TSA Admits That Body Scan Machines Can Record Images

from the but-that-won't-be-used.-really.-trust-us. dept

With the new body scanning machines showing up at more and more airports, there still are lots of concerns over privacy and what might happen to the images of the scans. The TSA insists that the images are quickly discarded, but Michael Scott points us to the news that the TSA has now admitted that the devices can store and record images, but insists that's only done for "testing, training, and evaluation purposes." However, the TSA also admitted that there's nothing preventing this "test mode" from being turned on while in regular use. How long until there's some sort of "terrorist" incident that leads to a new requirement that all scans be recorded?

Filed Under: body scanning, privacy
Companies: tsa

NY Times Finds An 8-Year-Old On TSA Flight Watch List

from the good-data-mining dept

Back in 2007, the TSA wrote a "mythbuster" blog post on its site claiming that no 8-year-olds were on the TSA "no fly" list, which apparently was a challenge to the NY Times. While it didn't actually find an 8-year-old on the "no fly" list, it did find one on the "watch list." To be fair, the TSA in its blog post does acknowledge that there could be some 8-year-olds on the watch list, but none on the no fly list. And the Times did not find one on the no fly list -- so the TSA's blog post is technically accurate.

That said, the TSA blog post also claims that if there are mistakes that lead to an 8-year-old being on the watch list, airlines can "automatically deselect" them. And... that did not appear to happen. The kid that the NYT found apparently gets vigorously searched every time he flies. The Times did get the TSA to say on record that "there are no children on the no-fly or selectee lists," but the fact that little Mikey Hicks gets searched so much highlights the problem. Right now, it seems like everything is based on a name alone. That's not particularly sophisticated. By this point, shouldn't the TSA have better tools than just a name to determine if someone is worth additional scrutiny?

Filed Under: 8 year olds, data mining, no fly list, tsa, watch list
Companies: tsa

TSA Withdrew Subpoenas On Travel Bloggers... But Serious Questions Linger

from the this-is-security? dept

Last week, the news that the TSA visited two travel bloggers who had written about some rather obvious "security directives" that the TSA had refused to confirm publicly (i.e., that everyone boarding a flight to the US would get a pat down) got a fair bit of attention. Beyond just seeking their sources, the TSA agents had subpoenas and with one of the bloggers, were quite threatening and ended up confiscating his laptop (which was then damaged when it was returned). With the story getting so much attention, the TSA withdrew the subpoenas saying they were no longer necessary. While some are attributing this to the negative publicity received in the press, it seems more likely that they had figured out what they needed (especially with Steven Frischling handing over his laptop).

There are two other aspects of the story that remain in question and are somewhat troubling. The first is the issue raised by Danny Sullivan about Google's role in this effort. It came out in the early reports that both bloggers had received the notice from someone with a Gmail account. Google won't comment on whether or not it received a subpoena in this case, but it seems likely that it did. In fact, as Sullivan points out, Google -- unlike some other companies -- often seems quite willing to comply with such subpoenas without giving users a chance to protect themselves. This is the company's right, of course, but given Google's own positioning as a protector of user rights, you would think it would be a bit more aggressive on this front.

The second issue concerns reports that the TSA more or less forced Frischling to post a Twitter message, asking the guy who sent him the original email to email him again. Again, earlier reports had noted that Frischling had already deleted the email when the TSA agents had arrived. So, the suggestion is that they wanted to get him to email again. An "anonymous source" (so take it for what it's worth) is claiming that the TSA agents typed a message into Twitter asking the guy to send Frischling an email, but told Frischling to actually "send" the Twitter message, so they could deny that they had posted it.

Given all of this, it seems like there's a half decent chance that the TSA withdrew the subpoenas because it already had what it needed. It could get the guy's email from Frischling's computer after the guy emailed back -- and then could subpoena Google to find out who it was, without getting much pushback. The bigger question, though, remains why this is happening at all. The "security directive" wasn't classified. It wasn't secret and it was obvious to anyone who happened to fly into the US from a foreign country. If the TSA really thinks that keeping something like this secret somehow makes us more secure, it's even more messed up than previously thought.

And, once again, we're reminded why we should have a federal shield law to protect anyone engaged in journalism from having to reveal their sources.

Filed Under: bloggers, security, shield law, subpoenas, terrorism
Companies: tsa

Post TSA's New Security Rules And Get A Visit And Subpoena From Homeland Security

from the chilling-effects dept

With the failed attempted terrorist attack last week, there has been a tremendous amount of confusion and changing stories concerning airline security. What was especially odd was that there were so many conflicting reports about what the TSA was requiring that it really made the very concept of flying a total pain. There were some reports saying that no carry on baggage was allowed and other reports saying no electronics were allowed. Then there were the reports that you could carry on one bag, but wouldn't be able to leave your seat in the last hour of the flight or have anything (anything at all) on your lap during that hour. Every flight seemed to be different and the TSA was silent for a few days, before finally issuing a vague "guidance" press release that didn't really answer any questions. Basically, the TSA said that it was changing rules constantly. One supposes that the idea was to completely vary the rules so that no "terrorist" could prepare for them and get around them, and I actually can see some merit in that, conceptually. But from a travelers' perspective, it's ridiculous. You simply can't plan ahead with any sense of reason.

