TSA Now Investigating Boarding Pass Hacker 270
An anonymous reader writes "A week after the Justice Department cleared him of any wrongdoing, Chris Soghoian, the Indiana University PhD student who created an online boarding pass generator for Northwest Airlines to highlight security holes is on the government's 'no-fly' list. The Transportation Security Administration has now launched its own investigation, says Wired blog 27strokeB. The TSA is claiming that Soghoian 'attempted to circumvent an established civil aviation security program established in the Transportation Security Regulations,' violations of which carry fines of up to $11,000 per violation. That could be a steep fine, says Washingtonpost.com's Security Fix blog: 'Something like 35,000 people viewed and possibly used the boarding pass generator during the less than 72 hours that it was live on his site in November. Soghoian told WaPo: "If they decide that the only safe way for me to leave the country is by boat, then that's pretty much the end of my career here in the States. It's one thing to harass researchers, but if they can chase them out of the country, then that's a real chilling effect."'"
35,000 views? (Score:3, Funny)
Re:35,000 views? (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:35,000 views? (Score:5, Insightful)
Big fucking deal. It was an obvious security hole. If anything, he should be hailed, not jailed. But then again, we don't want to go out and make NWA (who fucking blow anyway) and the TSA look worse than they already do (if anyone is reading from MCO's TSA, fucking fix your system by doing a "best practices visit" to any number of other airports -- your system sucks even at 4:00AM)
Re: (Score:3, Funny)
It's the burden of being a genius.
Re:35,000 views? (Score:5, Informative)
But the man who introduced fire to the world was burned at the stake.
Bollocks he was. He (Prometheus) was chained to a rock, and an eagle would come every day and tear out his liver. Then, in the night, his liver would grow back. Sheesh, don't you kids learn any mythology anymore?
What's the fine? (Score:5, Insightful)
Re:What's the fine? (Score:5, Insightful)
Re:What's the fine? (Score:5, Funny)
I was in line behind a TSA employee from a local small airport. She was telling the cashier that she had left the check to pay for a number of photocopied documents in her car and must retrieve it to pay. BUT she could not leave the documents and had to take them with her to the car as they were VERY VERY sensitive. Here's the kicker, she left them at Staples overnight to be copied.
I wonder if they let her sleep there and then shot the copier tech out in the alley?
Re: (Score:2, Funny)
Re: (Score:2)
That and missing your flight.
Re: (Score:3, Funny)
The TSA (Thousands Standing Around) do a decent job themselves.
Re: (Score:3, Informative)
Welcome to life under Occupation. Population You. (Score:2, Interesting)
Go Chris... (Score:4, Insightful)
Fair is fair (Score:4, Funny)
The blog is "27B Stroke 6" (Score:5, Informative)
He can still travel (Score:5, Insightful)
Re:He can still travel (Score:5, Funny)
The message? (Score:2)
Re: (Score:2)
You are no longer being governed, you are being ruled.
The US doesn't have enought smart people... (Score:2)
http://science.slashdot.org/article.pl?sid=06/12/
Re: (Score:2)
Irresponsible researcher (Score:2, Insightful)
Re: (Score:3, Interesting)
Re: (Score:2)
1) If he had just submitted a report to the TSA, it would get lost in the bureaucratic hell that is the TSA (or more likely, it would just be ignored, since fixing it would cost money and time.)
2) The media coverage that the site, and subsequent harassment that he has received has raised awareness far more than a report to the TSA or a blog entry ever would.
By bringing up the issue in a very public way, he has made many, many people very aware of the "security theatre" that th
Nice in theory (Score:5, Insightful)
You seem to be forgetting that that had already been done, up to and including having the information on how to create a fake boarding pass published on a congressman's web site for a year or so prior to his arrest. And yes, there had already be newspaper articles on it, and the TSA was either well aware of it and doing nothing or unaware of it even though it had been reported to them multiple times.
Ok, fine. It was trouble making. But for whom? It didn't lower airport security one iota. Anyone who cared about it already new how to do it. What it did do, though, was make trouble for the fake "security" providers at the TSA, and point out the fact that they are ripping us (the taxpayers) off.
