The IT Law Wiki
Don't have an account?
Register
Register
in: Privacy, Security, Transportation

Computer-Assisted Passenger Prescreening System

Sign in to edit

Overview[]

The Computer-Assisted Passenger Prescreening System (CAPPS II) project represented a direct response to the 9/11 terrorist attacks. After the attacks, air travel was widely viewed not only as a critically vulnerable terrorist target, but also as a weapon for inflicting larger harm.

The CAPPS II initiative was intended to replace the original CAPPS, currently being used. Spurred, in part, by the growing number of airplane bombings, the existing CAPPS (originally called CAPS) was developed through a grant provided by the Federal Aviation Administration (FAA) to Northwest Airlines, with a prototype system tested in 1996. In 1997, other major carriers also began work on screening systems, and, by 1998, most of the U.S.-based airlines had voluntarily implemented CAPS, with the remaining few working toward implementation.[1] Also, during this time, the White House Commission on Aviation Safety and Security (sometimes referred to as the Gore Commission)[2] released its final report in February 1997. Included in the Commission’s report was a recommendation that the United States implement automated passenger profiling for its airports.[3]

On April 19, 1999, the FAA issued a notice of proposed rulemaking (NPRM) regarding the security of checked baggage on flights within the United States (Docket No. FAA-1999-5536)[6] As part of this rule, domestic flights would be required to utilize “the FAA-approved computer-assisted passenger screening (CAPS) system to select passengers whose checked baggage must be subjected to additional security measures.”[4] The current CAPPS system is a rule-based system that uses the information provided by the passenger when purchasing the ticket to determine if the passenger fits into one of two categories: “selectees” requiring additional security screening, and those who do not. CAPPS also compares the passenger name to those on a list of known or suspected terrorists.[5]

CAPPS II was described by Transportation Security Administration (TSA) as “an enhanced system to confirm the identities of passengers and to identify foreign terrorists or persons with terrorist connections before they can board U.S. aircraft.”[6] CAPPS II would have sent information provided by the passenger in the passenger name record (PNR), including full name, address, phone number, and date of birth, to commercial data providers for comparison to authenticate the [[identity] of the passenger. The commercial data provider would have then transmitted a numerical score back to TSA indicating a particular risk level.[7] Passengers with a “green” score would have undergone “normal screening,” while passengers with a “yellow” score would have undergone additional screening. Passengers with a “red” score would not have been allowed to board the flight, and would have received “the attention of law enforcement.”[8]

While drawing on information from commercial databases, TSA had stated that it would not see the actual information used to calculate the scores, and that it would not retain the traveler’s information. TSA had planned to test the system at selected airports during spring 2004.[9] However, CAPPS II encountered a number of obstacles to implementation. One obstacle involved obtaining the required data to test the system. Several high-profile debacles resulting in class action lawsuits made the U.S.-based airlines wary of voluntarily providing passenger information. In early 2003, Delta Airlines was to begin testing CAPPS II using its customers’ passenger data at three airports across the country. However, Delta became the target of a vociferous boycott campaign, raising further concerns about CAPPS II generally.

In September 2003, it was revealed that JetBlue shared private passenger information in September 2002 with Torch Concepts, a defense contractor, which was testing a data mining application for the U.S. Army. The information shared reportedly included itineraries, names, addresses, and phone numbers for 1.5 million passengers.[10] In January 2004, it was reported that Northwest Airlines provided personal information on millions of its passengers to the National Aeronautics and Space Administration (NASA) from October to December 2001 for an airline security-related data mining experiment.[11]

In April 2004, it was revealed that American Airlines agreed to provide private passenger data on 1.2 million of its customers to TSA in June 2002, although the information was sent instead to four companies competing to win a contract with TSA.[12] Further instances of data being provided for the purpose of testing CAPPS II were brought to light during a Senate Committee on Government Affairs confirmation hearing on June 23, 2004. In his answers to the committee, the acting director of TSA, David M. Stone, stated that during 2002 and 2003 four airlines — Delta, Continental, America West, and Frontier, and two travel reservation companies — Galileo International and Sabre Holdings, provided passenger records to TSA and/or its contractors.[13]

