Court Says That Travel Company Can't Tell Others How Much Southwest Flights Cost

from the c'mon dept

A few months back, we wrote about Southwest Airlines' ridiculously antagonistic legal strategy against aggregators that would scrape information on flights and prices from Southwest.com and help people find flights and prices. The case we covered was the one against Skiplagged, but it was related to a separate case against Kiwi.com. Skiplagged had argued that it didn't violate Southwest's terms of service since it wasn't scraping info from Southwest... but rather had scraped it from a different site, Kiwi.com, which in turn had scraped it from Southwest.com.

Just the fact that we're arguing over whether or not it's legal to scrape data from publicly available websites should alert you to the fact that these lawsuits are nonsense. Factual data -- such as flight routes and prices -- are not protected by any intellectual property and if you put them out there, people can (and should!) copy them and spread them elsewhere. But, unfortunately, the court ruled against Kiwi.com last fall, granting Southwest an injunction saying that Kiwi can't scrape its site for data any more. Realizing it was in trouble, it appears that Kiwi caved in and settled the lawsuit agreeing to no longer collect data on Southwest flights.

Given that, the court has now made the preliminary injunction a permanent injunction barring Kiwi and any of its employees from ever scraping data off of Southwest's site. The court takes for granted that Southwest can just say in their terms of service that you can't copy data from their website and that's a valid contract. That seems dangerously empowering for terms of service. Can I add to Techdirt's terms of service that by reading this site you agree to place any copyright-covered works you create into the public domain?

Southwest’s Terms & Conditions are a valid and enforceable contract, and Kiwi.com accepted those Terms & Conditions when it used the Southwest Website with knowledge of the Terms & Conditions;

Kiwi.com breached the Terms & Conditions when it, among other things, harvested and scraped data from the Southwest Website, published Southwest’s flight and fare schedules on Kiwi.com, used the Southwest Website for Kiwi.com’s own commercial purposes, and brokered and sold Southwest flights without permission;

Kiwi.com’s violations of the Terms & Conditions have caused Southwest to suffer irreparable harm, including lost traffic on its website, customer service burdens, operational disruptions, and reputational damage; and

After considering the balance of harms, the threatened injury to Southwest if the injunction was denied outweighed the harm to Kiwi.com because, among other things, Kiwi.com’s unauthorized sales of Southwest flights poses a significant disruption to its customer operations, and the public interest would be served if an injunction is granted because there is an expectation that parties to contracts will honor their contractual obligations.

Those last two paragraphs also seem like complete nonsense. If people find it easier to use a third party service than your own site, well, then that should mean you should work to improve your own site, not get to sue them in court. Lots of things lead to "lost traffic" on a website, including better service from a competitor. But we don't say that violates the law.

Anyway, because of this no one associated with Kiwi.com can ever "extract" any information from Southwest's website or even post data about Southwest flights on its website and I honestly don't see how that's possibly legal. Data is data. You shouldn't be able to bar a company from posting data.

IT IS HEREBY ORDERED that Kiwi.com, Inc. and Kiwi.com s.r.o., as well as their officers, agents, servants, employees, and attorneys and all other persons acting who are in active concert or participation with them, are permanently prohibited, restrained, and enjoined permanently from: (1) harvesting, extracting, or scraping information from the Southwest website, www.southwest.com, or its proprietary servers, including Southwest’s flight and fare information; (2) publishing Southwest flight or fare information on the kiwi.com website, through its mobile applications or elsewhere; (3) otherwise accessing and using Southwest’s website and data for any commercial purpose; (4) selling Southwest flights; and (5) committing any other acts in violation of Southwest’s Terms & Conditions

What an unfortunate state of an events -- but also a very clear reminder that Southwest is anti-consumer in its practices.

Filed Under: data, flights, prices, scraping, sharing
Companies: kiwi, southwest

A Seamless Journey Awaits You On The Outbound Flights: All You Have To Give Up Is Your Face

from the say-cheese,-citizens dept

The DHS's airport panopticon is rolling out slowly, but surely. And of course it's being done with as little oversight or guidance as possible. Major international airports are already turning your face into your ID, giving travelers little option but to get their faces out if they don't want to receive extra questioning.

If you're worried about adding your face to the government's extra-large bin o' biometrics, you're welcome to opt out. The easiest way to avoid this is to not travel at all, which is exactly what the DHS suggests. There are other options, but by the time you know they're available, you've likely already had your face scanned and matched against the DHS database by software known mostly for its failure rate.

This happened to a JetBlue flier who noticed her face had been scanned and matched against… something… before she was able to board her international flight. She reached out to JetBlue via Twitter and got some not-very-enlightening answers and a couple of disturbing clarifications.

I just boarded an international @JetBlue flight. Instead of scanning my boarding pass or handing over my passport, I looked into a camera before being allowed down the jet bridge. Did facial recognition replace boarding passes, unbeknownst to me? Did I consent to this?

JetBlue responded to Mackenzie Fegan with the sort of apology one offers on Twitter: I'm sorry this made you feel [x]. The option no one at JetBlue will point out to you remains an option.

You're able to opt out of this procedure, MacKenzie. Sorry if this made you feel uncomfortable.

Note that it's "this" and not "we." This is how a corporate entity absolves itself of responsibility while nominally offering an apology. Good stuff.