We saw the same sort of misleading argument come up when people started pointing out that US Military personnel were being given ineffective bulletproof vests; somehow the people who were trying to raise awareness of the issue were supposedly "helping the terrorists." Which is just nuts. What they were doing is making things uncomfortable for the crooks selling the defective jackets, and having zero impact on the people wearing them unless and until they could raise enough awareness of the issue to get things changed--in which case their actions would have helped the roops, not hurt them.
--MarkusQ
Re: (Score:2)
What is the actual value and goals of his research? A responsible researcher could have created a proof-of-concept, and raised awareness through media channels, research paper, blog etc. He should have also presented his research to the TSA and the airlines.Instead what he did was not research. He created a website to create fake boarding passes and released it to the public. There was no academic benefit. If I created forged passport software and released it, that's not research.Let's call this for what it is: trouble-making, not research.
I agree with you, but I still think his "trouble making" had value of raising awareness and also he should not be persecuted for it.
Re: (Score:2, Informative)
What Chris S. did was just plain stupid. Yes, the web-based boarding document system was originally designed to keep unticketed passengers from getting onto planes, not from getting past the (at the time non-existent) TSA security points. Giving non-technical nogoodniks an eas
Re:Irresponsible researcher (Score:4, Insightful)
Re: (Score:2, Troll)
The problem exposes some very alarming trends I see in security research. It used to merely be embarassing when someone would release exploit code, but there really wasn't any recourse other than fix the flaw asap. Then, the separation between blackhat and whitehat hacking became more distinct... the responsible researchers started to notify the manufacturers with
Exactly! As an example (Score:2)
What this guy did is not research, but *IS* criminal.
Troublemaker==Felon? (Score:2)
No, he has already been treated to the "troublemaker" gauntlet, had his brush with the government and his future almost turned upside down. He's still a kid, and kids will do things without thinki
Airport Security is a joke (Score:5, Insightful)
Re:Airport Security is a joke (Score:5, Insightful)
I guess someone standing there with a rucksack full of explosives and going BOOM during a heavy traffic time, say the day before Thanksgiving, never occured to our overlords.
Re: (Score:2, Insightful)
I suspect that if they coordinated across 20 of the largest airports during the busiest time they could probably do a lot more damage (kill more people), without having to go through any security. But see, that wouldn't be as "Spectacular" as having build
Re: (Score:2, Offtopic)
Okay, I'll feed the troll. WHY? Are you a muslim? You gonna kill me for suggesting such a thing? You gonna stab me and leave me dead with a note attached? You gonna threaten me and my family with death or dismemberment if I don't convert?
Koran 5:33
The Punishment for those who oppose Allah and his messenger is : Execution or Crucifixion or the cutting off of hands and feet from opposite sides or exile from the land.
Okay, so maybe you aren't a muslim. Do you even know what Muslims teach from
Re:Airport Security is a joke (Score:4, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
And that's the crux of the problem - he didn't act like a researcher (as he claims) and merely point a security hole (as you claim). He crossed the line from researcher to (potentially) criminal when he published a tool on the web that had no other purpose than to make it possible for others to circumvent security.
Re: (Score:2)
Re: (Score:2)
Clearly the TSA listens and has people smart enough to create countermeasures.
Oh wait... Even after all this fucking publicity, the fucking hole is still fucking open, MONTHS FUCKING LATER.
At least they're spending their (your) money on frivolous prosecution. That must be worth something right?
Right?
Re:Airport Security is a joke (Score:5, Insightful)
The purpose was to shame the TAA into fixing a problem which was widely known and publicized: August 2003 by security expert Bruce Schneier [schneier.com], February 2005 in Slate [slate.com], February 2005 press release by a US Senator [senate.gov], February 2006 article in CSO Online [csoonline.com]. The TSA has been ignoring the problem for over three years. Bad guys have known about the attack for at least three years, possibly longer. For all we know bad guys are using it right now; we have no way of knowing. Even without Soghoian's program, it was really, really trivial to exploit; all you need is a very basic understanding of HTML, enough to change one name to another, to execute the attack Schneier described in 2003. The media has been letting the TSA continue to ignore this. If Soghoian had simply published a "I can make fake boarding passes and get into the "sterile" area of an airport he would have gotten an article or two and nothing would have changed. By providing a working exploit things just became that much harder for the TSA. News coverage exploded. Finally something will happen.
