Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×

Identity Theft From Tossed Airline Boarding Pass? 297

Posted by Zonk from the just-ouch dept.
crush writes "The Guardian newspaper has a great story about how the gathering of information for 'anti-terrorist' passenger screening databases allowed a reporter and security guru Adam Laurie to lay the groundwork for stealing the identity of a business traveller by using his discarded boarding-pass stub." From the article: "We logged on to the BA website, bought a ticket in Broer's name and then, using the frequent flyer number on his boarding pass stub, without typing in a password, were given full access to all his personal details - including his passport number, the date it expired, his nationality (he is Dutch, living in the UK) and his date of birth. The system even allowed us to change the information."
This discussion has been archived. No new comments can be posted.

Identity Theft From Tossed Airline Boarding Pass? More

Identity Theft From Tossed Airline Boarding Pass?

Comments Filter:

  • Boycott (Score:5, Insightful)

    by The Snowman ( 116231 ) * on Thursday May 04, 2006 @08:08AM (#15261507)

    Ever since 9/11, I refuse to travel by air. Not because of the scary terrorists, but because of my scary government. While the article talks about a UK program with bad security, the author is clear that this is all because of pressure from the United States.

    I sent an email to the TSA a while ago telling them that I despise their spying programs and I am boycotting the airline industry. I don't want to be treated like a second-class citizen, spyed on, and my rights violated. Sure, the majority of airline passengers don't have a problem, but there are a significant quantity that do hit security snags on a daily basis. What has this increased illusion of security bought us? Pork. We haven't caught terrorists because of spending on ineffective security programs. Each alleged terrorist since 9/11 was caught because of people. People who thought something was wrong -- the shoe bomber who had trouble with his bomb, and passengers and flight attendants handled the situation. Not computers, not databases. People.

    As far as I'm concerned, the airline industry can rot in hell for giving in to government pressure. They know these security programs do nothing more than waste money on pork and make certain politicians feel smug, earning brownie points with their constituents. Until the government gets a clue, I will not fly. If the airlines suffer, so be it. Money is what drives this country. Maybe when the government realizes that the airlines aren't making money, someone, somewhere, will get a clue and start implementing good security that does not violate our privacy.

    • Re:Boycott (Score:2, Insightful)

      by MyLongNickName ( 822545 )
      Wow. Dutch citiczen. UK government. Still US's fault.

      No, I am not a fan on the war on freedom^H^H^H^H^H^H^Hterrorism. But get over it. Both countries are capable of putting together a more secure system. Quit blaming the US for all the world's problems.

      This assumes the guardian is reporting a true story. They have been know to be free with the truth.

      • Re:Boycott (Score:3, Insightful)

        by Whiney Mac Fanboy ( 963289 ) *
        Wow. Dutch citiczen. UK government. Still US's fault.

        Maybe you should have read the article before commenting:
        [the boarding pass] would also serve as the perfect tool for demonstrating the chaotic collection, storage and security of personal information gathered as a result of America's near-fanatical desire to collect data on travellers flying to the US....

        • Re:Boycott (Score:4, Insightful)

          by MyLongNickName ( 822545 ) on Thursday May 04, 2006 @08:22AM (#15261604) Journal
          Maybe you shouldn't automatically suck down everything a news article tells you. I did RTFA. However, the US is allowed to make lawas about who can come into their country. Other countries have to respect those rules. If those countries choose to allow insecure systems like this to come into place, then that is THEIR problem, not ours.

          Our problem is that we have elected people who put moronic rules into place.

          • Re:Boycott (Score:3, Insightful)

            by Jedi Alec ( 258881 )
            However, the US is allowed to make lawas about who can come into their country.

            Indeed they are. Good thing the rest of us are allowed to take a hint and decide we're not welcome. Guess we'll just go somewhere else with our business.

      • Re:Boycott (Score:2, Insightful)

        by chiskop ( 926270 )
        This assumes the guardian is reporting a true story. They have been know to be free with the truth.

        Reference, please.

      • I suggest you RTFA. There's a pretty short line between US border requirements and this problem - and it doesn't help catch terrorists whatsoever.