Fegan's follow-up question was more on point:

Presumably these facial recognition scanners are matching my image to something in order to verify my identity. How does @JetBlue know what I look like?

JetBlue's response was not very comforting:

The information is provided by the United States Department of Homeland Security from existing holdings.

Oh. "Exisiting holdings." Awesome. But where did this "existing holding" get its backstock of facial photos? Well, some may have come from passports. Some likely came from state driver's license databases. The DHS has a number of sources for people's photos: mugshots, government employee records, biometric info collected from various state and federal agencies charged with vetting volunteers and applicants for certain forms of employment (day care, elder care, any job the government feels you need a license to perform…), and any place else the government may have acquired a photo of you (or someone who somewhat resembles you).

The process works nearly instantaneously. It's seamless and slick and all the work is done behind the scenes. Just smile and move forward. Sure, you can opt out -- or so JetBlue says -- but the link JetBlue provided explains nothing but its fervent belief that more facial recognition databases can only be a boon for airline passengers.

Since the program’s launch in 2017, more than 50,000 customers have participated in biometric boarding on 500+ flights across all four cities. There is no pre-registration required. Customers can simply step up to the camera for a photo match and make their way onto the aircraft.

“The success of JetBlue’s biometric boarding program is a testament to the airline’s ongoing work to create a personal, helpful and simple experience,” said Ian Deason, senior vice president of customer experience, JetBlue. “The boarding touchpoint is an area that needs innovation and we feel biometrics will change the future of air travel as we look to create a more seamless journey throughout the airport."

Opting in is as simple as putting your face in front of the cameras the DHS and JetBlue nudge travelers toward. Opting out, however, doesn't appear to be a process anyone -- the DHS or JetBlue -- are willing to talk about openly. The DHS just says, "Don't fly." JetBlue says, "Why would anyone want to make their 'journey' less 'seamless?'"

Flying has always been something the government has taken great interest in. The pitch is passenger safety, but the more the government knows about where and when you travel, the more secure it feels. It doesn't do much for the security of passengers but it eases the government's mind when its freely-moving citizens can still be tracked. Grabbing faces at checkpoints to ensure "seamless journeys" is just another step down the path the government's been traveling for awhile now, which includes allowing the CBP and DEA to warrantlessly peruse traveler data to find people it wants to track… or to shake down for cash.

The tech is finally catching up with the government's post-9/11 desires. It has asked repeatedly for us to trade privacy and personal security for a nebulous greater good. And it's gone ahead and made those tradeoffs no matter what the answer has been.

Filed Under: boarding pass, dhs, facial recognition, flights, homeland security
Companies: jetblue

Proposed DHS Rules May Cause The Deaths They Claim To Prevent

from the security-theater-making-us-less-safe dept

Back at the end of March, the Department of Homeland [in]Security issued rules stating that all electronics larger than a smartphone should be checked instead of kept in a carry-on on flights into the US from 10 airports or on 9 airlines from mainly Muslim countries in the middle east and north Africa. This was following claims by US and UK intelligence that terrorists are smuggling explosive devices in various consumer items to 'target commercial aviation'.

Not only does this not pass the smell test -- anyone looking to bring down an aircraft with explosive devices won't care if they're in the cabin or the hold: boom is boom. The idea that items are going to go through some sort of super-secret screening is laughable, when red-team penetration tests find it trivial to get prohibited items onto aircraft (including via people with no ticket who bypass security screenings). And, of course, airports already require carry-on electronics to be x-rayed, and often swabbed for explosive residue. What's more, I remember seeing 'explosives smuggled on board' hysteria since Pan Am 103 almost 30 years ago, where Czech explosive Semtex was suspected to be in everything from fake muesli to electronics following the use of just 12 ounces (340g) to blast a 50cm hole in the 747's hold.

A more "credible" theory is potential "cyber warfare" (a pox on that term). With electronics out of sight of the passengers after check-in, access to them is far easier for 'security services'. As well as allowing easy access to snoop on passenger electronics and data, there is a potential for far more nefarious actions in the tradition of Stuxnet.

Stuxnet was a worm that targeted a certain Siemens industrial control system primarily used by Iranian nuclear centrifuges. However, it spread via infected USB drives to computers, and from those computers to other USB drives, all the while using rootkits with compromised digital signatures to hide. It essentially used a digital version of '6 degrees of separation' to eventually infect its target. What better way to spread similar malware than to infect a bunch of computers on flights to the target country? It's not just laptops either, cameras need memory cards and are just as easy to infect. As a theory, it's got a lot to commend it, but that's beside the point, because, remember, this is about 'safety' and people not taking bombs into aircraft cabins.

So fast forward to the present, and while expanding the ban has been kicked about, a JetBlue flight has shown the incredible danger of requiring electronics to be put into bags that often are kicked about.

May 30th's JetBlue flight 915 (NY JFK to San Francisco) had to make an emergency landing in Michigan after a AA lithium battery in a backpack started to smoke. When it was noticed, the backpack was moved to the aircraft bathroom which presumably dislodged whatever was causing the short. Luckily that was enough to prevent the fire from getting started, which would have soon gotten out of control.

