05/ask-ars-can-i-se...
  - lawnchair_larry 6y ago
    As someone who has worked on security for said systems, and who is somewhat familiar with the types of requests that are serviced to LEAs and TLAs, I do think that they don’t have access to back end databases. What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? Or do you think they hack us?
    - gruez 6y ago
      There's precedent for all the things you described. >What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/prism-slide-4.1419979622.jpg https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/p... >Or do you think they hack us? https://i.stack.imgur.com/jWW5v.jpg https://i.stack.imgur.com/jWW5v.jpg
      - JoeSmithson 6y ago
        Your first link doesn't support your quote. The queries are sent to the data holder who send back the data, the agency does not have direct access
        gruez 6y ago
        >the agency does not have direct access Sure, NSA can't directly query against whatever database gmail uses to store your email, but they still have all your emails, photos, and login history. As far as your privacy is concerned, there isn't really any meaningful difference.
- 112012123 6y ago
  Definitely depends on the airline. The big US carriers all have their own systems, but the vast majority of foreign carriers use a GDS on their backend. It's just not worth building in-house unless you're at very large scale.
  - Svip 6y ago
    Old non-US airlines definitely have their own systems. I know Scandinavian Airlines have their own, and it looks like Lufthansa and KLM-Air France do too.[0] I would be surprised if say British Airways didn't. [0] https://www.emirates247.com/business/corporate/buying-ticket-from-airline-website-cheaper-than-travel-agency-2015-06-12-1.593520 https://www.emirates247.com/business/corporate/buying-ticket...
    - Uberphallus 6y ago
      Nope, they all use Amadeus, except for Scandinavian Airlines. Actually Lufthansa and Air France CREATED Amadeus to consolidate their GDS operations. They're now pissed because Amadeus takes a piece of the cake and plays weird pricing shenanigans, but they're still there. Source: worked at Amadeus.
      - BrandoElFollito 6y ago
        This creation is also visible through the split between France (R&D in South of France) and Germany (datacenters and operations)
    - 112012123 6y ago
      These guys do use Amadeus on the backend to manage their ticket inventory. Specifically Amadeus Altea - though you are correct that they try very hard to avoid paying GDS distribution fees for selling tickets through the GDS third party sales channels (which is what that article is discussing).
- useful 6y ago
  The industry is moving to a being able to purchase products instead of complete PSS/GDS solutions. As an airline you'll be able to buy an inventory management system from Amadeus, a pricing system from Sabre, a support system from TravelSky, and a website from Travelport. The best example I can think of is American. They have Amadeus running their international website. Their ticketing system is internal. And all their inventory is managed in Sabre. Southwest was similar, for a while Amadeus ran their international site while Southwest ran an outdated internal system for domestic travel that didnt support flights leaving and arriving on different days. They eventually had Amadeus move into running their domestic stuff a few years ago and now they have red-eyes. Delta runs all their own stuff on a mainframe and from the outside it looked like a slow moving disaster. I know Amadeus sees all their inventory and looks at each passenger.
  - dave5104 6y ago
    > They eventually had Amadeus move into running their domestic stuff a few years ago and now they have red-eyes. Heh. I remember thinking years back that it was odd that Southwest never had any overnight flights, especially transcontinental. Just assumed it was the way they did business and some sort of cost cutting measure. Didn't think it'd be due to a software limitation!
    - redbeard0x0a 6y ago
      > due to a software limitation This _is_ a cost cutting measure. They decided not to pay for their software to support red eyes.
      - jakub_g 6y ago
        In case someone is as confused as me wth the discussion is about (never heard that jargon): > In commercial aviation, a red-eye flight is a flight scheduled to depart at night and arrive the next morning. https://en.m.wikipedia.org/wiki/Red-eye_flight https://en.m.wikipedia.org/wiki/Red-eye_flight
    - 112012123 6y ago
- znpy 6y ago
  Is there a way to know if you've gone through sabre?
  - opportune 6y ago
    If you’re an EU resident, I’m guessing you could force their hand using GDPR?
    - bitdivision 6y ago
      Looking at their website they have GDPR forms for employees and for clients, but they don't have anything for Joe Public, not sure if this is because they don't 'own' the data themselves?
    - Technetium 6y ago
      I'm going to say that's probably a hard no. If you're not cleared then certain documents will just not exist or would come back saying that some information has been redacted for national security reasons. You can see some examples of such requests here if you search hard enough https://www.muckrock.com https://www.muckrock.com
- cm2187 6y ago
  When you mean travel agent, do you also include the likes of expedia, opodo, etc?
  - splonk 6y ago
    Both of them also have GDS integrations. I don't know exactly how much but I'd assume it's the bulk of their traffic. As a general rule the large majority of anything you don't book directly with the airline/hotel (and for all I know, some of what you do) is very likely to be in a GDS somewhere.
  - isbvhodnvemrwvn 6y ago
    Yes, they are called OTAs - Online Travel Agencies.
  - mixmastamyk 6y ago