        Perhaps your 'Don't blame the US' line is every bit as much a knee-jerk reaction as you think the 'Blame the US' line is?

        J.

    • As far as I'm concerned, the airline industry can rot in hell for giving in to government pressure.

      Correct me if I am wrong, but didn't the 9/11 bombers use US internal airlines because the security was so poor? A situation caused by the airline companies not agreeing to previous government calls for tighter security due to concerns that people might be put off flying.

      I dont like all the pointless security either but some of it is defintely neccessary, and that wasn't the case on US internal airlines pre

      • Correct me if I am wrong, but didn't the 9/11 bombers use US internal airlines because the security was so poor?

        By internal I take it you mean using U.S. airlines to attack the U.S. Duh? This place isn't like Europe with a bunch of little countries next to each other. If they didn't use U.S. airlines taking off from U.S. airports, what would they have used?

        Anyway, the problem wasn't security. The hijackers had clean records, were in this country legally, and had authentic identification. There was no wa

      • I dont like all the pointless security either but some of it is defintely neccessary, and that wasn't the case on US internal airlines pre-September 2001.

        Could you please elaborate on which parts are necessary and which parts aren't if, as you claim, the security is pointless. If the security is pointless then by definition there are no necessary parts of it.

        And anyway people need to see security at airports/on planes, in order to allievate fear of flying, which many people had after 9/11 and which

        • Could you please elaborate on which parts are necessary and which parts aren't if, as you claim, the security is pointless.

          I'd suggest that if someone really wanted to hijack another plane in the US, or wherever, it would still be possible, even with the extra security. A number of scenarios spring to mind, but forgive me if I don't suggest them out loud! You're all clever people and I don't doubt for a second you could all come up with a number of feasible plans. The current security might make some of t

        • I got my laptop bag wiped down at SFO a few years ago, and the little tissue popped into the machine to test for explosives. Either it's incredibly selective, or it's bullshit. My bag had been under the counter at the late lamented National Shooting Club on Duane while I shot ~200 rounds of 9mm and a box of .38 S&W. It had had spent cartridges falling on it. I'd been handling both live and spent ammunition. When I arrived at the airport I stank of firing ranges.

          And yet the little wipe said all w

    • Re:Boycott (Score:5, Interesting)

      by mgblst ( 80109 ) on Thursday May 04, 2006 @08:50AM (#15261825) Homepage
      I flew from Sydney to Vancouver, and the plane happened to stop in Honolulu for refueling. Since Honolulu is in the US, every single person had to get off the plane, have their picture taken, and be finger printed. Then we all got back on, and flew the rest of the way to Canada. It took 2 hours, for nothing. Nobody was staying in Honolulu, we only wanted some fuel. Thanks US.

      And surprisingly, they didn't catch any terrorists that day, either.

      • That story scares me. (Score:2, Interesting)

        by Don_dumb ( 927108 )
        I have to admit I am shocked, I didin't think they had any right to do so.

        I thought that runways were a kind-of international territory? Thereby allowing people to get transferring flights without going through passport control (which acts as the the offical border) and be a passenger on a plane that refuels without getting visas for the land in which they are only sitting on a runway. Does the US government really have the right to do this? I mean they couldn't stop a plane flying from Canada to Mexico be

        • Re:That story scares me. (Score:3, Informative)

          by innot ( 582843 )

          No, an airport is national territory. And by convention an airplane becomes part of the national territory the moments the doors open (with doors closed different regulations apply (Warsaw Convention, Montreal Convention))

          Most International Airports have designated transit area for passengers transiting a country to save them from the hassle of immigration and emigration - Except for the US, where most international airports do not have real transit areas, thus requiring all transiting passengers to ente

      • Comment removed based on user account deletion
    • I can't boycott flying. If I don't fly, I don't work.

      That doesn't mean I put up with the TSA silently. I got so tired of getting groped by them without warning (twice on the same trip!) that I now wear nothing but spandex when going through security. Haven't been patted down since.