And therein lies the problem. Lithium battery fires are very dangerous, and one of the things that make them more dangerous than most other fires is that most of the things you'd do by instinct to put out a fire (smother it, put water on it) actually makes them worse. Realistically, the only way to deal with a lithium fire is to stop it before it starts, and while that happened this time, if it were in the hold we'd be looking at a downed Airbus A321 with 158 dead.

Airlines know this and have for a long time. In 2000, I tried to fly with 2 batteries in my checked baggage from the UK to San Francisco with Virgin, and to Las Vegas with TWA. The batteries, Hawker (now Enersys) SBS40's were 38Ah, 12v batteries (yes, you can easily start a car with them) and were packed safely into my checked baggage as well as being certified safe for air travel (they won't leak if tipped or punctured). Virgin had no problems, but TWA flatly refused, citing a risk of fire in the hold (and at 28lb/12.7kg each, carry-on wasn't an option)

Now bear in mind this is a battery designed for rugged use, puncture resistant and safe (which is why they were used in Battlebots entries, which is why I was taking them, for the Suicidal Tendencies team), in a fire-resistant case where the only available fuel might be some small amounts of hydrogen gas, and whatever items are around. Lithium batteries generally don't come in rugged fire-resistant cases, provide their own fuel, and worst of all, physical damage (such as heavy-handed baggage handlers) can cause such damage.

If you want a more specific example of the risks, just cast your minds back to last year and the Samsung note7. With just the potential for a fire with note7 battery, they were banned from aircraft for safety reasons. They weren't consigned to the hold, where they can cause problems without anyone noticing.

And it gets worse, Lithium-ion batteries are EVERYWHERE. Aside from the rechargeable AA and AAA batteries like the one that caught fire on flight 915, lithium batteries are in laptops and cameras. Here are some examples of lithium batteries I had to hand, that I'd take on a trip with me and have to check.

That's a laptop battery, a digital camera battery, a phone battery and a video camera battery (I have 4 of these). One of them is 10 years old, that's how long these batteries have been out there.

Any of these can cause an uncontrollable fire if mishandled (and sometimes, just from age). What's more, any of these devices wouldn't take much to rig with a short-range detonation using nothing more than their own battery as the bomb. A bomb which will pass all the cursory security checks because there are no obvious chemicals (RDX, TNT, etc) to detect.

As a policy to prevent bombings, it's not useless, it's actually WORSE than useless, as it makes it FAR easier to take down an aircraft with electronics, just by accident, let alone by design.

The only people who benefit from this policy were it to be enacted worldwide, would be the computer snoopers, and of course, the many thieves, pilferers, 5-finger-discount shoppers, and general low-life criminals that seem to be employed at most airports in their security/baggage handling/TSA departments. Anyone else is potentially flying corpse-class.

Now, some might say that in this case, having lithium-ion batteries of any kind on an aircraft -- whether in checked luggage or carry-on -- is a recipe for disaster, and that they should be banned in general. But what I'm saying is that they are more prone to fire through mishandling than other battery types, and that such a fire, once it has started and takes hold, is more difficult to get under control easily. Well-maintained, well-treated batteries are safe if they're kept in the cabin, as any incident can at least be quickly addressed, as the recent JetBlue incident showed. Requiring they be put into baggage that is dropped, thrown, punted, squished, molested, rummaged through and otherwise mishandled, before being packed tightly into an aircraft hold unattended means that damage leading to a fire is far more likely, and that fire is unlikely to be discovered – let alone extinguished – before it is too late for the safety of the aircraft.

And if you're wondering how to put out a lithium battery fire when started, the answer is to use a class-D fire extinguisher (which only works on metal fires) but in a pinch, salt (pun intended) or sand can be used. Good luck finding the former, or enough of the latter two at 43,000ft. In a pinch, you can use water in mist form to cool around the battery and bring its temperature down (this can take a LOT of water and time), while also isolating it from any other fuel where possible (which was done in this case). Again, this is not really feasible if the fire is in the hold. Here's a demonstration of extinguishing a laptop battery fire, and how even when prepared, and waiting for it, with an extinguisher at the ready, it can still take a minute or two to put it out. Most people would be tempted to stop once the flames go out, allowing for re-ignition.

Reposted from the Politics & P2P blog

Filed Under: batteries, dhs, fires, flights, laptops, rules

DHS, TSA To Make Boarding A Plane Even More Of A Pain In The Ass

from the whatever-makes-the-experience-more-dystopian... dept

More bag-sorting and intrusiveness awaits more flyers thanks to the DHS and TSA. The TSA has already banned electronic devices larger than a cellphone from being brought on board flights originating in 10 predominantly Muslim countries. Now, it wants to extend that ban to European nations. For now, the new inconvenience is in its test phase.

Rather than make things safer, officials now want lithium ion batteries and other similar fire hazards to be stowed in areas where no one's likely to notice a developing fire and subject them to the sort of abuse airline employees save for items they haven't personally purchased. All in the name of safety, and all in the name of unspecified threats.

The additional stupidity is this would only apply to flights in and out of the US, but not to domestic flights… at least not at this point. DHS boss John Kelly sort of clarified this on Fox News last week, utilizing a very governmental vagueness.

WALLACE: I want to pick up on aviation because you are in the process of making some big decisions on aviation. And I want to do a lightning round, quick questions, quick answers.

Are you going to ban laptops from the cabin on all international flights both into and out of the U.S.?

KELLY: I might. That's a quick answer.