    Or Orbitz?
- aahhahahaaa 6y ago
  They don't use a GDS on the front end, but doesn't all that data feed into a GDS somewhere on the backend? I don't know much about Sabre but I know Amadeus reaches pretty far across everything.
  - skim_milk 6y ago
    Travel agencies still like to use the frontend even though they're even less user friendly than VIM. This isn't the right time for it but once upon a time you could research what travel agencies use what GDS by the job requirements these agencies put out - usually you need like 5 years experience with Sabre/Apollo/whatever for any job here. Once your travel details are in the GDS then the airline clerks, car rental sales person, hotel clerks, and your travel agent can check out or update your travel info for you just based on the PNR number on your airline ticket for convenience if you're just not into that weird smartphone thing. You can change a bunch of things during the trip like what car you drive and hotel amenities during your stay so after the trip ends we download your trip from Sabre and build reports for your boss or whatever.
- keithnz 6y ago
  I used to work for Sabre, they do a lot more than just bookings, they provide all the software to run an airline basically. I worked in the area for scheduling air crew. But also crossed over into all the flight tracking. Their systems hold a lot of data, though the airlines own and host that data in secure facilities. Fun Facts, when I worked there, you could fly for free on American Airlines ( the company got split out from AA ). They claimed to employ the most PhDs at one time ( lots of operations research). Also claimed to invent database transactions for the problem of people trying to book the same seat on airplanes at the same time (early 60s I believe)
- squeaky-clean 6y ago
  Also a travel industry programmer. Same feelings about for how much longer, heh. > If you book through the airline's systems or on online reservation systems they likely use the airline's systems to track travel instead of GDS since the GDS wants to take a big cut of every ticket sale. But in my experience, the airline backend and pricing is usually outsourced to Sabre or Amadeus. Frontier and Southwest are the only big players I know of that handle that sort of thing themselves, and Frontier has a teeny-tiny routelist compared to the others.
  - namdnay 6y ago
    Southwest is Amadeus too now :)
  - tyingq 6y ago
    "But in my experience, the airline backend and pricing is usually outsourced to Sabre or Amadeus" True, but that doesn't make the reservations visible in the GDS. If Sabre or Amadeus is running your "CRS (Central Res System)", they aren't allowed to do anything with the data that you haven't asked them to.
    - deleted 6y ago
      [deleted]
- baybal2 6y ago
  > I can tell you that Sabre and other GDS's are only used if you go through a travel agent or use some online reservation systems. It doesn't change the fact that a state will get the PNR from the airline.
- 77pt77 6y ago
  Many tickets I've bough in Europe via the airline's website were using amadeus (spanish?).
- dagoban 6y ago
  not true. BA,LH,LX,OS,AF,KL,... all run on AMA AA runs on Sabre Its actually the other way around, some airlines have their own system, but most use some sort of GDS. i.e. even when you make a booking directly with one of the airlines above mentioned, the entire PNR is still created and used in a GDS. Even when you use Farelogix (for LH NDC bookings for example) the entire PNR also gets created in AMA. When you want to make changes in the LH PNR that FLX does not support yet, you still have to make the changes in the AMA PNR.
01100011 6y ago
National Security Letters basically turn any private database into a tool of the state: https://en.wikipedia.org/wiki/National_security_letter?wprov=sfla1 https://en.wikipedia.org/wiki/National_security_letter?wprov... I'm not saying the US is as bad as China, but I roll my eyes when people talk about China forcing its companies to serve the interests of the state. Our government does it all the time and it doesn't require a warrant.
- divbzero 6y ago
  People are right to criticize China for it and just as right to criticize the US for similar faults. We should behave better and encourage others to do the same.
  - antocv 6y ago
    Disagree, we should encourage China, Russia, Israel, and any other capable state to spy on us. Disolve the monopoly, let it be a game for many to play. One single power is much more dangerous for everybody than a plurality.
    - VWWHFSfQ 6y ago
      I disagree with what you're saying, but I'm thankful to live in a country that allows you to say it.
- eloisius 6y ago
  Absolutely. The only thing that frustrates me about these topics is that only discussions about one of them tends to Get pummeled with whataboutism. We should condemn authoritarianism wherever it exists and not let authoritarianism elsewhere be a justification for authoritarianism anywhere.
- koheripbal 6y ago
  This is a "both sides"/whataboutism argument. China is absolutely worse than the US in this regard. Chinese military intelligence actually conducts offensive espionage on behalf of Chinese companies to steal IP from western companies. The US has a court system that reviews National Security Letters, and can accept challenges to them, and while that court is secret, it's still bound by rules that are established by elected congressional officials. ...and perhaps most importantly, they are still somewhat rare. Chinese companies on the other hand are required to cooperate on all requests, even international subsidiaries of any Chinese companies. No "letters" or court orders - you either do it or the CEO goes to jail, no trial, no judicial review. It might seem like the results are similar, but having judicial and congressional oversight makes a world of difference in tempering how/when it can be used and, more importantly, rolling it back when it's no longer necessary. https://en.wikipedia.org/wiki/National_security_letter#Doe_v._Ashcroft https://en.wikipedia.org/wiki/National_security_letter#Doe_v... It's a night and day comparison.