The TSA has proven itself grossly incompetant. There is little to no oversight and zero public accountability. Drastic measures were necessary, as rational measures have clearly failed. The really sad thing is even in the face of such a drastic failure, they're not fixing the core problem.
Re: (Score:3, Insightful)
Looks the same as the FBI investigation (Score:2)
Reading the letter makes it sound much like the case the FBI was workign on against him (and subsequently droped).
All of the legalease (as well as I can read it) states is that you can't make these or higher some one else to make them.
Well, he didn't, he just created a program that COULD. In this case (as with the FBI one) it all seems about intent...
Re: (Score:2)
Re: (Score:3, Insightful)
only a Geek would believe that this kind of argument plays well in court.
Proving a point is expensive.... (Score:3, Informative)
In this case, he would have been better off just telling people it could be done IMO. Just the same, if Kazaa isn't guilty, how can this guy be held responsible for what people did with his demonstration? If he personally used the fake boarding passes to fly and thus circumvent TSA rules, then he's guilty, should be punished. To demonstrate that its possible doesn't make him guilty. Even making it possible for others to do so doesn't make him guilty of anything except making the TSA look stupid.
Printing counterfeit money is not illegal... using it is. Normally, nobody would print it without the intent of using it, but in this case, the whole effort was to prove that it could be done and show that a fake boarding pass ruins security measures. If he can print fake boarding passes, any reasonably savvy group can. The manner used to demonstrate this flaw surely makes it impossible to not fix the problem?
I hope that he is not slapped with huge fines...
Re: (Score:3, Informative)
Printing counterfeit money is not illegal...
Actually, it is [moneyfactory.gov]:
Re:Proving a point is expensive.... (Score:5, Insightful)
Survey says - "Anonymously".
He could have written his boarding pass creator as a flash app and uploaded it to Newgrounds. He could have posted a JS version on any of a number of blogs without using his own name. He could have even posted about it, with a link to an anonymously hosted applet, and probably made the Slashdot FP. He could even have gotten someone outside the US to host the exact same content, with all occurrences of his name replaced by "Mr. CheeseNips".
But no. He had to use his own name, and therein lies his biggest mistake.
Anyone who says we don't need anonymity just doesn't fear the government enough for their own good. And anyone who makes the government look bad without at least trying to hide their identity needs to study their history a tad more.
I, for one, THANK Soghoian for exposing a glaring flaw in the farce we call the TSA. Not because it has made us safer (as we can see, they chose to shoot the messenger rather than, y'know, fix the goddamned problem), but because it has slightly reduced the false sense of security among the voting sheep.
Re:Proving a point is expensive.... (Score:4, Interesting)
Anyone who makes the government / any powerful organization look bad without at least pausing to think about the repercussions is foolish. Hiring a lawyer might be a good idea. Contacting the TSA and giving them six months notice is also a good idea. Contacting two or three major newspapers and letting them know about it is also a good idea.
But for once, I think Chris Soghoian is brace to use his real name and not hide. If he is really willing to face imprisonment and fines to make the TSA more accountable, the USA safer, and the draconian new "security" measures less credible, he's brave and patriotic in my book.
Just my two cents.
Re:Proving a point is expensive.... (Score:5, Informative)
CSO Online told people about it in February 2006. [csoonline.com] Slate told people about it in February 2005. [slate.com] Senator Schumer told people about it in February 2005. [senate.gov] Security expert Bruce Schneier told people about it in August 2003. [schneier.com]
We're more than a little beyond "telling people" being productive.
Worse, apparently a proof of concept isn't enough. The TSA is busy trying to presecute the messenger, but they still haven't fixed the core problem. I'd sadly forced to conclude that the TSA will not fix a real threat to airline security until terrorists successfully exploit that threat. While honest people are stuck measuring their shampoo out of fear of a deeply implausible liquid-bomb threat, anyone with access to a printer and a reasonably plausible state ID can get into the "sterile" area of the airport. (I find it darkly humorous that the boarding pass vulnerability makes the cost of getting 30 ounces of liquid explosives onto a plane just 10 fake boarding passes for almost no cost and 10 evil conspirators.)