WALLACE: Yes, well, expand a little bit.

KELLY: Well, there’s a real threat. Numerous threats against aviation, that's really the thing that they are obsessed with, the terrorists, the idea of knocking down an airplane in flight, particularly if it’s a U.S. carrier, particularly if it's full of mostly U.S. folks, people. It's real. You know that I implemented I think on the 21st of March a restriction on large electronic devices in the cabins from ten points of origin.

But wait, there's more! Not only will laptops face a potential ban on international flights, folks flying domestic may be forced to do even more sorting of their carry-on goods.

WALLACE: Another lightning round question, I do need a quick answer here because we’re running of time. The TSA is testing tighter screening of carry-ons, and the idea that people who bring their carry-ons are going to have to unpack them and put food in one bin, and electronics in the another bin, and paper in another bin.

Are you going to spread that nationwide and what’s that going to do to the screening lines?

KELLY: Yes, I mean, the reason we’ve done, TSA, of course, works for me. The reason we've done that is because of -- people trying to avoid the $25 or $50 or whatever it is to check a bag are now stuffing your carry-on bags to the point of, you know -- well, they can't get any more in there. So, the more you stuff in there, the less the TSA professionals that are looking at what's in those bags through the monitors, they can't tell what's in the bags anymore. So, if you put --

WALLACE: So, are you going to do that nationwide?

KELLY: We might, and likely will.

There's a good chance this move will receive unanimous support from airlines. Not that airlines can actually create travel safety policy, but this policy will likely result in more checked baggage. It likely won't have any effect on travel safety, but it will at least give TSA agents more opportunities to convert passengers' electronic devices for personal use.

It's also going to create longer lines at security checkpoints, as bags are unpacked and sorted before scanning, then reassembled afterwards. This new inconvenience also works out well for the TSA, as it serves as the perfect advertisement for its Precheck service -- the one where the government sells your rights back to you for a small fee.

Again, this will have a negligible effect on travel safety. In fact, it could be argued that piling up people at security checkpoints makes them a much more tempting target than going through all the logistics of smuggling weapons and explosives onto a plane. At best, security will be no better than it was prior to the bag sorting, and it definitely will make travelers less secure. As Mike pointed out earlier, taking steps to separate people from their electronic devices will lead to all sorts of sensitive information being stored in unsecured areas.

[F]orcing people to give up their laptops has a secondary (but very serious) problem: for anyone traveling with sensitive information (lawyers, doctors, reporters, business execs, public officials, etc.) giving up your laptop is a massive security risk.

All of this makes much more sense when you realize the head of the DHS isn't in the business of finding smart solutions, but rather selling fear to willing buyers.

Homeland Security Secretary John Kelly on Friday said the terror threat is worse than most realize, saying some people would "never leave the house" if they knew the truth.

“I was telling [Fox host] Steve [Doocy] on the way in here, if he knew what I knew about terrorism, he’d never leave the house in the morning,” Kelly said on “Fox & Friends.”

And yet, millions of Americans not only leave the house, but fly millions of air miles without incident. I'm sure Kelly believes this is mostly due to the TSA's ever-shifting rules on carry-on luggage, but the reality is that terrorist attacks are still an anomaly -- outliers on the curve of human existence, at least here in the US. The proposed measures will guarantee more money flows to airlines and TSA, but little else.

Filed Under: dhs, flights, laptops, security theater, tsa

US & EU Not Banning Laptops On Planes... Yet

from the stay-tuned dept

Last week there were reports claiming that the Department of Homeland Security (DHS) was just about ready to ban any laptops from being in the passenger cabin on any flights between the EU and the US. As we pointed out this made no sense, even if there were credible reports of terrorists turning laptops into bombs (as the rumor goes). The plan was supposedly set to go into effect last Thursday, but on that day DHS said it hadn't made a final decision yet. Of course, apparently some over eager airline employees had official signs printed up claiming the ban was already in place (leading to later apologies).

Apparently, the decision not to implement the ban came because EU officials were not thrilled with the idea and wanted to discuss -- leading to a series of meetings. Of course, that also allowed time for the airline industry to snap to attention and announce that such a ban might cost travelers around $1 billion. Admittedly, there may be some dubious math involved... but it's fairly obvious that such a plan would lead to all sorts of problems for travelers -- from general lost productivity, to delays and confusion around checking the laptops, to broken, lost or stolen computers and more.

At least for now, we can breathe a sigh of relief that the EU/US meetings have ended without a plan to ban laptops on planes... though such a plan could always pop out again in the near future (and, it will almost certainly happen if there is an airplane bombing). And, of course, there's still the ominous "other measures" still being considered:

US and EU officials have decided against a ban on laptops and tablets in cabin baggage on flights from Europe.

But after a four-hour meeting in Brussels to discuss the threats to aviation security, officials said other measures were still being considered.

Air travel security theater continues to be the worst security theater.

Filed Under: bans, dhs, eu, flights, laptops, security theater, us

FBI Director Finally Starts Answering Questions About Its Surveillance Flights Over US Cities

from the public-areas-still-public,-even-if-viewed-from-above dept

Suspicions confirmed (well, at least by the FBI…): the FBI has been flying its surveillance planes over cities, often at the behest of local law enforcement.