And since the TSA was so quiet and/or vague, there were a ton of people searching for information. Even the NY Times was relying on info found on airline websites rather than the TSA itself. So it was of little surprise that there would be plenty of demand for anyone to share any info that they knew -- not for any nefarious purpose, but just so regular travelers could properly prepare for their trip.

Among those who found and posted such information was blogger/reporter and travel expert Christopher Elliott, who regularly blogs about travel issues. He posted the details of a TSA order requiring pat-downs of all passengers on international inbound flights. The order that he posted had been sent to US Airways employees, and seemed like a reasonable bit of information that people would probably like to know about, so it's no surprise that Elliott blogged about it. But last night, Elliott received a surprising knock on the door from a Federal Agent with a subpoena demanding he hand over the details of where he received the info on the pat down procedure (thanks to Rob Hyndman who pointed me to an account of this incident).

Now, the argument in favor of this action is that these sorts of security procedures are probably supposed to be kept quiet (again, the idea would be to throw off any terrorist), but if you actually think about this, it doesn't make any sense. First, it wouldn't take long at all for reports of universal pre-boarding pat downs to be spread around. After all, thousands of people get on planes to fly to the US every day. In fact, among the many stories I heard, the universal pat down story was among them. So it's not like it's actually a secret. It's quite clear from what's being done. Second, if the TSA's security plan is based on keeping information like this "secret" (even if it's made obvious by their actions), then we're in even more trouble than I thought. It's security through pretend obscurity. It's ostrich-level security theater. It's security theater where the idea is that if the TSA pretends no one knows what's actually happening, then it can assume that no one knows what the procedures really are for airport security.

Instead, the whole thing (once again) demonstrates how silly the TSA security procedures are. And, oh yeah, rather than sending federal agents to issue subpoenas to folks like Elliott to figure out how he got the security procedures, shouldn't Homeland Security be spending more time tracking terrorists and coming up with plans that actually make us safer? What good is it engaging in a witch hunt over who passed on the obvious info that people get patted down before they board a US-bound flight?

Update: Wired has details of another blogger who received a similar visit, that was a lot less friendly (lots of threats involved) named Steven Frischling. Frischling cooperated, and they went through his phone -- even calling his mom, and then wanted to get an image of his hard drive. When they had trouble making the image, they ended up taking his laptop. I'm still confused as to how this makes anyone safer.

Filed Under: christopher elliott, homeland security, security, subpoena, terrorists, tsa, tsa rules
Companies: tsa

TSA Inspections Are Still A Farce

from the security-theater dept

If you thought taking your shoes off and putting your liquids in little plastic bags was going to stop terrorists from smuggling bombs onto planes, think again. A new report from the Government Accountability Office finds that investigators were able to smuggle bomb components through TSA checkpoints without being caught. This isn't much of a surprise; a similar test last year found that the TSA caught only 2 out of 22 people who tried to smuggle dummy weapons through checkpoints in a Newark airport. This is not really surprising. The TSA's strategy has been basically reactive: the 9/11 hijackers used box cutters, so those get banned. Somebody tries to smuggle explosives onboard in his shoes, so the TSA makes us all take our shoes off. Somebody tries to smuggle liquid explosives onto a plane, so the TSA bans bottled water. There's no reason to think these rules actually make us safer, but they do allow the TSA to pretend they're "doing something" about terrorism. A TSA spokeswoman insists that this wasn't a fair test because they only got by one of their "19 layers of security." I wouldn't be surprised if the other 18 layers were as ineffectual than the others, but one thing that can be said for them is that they're a lot less annoying for travelers. How about if the TSA stops wasting resources forcing 5-year-old girls to take their shoes off, and shift those resources to the sort of in-depth police work that led to the foiling of last year's liquid explosives plot.

Filed Under: airports, inspections, security, tsa
Companies: tsa

Feds' Edict To Encrypt Hard Drives Gets -- You Guessed It -- Ignored

from the surprise! dept

Back in May, the Transportation Security Administration did its best to gloss over the fact that it lost a hard drive containing personal information on some 100,000 of its employees by putting out a press release about it at 7 o'clock on a Friday evening. Now, a few months later, it's disclosed that the drive wasn't encrypted (via Threat Level), in contravention of a White House order from last summer saying that all devices containing personal data need to be encrypted if they're taken outside secure areas. As we've noted, these sorts of edicts and guidelines are meaningless unless they're actually followed, and non-compliance brings real repercussions.

Filed Under: data breaches, identity theft
Companies: tsa