      Of course, my bags still get X-rayed, and every time my carryon goes through security at MSP it gets hand searched because, they claim, any bag with a CPAP (machine for treating sleep apnea) must be hand-searched. Of course, that'

    • Re:Boycott (Score:2, Interesting)

      by azhrei_fje ( 968954 )
      They know these security programs do nothing more than waste money on pork and make certain politicians feel smug, earning brownie points with their constituents.

      This is right on.

      The next time you visit an airport, ask yourself what would happen if a terrorist didn't wait until they got all the way to the metal detectors and X-ray machines before detonating an explosive device. As a business traveler, I've logged a million miles on one airline and hundreds of thousands on other airlines. Any idiot who

      • Re:Boycott (Score:3, Interesting)

        by smooth wombat ( 796938 )
        I'm so glad you said the same thing I've been saying for a long time re: someone wanting to do harm not waiting to get on the plane. The line of people waiting to get screened is just as viable a target as an entire plane.

        Want to really cause panic in the air traffic system and probably get it shut down? Get you and four of your friends to do the same thing at five different airports at the same time on the same day. Say 12 noon eastern time the day before Thansksgiving.

        If anyone from any three letter ag
    • The only major shift in U.S. airline security practices as they directly affect passengers is that those measures previously ubiquitous in international travel are now used for domestic travel as well--and some of the gizmos have gotten a bit better. I've been travelling internationally for 25 years and save for updating the X-Rays and adding aerosol analyzers to the routine, I feel no more violated by U.S. security measures than I did twenty years ago going through, say, British customs who rifled through

  • Shenanigans (Score:5, Funny)

    by eldavojohn ( 898314 ) * <eldavojohn AT gmail DOT com> on Thursday May 04, 2006 @08:08AM (#15261509) Journal
    The system even allowed us to change the information....
    That's right, (*snicker*) Broer is now a 38 year old pregnant mother of four from Belgrade with a passport that expired in 1983. Let's see how long it takes him to figure out he's the victim of identity mod!

    I doubt "Mrs." Broer will ever throw away her airplane ticket stub again!
  • "The problem is that if the system doesn't have a lot of information on you, or you have ordered a halal meal, or have a name similar to a known terrorist, or even if you are a foreigner, you'll most likely be flagged amber and held back to be asked for further details" [emph mine]
    WTF? I didn't think the US did racial profiling - this is quite sad for Muslims (as well as people like me, who just order different 'special' [I like kosher] meals at random). Not only that, it's not going to help fight terrorists, just irritate the law-abiding.

    • Kosher? nope, that's ok.

    • Not only that, it's not going to help fight terrorists, just irritate the law-abiding.

      You act like you've never heard of the TSA. Basically all they do is confiscate plastic bullets off of keychains and let people onboard with a pocket full of sharp metallic pens. As much as they try, their entire purpose is to be a purely psychological barrier to entry -- to scare away potential terrorists, and to appease the masses. If they think airline security is good (which it is not, it's pitiful) they will fly mo

    • Re:Halal == potential terrorist? (Score:5, Interesting)

      by AgentPaper ( 968688 ) * on Thursday May 04, 2006 @08:31AM (#15261664)
      To add insult to injury, if your name even remotely resembles the name of a known or suspected "evildoer," you get flagged. My entire family now suffers an extra 45 minutes of screening at the airport, every single time we fly, because my dad's name matches that of some IRA gunman who was last active in the early 80's. (Before you go thinking this might be a valid concern, consider that we're talking about an extremely common name. "John Murphy" isn't exactly "Zaccarias Moussaoui.") And of course, all this color-coded rigmarole does not make us one bit safer, just more vulnerable to the constant fear-mongering coming out of Washington.
      • To add insult to injury, if your name even remotely resembles the name of a known or suspected "evildoer," you get flagged. My entire family now suffers an extra 45 minutes of screening at the airport, every single time we fly, because my dad's name matches that of some IRA gunman who was last active in the early 80's. (Before you go thinking this might be a valid concern, consider that we're talking about an extremely common name. "John Murphy" isn't exactly "Zaccarias Moussaoui.") And of course, all this
      • About 15 years back, in California, even before the current round of rabid security paranoia, I recall a plane that was hijacked by a AIRPORT EMPLOYEE who had the proper security pass to open one of those uber locked doors in the boarding area and walk out on the tarmac.

