Fliers' Private Lives Face New Screening

Robert O'Harrow Jr. Washington Post Service
Saturday, February 2, 2002

U.S. to Test High-Tech Security Plan Linking Reservations to Databases

.

The government's plan is to establish a computer network linking every reservation system in the United States to private and government databases. The network would use data-mining and predictive software to profile passenger activity and intuit obscure clues about potential threats, even before the scheduled day of flight.

.

It might find, for instance, that one man used a debit card to buy tickets for four other men who will be sitting in separate parts of the same plane - four men who have shared addresses in the past. Or it might discern an array of unusual links and travel habits among passengers on different flights.

.

Those sorts of details - along with many other far more subtle patterns identified by computer programs - would contribute to a threat index or score for every passenger. Passengers with higher scores would be singled out for additional screening by authorities.

.

As described by developers, the system would be an unobtrusive network enabling authorities to target potential threats far more effectively while reducing lines at security checkpoints for most passengers. Critics say it would be one of the largest monitoring systems ever created by the government and a huge intrusion on privacy.

.

Although such a system would rely on existing software and technology, it could be years before it is fully in place, given that enormous amounts of data would need to be integrated and a structure would need to be established for monitoring passenger profiles.

.

At least one carrier, Delta Air Lines, has been working with several companies on a prototype. Northwest Airlines has acknowledged that it is talking with other airlines about a similar screening system. Federal authorities hope to test at least two prototypes in coming months or possibly sooner, according to government and industry sources familiar with the effort.

.

"This is not fantasy stuff," said Joseph Del Balzo, a former acting administrator of the Federal Aviation Administration and a security consultant working on one of the profiling projects. "This technology, based on transaction analysis, behavior analysis, gives us a pretty good idea of what's going on in a person's mind."

.

The screening plans reflect a growing faith among aviation and government leaders that information technology can solve vexing security problems by rooting out and snaring people who intend to commit terrorist acts. But a range of policy and technical questions still need to be answered before the system can become a reality. The Transportation Security Administration, for example, must decide on a set of standards so technology companies and airlines can begin building a system. They must also figure out how to pay for the system and its operation. Industry officials said they hoped the system would cost, on average, much less than $2 per ticket. Officials at the new agency declined to comment.

.

Government officials and companies also face questions about privacy. In interviews, more than a dozen people working on two parallel projects said they were taking pains to protect individual privacy. They intend to limit the personal information shared with airlines and security officials.

.

But developers face restrictions on how much information they can use. Industry officials have already discussed with lawmakers the possible need to roll back some privacy protections in the Fair Credit Reporting Act and Driver's Privacy Protection Act to enable them to use more of the credit and driver's-license data. Civil liberties campaigners said they feared the system could be the start of a surveillance infrastructure that will erode privacy protections. When told about the system, Barry Steinhardt, associate director of the American Civil Liberties Union, said it would be "a massive complex system of surveillance."

.

"It really is a profound step for the government to be conducting background checks on a large percentage of Americans. We've never done that before," he said. "It's frightening."

.

Some critics worry that law enforcement authorities will be tempted to use it for broader aims, such as snaring deadbeat parents or profiling drug couriers.

.

"If you can profile for terrorists, you can profile for other things," said Richard Smith, an independent computer security and privacy specialist. "The computer technology is so cheap and getting so much cheaper, you just have to be careful: Turn up the volume a little bit, and we just use the air transportation system to catch everybody."

.

Airlines rely on a couple dozen variables to screen passengers, such as travel history, how they bought tickets and whether they are flying one-way, people familiar with the system said. The details of that system, known as Computer Assisted Passenger Screening, or CAPS, are closely guarded. But security specialists regard that system, expanded after Sept. 11, as limited. The systems under development would include a thousand or more minute details and computer-derived conclusions about a person's travel, daily activity over time and whether he or she has coordinated activity with other passengers, possibly on other flights.

.

Two leading prototypes are being developed. One group is led by HNC Software, a risk-detection specialist. HNC is working with several companies, including PROS Revenue Management, which has access to seating records of virtually every U.S. passenger, and Acxiom Corp., one of the world's largest data-marketing companies, which collects such information as land records, car ownership, projected income, magazine subscriptions and telephone numbers.

.

"We can quickly build a system that is much more effective than anything in place today," said Joseph Sirosh, executive director of advanced technology solutions at HNC Software.

.

A second group is being led by Accenture. It has worked for months on a prototype with a variety of companies, including Delta. The data giant Equifax; Sabre Inc. (which is responsible for about half of U.S. airline reservations); IBM, and other companies have also been working on profiling efforts. Both systems are designed to use travel information and other data to create models of "normal" activity. Then they will look for variations in individual behavior that might suggest risk. Both may eventually make use of some sort of biometric system that uses iris scans, fingerprints or other immutable characteristics.