What Your Homeland Security Travel File Looks Like
Homeland Security's dossier on all your the travel you've ever taken looks something like this.
Post a comment
Comments:
time to sign up for one of those VPN services.
I would be freaked out if I could actually SEE that image but honestly, records are kept on everyone and anyone big deal.
@BustangBetty: Yep. I can't see a thing on that image, so I'm not exactly sure what's circled or what I should be afraid of.
I wanted to make a joke right now, but not so badly that I'm willing to up my chance of ending up on a no fly list.
@Raywind:
If you go through the site, it shows his IP address that he ordered the ticket from. I wish I could take a flight like his...$1400+ somewhere.
As if it is not hard to spoof your IP address. If someone was really trying to do something devious then they'd hide themselves.
Once the authorities get printers that no longer mysteriously blot out all of the important information with black ink, they'll know everything!
It's his (travel agent's) IP address, from when the tickets were purchased. The airline provides that info. If you buy from a kiosk or ticket counter in the airport, the terminal that sold the ticket goes in there instead. The IP is not really a big deal. I don't know why people get so freaked out about IPs. That's probably the most common and least identifying mark you leave on the Internet. After all, The Consumerist has my IP as soon as I view the story, and again when I post this comment.
Now, the grey bars (the stuff the author redacted) probably conceal things like credit card or other personal info. Any time you pay by check or credit card the merchant keeps your financial info, at least until the end of the return period.
If they record your IP... I wonder what happens if you use an anonymous proxy to buy your tickets? Do you get red-flagged?
Just another brick in the wall. Looks innocuous enough given the current global political climate. But they add up.
Eventually, Homeland
"security" will know your grocery list and everyone will be saying: I don't see what the big deal is.
Two weeks to go, and some if this craziness might go away.
a few months ago I requested my records from Customs. They include passport swipe in/out times, everything you tell the agent in a secondary search and much more, and whats even more amazing, is the information in my OWN file that they blacked even me out from seeing.
Its quite amazing. If consumerist wants a copy, i'll gladly send them in
Everyone panic!!! Seriously if you're not doing anything wrong you have nothing to worry about. If you are worried about this then...you're probably doing something you don't want people to find out about. Seriously who cares...records like this exist everywhere about us including our employment history, credit history, medical history...etc etc. This is modern society...it comes with the good and the bad.
I'm more interested in the back end needed to process all this info. Wonder what that data center looks like and where it is located!
@Coyote: The author mentioned that those are his passport numbers. But perhaps it could be CC also...
@Daniel Suslavich: That reminded me - there doesn't seem to be any 'swipe out' in U.S. Border patrol. Or am I forgetting something? Other than a glance at it from TSA, no one from the govt looks at my passport on the way out of the country. The ticket agent (working for the airline) does, but how does their commercial ticket-selling system connect with this Homeland Security terrorist watch list / organized crime prevention system? I feel a disconnect.
In other countries, there's an exit stamp system by the border authorities... but not here. So what happens if you are some sort of wanted criminal fleeing internationally - at what point does the flag go up on your way out of the U.S?
Haha...I fly about 2x a week...and make seat assignment changes and whatnot all the time...I wonder how long the file on me (or any other frequent flier/business traveler) is...
@LetMeGetTheManager: And the entire ordering process. Apparently if you pause to scratch your but before confirming, you're a terrorist.
Collecting information is the easy part. Now try to use that information. It doesn't appear to have a consistent format. Billions of dollars to record so much information that is sitting on backup tapes.
@acknight: I went looking for the link... stared at that single-line post, then finally noticed the slightly different text on the very last word.
I would care if my ip was static. But it changes so I don't care.
So, if I want to see MY OWN file, how do I go about requesting this via the Freedom of Information Act?
@RurouniX: Of course. Until something innocent you say is taken out of context and used against you. Paranoia and rampant fear have, I believe, caused such situations before.
This is my other username, but anyways, from the records they sent me, the country you are entering sends the information to the country of your passport and that acts as the swipe out (For example, on 4/26/2007 I swiped my passport at Montego Bay Intl Airport, and thats on my record, and then the swipe in record by US Customs in Fort Lauderdale is at 4/27/2007 at 5:38pm)
They do include PNR (flight data) from Intl Itinearies in your record.
The DHCP servers for your ISP keeps a time stamp of who had what IP address and when they had it. It isn't that hard for someone with a warrant or court order to find out who you are. All they need is the IP with the date and time.