imglorp 6y ago
Pretty sure they've also got feeds on everyone's credit card purchases, emails of itineraries, text message confirmations, your phone homing and roaming (from the cell networks), from scores of apps that wanted your location squealing to whoever wants to buy it, from face rec at airports, etc etc. Your travel is certainly no mystery to the state without this one airline feed.
- deleted 6y ago
  [deleted]
- sneak 6y ago
  https://www.wired.com/2010/12/realtime/ https://www.wired.com/2010/12/realtime/ The feds get every card swipe in real-time without a warrant.
deleted 6y ago
[deleted]
jorblumesea 6y ago
They're also a target for APTs and foreign governments. Pretty much everyone wants to get their hand on travel data. Also fairly likely that other GDS such as Amadeus has similar issues. Speaking from personal experience, Sabre's code base is very outdated, and filled with tech debt and hacks. They haven't done a good job controlling bloat and many teams are skeleton crews that are consumed with ops and can barely fix bugs. I'm sure you don't need to "hack" anything. Contrary to what some posters here seem to be saying, Sabre is very widely used in many parts of the travel industry. https://www.forbes.com/sites/leemathews/2017/07/06/travel-giant-sabre-confirms-its-reservation-system-was-hacked/#1ffa7bd14b20 https://www.forbes.com/sites/leemathews/2017/07/06/travel-gi...
coip 6y ago
“Secretly” well there goes that headline as fact. How meta
justanotheranon 6y ago
https://search.edwardsnowden.com/docs/FullSpectrumCyberEffects2014-04-04_nsadocs_snowden_doc https://search.edwardsnowden.com/docs/FullSpectrumCyberEffec... see page 8. GCHQ has a program called ROYALCONCIERGE, where they hack the reservation systems of hotels to watch for targets renting rooms. then GCHQ sends teams ahead of time to intercept the targets, preaumably to spy on them, or assassinate them or rendition them to a black site. from another Snowden doc which i can no longer find, it was revealed that ROYAL CONCIERGE hacked hotels owned by Starwood, one of the biggest umbrella corps owning multiple global hotel chains. you think NSA only went after Starwood hotels? remember NSA said their "Full Spectrum Domination" posture means "Collect It All." you think if NSA/GCHQ are hacking into hotel reservation databases to exfiltrate the whole shebang, that Airline reservation systems are NOT a higher priority? a commenter said it is ridiculous hypocracy how we blast China for forcing its tech companies to become appendages of their military/intelligence complex, while ignoring FBI/CIA/NSA do the very exact same thing under the rubric of NSLs and Bulk FISA Warrants and Business Records "All Tangible Things" and EO12333 get-out-of-jail-free cards to target anything loosely related to "understanding foreign intelligence." there is zero difference between what China does and what the FVEYs do, except that our Overlords tell us they are not spying on us, while every peasant in China knows they are being spied on by their govt because the Chinese govt openly admits to it.
- antocv 6y ago
  China spying on us thru Tiktok 5g huawei, somehow this gives China power over us and that is bad. Meanwhile, no no, CIA/GHCQ/Five-Eyes, spies on us, nothing to see, nothing to fear, no.
- tdeck 6y ago
  I don't understand what this has to do with China. Can't they both be bad? How does the NSA spying on people make China doing it any better? If I've got five eyes spying on me I'm still not keen to add a sixth.
  - TheSpiceIsLife 6y ago
    It has to do with China as the parent comment made clear: We’re constantly told China is a threat, and that’s probably a reasonable bit of advice. We’re not constantly told our own governments are a threat, and that forms the basis of propaganda and misinformation.
neximo64 6y ago
How is this interesting? Any old school travel agent can look up names and follow their travel history anyway? (No matter how it is booked btw) You could call one up and ask if X has got on the flight and they can check. I've done it before to check if I wanted to know the persons flight was delayed and made it to the airport on time.
- tyingq 6y ago
  It's more complicated than that. Most tickets aren't in a GDS, but only in an individual airline's CRS. And a travel agent wouldn't have broad SQL like ability to query. They would need at least 2 of name, record locator, or flight/date. And travel agents don't typically have access to every airline CRS and all GDS systems...some subset is more common.
  - perennate 6y ago
    Presumably there is some travel agent with access to the data. I think it's concerning that one company maintains so much information, but in terms of government access, if the FBI is going to go through the trouble of getting a court-issued order like this [1] (which is specific to one person for one particular six-month period), then finding the right travel agent to serve the order to doesn't seem like it'd slow things down much (it took at least three days to get the order since some "Judge Huff was not in chambers"). [1] https://www.documentcloud.org/documents/6989724-All-Writs-Act-Order-on-Sabre-to-Give-Real-Time.html https://www.documentcloud.org/documents/6989724-All-Writs-Ac...
    - tyingq 6y ago
      You used to be able to fly without an ID...you could fly as John Smith or whatever. Certainly has turned.
- raxxorrax 6y ago