FBI Surveillance flights over Baltimore and Ferguson as residents of those cities engaged in civil disobedience against racially-motivated police violence were lawful and useful, bureau Director James Comey claimed Thursday.

Comey said that the missions were flown at the behest of local law enforcement in each case, as demonstrations raged against the killings of Michael Brown and Freddie Gray by city cops.

In cases where large-scale protests are probable, it's unsurprising that aerial surveillance will be in use. Comey pitches the FBI's secret surveillance flights as a public benefit, which, in these cases, it arguably is.

“If there is tremendous turbulence in a community, it’s useful to everybody—civilians and law enforcement—to have a view of what’s going on,” Comey said. “Where are the fires in this community? Where are people gathering? Where do people need help?” he went on.

What's more concerning are the FBI's other flights -- the ones it's not as eager to talk about. These flights were uncovered by journalists and hobbyists, who tracked the planes' bizarre flight patterns, as well as traced their ID numbers back to a plethora of shell companies the FBI created to hide the planes' purpose and origin.

To be clear, aerial surveillance rarely implicates Fourth Amendment concerns. In order to do so, planes/helicopters/drones have to fly at very low altitudes and disturb normal ground activities. At this point, the airborne surveillance becomes legally analogous to a breaching of the curtilage -- more or less a warrantless search.

Comey also answered questions from Senator John Conyers, who had concerns about observed FBI flights over his home state of Michigan. As Comey explained, the flights are simply standard operating procedure.

We use planes in our predicated investigations to conduct surveillance of people who are under investigation. We do not use planes for mass surveillance. And so the good folks in Michigan who saw a plane in the air, I think a lot of them had a chance to meet with my SAC (special agent in charge) out there, and have him explain: 'Look, this is what we do in criminal cases. It should make sense, if you understand how we use it in individual cases.' So we have a small number of airplanes — I actually wish we had more — that we use to follow people in places where it's hard to follow them on foot or in a car."

Even if lawful, the planes are still raising surveillance concerns. Targeted surveillance is one thing, but it's common knowledge that US government agencies are using airborne cell tower simulators. Much like the ground version (commonly known as Stingrays), these devices scoop cell phone connection data (which includes location info). Many can be configured to obtain communications as well. The FBI denies using any of its planes for "mass surveillance," but the agency possesses all of the necessary technology to deploy them in this fashion.

Filed Under: fbi, ferguson, flights, james comey, privacy, stingray, surveillance

FBI Investigating Chris Roberts For Hacking Flight WiFi, Taking Control Of Engines

from the how-is-this-possible? dept

I'll be honest: when I wrote about Chris Roberts being detained by the FBI for tweeting about hacking his flight's WiFi, I reacted with a great big eyeroll. On the one hand, security researchers like Roberts look for these vulnerabilities all the time and it's quite helpful when law enforcement and airlines learn about potential avenues for threats. On the other hand, Chris Roberts is quite obviously not Al Qaeda. The whole thing appeared to be a reaction to embarrassment that the vulnerability had been allowed to exist, rather than any belief that Roberts was in any way a threat.

But if Roberts is to be believed, he did something really stupid on previous flights: he used his WiFi hack to manipulate the plane's engines.

During two interviews with F.B.I. agents in February and March of this year, Roberts said he hacked the inflight entertainment systems of Boeing and Airbus aircraft, during flights, about 15 to 20 times between 2011 and 2014. In one instance, Roberts told the federal agents he hacked into an airplane’s thrust management computer and momentarily took control of an engine, according to an affidavit attached to the application for a search warrant.

“He stated that he successfully commanded the system he had accessed to issue the ‘CLB’ or climb command. He stated that he thereby caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane during one of these flights,” said the affidavit, signed by F.B.I. agent Mike Hurley.

If true, that would go way beyond identifying exploits, mentioning that you could drop the oxygen masks, or really anything else that deals with in-flight wireless hacks. If the affidavit is to be believed, Roberts dangerously manipulated the flight's equipment, potentially putting everyone aboard at risk. We have only the FBI's word for all of this, of course, but the feds are certainly behaving as though Roberts both said all of this and that he's not simply making fictional claims.

Roberts, who has been interviewed at least three times by the F.B.I. this year, is under investigation for allegedly hacking into the electronic entertainment systems of airplanes, according to an application for a search warrant to probe seized electronic equipment. The document shows F.B.I. agents investigating Roberts believe he has the ability to do what he claims: take over flight control systems by hacking the inflight entertainment computer.

“We believe Roberts had the ability and the willingness to use the equipment then with him to access or attempt to access the (inflight entertainment system) and possibly the flight control systems on any aircraft equipped with an (inflight entertainment system) and it would endanger the public safety to allow him to leave the Syracuse airport that evening with that equipment,” sates the warrant application.

Roberts, for his part, has at least suggested to a Wired reporter that the FBI is twisting his words:

“That paragraph that’s in there is one paragraph out of a lot of discussions, so there is context that is obviously missing which obviously I can’t say anything about,” he said. “It would appear from what I’ve seen that the federal guys took one paragraph out of a lot of discussions and a lot of meetings and notes and just chose that one as opposed to plenty of others.”

That still doesn't say he didn't do it, though.