Oh Snap (Score:5, Informative)
Coralized Archive of the mirror: http://geocities.com.nyud.net:8080/j0hn4dm5/forge
The mirror:
-http://j0hn4d4m5.bravehost.com/
(Coral CDN didn't seem to work on it)
Maybe now the TSA will actually do something about their security hole.
Actually, I doubt it, but we can hope.
New Homeland Security Motto: (Score:3, Insightful)
Security Threat (Score:5, Interesting)
So, a bunch of terrorists captured a couple of airplanes and flew them into buildings. Yeah, a bunch of people died, which is tragic. And the Economy Burped, which is
However, we've learned our lesson, and have secured the airplanes better. In addition, I doubt, HIGHLY DOUBT, that they could get anywhere close to doing the same thing, given the same circumstances, mainly because the passengers wouldn't stand for it.
Screening 80 year old grandmas of their knitting needles is stupid. Taking off shoes is stupid. Banning Liquids is stupid. For all the inconvenience of it all, it will not prevent someone from trying to by-pass whatever security is setup, and eventually they will succeed.
I know for a fact that I could bring a knife on board a plane even today, even passing through all the security. They can't stop me if they can't see it. And there are such knives available.
The point is, all this "security" isn't really designed to prevent hi-jackers, it is designed to placate the masses. See my sig for more info
Re: (Score:2)
Re: (Score:2)
I'd like to hear more about your invisible knives.
Re: (Score:3, Informative)
Re: (Score:2)
The thing is, *last* time it was knives. Next time it will be whatever they aren't looking for...
Re: (Score:2)
The economy was starting to downturn months before 9/11 - I was taking off a semester from school and working. I wanted to take another semester off and move to Calif. for 6 months, and in October 00, there were still jobs available for the asking. By January 01, the supply of jobs had largely dried up.
However, we've learned
Re: (Score:2, Interesting)
Who needs a knife? (Score:2)
So what did we learn kids? (Score:3, Insightful)
The thing is, Americans cannot understand how someone could possibly just "want to help" and not "want to make money". If such a thing happens, then surely they must be up to something, they are probably a terrorist and should be locked up anyway.
Re: (Score:2)
-Rick
No-fly list? (Score:2, Insightful)
I didn't actually see a citation of where he'd been placed on the no-fly list, can anyone find one and post it? Probably not, since the list doesn't even technically "exist" except as an abstract concept... sorta.
I have to strongly disagree with the dude above wh
Re: (Score:2)
I don't see the societal benefit of this either. He released the software, rather than selling it or using it for his own nefarious purposes. So he's unlikely to be "up to" anything evil. Since it's a government mandated list and not optional for large private carriers to follow, they should not place people (at least not US citizens or permanent residents[1]) on the no-fly list without trial.
-b.
[1]-> If
Having it both ways... (Score:2, Insightful)
To avoid being arrested, why not make the boarding pass have VOID VOID VOID printed all over it in such a way as it exposes the problem, but doesn't actually create a valid boarding pass. Then he would have violated no laws, AND exposed the poor security procedure at the same time.
Once the story broke he could create a boarding pass that's given to someone that's authorized to test the fake boarding pass, or others othe
Seen this before (Score:2)
go to bed without supper! (Score:4, Funny)
Does that mean he is grounded for being naughty?
That's unfair. Obviously he did his homework.
Final proof the no-fly list isn't about safety (Score:5, Insightful)
He's there because the no-fly list is a tool for control and coercion at the whim of the authorities without the restraint of statute or jury.
Geez, didn't this guy realize that... (Score:2)
Bruce Schneier on the matter (Score:2)
http://www.wired.com/news/columns/0,72045-0.html [wired.com]
A little bit frightened (Score:3, Insightful)
Al Capone... (Score:2)
So justice had there try. Now its TSA's turn. Next the IRS will look over his finances looking for undeclared paypal donations for his defence, student loan fraud, etc. Next the army will conscript him under some secret law, and send him to Iraq. If they still can't get him there is always the RIAA & MPAA.