  It is interesting because it lets you reflect on asine practices. If this level of distrust by government towards citizens is accepted and normalized because of terrorism and subjective security needs, don't cry if people think government wants to intentional feed lead to your kids.
colecut 6y ago
heeeyyeyyy Dunder Mifflin is a part of Sabre
- l0c0b0x 6y ago
  ROFL... I actually searched for 'Dunder'. I knew someone was going to bring it up.
imroot 6y ago
The travel industry (esp the airlines) are moving to puzzle piece style integrations -- I know that Hilton Uses Sabre for incoming GDS reservations, but, uses salesforce internally for managing a lot of the guest interactions (including bookings and customer support): AA (as mentioned previously in this thread) uses multiple commercial systems, and Marriott uses a mixture of FOSSE, MARSA (there might be an H in there, but, it's been a while since I've been at MI) that talk to their backend microservices for their .com system. MI picked up a LOT of technical debt and a LOT of security bugs when transitioning SPG programs and properties into MI's portfolio (thankfully, I was off of that project at that point in time). I don't think this is the case where the FBI or other conglomerates have direct SQL-style access into their systems, but, more-so where FBI has retired or plans internally to pull data from systems when requested: When it's hard as hell for employees with the proper need-to-know for their application to pull up data in a meaningful fashion, you know that it's next to impossible for Law Enforcement to have a nice little dashboard where they can just type "Ian Wilson" and get a list of every place I've ever stayed ever (unless they're working with VISA: that's something that I kinda expect, tho).
crb002 6y ago
The FBI is probably using all information sold to advertisers. The EU passed GDPR for security, not just privacy.
dboreham 6y ago
Honestly I would have thought Sabre would have been streaming their data to TLAs since the 1960s.
corn13read 6y ago
I hear their printers catch on fire too!
mixmastamyk 6y ago
How far back does this data go? I'm hoping it gets deleted after ten years or so, but not optimistic.
- chishaku 6y ago
  https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center
drc500free 6y ago
What's interesting is that names on international flights are already checked directly against several watchlists. So apparently that tool isn't sufficient.
downvoteme1 6y ago
I am surprised that this is considered a secret anymore. If you travel anywhere and board a flight, stay a hotel or rent a car, you should assume that the government already knows about this. All companies have data sharing agreements with the government and judges are known to sign very broad data warrants that force companies to give data to governments for any suspicion of crime . Basically today, everybody should assume that the government knows everything about you - where you live, where you work, what car you drive, where you travel, What property you own, lease , whom you call etc. Privacy exists in name only.
- SkyBelow 6y ago
  >Privacy exists in name only. Given that this information is the companies own info, voluntarily shared as a private business, I wonder if we can make a comparison to free speech and the notion that free speech still exists despite most avenues of communication now being privatized and having control over what speech is allowed. Conceptually, if free speech can still be considered to exist in such a realm, cannot privacy? Yes, you may have to choose to note engage in companies that share their data if you want to keep your privacy, but that is much like what happens if you want to be able to speak without having to follow the limits those companies have in place. This is not to say the arguments are identical, but that there does seem to be similarity in their structure. If one can takes the argument that you can keep your privacy by just refusing to use airlines, credit cards, hotels, etc. and says that being forced to give up so much to maintain privacy means that privacy is dead (or exists in name only), then shouldn't it also be possible to make the argument that you can keep your free speech as long as you avoid the growing list of companies who refuse to business with individuals who engage in certain forms of speech (especially who do so loudly) mean that free speech is also dead? If instead the 'private businesses doing what they want' argument wins, then shouldn't it also apply in the case of privacy? That the company sharing whom they are offering a service to doesn't violate privacy because it is information you willingly gave them that they can then give others. (The case where the information is gathered through overly broad warrants stands out as an exception, being that it is forced by the government.)
barnyfried 6y ago
Obviously its not a secret since you know it.
criveros 6y ago
I wonder if Sabre's printers still catch on fire.
andy_ppp 6y ago
/secretly/obviously/
Cthulhu_ 6y ago
Meanwhile, most of the West has been very er, Critical, about anything coming in from China because they may be spying on us. Double standards?
virologist 6y ago
and what is wrong with that? it is FBI it saves lives.
jermier 6y ago
Interesting that the word 'secretly' is used in the title, after the fact, and not before it
deleted 6y ago
[deleted]
classified 6y ago
> No one really knows just how often or widely the government has used the All Writs Act to force companies into surveillance Seeing how they used Sabre to prosecute a measly $5000 damage, we can surmise that they'll use this and similar systems for just about anything they can possibly be used for.
vuyani 6y ago
Now swap FBI with China and HN would be calling for a full on ban. When its America, its just “how is this interesting”