        Personally I think security would be better served by the FAA only being concerned with certifying passengers ammo as being approved as pre-fragmented and not capable of piercing the airplane skin. In the 1970s there was a terrorist who

      • To add insult to injury, if your name even remotely resembles the name of a known or suspected "evildoer," you get flagged. My entire family now suffers an extra 45 minutes of screening at the airport, every single time we fly, because my dad's name matches that of some IRA gunman who was last active in the early 80's.

        I have the same problem when I fly, but I didn't think until now that my name might be similar to someone on an IRA watchlist.

        The best example is when I flew to the UK last year around C

    • Re:Halal == potential terrorist? (Score:4, Funny)

      by Phisbut ( 761268 ) on Thursday May 04, 2006 @08:34AM (#15261691)
      I didn't think the US did racial profiling - this is quite sad for Muslims

      Sometimes it's not on purpose, they just freak out when they hear or see certain things... a guy over here started taking the required action to have his name legally changed a couple of years ago... his first name being Jihad, you can guess the reaction he gets in airports when they ask his name.

      So yeah, some people are flagged just based on their name.

    • OK, so racial profiling unfairly targets the vast majority of Muslims and Arabs who aren't terrorists. But this begs the question: How many planes have been hijacked by non-Muslims?

      Yeah, I know, they are recruiting women and non-Arabs, but the fact of the matter is that targetting young, male Muslims is more effective than not. You're inconvenienced because your Muslim? Well guess what, I was inconvenienced for many years because I am male. I had to pay significantly higher insurance rates despite havi
    • I always order the Kosher meal if my plane has "lunch" listed. What would you rather have, a giant hot pastrami on rye (seriously, the airlines heap it on, and that's *always* what they serve for kosher lunch) or a cold ham with american cheese sandwich? I haven't flown in quite a few years now, though, so I haven't yet been subjected to these sorts of civil rights violations.

  • BA could be liable for damages... (Score:3, Interesting)

    by The Dodger ( 10689 ) on Thursday May 04, 2006 @08:14AM (#15261553) Homepage
    ..under the UK's Data Protection Act. See http://www.dataprotection.gov.uk/ [dataprotection.gov.uk] for details...
    • Not really, the circumstances in which you can claim are pretty limited ( media summary [informatio...ner.gov.uk]);

      The right to compensation

      An individual can claim compensation from a data controller for damage and distress caused by any breach of the act. Compensation for distress alone can only be claimed in limited circumstances.

      You, of course, must be able to demonstrate and document the damage and distress too.

  • No piece of paper is safe (Score:3, Interesting)

    by Billosaur ( 927319 ) * <wgrotherNO@SPAMoptonline.net> on Thursday May 04, 2006 @08:16AM (#15261562) Journal

    From the artice: Using this information and surfing publicly available databases, we were able - within 15 minutes - to find out where Broer lived, who lived there with him, where he worked, which universities he had attended and even how much his house was worth when he bought it two years ago. (This was particularly easy given his unusual name, but it would have been possible even if his name had been John Smith. We now had his date of birth and passport number, so we would have known exactly which John Smith.)

    Laurie was anything but smug.

    "This is terrible," he said. "It just shows what happens when governments begin demanding more and more of our personal information and then entrust it to companies simply not geared up for collecting or securing it as it gets shared around more and more people. It doesn't enhance our security; it undermines it.

    Anything that has even one piece of critical information on it (name, address, account numer of any sort, etc.) is vulnerable. That's why my shredder works overtime. I don't throw boarding passes away; I have quite a collection of them from my trips to Europe and the ones I don't want get consigned to the shredder. You can't take for granted that once you toss away a piece of paper, it will be on its way to the landfill soon enough. Trash may sit unattended for hours, even at a busy airport, and is a ripe picking ground. Mind you, I think airport security might look at you funny if you were poking around in all the trash cans, but you never know.