As with too many of these stories, the end result is that we have absolutely nobody to root for. To be fair, Roberts has been warning the airlines and the feds about these exploits for years, without any of it generating much attention. His purported stunt has suddenly brought a little light to what is obviously an untenable security risk, which doesn't in any way excuse manipulating an engine mid-flight. That, plainly, is insane, and I don't think it can be argued that it's an action that deserves punishment. On the other hand, Roberts still isn't Al Qaeda and the end result of all of this may be that planes are safer. Intentions matter, after all.

As for the federal government and the airlines: are you kidding me? You're telling me that not only was all of this possible, which is crazy at the outset, but they had been warned about it and had done nothing? Crazy as it sounds, everyone should be thanking the universe that Chris Roberts was the one manning the keyboard on these flights instead of someone with more nefarious intentions. The feds and the airlines should have simply hired Roberts to battle these vulnerabilities rather than letting it get to this point. Instead, we learn this way that it may indeed be possible to get control of a flight through a plane's WiFi. And we learn that law enforcement and the airline's chief strategy to deal with that fact was to pretend it didn't exist.

Filed Under: chris roberts, fbi, flights, hacking, wifi

Why United Airlines And Orbitz Are Suing An Entrepreneur Who Helps People Find Cheaper Flights

from the because-you-can't-reveal-the-airlines'-secrets dept

Nearly two years ago, I wrote up an article on some super scammy airline pricing practices I had discovered in the process of trying to book a multi-city trip. Basically, I found that if you go to a travel search site and try to book the entire multi-city trip as a single trip, it would cost around twice as much more than if you booked the individual legs of the trip separately. In the comments to that post, some more experienced travel experts revealed even more questionable airline pricing practices, and even provided a few more tips on how to get even cheaper fares. These days, more and more sites are popping up to help people sniff out these questionable practices and ways around them. For example, I recently learned about FlightFox, which basically gathers up some expert flight bookers, who know all the tricks, and will help you find cheaper fares (you have to pay them, but if they can save you more than you have to pay them, then it's worth it). While there's some irony in the idea of basically going back to the age of when an "agent" helps you book your flight, it also shows the power of the internet to get around crappy airline pricing practices.

Another such site is Skiplagged -- a site that focuses on finding what's known as "hidden city pricing." This is when you book a flight where the layover city is your real destination, but the flight is still cheaper than if you flew directly to that city. For example, if you wanted to fly from New York to San Francisco, booking a direct flight would be more expensive than booking a flight from New York to Reno -- but which has a layover in San Francisco. So you book the NY to Reno flight and just leave when you get to San Francisco (just make sure you don't check your bags). The site, Skiplagged, has built a clever search engine to sniff out those kinds of deals. I only just heard about it via a post on Boing Boing noting that the 22 year-old entrepreneur who runs the site (as a side project from his day job), Aktarer Zaman, has been sued by United Airlines and Orbitz over the site.

The claim seemed so ridiculous that I did some digging and pulled up the actual lawsuit [pdf], which is well worth reading. Zaman also did an interesting Reddit AMA about a month ago after the suit was served (incorrectly, on his mother). The lawsuit makes a bunch of claims that just seem unlikely to stand up in court -- but there are also a few details left out of all of the press coverage (a few of which may -- slightly -- harm Zaman's case).

The airlines make a really big deal about how "hidden city" traveling breaks "the rules." But, for the most part, the rules in question are for the travelers -- and Zaman didn't agree to them. So, instead, Orbitz and United are going with a "tortious interference with contract" claim, arguing that Zaman is interfering with Orbitz's agreements with airlines. There's also an "unfair competition" claim -- though it's hard to see how that makes any sense at all when all Zaman is doing is accurately showing flight pricing that is available via airlines' own sites and search engines like Orbitz's.

The lawsuit relies heavily on the fact that Zaman signed up for Orbitz's affiliate program, and, in doing so, agreed to abide by Orbitz's terms of service. In response to this, Zaman (in his AMA) notes that he only was exploring the affiliate program and didn't actually use it (in part because it wouldn't work in a way that fit Skiplagged's service). In fact, he posted a screenshot showing a grand total of six (six!) impressions and zero orders via his Orbitz affiliate account: Some of the claims in the lawsuit are so hyperbolic as to be ridiculous. The claims of problems caused by hidden city ticketing seem greatly exaggerated:

"Hidden city” ticketing also causes irreparable harm to United’s relationships with prospective customers. Any time a passenger foregoes a leg of travel, the passenger essentially takes away a seat that could have been sold to a prospective United customer. The prospective United customer may switch to another airline as a result, especially if his or her desired flight is full. In such case, United likely would also lose ancillary sales for other services, such as car rentals and lodging, and a number of disappointed customers may switch from United for all future travel if United’s flights are consistently “full.” United has no adequate remedy at law.

Yet, it turns out that people do this all the time. If you look on various travel guru sites, lots of people discuss this trick, and people appear to use it all the time. The "damage" done to airlines seems minimal.

Orbitz also makes some ridiculous claims about how people using Skiplagged and ending up on Orbitz's site for the booking will somehow automatically assume an agreement between the two sites:

To the average internet user of Skiplagged, the transition from the Skiplagged site to Orbitz’s website is seamless and strongly suggests an affiliation or identity between Skiplagged and Orbitz that does not exist. Indeed, online travel agencies such as Orbitz enter into agreements with airlines to use and publish the airlines’ data, all with the prior consent and cooperation of the airlines and according to financial terms that compensate all parties involved. By creating a website that operates in much the same manner as an online travel agency, and by linking that site to Orbitz’s site, Zaman is attempting to confuse and mislead the public into believing that his website, and the “hidden city” ticketing it employs, is done with the approval (if not the outright authorization and sponsorship) of Orbitz and the airlines.