642 points by AndrewBissell 6y ago

I work in the travel industry as a programmer (god only knows for how much longer) - I can tell you that Sabre and other GDS's are only used if you go through a travel agent or use some online reservation systems. If you book through the airline's systems or on online reservation systems they likely use the airline's systems to track travel instead of GDS since the GDS wants to take a big cut of every ticket sale. And obviously only legacy travel companies like Hertz and Mariott integrate with GDS's, new travel companies Uber and Airbnb likely don't have any relationship with Sabre. You're only likely to be in a Sabre system if you've been booked by your company through a travel agent and rent using legacy car/hotel companies also through your company's travel agent.

ta17711771 6y ago
So, corporate bigwhig types who don't understand technology?
- skim_milk 6y ago
  Having travel agents for companies is actually a good idea, having someone work to set up travel for workers saves a crapload of time and money for everyone and better done if its outsourced to someone that knows travel. Lots of board and CXX whigs book their vacations through their agent on their company's dime as a part of their benefits package which is actually a great deal for them. I'm more of a thrill seeker so I wouldn't use one but the average person who just wants a stable planned-out vacation that they only get once a year it's a really good idea.
  - BryanBigs 6y ago
    At my old SP500 firm, Corp travel agents were always - and I mean ALWAYS - worse than what I could get from the airline directly. Why? Internal accounting. Some part of HR got to count part of the "fee" as revenue, billed against my travel budget. Insane. Once that became common knowledge, my coworkers and I were 'strongky encouraged' by our department head to buy travel with our Corp cards. This led to a strongly worded memo from the head of HR at FY end demanding we stop the process. That led to meetings, committees, more dueling memos. Great use of everyone's time. I am so glad I don't work there anymore.
    - Spooky23 6y ago
      Yup, that's pretty common with legacy contracts. Internal accounting bullshit ruins all sorts of things. I worked at a place where "thou shalt" use some stupid travel agent to buy intercity train tickets. You had to call the company and pick up the paper ticket in some inconvenient place between the hours of 10-3, closed from 12-1. The ticket cost ~$5-10 more than buying it at the train station, split between the travel agent and procurement group, unless you purchased it a month in advance, and could be used for 6 months. The "hack" was that business units with lots of travel would buy 100 at a time every couple of months, and you'd need to find a secretary with a stash to get a paper ticket. I would ply them with my wife's baking to ensure a steady supply. Not surprisingly, many tickets were wasted unused (in pursuit of saving the $5), or people took unnecessary trips to avoid wasting money on tickets (and wasting 3x more in per diems, etc). The next innovation was to declare that the trip was an emergency, and then you could buy the ticket from the conductor, in cash. The penance for less hassle is that you had to write a sad tale about why attending a training class met some standard for "emergency" travel.
    - cosmie 6y ago
      My company used to be like that, but was acquired last year and the company that acquired us has such a refreshing travel process: - Booking fees are itemized and stated up front. $3 for bookings handled 100% via the online reservation system, $25 if you ever have to talk to an actual agent. - The online reservation system shows publicly listed rates as well as negotiated rates, and you're free to choose what you want within policy. The negotiated rates were virtually never the cheapest, but they also tended to come with a lot more flexibility (i.e. no change fees, refundable up to time of departure, 24 hour cancellation of hotel reservations, etc). Those two aspects, combined with the fact that the travel would ultimately be booked to your card on file anyway (generally a corp card for anyone traveling frequently), pretty much negates any incentive to go outside of the official travel system. Depending on the trip and your travel budget, you can either go with the riskier but cheaper options or go with the more flexible but also more expensive options. The default booking fee is tiny enough to be understandable, and the incremental $22 fee ends up well worth it in the situations you need to call the travel team's 1-800 number to get you out of a bind. The old system didn't bother me much as I was used to it being The Way Companies Are. But after being spoiled here, I dread the day I end up in another travel-heavy job and have to go back to the more typical Big Corp travel process.
  - Xylakant 6y ago
    I've seen engineers with a three digit hourly rate spend multiple hours trying to achieve double digit savings.
- cosmie 6y ago
  Corporate bigwig types (whether technical or otherwise) are generally not booking their own travel - that's what executive assistants are for. I'm a technologically literate corporate peon, and still booked >$15k in travel last year through SABRE via our online corporate booking system, and about $10k in bookings executed manually by our travel team. The online bookings still routed through an internal travel agent for final approval and execution of the booking, but I never actually interacted with anyone. The manual bookings were the only time I ever spoke with an agent, and it was almost always to handle an itinerary that was too complex for the UI of the online booking system to accommodate.
walrus01 6y ago
You think US intelligence doesn't have access to other major airlines' back end databases, or things like major hotels' reward programs, airbnb, uber, lyft?
- monksy 6y ago
  They have PNRs https://arstechnica.com/tech-policy/2014/05/ask-ars-can-i-see-what-the-feds-know-about-where-ive-traveled/ https://arstechnica.com/tech-policy/2014/05/ask-ars-can-i-se...
- lawnchair_larry 6y ago
  As someone who has worked on security for said systems, and who is somewhat familiar with the types of requests that are serviced to LEAs and TLAs, I do think that they don’t have access to back end databases. What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? Or do you think they hack us?
  - gruez 6y ago
    There's precedent for all the things you described. >What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/prism-slide-4.1419979622.jpg https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/p... >Or do you think they hack us? https://i.stack.imgur.com/jWW5v.jpg https://i.stack.imgur.com/jWW5v.jpg
    - JoeSmithson 6y ago
      Your first link doesn't support your quote. The queries are sent to the data holder who send back the data, the agency does not have direct access
      - gruez 6y ago
        >the agency does not have direct access Sure, NSA can't directly query against whatever database gmail uses to store your email, but they still have all your emails, photos, and login history. As far as your privacy is concerned, there isn't really any meaningful difference.
112012123 6y ago
Definitely depends on the airline. The big US carriers all have their own systems, but the vast majority of foreign carriers use a GDS on their backend. It's just not worth building in-house unless you're at very large scale.
- Svip 6y ago
  Old non-US airlines definitely have their own systems. I know Scandinavian Airlines have their own, and it looks like Lufthansa and KLM-Air France do too.[0] I would be surprised if say British Airways didn't. [0] https://www.emirates247.com/business/corporate/buying-ticket-from-airline-website-cheaper-than-travel-agency-2015-06-12-1.593520 https://www.emirates247.com/business/corporate/buying-ticket...