    • Actually I have quite a few reciepts from Germany that have my entire credit card number on them. That would never fly in America I believe.

      And before you say whatever, I'm looking right now at a reciept from a company selling Die Bahn tickets, that has my full credit card number. I don't even throw away reciepts that have just 4 digits of my credit card number on it.

      I don't even trust standard shredders most of the time. If it doesn't cross shred, then what are the chances that some piece of information
      • At least with a cross shredder, you increase the number of elements by a significant multiple. If your shredder produces anything larger than confetti, then it's too cutting too big. I personally incinerate all important documents.

        I shred then incinerate important stuff; shredded paper can make very good firestarting fuel on those cold winter nights. A but tough in the summer, but that's where the barbecue comes in.

  • Modern Living Lesson One: Shred Everything (Score:5, Funny)

    by digitaldc ( 879047 ) * on Thursday May 04, 2006 @08:17AM (#15261570)
    I even shred my scratch pad, sticky notes and code written on napkins.

  • Anyone ever heard of a (Score:5, Insightful)

    by dedeman ( 726830 ) <dedeman1@yahUUUoo.com minus threevowels> on Thursday May 04, 2006 @08:17AM (#15261572)
    Shredder? I really don't know if this is common knowledge/thought/attitude, but keep everything with your name and and identifying number on it until you have access to a shredder.

    Shred anything with more then one piece of identifying information on it. Examples: Name and address (junk mail), Name andSSN (should know this by now), Name and phone# (yeah, it's in phone book, but don't let it float around). There are tons of combinations. I'd go so far as to shred directions from and to a destination, or even ATM receipts.

    You'd be suprised how much seemingly worthless information can be compiled to gain terrific insight into people.

    At the expense of sounding paranoid, I even shred my baggage check tickets (Name+flight#+someID#).
    • At the expense of sounding paranoid, I even shred my baggage check tickets (Name+flight#+someID#).

      I chew and eat them lol!
    • You don't sound paranoid, you just make choices in life

      You obviously are a very rational being who spends his time doing things that do not give you pleasure but that you believe are important.

      There is another option however: enjoy life and see what it brings. It is quite a relaxed way of living. sure, it may get me killed someday. Until now, it hasn't. Sure, it brings spam and telemarketeers in some form. The inconvenience does not outweigh the hassle of preventing them at this moment. Also, it gives me a
      • You know, you can enjoy an interesting, enriching life and shred your ATM receipts.
    • Actually, you should be shredding everything. If you only shred stuff with one bit of personally identifiable information, then one dumpster diving individual will have all the information they need as your life is spread over many individual items you may chose not to shred (think 1+1=2).

      In the case of identity theft, your address + annual income is a great way for thieves to narrow down their marks or potential homes to rob, and these are pretty typical questions on surveys too. Keep in mind that this is

    • Shredder (Score:2, Funny)

      by pkluss ( 731808 )
      I haven't seen him in forever. All he does is hang out with Krang in Dimension X anymore...

  • Passport Required!!!! (Score:5, Interesting)

    by hughk ( 248126 ) on Thursday May 04, 2006 @08:18AM (#15261575) Journal
    I am curious as to how the person got so far through the BA website without a password or PIN. Last time I looked, you needed this. Perhaps Mr Broer hadn't registered one. Otherwise did they compromise BA's website?

    The important thing is that you will not be allowed on an international flight without showing a valid passport. BA boarding procedures mandate a check of the passport against the ticket at the gate. This is kind of necessary now that outbound passengers from the UK are very rarely checked by immigration. True, an airline is unlikely to even have a UV light let alone a scanner there so it may be possible to get through with a forged passport.

    • I want to know how they managed to purchase a ticket in his name. The article doesnt seem to mention anything about bank details. Unless I missed it...
    • The article states that they informed BA about the security hole in March, and BA fixed their website, so that may explain what you noticed.
    • The important thing is that you will not be allowed on an international flight without showing a valid passport. BA boarding procedures mandate a check of the passport against the ticket at the gate.