That seems like a massive stretch. To the average traveling public, they won't be aware of any such deals and will assume (mostly correctly) that Skiplagged works like any search engine, linking to websites and information on the open internet with no direct agreement with those sites. That's not illegal.

Even more ridiculous is Orbitz's argument that because Zaman uses meta-refresh to get people to the right page for booking, Orbitz's team of engineers can't figure out how to block him. If I were a developer at Orbitz, I'd be insulted by this:

[W]ith the help of a redirector service, Skiplagged redirects users to the unique Orbitz URL when they select “Book Now.” This redirection process is accomplished through the use of an antiquated html technique called “meta refresh.” In its most basic form, a “meta refresh” will automatically refresh the user’s current web page after a specified time interval. With a few tweaks of the html code, “meta refresh” can also be used to automatically transfer users to a new page on a different website. This is done by instructing the browser to fetch a different URL and setting a low refresh time interval. Here, Skiplagged instructs the user’s browser to refresh automatically to the unique Orbitz URL that Skiplagged’s program has identified.

When Zaman causes the redirect to Orbitz, he also causes the user’s computer to initiate a pre-populated search utilizing his algorithm to cause searching on Orbitz’s site that would not be replicable by the typical user or otherwise through authorized use of the site. Once on the Orbitz website, because of the Zaman search (conducted without the user’s knowledge) the user is presented with the exact flight itinerary that was selected on Skiplagged. This is akin to “deep linking,” which transfers a user to a specific, indexed piece of web content on another website, rather than the website homepage. Just as with “deep linking,” Zaman uses the “meta refresh” and related algorithm to seamlessly transfer a user from Skiplagged to Orbitz’s site, which creates the impression that Skiplagged and Orbitz are partners or one-in-the-same.

To counteract Zaman’s conduct, Orbitz is continuing to investigate ways in which it may detect customers originating on Skiplagged and prevent the “hidden city” bookings from being made on the Orbitz site. Nevertheless, Zaman’s repeated variation in redirection strategies and his use of technical approaches like the “meta refresh” technique have frustrated Orbitz’s efforts. Injunctive relief will be necessary to ensure that Zaman does not further alter his software in an effort to circumvent Orbitz’s corrective actions.

This all seems to assume that "deep linking" is illegal. But it's not. And just because this 22-year-old on his side job is able to outwit Orbitz's team of computer programmers doesn't suddenly make what he's doing illegal.

Where it gets slightly trickier for Zaman is in his pre-lawsuit dealings with Orbitz (and possibly United). The lawsuit claims that when approached by Orbitz's lawyers, Zaman agreed to stop linking to Orbitz, but then proceeded to just block Orbitz's IP addresses, so that when people at Orbitz's offices checked it looked like he was blocking Orbitz, but everyone else could get there:

On the same day, Zaman responded to Orbitz Worldwide by email and promised to “stop redirecting users to Orbitz and partners by end of business week.”

Zaman, however, did not stop redirecting Skiplagged users to Orbitz, but instead has blocked Orbitz IP addresses from accessing the Skiplagged website. Starting on or around October 2, 2014, when Orbitz personnel attempted to perform a search on Skiplagged, they received an error message that read “Sorry for the inconvenience, but Skiplagged is unable to process your booking request.” Zaman, in other words, was trying to hide his improper conduct from Orbitz, so that he could go on redirecting Skiplagged users to Orbitz’s site, without Orbitz’s permission or knowledge. Orbitz believed and relied upon Zaman’s promises and believed for a time that Zaman was complying with his promises based on several tests from Orbitz computers that seemed to show that Zaman had complied with his promises. As such, Orbitz initially refrained from bringing this lawsuit.

It's possible that his email telling Orbitz that he would remove it, and then his failure to do so (along with just blocking Orbitz's own IPs) could lead to at least some trouble in the form of promissory estoppel.

Separately, Zaman and United's lawyers had a conversation where Zaman agreed to "remove all United references" on Skiplagged. And here he got creative. Whenever a United flight showed up, he wrote "censored" and had a notification that said "Sorry for the inconvenience, but United Airlines says we can't show you this information." In this case, depending on what was actually said, it's unclear if this would reach the same "promissory estoppel" level that the email to Orbitz might reach -- though he did send United an email saying "United is removed from our services." It could be argued whether or not that's accurate.

On the whole, the lawsuit really is ridiculous. Suing this guy for showing accurate information about flight prices seems tremendously questionable. However, the situation is complicated somewhat by Zaman's promises to both companies. No matter what, it's well known that airlines play really obnoxious fare-pricing games, and Zaman was trying to shed some light on it with a simple side project. And, really, if your entire business can supposedly be undermined by a 22-year-old kid in his spare time accurately showing the prices of various flights, perhaps the real problem is with your business model, and not with the kid.