Concerns about privacy protections had also dissuaded the European Union (EU) from providing any data to TSA to test CAPPS II. However, in May 2004, the EU signed an agreement with the United States that would have allowed PNR data for flights originating from the [[EU] to be used in testing CAPPS II, but only after TSA was authorized to use domestic data as well. As part of the agreement, the EU data was to be retained for only three-and-a-half years (unless it is part of a law enforcement action), only 34 of the 39 elements of the PNR were to be accessed by authorities,[14] and there were to be yearly joint DHS-EU reviews of the implementation of the agreement.[15]

Another obstacle was the perception of mission creep. CAPPS II was originally intended to just screen for high-risk passengers who may pose a threat to safe air travel. However, in an August 1, 2003, Federal Register notice, TSA stated that CAPPS II could also be used to identify individuals with outstanding state or federal arrest warrants, as well as identify both foreign and domestic terrorists (not just foreign terrorists). The notice also states that CAPPS II could be “linked with the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program” to identify individuals who are in the country illegally (e.g., individuals with expired visas, illegal aliens, etc.).[16] In response to critics who cited these possible uses as examples of mission creep, TSA claimed that the suggested uses were consistent with the goals of improving aviation security.[17]

Several other concerns were raised, including the length of time passenger information is to be retained, who would have access to the information, the accuracy of the commercial data being used to authenticate a passenger’s identity, the creation of procedures to allow passengers the opportunity to correct data errors in their records, and the ability of the system to detect attempts by individuals to use identity theft to board a plane undetected.

In August 2004, TSA announced that the CAPPS II program was being canceled and would be replaced with a new system called Secure Flight.

References[]

  1. ↑ Dept. of Transportation, White House Comm’n on Aviation and Security: The DOT Status Report (Feb. 1998).[1].
  2. ↑ The Gore Commission was established by Executive Order 13015 on August 22, 1996, following the crash of TWA flight 800 in July 1996.
  3. ↑ White House Comm’n on Aviation Safety and Security: Final Report to President Clinton (Feb. 12, 1997).[2]
  4. ↑ 64 Fed. Reg. 19220 (Apr. 19, 1999).
  5. ↑ GAO, Aviation Security: Computer-Assisted Passenger Prescreening System Faces Significant Implementation Challenges 5-6 (GAO-04-385) (Feb. 2004).
  6. ↑ Transportation Security Administration, “TSA’s CAPPS II Gives Equal Weight to Privacy, Security,” Press Release, Mar. 11, 2003.[3]
  7. ↑ Robert O’Harrow, Jr., “Aviation ID System Stirs Doubt,” Wash. Post, Mar. 14, 2003, at A16.
  8. ↑ Transportation Security Administration, “TSA’s CAPPS II Gives Equal Weight to Privacy, Security,” Press Release, Mar. 11, 2003.[4]
  9. ↑ Sara Kehaulani Goo, “U.S. to Push Airlines for Passenger Records,” Wash. Post, Jan. 12, 2004, at A1.
  10. ↑ Don Phillips, “JetBlue Apologizes for Use of Passenger Records,” Wash. Post, Sept. 20, 2003, at E1; Sara Kehaulani Goo, “TSA Helped JetBlue Share Data, Report Says,” Wash. Post, Feb. 21, 2004, at E1.
  11. ↑ Sara Kehaulani Goo, “Northwest Gave U.S. Data on Passengers,” Wash. Post, Jan. 18, 2004, at A1.
  12. ↑ Sara Kehaulani Goo, “American Airlines Revealed Passenger Data,” Wash. Post, Apr. 10, 2004, at D12.
  13. ↑ The written responses to the committee’s questions are here; Sara Kehaulani Goo, “Agency Got More Airline Records,”Wash. Post, June 24, 2004, at A16.
  14. ↑ Some information, such as meal preferences, which could be used to infer religious affiliation, and health considerations will not be made available. Sara Kehaulani Goo, “U.S., EU Will Share Passenger Records,” Wash. Post, May 29, 2004, at A2.
  15. ↑ Department of Homeland Security, “Fact Sheet: US-EU Passenger Name Record Agreement Signed,” May 28, 2004.[5]
  16. ↑ 68 Fed. Reg. 45266 (Aug. 1, 2003); GAO, Aviation Security: Challenges Delay Implementation of Computer-Assisted Passenger Prescreening System 17 (GAO-04-504T) (Mar. 17, 2004).
  17. ↑ Id.
Community content is available under CC-BY-SA unless otherwise noted.

Fan Feed

More The IT Law Wiki