This week I came across a story about a 24 year old security researcher/PhD student named Christopher Soghoian who developed a fake boarding pass generator on his website. There you could enter your “information” and out would come a realistic looking ticket like the kind you print from home for an early check in. If you’re experience is anything like mine then waking up to the security line at the airport means I hand my boarding pass and ID to the TSA screener who makes sure my face and name match on all the documents and scribbles something before letting me through. The agent never scans the barcode. These passes are meant to get a person past the screener but not onto the plane.
I’m terrified. After the terrorist plot to blow up planes using bomb material concealed in liquid was foiled, all forms of liquid was banned from terminals. The TSA finally realized the weakness in a plan that sought to deal with the plot retroactively, and has loosened the restrictions. Now I think I can bring four ounces of liquid and medicine with a prescription label. But this hole shows us a major problem with not only the implementation of security measures but our process for dealing with the problems.
Soghoian designed the script to identify this weakness, not to exploit it. “I want Congress to see how stupid the TSA's watch lists are. Now even the most technically incompetent user can click and generate a boarding pass. By doing this, I'm hoping [Congress] will see how silly the security rules are. I don't want bad guys to board airplanes but I don't think the system we have right now works and I think it is giving us a false sense of security.” The day after the story became public on wired.com, Congressman Edward Markey (D-MA) called for Soghoian’s arrest and for the site to be taken down; he later rescinded the call for arrest.
That day the FBI visited Soghoian in his home, but he was not arrested. That night the FBI returned and seized his computers with a warrant signed at 2 a.m.. Am I wrong or does it seem that the government is less interested in learning about these security vulnerabilities than punishing someone for revealing them?
Most interestingly is one of the people who identified this security vulnerability before this incident was Sen. Chuck Schumer (D-NY), who did so in 2005 press release.
President Bush has a spotty philosophy on government power: he thinks the Feds should wiretap your phones and inspect your airline luggage, but not control your Social Security benefits. Nevertheless, my bet is that this week, he's damn happy the Coast Guard controls port security.
Think that labor rights aren't completely eroded in the United States? Check out this story from SF Chronicle gossip hounds Matier and Ross for chilling evidence to the contrary.
A local AmTrak conductor was fired recently after getting injured while getting a drunk passenger off the train. On August 15, 2005 Rebecca Gettleman noticed a visibly intoxicated passenger and got him off the train and into the hands of authorities. In the process of stepping off the train, the passenger pitched forward, falling down the stairs. Gettleman grabbed him, and in the process injured herself, requiring a month of physical therapy.
Ray Bradbury wrote an editorial in the L.A. Times this week hoping to restart the debate for a monorail system in Los Angeles. In his assessment the traffic is five years away from total gridlock. The city’s slow and costly effort to develop an underground subway system has had a history of funding and infrastructural problems. The creation of a light rail, which includes low emission “trains” that can travel along streets, has been in various stages of development since 2001.