      I think you missed the point a bit on this one. The important thing is not that they could buy a ticket in his name, it's that they got all the information they needed to do ANYTHING with his name. Identity theft is the goal here. Once you get all the information they had access to you can open a bank account,

      • The point is that they could do some things, but not all. To open a bank account, for example, would need a lot of additional documentation. Some of it much harder to forge. Admittedly, not impossible but a different level of difficulty.
    • I am curious as to how the person got so far through the BA website without a password or PIN. Last time I looked, you needed this. Perhaps Mr Broer hadn't registered one. Otherwise did they compromise BA's website?

      It sounds like they bought a ticket in his name, supplying his frequent flyer number. Then logged in to that new passenger record, and followed the link to the associated frequent flyer record.

      Sounds like BA had skipped on an authentication step, either at the point of linking, or in allowing a t
    • It's not about getting on to a flight with false ID, it's about getting identifying information from nothing more than a boarding pass.

      As I understand it, the chain of events is this...

      If you're a member of the BA loyalty club, you didn't used to have to go through the web site... probably still don't have to.

      You could sign up by one of the handouts at airports, get your card and give the number (along with all the stuff the USA wants) to your travel agent, and never visit BA's website.

      BA print the loyalty

  • Real ID act (Score:5, Interesting)

    by guisar ( 69737 ) on Thursday May 04, 2006 @08:20AM (#15261596) Homepage
    Yesterday I was stopped by a cop in the Concord, MA national park because the muffler on my old vw bus was a bit loud. I handed him my Vermont driver's license, which is a bit of paper with no SSN, only a coded address and no photo. His response- "What's this". "My driver's license" I replied. "Well how do they hope to stop terrorists with this?"

    Being an opponent of the current craze for every more comprehensive and intrusive IDs and ID checks here in the US, I hope some proponents of the Real ID act will pay heed to unintended consequences of this absurdity.

    • Re:Real ID act (Score:4, Interesting)

      by CortoMaltese ( 828267 ) on Thursday May 04, 2006 @09:00AM (#15261928)
      A friend told me she'd tried to buy some beer at a liquor store, and when asked for an ID, she'd used her passport. "Don't you have a driver's license?" the person behind the counter had asked, "Anyone can get a passport." So I guess the driver's license is the "real" ID in the US...

      • I've actually used other photo ID besides a driver's license (passport, military ID, etc) and had the cashier/bouncer/etc tell me they need a state-issued ID, not a federal one. In many cases, a state ID or driver's license really is the "real" ID. I think it's more because of ignorance on the part of the people requesting the ID than anything.

        • Back in 2002 (I was 24), I was back in the US near Boston for my sister's wedding. (I live in Japan). After the wedding and reception were over, my other sister, her husband, and I went out to a bar for a few beers. The waitress asked me for ID, and I handed her my passport.

          She looked like she had never seen one before and told me she would have to check with her boss. She walked it over to him, he looked at it with a disbelieving look, looked at me, looked back at the passport, and then shook his head "no

    • You should post a photo of your license so we can see what you mean...
    • "Well how do they hope to stop terrorists with this?"

      So paper is not sufficient to stop terrorists. But if it's laminated...!

      :w

  • Security scans (Score:5, Interesting)

    by RafaelGCPP ( 922041 ) on Thursday May 04, 2006 @08:51AM (#15261836)

    On 2004 I travelled a lot to USA.

    This don't seem to be much, but I was "selected" for manual scanning of my handbag in almost every USA airport.

    Common sense and good diplomatics told me to accept that and never question authorities when you are a foreign citizen, but on the last scan, at MIA airport, though I created the guts to ask the nice TSA security agent why I was being scanned over and over. The answer shocked me: "It is all that electronics you carry. Makes very difficult to see what you have". I always carried my cellphone, myPDA, my digital camera and my CD player with me, on the same bag, and it really looked a mess.

    The funny thing: I felt safer, because they were really looking at the x-ray. The only time I got stopped by airport security where I live, was because I told the guys my cellphone never made those portals beep... THAT DAY, it beeped!!!