  - Uberphallus 6y ago
    Nope, they all use Amadeus, except for Scandinavian Airlines. Actually Lufthansa and Air France CREATED Amadeus to consolidate their GDS operations. They're now pissed because Amadeus takes a piece of the cake and plays weird pricing shenanigans, but they're still there. Source: worked at Amadeus.
    - BrandoElFollito 6y ago
      This creation is also visible through the split between France (R&D in South of France) and Germany (datacenters and operations)
  - 112012123 6y ago
    These guys do use Amadeus on the backend to manage their ticket inventory. Specifically Amadeus Altea - though you are correct that they try very hard to avoid paying GDS distribution fees for selling tickets through the GDS third party sales channels (which is what that article is discussing).
useful 6y ago
The industry is moving to a being able to purchase products instead of complete PSS/GDS solutions. As an airline you'll be able to buy an inventory management system from Amadeus, a pricing system from Sabre, a support system from TravelSky, and a website from Travelport. The best example I can think of is American. They have Amadeus running their international website. Their ticketing system is internal. And all their inventory is managed in Sabre. Southwest was similar, for a while Amadeus ran their international site while Southwest ran an outdated internal system for domestic travel that didnt support flights leaving and arriving on different days. They eventually had Amadeus move into running their domestic stuff a few years ago and now they have red-eyes. Delta runs all their own stuff on a mainframe and from the outside it looked like a slow moving disaster. I know Amadeus sees all their inventory and looks at each passenger.
- dave5104 6y ago
  > They eventually had Amadeus move into running their domestic stuff a few years ago and now they have red-eyes. Heh. I remember thinking years back that it was odd that Southwest never had any overnight flights, especially transcontinental. Just assumed it was the way they did business and some sort of cost cutting measure. Didn't think it'd be due to a software limitation!
  - redbeard0x0a 6y ago
    > due to a software limitation This _is_ a cost cutting measure. They decided not to pay for their software to support red eyes.
    - jakub_g 6y ago
      In case someone is as confused as me wth the discussion is about (never heard that jargon): > In commercial aviation, a red-eye flight is a flight scheduled to depart at night and arrive the next morning. https://en.m.wikipedia.org/wiki/Red-eye_flight https://en.m.wikipedia.org/wiki/Red-eye_flight
  - 112012123 6y ago
znpy 6y ago
Is there a way to know if you've gone through sabre?
- opportune 6y ago
  If you’re an EU resident, I’m guessing you could force their hand using GDPR?
  - bitdivision 6y ago
    Looking at their website they have GDPR forms for employees and for clients, but they don't have anything for Joe Public, not sure if this is because they don't 'own' the data themselves?
  - Technetium 6y ago
    I'm going to say that's probably a hard no. If you're not cleared then certain documents will just not exist or would come back saying that some information has been redacted for national security reasons. You can see some examples of such requests here if you search hard enough https://www.muckrock.com https://www.muckrock.com
cm2187 6y ago
When you mean travel agent, do you also include the likes of expedia, opodo, etc?
- splonk 6y ago
  Both of them also have GDS integrations. I don't know exactly how much but I'd assume it's the bulk of their traffic. As a general rule the large majority of anything you don't book directly with the airline/hotel (and for all I know, some of what you do) is very likely to be in a GDS somewhere.
- isbvhodnvemrwvn 6y ago
  Yes, they are called OTAs - Online Travel Agencies.
- mixmastamyk 6y ago
  Or Orbitz?
aahhahahaaa 6y ago
They don't use a GDS on the front end, but doesn't all that data feed into a GDS somewhere on the backend? I don't know much about Sabre but I know Amadeus reaches pretty far across everything.
- skim_milk 6y ago
  Travel agencies still like to use the frontend even though they're even less user friendly than VIM. This isn't the right time for it but once upon a time you could research what travel agencies use what GDS by the job requirements these agencies put out - usually you need like 5 years experience with Sabre/Apollo/whatever for any job here. Once your travel details are in the GDS then the airline clerks, car rental sales person, hotel clerks, and your travel agent can check out or update your travel info for you just based on the PNR number on your airline ticket for convenience if you're just not into that weird smartphone thing. You can change a bunch of things during the trip like what car you drive and hotel amenities during your stay so after the trip ends we download your trip from Sabre and build reports for your boss or whatever.
keithnz 6y ago
I used to work for Sabre, they do a lot more than just bookings, they provide all the software to run an airline basically. I worked in the area for scheduling air crew. But also crossed over into all the flight tracking. Their systems hold a lot of data, though the airlines own and host that data in secure facilities. Fun Facts, when I worked there, you could fly for free on American Airlines ( the company got split out from AA ). They claimed to employ the most PhDs at one time ( lots of operations research). Also claimed to invent database transactions for the problem of people trying to book the same seat on airplanes at the same time (early 60s I believe)
squeaky-clean 6y ago
Also a travel industry programmer. Same feelings about for how much longer, heh. > If you book through the airline's systems or on online reservation systems they likely use the airline's systems to track travel instead of GDS since the GDS wants to take a big cut of every ticket sale. But in my experience, the airline backend and pricing is usually outsourced to Sabre or Amadeus. Frontier and Southwest are the only big players I know of that handle that sort of thing themselves, and Frontier has a teeny-tiny routelist compared to the others.
- namdnay 6y ago
  Southwest is Amadeus too now :)
- tyingq 6y ago
  "But in my experience, the airline backend and pricing is usually outsourced to Sabre or Amadeus" True, but that doesn't make the reservations visible in the GDS. If Sabre or Amadeus is running your "CRS (Central Res System)", they aren't allowed to do anything with the data that you haven't asked them to.
  - deleted 6y ago
    [deleted]
baybal2 6y ago
> I can tell you that Sabre and other GDS's are only used if you go through a travel agent or use some online reservation systems. It doesn't change the fact that a state will get the PNR from the airline.
77pt77 6y ago
Many tickets I've bough in Europe via the airline's website were using amadeus (spanish?).
dagoban 6y ago
not true. BA,LH,LX,OS,AF,KL,... all run on AMA AA runs on Sabre Its actually the other way around, some airlines have their own system, but most use some sort of GDS. i.e. even when you make a booking directly with one of the airlines above mentioned, the entire PNR is still created and used in a GDS. Even when you use Farelogix (for LH NDC bookings for example) the entire PNR also gets created in AMA. When you want to make changes in the LH PNR that FLX does not support yet, you still have to make the changes in the AMA PNR.