@Coyote: [The IP address is] probably the most common and least identifying mark you leave on the Internet.
Common, yes; but least identifying? I beg to differ. Under the right circumstances IPs are plenty identifying. If you have DSL at home, and if your ISP is typical, then your IP address can be linked up with your home address, since the ISP knows the mapping between their block of IP addresses and their account. If the US gets mandatory data-retention laws (boo!) then that mapping will have to be preserved, instead of getting naturally forgotten after a few months, as ISP logs get cycled.
@Preyfar: Most web proxies I know don't work with SSL (the secure https: protocol used for online commerce). For those who want privacy I'd say buy online at the library or during lunch hour at work.
Home DSL users might hope that these old IP addresses become useless as ISP logs naturally turn over every few months.
@MyPetFly: I hope you're right, but I'm not holding my breath. Politicians are still politicians. People are expecting too much from the guy which will only lead to big disappointments down the road. But hey, it can't get a whole lot worse, right?
@MyPetFly: I certainly also hope some of the craziness abates, but it's good to remember that most of "the system" does not change just because the administration changes. Or, once craziness gets installed as part of the bureaucratic machinery, it takes a deliberate effort to turn it off and tear it out. (E.g., the crazy-unconstitutional Project Shamrock, which surveilled Americans for about two decades, finally shut down in the 70's.)
This might be a good time to plug the EFF, a nonprofit watchdog group who fight for online privacy (and more). And don't forget the ACLU, who also do a lot to resist the craziness as you nicely put it.
@RurouniX: if you're not doing anything wrong you have nothing to worry about.
If I'm not doing anything wrong, then stop watching me.
@Dooley: If you read the fine article, you can find that info in the last paragraph -- you have to write a letter, and mail it to this address, and you should be ready to pay for the records retrieval.
The real irony of course is that none of these idiotic "security" measures will protect us the slightest bit. Oh, we made it slightly harder for terrorists to do the same exact thing they did before! Obviously they won't be creative enough to come up with any new ideas!
Nope. Just there to quiet down the slavering masses.
@Tues_SteveDave: I'm wondering if the ISPs are required to save data about IP address leases now. Most broadband networks use dhcp so it's unlikely those IPs are reliable for more than a few days. But if you had a record of IP assignments for the past 10 years you could certainly track down the computer or user in seconds.
Here's an essay (long PDF) addressing the common but silly and naive "nothing to hide" argument:
@Tues_SteveDave: Yes, it rotates, but the ISP controls the rotation, and knows what your IP address is at any given moment. So it is just a subpoena away. Presumably they don't store that info forever, but most keep it awhile. For example, Jammie Thomas's ISP, Charter, provided a four-month log of her DHCP leases, including IP address and MAC address. Her IP probably rotated frequently (I'm assuming), but Charter, who were doing the rotation, knew what it was and were able to present that evidence at her trial.
@LandruBek: Offices tend to use static ips, or use static dhcp based on mac address so people get the same IP day to day. This is essential for remote access and telecommuting. In short, it would be much easier to track down your work computer.
Really though, unless you're flying to Afghanistan on a regular basis I wouldn't waste too much time trying to avoid this. Not saying it's right, just saying it's probably not worth your time to go all cloak and dagger.
@FrankenPC: I think the one thing we have going for us is that this much data is almost impossible to process. If I remember correctly the FBI reported that it gave up monitoring phone conversations a few months ago given the huge amount of processing power required and almost zero net result from it.
@Hooray4Zoidberg: In the USA the answer is no, they are not yet required to do so, but here is an article from last April where FBI Director Mueller requested laws requiring ISPs to maintain two years' worth of data. In the EU the answer is yes; their data retention law nominally took effect in September 2007.
I actually find my credit report to be far more troubling than this type of thing. That thing had every bank account I've had since I was an infant and my parents opened one up for my baptism gifts. There were accounts I'd forget I ever had, in banks that had been closed for 15 years. And that information is far less secure hands than this stuff.
These Docs look like basic CRS/GDS files from either Amadeus or Sabre. They are formated for use with the old text only reservation systems. It would not suprise me that the DHS might have a record of these, but they can easly be obtained by any travel agent who knew the reservation number and last name of the traveler.
For web based reservations it is not at all uncommon to document the IP address, and this goes back to the late 90s when online travel booking sites started to pop up.
Ok I'm officially freaked out.