    • I am a US citizen and I don't live in the US. It seems every time I go back to the US the security becomes slower, more intrusive, & dumber. I don't really have any compunction telling security agent how stupid they are being and I've even showed them the bill of rights (which they don't know) and the airports security regulations (which they don't either). I routinely wear clothing anti-Bush slogans... this has the effect of rocketing me though EU security (and giving people a little smile) and slow
      • I fly all the time. It's not nearly as bad as people whine about. I can be through security and boarded within about 15mins in most cases. Of course, my name isn't Muhammad.

        I routinely wear clothing anti-Bush slogans... this has the effect of rocketing me though EU security (and giving people a little smile)

        If this is true, then I have alot less respect for the EU and their ability to effectively manage their own security.

        I do remember once going to the US and the Germans were putting Americans th

  • And you don't know half of the absurdity of it! (Score:2, Insightful)

    by Anonymous Coward
    First about the BP stubs. Info on the BP stubs, is in plain sight for the TRAVELER information. If the traveller then drop it it is a stupidity concern, not a security concern. For example, Would you throw out a bank receipt with your account sold, bank account, bank name, signature and all the tralala out ? This is the same problem here.

    Now the fact they could buy a document in the name of the pax on an unsecurised web site IS a concern.

    As for APIS, having worked on the implementation on a main frame
    • Pay Cash ? You automatically get flagged as suspectful. Pay with CC ? This is seen as OK. Be a frequent traveller ? You are automatically flagged as safe. Take only a one way ticket ? Be preparred for the "glove" search... Knowing the rule it would be blantantly easy to bypass this check (take a round trip, on a frequent flyer, using a CC, do it 10 times, then afterward you are a "safe" traveller...). We always laughed at the stupidity of that. I left shortly afterward so I dunno if the US kept that securit
      • There is no "anonymity" in airlines unless you want to find out why your luggage was confiscated or if items are missing from it. Then it's a matter of national security. They have your name when you buy a ticket, regardless how you paid. Using neither cash nor credit card changes your status as a "known person." All a credit card tells you is that you may be the victim of fraud. The only way paying with cash should be considered more suspect is if the bills were counterfeit. Anything else is bullshit
        • There are up to two people involved in an airline ticket purchase: The person taking the flight, and the person PAYING for the flight. Usually they are the same person but sometimes they are not, and if not, you want to know who both people are. It would be handy to know if the president of a terrorist-connected charity is buying airplane tickets for people, for example, so you can give those people an extra look.

          You think the system is "Pay with credit card, no suspicion." It's not. The system is "ave
    • The target group of these seemingly stupid scans is IMHO the hypothetical "zombied" average grass-roots terrorist, i.e., somebody who isn't an actual operative of a terror cell, but, rather, someone indoctrinated by some extremist brainwash --- doesn't matter what ideology we're talking about. Such person will assumingly be stupid enough to be easily caught in the stupid checks. OTOH, seeking reason behind actions of huge government entities like the military is often stupid in itself, so maybe you should i
    • For the non-francophones "soldE" is FR for (account) "balance".

  • Shouldn't come as a surprise (Score:4, Insightful)

    by slusich ( 684826 ) * <slusich@@@gmail...com> on Thursday May 04, 2006 @09:04AM (#15261959)
    The fact that the information was on the stub and was easily retreivable shouldn't come as a surprise to anyone. Companies are way too free with where they put such information. Companies need to be held accountable for such things. Casinos actually do things the right way in this case. Loyalty cards and cash out tickets are usually encoded only with an ID number and no more. PINs, address information and such are almost never included.

  • Dumbest thing I've ever read (Score:5, Insightful)

    by terjeber ( 856226 ) on Thursday May 04, 2006 @09:13AM (#15262051)

    the author is clear that this is all because of pressure from the United States.

    I am a Norwegian, and I am saddened by the new religion that has Europe in it's grips. There are various sects in this religion, but they all have one thing in common, the big "Satan" is the US of effing A. Anything bad that goes on in the world is the fault of the US. This article, and the response to it, is an example of how fanatics suffering from this religion think.

