Feds consider lowering passenger data requirements

The U.S. Department of Homeland Security has taken a preliminary step in overhauling plans for an air traveler-screening program that has alarmed privacy advocates in the past.

Under a new proposal for a controversial program known as Secure Flight (click for PDF), the Transportation Security Administration would assume the duty of checking passengers against terrorist watch list databases, which is currently done by U.S. air carriers. In a nod to earlier privacy concerns, it proposes scaling back the amount of data that airlines would be obligated to submit about their passengers.

Unlike earlier plans, "it's not going to rely on collecting commercial data; it's not going to assign a risk score to passengers; it's not going to try to predict behavior," Homeland Security Secretary Michael Chertoff said at a press conference on Thursday. "It's only designed to collect a minimum amount of personal identifying information so that we can do an effective job of matching the traveler to a person whose name and identity is on a watch list."

"It's only designed to collect a minimum amount of personal identifying information so that we can do an effective job of matching the traveler to a person whose name and identity is on a watch list."

--Homeland Security Secretary Michael Chertoff

The plans aren't final. They are set to be open for public comment for 60 days after their publication in the Federal Register. A TSA spokeswoman said the agency expects to begin implementing the new rules late next year.

Secure Flight, which was born in 2004, has already been put on hold amid privacy "mishaps" flagged by government auditors and others. As a result, Congress decreed that Homeland Security can't proceed with a watch list-checking program until it shows that it's sufficiently privacy-protective and functional.

The latest approach is intended to improve security amid what Homeland Security says are inconsistent watch list-checking practices by airlines. It's also designed to give federal agents more time to resolve the "false positive" matches that have notoriously arisen under the current system, leading to delays for innocent travelers.

For international flights, some changes will be coming sooner. In a separate rule issued Thursday, Homeland Security said Customs and Border Protection will soon begin requiring airlines to submit, no later than 30 minutes before takeoff, a passenger's full name, date of birth, gender, passport information, citizenship information, and flight and itinerary information.

Much of that data doesn't currently get sent for checks against watch lists until after the flight has already taken off, which Homeland Security says is "too late" to do effective screening.

In its 139-page proposed rules for Secure Flight, Homeland Security says it would require passengers only to submit their full names--as they appear on their identification documents--to airlines when making flight reservations.

Airlines would also be required to request other information, such as the passenger's date of birth and gender, but giving it would be voluntary. Homeland Security warned, however, that withholding those extra details could prompt extra screening at the airport or prevent early check-in, as it may be more difficult for federal agents to distinguish innocent travelers from terrorist watch list designees.

Passengers would also be asked to voluntarily submit to their airline two somewhat mysterious new identification numbers developed by TSA. Those, too, are intended to make the screening process easier.

One is called a "redress number," which TSA plans to assign to passengers who have reported through its redress process being "incorrectly" delayed in their travels. The other is a "known traveler" number, which would be given to travelers who have already undergone what Homeland Security calls a "terrorist security threat assessment" and been deemed benign.

It's unclear how that process would unfold, but the idea resembles an existing program called Registered Traveler, in which passengers can pay a fee, submit biometric and biographic information and, if they pass muster, receive a special card designed to allow speedier passage through security checkpoints.

[Marcus Westrup]

What a mess

This will be complicated and expensive to implement, and I don't see any improvements to security. Any time you violate the KISS principle you risk disaster.

What happens if the computer systems go down? Does everyone in the country have to sit and wait?
And how can TSA provide extra training for "access controls" and "audit logging" tasks? Those jobs require the actions of fully qualified IT security personal, or it means nothing.

All in all I think this is a long way from being settled.

[likes2comment]

Give up your liberty to be secure.

Everyone needs to give up their liberty to be secure according to what Homeland inSecurity always proposes. I think this means the terrorists have won without having to destroy any more buildings, etc.