Get used to it (Score:2, Insightful)
wait... (Score:3, Insightful)
Hey, look, the investigator's name and phone #... (Score:3, Informative)
James A. Roberts
(317) 390-6916
Ironic Reaction... (Score:3, Funny)
Does NOBODY see the irony here?
The government is putting him on the No-Fly list, BECAUSE HE RELEASED A PROGRAM THAT ALLOWS PEOPLE TO CIRCUMVENT THE NO-FLY LIST.
So this helps, how?
Re:he has it coming (Score:4, Insightful)
Re: (Score:2)
Exactly, of course this is against the law.
I'd also say it's deserving of a fine of around $100 or so, nothing more.
And immediate job loss without privileges for several of the highest ranking managers responsible for letting the insanely lacking security system live for so long.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Re:he has it coming (Score:4, Insightful)
Molog
Re: (Score:2, Insightful)
Re: (Score:2)
People have been saying it for years. Last I checked, with E-tickets, you didn't even need a boarding pass---a printout of an email message was enough. (This should be changed if it hasn't already been.) The proper channels have repeatedly ignored complaints about this. As such, this guy should be protected by something akin to whistleblower laws, but I don't think there are any at the federal level except between employers and employees, sadly.
The way I see it is this: the TSA gave the public their n
Re: (Score:3, Insightful)
Re:he has it coming (Score:5, Insightful)
Your argument is simply foolish. The TSA is inept at running a dept, so they are also inept at hiring researchers or security folk to check up on their stuff. This is a government agency. This person committed no actual crime -- he didnt use one, and didnt even print one.
The criminal would have kept this secret, and used it to his/her benefit by selling it to terrorists, criminals, or whatever. Those types of actions should be punished, SEVERELY!
What did he do? He made us all safer. He did it by exposing how ridiculous the TSA is, and gave them all the knowledge to fix the problem. He did not personally gain from this experience. If anything, he has suffered already for it much more than he ever should have. I would feel differently if this was a private company and not a public-oriented service (like AIRLINE travel), to which my tax dollars go (both to bail out airline bankruptcy, as well as to operating the TSA).
IU needs to stick up for their researchers, and foot the legal bill. I doubt they will, however, having been a past student, the administration at IU is pretty much inept equivalent to the TSA in my eyes.
God forbid someone try to HELP the world...
Re:he has it coming (Score:4, Insightful)
It's a shame the TSA people think just like you, if people would quit trying to kill the messengers, we might start seeing something that looked more like security and less like cronies securing contracts.
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2, Funny)
Motherland - a bunch of Russians raise their eye-brows, then sit back down at the barage of Soviet Russia jokes bandied about here.
Homeland - a bunch of Rednecks raise their beers and shotguns, create a lot of noise, then start calling their hatred of non-Anglo's "patriotism".
"Homeland" (Score:2)
We're surrounded by people who don't learn from history, or from reading at all. Presumably because their lips get too tired.
Re: (Score:2)
I may add to this that it's citizens' responsibility to keep the country secure - this job shouldn't just be handed out to specialists. I'd not be averse to six months to a year of mandatory military training for all able-bodied citizens between 20 and 40
Re: (Score:2)
There's about 1.2M highschool graduates [bloomberg.com] this year, and supposedly 7.5M US citizens [wikipedia.org] enrolled in the ROTC (though that seems high, and is uncited). It seems that the ROTC is already serving the right scale of enrollees. I'd favor replacing mandatory HS gym classes with ROTC for at least a year or two, required for HS graduation. Perhaps even mandatory s
Re: (Score:2)
Nor would a suicide bomber have publicized the security hole (if it *was* a security hole, since the only true security is physical security - metal/explosives detectory, x-ray machines, and armed pilots/sky marshals - having to show ID is just something to make the sheeple more comfortable). The suicide bomber would have used the hole if he could have and kept his mouth shut. So, the guy actually did the USA a service by publicizing the hole before it was exploi
Re: (Score:2)
There is no "double jeopardy" until there is a criminal trial and acquital.
There is no double jeopardy if the second trial is on a different charge and requires proof of a somewhat different set of facts.
There is no double jeopardy if the second trial or hearing is a civil action---no barrier to suing O.J. Simpson for wrongful death even after he has been acquitted of murder.