    The system they hacked was the BA frequent flyer system. This system has nothing to do with passenger security or US national security. This is a convenience system made so that BA passengers easily can buy tickets, earn miles, buy upgrades etc. This system shouldn't have information such as the passport number. The fact that it does is an internal matter for BA and has absolutely nothing to do with the USA.

    I travel a lot for business and I am a member of most of the frequent flyer systems in Europe and the US, but not BA since I am already a member of one of their co-shares. None of the airlines have my passport number stored on the frequent flyer site. Not one of them.

    This is an internal BA problem, BA should never have had the passport number stored on the FF site, they should never allow this to be accessed without a password etc.

    Blaming the US for this is ridiculous in the extreme. The US has nothing to do with how an airline designs its Frequent Flyer website, and no, the US does not require that your passport number of other personal information is stored on the FF site or anywhere else for that matter. They only require the information be sent before you board the plane.

    Sadly, the new European religion requires full frontal lobotomy prior to joining, something that has not reduced the number of Europeans who sign on.

  • Shredders arn't that great (Score:3, Interesting)

    by hey ( 83763 ) on Thursday May 04, 2006 @09:18AM (#15262100) Journal
    If I was looking for sensitive info on a street on garbage day I'd look for the shredded stuff. Also, of course, you can put it back together.
  • I knew there was a reason my boarding passes went into the shredder when I got home...

  • I call bullshit (Score:3, Informative)

    by corbettw ( 214229 ) on Thursday May 04, 2006 @09:36AM (#15262258) Journal
    This whole article sounds like complete and utter bullshit.

    First, the writer said he logged into BA's site, using only the supposed victim's frequent flyer number. But if you go to http://www.britishairways.com/travel/home/public/e n_gb [britishairways.com] and look on the right side of the screen, you'll see you need a password along with your ID to access the site. So either 1) the person had no password (doubtful, most sites won't permit a blank password), or 2) he's lying. I'll go with #2 and assume he's lying. Since he's lying about how he got the information, it can be safely assume he made up everything else in the article.

    As for the rest of the article, it might be accurate, but somehow I doubt that. The whole thing just utterly fails to pass the smell-o-scope test, pegging right between 'horse manure' and 'grade A Kentucky bullshit'.
    • From TFA

      "BA has now closed its security loophole after being contacted by the Guardian in March"

      So I wouldn't expect it to work now...

    • Re:I call bullshit (Score:5, Informative)

      by rfunches ( 800928 ) on Thursday May 04, 2006 @10:08AM (#15262551) Homepage

      Okay, I'll bite.

      From TFA, the guy is a business traveller. Now look what happens if you "need help" logging in [britishairways.com] to BA's website:

      As a member of the British Airways Executive Club, On Business or as a registered customer with britishairways.com, you can now log in to manage your account and access our exclusive online services. You log in by entering your details in the boxes at the top right hand corner of the screen.

      Login ID Your login ID is either your: > Executive Club membership number or > On Business membership number or > Username

      PIN/Password When logging in with the following: > Executive Club membership number, use your 4-digit PIN or > On Business use your login id and password or > username, use your password

      Executive Club members If you need a PIN or have forgotten your PIN, then please click here to apply for one >>

      On Business members If you have forgotten your password or login id click here for more information >>

      Forgotten your password? Enter your username in both the Login ID and the PIN/Password boxes to receive your password prompt.

      From what I can tell, if the reporter is in fact not lying, if the "victim" was an Executive Club member, you need the following if you need a PIN, or have forgotten your PIN:

      • Membership number
      • First name
      • Family/Last name

      Hmm. This is printed on the boarding pass already. Oh, and if he's an On Business member, you only need the username to retrieve the password, and the website tells you that it's "2 characters 6 digits"; what's the chance of that being the membership number printed on the boarding pass?

      I wouldn't call this complete and utter bullshit yet. There are reasonable explanations for how this was accomplished.

Slashdot Top Deals

Is knowledge knowable? If not, how do we know that?

Close