JetBlue Shared Passenger Data. Bad airline, BAD! UPDATE: Army admits to using data

[DealMonkey]

Is there any excuse for this sort of thing?

Wired.com

JetBlue Airways confirmed on Thursday that in September 2002, it provided 5 million passenger itineraries to a defense contractor for proof-of-concept testing of a Pentagon project unrelated to airline security -- with help from the Transportation Security Administration.

The contractor, Torch Concepts, then augmented that data with Social Security numbers and other sensitive personal information, including income level, to develop what looks to be a study of whether passenger-profiling systems such as CAPPS II are feasible.

study (PDF), titled "Homeland Security -- Airline Passenger Risk Assessment," which JetBlue says was based on an unauthorized use of its data, was presented at a February technology conference.

Privacy activist Bill Scannell, who runs the Don't Spy On.Us website, had scathing words for JetBlue's revelation.

"JetBlue has assaulted the privacy of 5 million of its customers," said Scannell. "Anyone who flew JetBlue before September 2002 should be aware and very scared that there is a dossier on them."

Torch Concepts acquired the data by contacting the Transportation Security Administration, which says it facilitated the transfer of the data from JetBlue to Torch Concepts, according to TSA spokesman Brian Turmail.

The TSA says the study was for a Pentagon proof-of-concept program related to improving security on military bases.

Torch Concept's lawyer, Richard Marsden, says the study was authorized and was related to "a science and technology study on the feasibility of enhancing the structure of the Army."

It remains unclear how an airline passenger-screening feasibility study without any references to the military relates to an Army feasibility study, though Marsden said he could not reveal any more information because of a confidentiality agreement.

The Army is investigating the matter, according to spokesman Maj. Gary Tallman, who added that "we take data and privacy regulations seriously and do everything we can to protect people's privacy."

Because it was a defense contractor that set up the records system, the Army may have violated the Privacy Act by not issuing official notice of the creation of the system.

The Privacy Act requires an agency to apply the act's provisions when it "provides by a contract for the operation by or on behalf of the agency of a system of records."

JetBlue clearly violated its own privacy policy by transferring its passenger data. Such a violation could be grounds for an investigation of unfair business practices by the Federal Trade Commission, which has the authority to fine companies and issue injunctions.

...

 

[JackStorm]

This doesn't surprice me at all. I hear weekly (tho it wouldn't surprice me if it happened dayly) of how peoples privacy is geting violated by the pentagon higherups and/or DOJ. I really hope people wake up soon and stop those lunitics (ashcroft comes to mind at the moment)before they do any more damage.

Heh, the pentagon people and those over at the DOJ must be creaming in their pants when they think about how easy it is for them to get personal info on people now a days.

 

[Rockhound]

Just to clarify the point being made. Although you can argue that the feds obtained private and personal information, it was JetBlue who in fact violated the people's privacy in this case. They were only asked for the information and wholeheartedly gave it which places the blame solely on them. The feds didn't use any law to force JetBlue to turn over this infomation. They (JetBlue) in fact violated their own privacy policy.

 

[sandorski]

What's most disturbing is the request from those who have sworn to Uphold the Constitution, to those who may have a monetary reason to comply. The US is turning into the USSR, except that instead of your neighbours or family turning you in, it's businesses where you may have frequented who turn you in.

 

[DealMonkey]

Update: Wired.com

Army Admits Using JetBlue Data

Millions of JetBlue passenger records were used in a military effort whose methods closely resemble those employed in the notorious Terrorism Information Awareness überdatabase program, the Army confirmed Monday.

Last week, defense contractor Torch Concepts came under heavy scrutiny after Wired News revealed that the company had crunched fliers' private data without their knowledge.

On Monday, Army spokesman Maj. Gary Tallman said the information was used by Torch Concepts to test a prototype of a data-mining system designed to screen out terrorists who might want to infiltrate or attack Army bases worldwide.

According to a corporate press release from May 8, 2002, the Torch-built system would identify "abnormal events or activities that may include rebel actions before damaging events occur." To do this, the contractor would apply "intelligent pattern recognition in identifying latent relationships and behaviors that may help point to potential terrorist threats."

To privacy advocates, that sounds a lot like TIA's mission (PDF) of researching "data search and pattern recognition technologies ... based on the idea that terrorist planning activities or a likely terrorist attack could be uncovered by searching for indications of terrorist activities in vast quantities of transaction data."

"This looks and feels like the data Valdez," said Lee Tien of the Electronic Frontier Foundation.

"Look at how we found out about this, only because one company was foolish enough to speak publicly about it," Tien added. "We should put the brakes on all these data-mining programs, and have a serious national conversation, because travel data is just one example of the many kinds of data every data-mining operation wants to suck in from private businesses."

On Monday, the Electronic Privacy Information Center filed three Freedom of Information Act requests in an attempt to uncover how the government might have used JetBlue passenger data in the development of government databases.

Tallman emphasized that the Army itself never handled the raw passenger data and that it was interested in testing the pattern-matching technology, not accessing a list of JetBlue's customers.

It remains unclear whether the Army system for protecting military bases was put into effect, and if so, what kinds of data were used to detect terrorist attacks ahead of time.

Torch secured the job with the Army as a subcontractor to SRS Technologies, a company based in Newport Beach, California.

"Torch worked directly with the Army and had a specific mandate to ferret information out of data streams" to find the "abnormal behavior of secretive people," said Bart Edsall, who runs business development for SRS.

That's something SRS should know a thing or two about. The company bills itself as the "prime support contractor" for the Information Awareness Office of Darpa (Defense Advance Research Projects Agency) -- the Pentagon research division that spearheaded work on TIA.

SRS helped Darpa evaluate various technical proposals for TIA. The company also aided the agency in funding decisions related to the project.

Edsall denied that Torch had anything to do with these efforts.

Torch's corporate counsel, Richard Marsden, declined to comment.

Darpa's spokeswoman, Jan Walker, denied any connection between Darpa and the research involving the JetBlue passenger data.

"Torch Concepts does not hold a Darpa contract. They are not involved in any of our Information Awareness Office programs," she wrote in an e-mail.

JetBlue CEO and founder David Neeleman said on Sunday that the original request to help with the Torch study came from the Transportation Security Administration. The Army then verified for JetBlue that Torch was trustworthy.

"As far as we are concerned, the Army referred us to Torch," said Neeleman, who has been personally replying to irate customer's e-mails about the privacy breach by the discount airline.

But Neeleman said he was unaware of Torch's relationship as a subcontractor to SRS -- or to any other defense firm, for that matter.

He added, "I believe the data has been destroyed and I'm moving on."