Filed Under: aktarer zaman, flight pricing, flights, hidden cities, hidden city flights, hidden city tickets, layover, promissory estoppel, skip lag, tortious interference
Companies: orbitz, skiplagged, united airlines

FAA Grounds Attempts At Ride Sharing For Amateur Pilots

from the because-that's-what-the-FAA-does dept

Hot off of doing its best to kill off any commercial use of drones, the FAA is now looking to ground some attempts at building ride sharing for amateur pilots. While plenty of people are referring to AirPooler as an "Uber for airplanes," it's not really like that. Here, the idea is that if you're a pilot flying somewhere, you can post your plans and if someone was looking to travel that route, they can hop on board and pay some of the fuel costs. The end result basically benefits everyone. The pilot has lower costs, the traveler gets a cheap flight and everyone's better off. This kind of thing happened informally all the time in the past, usually by word of mouth and bulletin boards. Airpooler is just formalizing the process.

But the FAA... doesn't like it. It claims that any offsetting of the pilots costs makes it a commercial endeavor and that violates the FAA's rules on private (non-commercial) pilots.

Private pilots as a general rule may not act as pilot in command of an aircraft that is carrying passengers or property for compensation or hire nor, for compensation or hire, may they acts as pilot in command of an aircraft.

Now, there is an exception to that rule if the passengers are paying a pro rata share of the expenses of the flight. So this shouldn't be a problem, right? Wrong. The reasoning here is about as opaque as a foggy morning in San Francisco. The FAA repeats that there's an exception for expense sharing, but then argues that AirPooler can't rely on this exception.

As such, although § 61.113(c) contains an expense-sharing exception to the general prohibition against private pilots acting as pilot in command for compensation or hire, a private pilot may not rely on that narrow exception to avoid the compensation component of common carriage. For this reason, the FAA has required a private pilot to have a common purpose with his or her passengers and must have his or her own reason for travelling to the destination.

Likewise, although airline transport pilots and commercial pilots may as as pilot in command on an aircraft carrying passengers for compensation or hire, they may not conduct a commercial operation involving common carriage without obtaining a part 119 certificate. You have urged that the test for compensation in commercial operations is "the major enterprise for profit" test set forth in the definition of commercial operator. Specifically, you state that a pilot would not be engaged in a major enterprise for profit "if accepting only the cost reimbursements allowed under § 61.113."

Based on the fact that the FAA views expense-sharing as compensation for which an exception is necessary for private pilots, the issue of compensation is not in doubt.

Therefore, the "major enterprise for profit" test in § 1.1 is wholly inapplicable. Accordingly, we conclude that, with regard to pilots using the AirPooler website, all four elements of common carriage are present. By posting specific flights to the AirPooler website, a pilot participating in the AirPooler serve would be holding out to transport persons or property from place to place for compensation or hire. Although the pilots participating in the AirPooler website have chosen the destination, they are holding out to the public to transport passengers for compensation in the form of a reduction of the operating expenses they would have paid for the flight. This position is fully consistent with prior legal interpretations related to other nationwide initiatives involving expense-sharing flights.

Got it? I've read it over half a dozen times and I'm still confused. There's an exception that says that a passenger can pay their share of the expenses and it doesn't make it a commercial flight, but... that doesn't apply here because it's compensation, as clearly determined by the fact that there's an exception for this kind of compensation. Say what?

AirPooler apparently plans to ask the FAA "to elaborate" though the FAA's historical approach to almost any innovation seems to be "well, let's wait and not really make a decision for as long as is humanly possible." End result: significantly less innovation, not just from the likes of AirPooler, but all of the entrepreneurs who won't even try to build startups in the space.

Filed Under: faa, flights, pilots, ride sharing
Companies: airpooler

DailyDirt: Lost At Sea

from the urls-we-dig-up dept

Malaysian flight MH370 remains a mystery (for now?), but technology that could have answered a lot of questions actually exists -- it just wasn't aboard MH370. There are black boxes that can eject with parachutes and be more easily recovered. Various aircraft monitoring systems and engine monitoring systems can send maintenance signals to satellites, providing significant help to investigators if problems during a flight occur. Despite all these technological advances, it's still pretty easy to get lost in the oceans. Here are just a few links on finding things on the open sea.

• In 1992, a cargo ship lost 28,800 rubber ducks (among other items) in the North Pacific, and these bath toys have turned up in unexpected locations years later. It wouldn't be so surprising to find these rubber duckies just in Alaska, but some found their way to Maine and (possibly) to even more distant shores of the Atlantic. [url]
• The perfect non-denial denial phrase "can neither confirm nor deny" originates from the "Glomar Response" concerning a CIA operation to recover a sunken Soviet submarine from the ocean floor in the 1970s. Glomar is an abbreviation of Global Marine, the name of the company that built the salvage vessel that "may or may not have" tried to go after the sunken sub. [url]
• An empty Russian cruise ship (the MV Lyubov Orlova) has been lost in the North Atlantic for over a year, and it's possible that it's still afloat. There have been other crew-less ships that have sailed far from their home shores, like the Ryou-Un Maru -- a Japanese fishing ship that made its way across the Pacific to the Gulf of Alaska. [url]

If you'd like to read more awesome and interesting stuff, check out this unrelated (but not entirely random!) Techdirt post via StumbleUpon.

Filed Under: aircraft monitoring systems, black box, flights, glomar response, lost, malaysian flight, mh370, mv lyubov orlova, rubber ducks, ryou-un maru, ships