01100011 6y ago

National Security Letters basically turn any private database into a tool of the state: https://en.wikipedia.org/wiki/National_security_letter?wprov=sfla1 https://en.wikipedia.org/wiki/National_security_letter?wprov... I'm not saying the US is as bad as China, but I roll my eyes when people talk about China forcing its companies to serve the interests of the state. Our government does it all the time and it doesn't require a warrant.

divbzero 6y ago
People are right to criticize China for it and just as right to criticize the US for similar faults. We should behave better and encourage others to do the same.
- antocv 6y ago
  Disagree, we should encourage China, Russia, Israel, and any other capable state to spy on us. Disolve the monopoly, let it be a game for many to play. One single power is much more dangerous for everybody than a plurality.
  - VWWHFSfQ 6y ago
    I disagree with what you're saying, but I'm thankful to live in a country that allows you to say it.
eloisius 6y ago
Absolutely. The only thing that frustrates me about these topics is that only discussions about one of them tends to Get pummeled with whataboutism. We should condemn authoritarianism wherever it exists and not let authoritarianism elsewhere be a justification for authoritarianism anywhere.
koheripbal 6y ago
This is a "both sides"/whataboutism argument. China is absolutely worse than the US in this regard. Chinese military intelligence actually conducts offensive espionage on behalf of Chinese companies to steal IP from western companies. The US has a court system that reviews National Security Letters, and can accept challenges to them, and while that court is secret, it's still bound by rules that are established by elected congressional officials. ...and perhaps most importantly, they are still somewhat rare. Chinese companies on the other hand are required to cooperate on all requests, even international subsidiaries of any Chinese companies. No "letters" or court orders - you either do it or the CEO goes to jail, no trial, no judicial review. It might seem like the results are similar, but having judicial and congressional oversight makes a world of difference in tempering how/when it can be used and, more importantly, rolling it back when it's no longer necessary. https://en.wikipedia.org/wiki/National_security_letter#Doe_v._Ashcroft https://en.wikipedia.org/wiki/National_security_letter#Doe_v... It's a night and day comparison.

imglorp 6y ago

Pretty sure they've also got feeds on everyone's credit card purchases, emails of itineraries, text message confirmations, your phone homing and roaming (from the cell networks), from scores of apps that wanted your location squealing to whoever wants to buy it, from face rec at airports, etc etc. Your travel is certainly no mystery to the state without this one airline feed.

deleted 6y ago
[deleted]
sneak 6y ago
https://www.wired.com/2010/12/realtime/ https://www.wired.com/2010/12/realtime/ The feds get every card swipe in real-time without a warrant.

deleted 6y ago

[deleted]

jorblumesea 6y ago

They're also a target for APTs and foreign governments. Pretty much everyone wants to get their hand on travel data. Also fairly likely that other GDS such as Amadeus has similar issues. Speaking from personal experience, Sabre's code base is very outdated, and filled with tech debt and hacks. They haven't done a good job controlling bloat and many teams are skeleton crews that are consumed with ops and can barely fix bugs. I'm sure you don't need to "hack" anything. Contrary to what some posters here seem to be saying, Sabre is very widely used in many parts of the travel industry. https://www.forbes.com/sites/leemathews/2017/07/06/travel-giant-sabre-confirms-its-reservation-system-was-hacked/#1ffa7bd14b20 https://www.forbes.com/sites/leemathews/2017/07/06/travel-gi...

coip 6y ago

“Secretly” well there goes that headline as fact. How meta

justanotheranon 6y ago

https://search.edwardsnowden.com/docs/FullSpectrumCyberEffects2014-04-04_nsadocs_snowden_doc https://search.edwardsnowden.com/docs/FullSpectrumCyberEffec... see page 8. GCHQ has a program called ROYALCONCIERGE, where they hack the reservation systems of hotels to watch for targets renting rooms. then GCHQ sends teams ahead of time to intercept the targets, preaumably to spy on them, or assassinate them or rendition them to a black site. from another Snowden doc which i can no longer find, it was revealed that ROYAL CONCIERGE hacked hotels owned by Starwood, one of the biggest umbrella corps owning multiple global hotel chains. you think NSA only went after Starwood hotels? remember NSA said their "Full Spectrum Domination" posture means "Collect It All." you think if NSA/GCHQ are hacking into hotel reservation databases to exfiltrate the whole shebang, that Airline reservation systems are NOT a higher priority? a commenter said it is ridiculous hypocracy how we blast China for forcing its tech companies to become appendages of their military/intelligence complex, while ignoring FBI/CIA/NSA do the very exact same thing under the rubric of NSLs and Bulk FISA Warrants and Business Records "All Tangible Things" and EO12333 get-out-of-jail-free cards to target anything loosely related to "understanding foreign intelligence." there is zero difference between what China does and what the FVEYs do, except that our Overlords tell us they are not spying on us, while every peasant in China knows they are being spied on by their govt because the Chinese govt openly admits to it.

antocv 6y ago
China spying on us thru Tiktok 5g huawei, somehow this gives China power over us and that is bad. Meanwhile, no no, CIA/GHCQ/Five-Eyes, spies on us, nothing to see, nothing to fear, no.
tdeck 6y ago
I don't understand what this has to do with China. Can't they both be bad? How does the NSA spying on people make China doing it any better? If I've got five eyes spying on me I'm still not keen to add a sixth.
- TheSpiceIsLife 6y ago
  It has to do with China as the parent comment made clear: We’re constantly told China is a threat, and that’s probably a reasonable bit of advice. We’re not constantly told our own governments are a threat, and that forms the basis of propaganda and misinformation.

neximo64 6y ago

How is this interesting? Any old school travel agent can look up names and follow their travel history anyway? (No matter how it is booked btw) You could call one up and ask if X has got on the flight and they can check. I've done it before to check if I wanted to know the persons flight was delayed and made it to the airport on time.

