Published
on Saturday, September 20, 2003 by the Oakland Tribune
JetBlue Airways Gave Defense Dept Inineraries of 5 Million
Customers
Airline Passengers' Data Used in Study
Violating its own privacy policy, JetBlue Airways gave
5 million passenger itineraries to a Defense Department
contractor that used the information as part of a study
seeking ways to identify "high risk" airline
customers.
The study,
produced by Torch Concepts of Huntsville, Ala., was
intended to be a proof-of-concept analysis for a project
on military base security, titled "Homeland Security:
Airline Passenger Risk Assessment."
JetBlue,
whose terminal at Oakland International Airport is a
major hub for the low-cost carrier's popular cross-country
routes, insisted the data was not shared with any government
agency and that Torch has since destroyed the passenger
records.
New York-based
JetBlue said it has taken steps so the situation will
not happen again. "This was a mistake on our part,"
JetBlue chief executive David Neeleman said in an apologetic
e-mail sent to angry customers.
Silicon Valley
privacy activist Bill Scannell, who first posted details
of the study and JetBlue's involvement on his Web site,
Don't Spy On Us, said Friday the privacy of anyone who
flew JetBlue from its inception until September 2002
was compromised.
"Torch
Concepts went and ran basically a 'total information
awareness' on (travel records from 5 million customers).
They got Social Security numbers, and from that were
able to pull out the driver's records ... purchasing
patterns, where they've lived," Scannell said.
"Had
I been a JetBlue passenger, I would be getting a new
Social Security number. I would assume my identity has
been stolen."
Marc Rotenberg,
executive director of the Electronic Privacy Information
Center in Washington, said that by violating its privacy
policy, JetBlue could be sued for "deceptive trade
practices."
Rotenberg
said his organization was contemplating filing a complaint
with the Federal Trade Commission.
JetBlue "really
should have known better," said Richard M. Smith,
an Internet security and privacy consultant based in
Cambridge, Mass. Smith said the content of the study
raises serious questions about whether it was really
aimed at military base security.
"It's
basically a prototype for CAPPS II," Smith said,
referring to the nationwide computer system being developed
by the Transportation Security Administration. The Computer
Assisted Passenger Prescreening System, ordered by Congress
after the Sept. 11 attacks, will check such things as
credit reports and consumer transactions and compare
passenger names with those on government watch lists.
The TSA,
the federal agency in charge of airline and airport
security, said Friday it was not involved in the study.
Torch contacted
the TSA last summer for airline industry contacts and
the agency complied with the request, but "that
was the extent of our involvement," TSA spokesman
Nico Melendez said.
The Torch
study analyzed the records JetBlue provided in September
2002, as well as other demographic data collected about
the passengers, including Social Security numbers and
information about their finances and families.
The apparent
goal of the study, which was presented at a technology
conference in February, was to determine the usefulness
of combining passengers' travel and personal information
in order to create a profiling system that would make
air travel more safe.
One conclusion
of the study was that "data elements have been
identified which best distinguish normal JetBlue passengers
from past terrorists."
Neeleman's
e-mail said Torch "developed this information into
a presentation, without JetBlue's knowledge, for a Department
of Homeland Security symposium" and that he was
"deeply dismayed to learn of it."
Neeleman
said JetBlue provided passengers' names, addresses and
phone numbers to Torch after an "exceptional request
from the Department of Defense to assist their contractor,
Torch Concepts, with a project regarding military base
security."
Torch referred
calls to its attorney, Richard Marsden, who did not
immediately return a call seeking comment.
"This
is a great lesson for all of us," Scannell said.
"This is just 5 million citizens. What CAPPS II
will do is do this to all of us."
"This
is why we need to drive a stake through the CAPPS II
vampire now."
More information
can be found at Bill Scannell's Web site, www.dontspyon.us
©1999-2003
by MediaNews Group, Inc. and ANG Newspapers