tyingq 6y ago
It's more complicated than that. Most tickets aren't in a GDS, but only in an individual airline's CRS. And a travel agent wouldn't have broad SQL like ability to query. They would need at least 2 of name, record locator, or flight/date. And travel agents don't typically have access to every airline CRS and all GDS systems...some subset is more common.
- perennate 6y ago
  Presumably there is some travel agent with access to the data. I think it's concerning that one company maintains so much information, but in terms of government access, if the FBI is going to go through the trouble of getting a court-issued order like this [1] (which is specific to one person for one particular six-month period), then finding the right travel agent to serve the order to doesn't seem like it'd slow things down much (it took at least three days to get the order since some "Judge Huff was not in chambers"). [1] https://www.documentcloud.org/documents/6989724-All-Writs-Act-Order-on-Sabre-to-Give-Real-Time.html https://www.documentcloud.org/documents/6989724-All-Writs-Ac...
  - tyingq 6y ago
    You used to be able to fly without an ID...you could fly as John Smith or whatever. Certainly has turned.
raxxorrax 6y ago
It is interesting because it lets you reflect on asine practices. If this level of distrust by government towards citizens is accepted and normalized because of terrorism and subjective security needs, don't cry if people think government wants to intentional feed lead to your kids.

colecut 6y ago

heeeyyeyyy Dunder Mifflin is a part of Sabre

l0c0b0x 6y ago
ROFL... I actually searched for 'Dunder'. I knew someone was going to bring it up.

imroot 6y ago

The travel industry (esp the airlines) are moving to puzzle piece style integrations -- I know that Hilton Uses Sabre for incoming GDS reservations, but, uses salesforce internally for managing a lot of the guest interactions (including bookings and customer support): AA (as mentioned previously in this thread) uses multiple commercial systems, and Marriott uses a mixture of FOSSE, MARSA (there might be an H in there, but, it's been a while since I've been at MI) that talk to their backend microservices for their .com system. MI picked up a LOT of technical debt and a LOT of security bugs when transitioning SPG programs and properties into MI's portfolio (thankfully, I was off of that project at that point in time). I don't think this is the case where the FBI or other conglomerates have direct SQL-style access into their systems, but, more-so where FBI has retired or plans internally to pull data from systems when requested: When it's hard as hell for employees with the proper need-to-know for their application to pull up data in a meaningful fashion, you know that it's next to impossible for Law Enforcement to have a nice little dashboard where they can just type "Ian Wilson" and get a list of every place I've ever stayed ever (unless they're working with VISA: that's something that I kinda expect, tho).

crb002 6y ago

The FBI is probably using all information sold to advertisers. The EU passed GDPR for security, not just privacy.

dboreham 6y ago

Honestly I would have thought Sabre would have been streaming their data to TLAs since the 1960s.

corn13read 6y ago

I hear their printers catch on fire too!

mixmastamyk 6y ago

How far back does this data go? I'm hoping it gets deleted after ten years or so, but not optimistic.

chishaku 6y ago
https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center

drc500free 6y ago

What's interesting is that names on international flights are already checked directly against several watchlists. So apparently that tool isn't sufficient.

downvoteme1 6y ago

I am surprised that this is considered a secret anymore. If you travel anywhere and board a flight, stay a hotel or rent a car, you should assume that the government already knows about this. All companies have data sharing agreements with the government and judges are known to sign very broad data warrants that force companies to give data to governments for any suspicion of crime . Basically today, everybody should assume that the government knows everything about you - where you live, where you work, what car you drive, where you travel, What property you own, lease , whom you call etc. Privacy exists in name only.

SkyBelow 6y ago
>Privacy exists in name only. Given that this information is the companies own info, voluntarily shared as a private business, I wonder if we can make a comparison to free speech and the notion that free speech still exists despite most avenues of communication now being privatized and having control over what speech is allowed. Conceptually, if free speech can still be considered to exist in such a realm, cannot privacy? Yes, you may have to choose to note engage in companies that share their data if you want to keep your privacy, but that is much like what happens if you want to be able to speak without having to follow the limits those companies have in place. This is not to say the arguments are identical, but that there does seem to be similarity in their structure. If one can takes the argument that you can keep your privacy by just refusing to use airlines, credit cards, hotels, etc. and says that being forced to give up so much to maintain privacy means that privacy is dead (or exists in name only), then shouldn't it also be possible to make the argument that you can keep your free speech as long as you avoid the growing list of companies who refuse to business with individuals who engage in certain forms of speech (especially who do so loudly) mean that free speech is also dead? If instead the 'private businesses doing what they want' argument wins, then shouldn't it also apply in the case of privacy? That the company sharing whom they are offering a service to doesn't violate privacy because it is information you willingly gave them that they can then give others. (The case where the information is gathered through overly broad warrants stands out as an exception, being that it is forced by the government.)

barnyfried 6y ago

Obviously its not a secret since you know it.

criveros 6y ago

I wonder if Sabre's printers still catch on fire.

andy_ppp 6y ago

/secretly/obviously/

Cthulhu_ 6y ago

Meanwhile, most of the West has been very er, Critical, about anything coming in from China because they may be spying on us. Double standards?

virologist 6y ago

and what is wrong with that? it is FBI it saves lives.

jermier 6y ago

Interesting that the word 'secretly' is used in the title, after the fact, and not before it

deleted 6y ago

[deleted]

classified 6y ago

> No one really knows just how often or widely the government has used the All Writs Act to force companies into surveillance Seeing how they used Sabre to prosecute a measly $5000 damage, we can surmise that they'll use this and similar systems for just about anything they can possibly be used for.

vuyani 6y ago

Now swap FBI with China and HN would be calling for a full on ban. When its America, its just “how is this interesting”