Terrorists Evolve. Threats Evolve. Security Must Stay Ahead. You Play A Part.

9.16.2008

Bar-Coded Boarding Passes – Secure, Mobile, and On The Way

Photo of a new scanner being used at an airport As we’ve talked about earlier on the blog, TSA has taken a lot of steps to confirm ID: TSA Travel Document Checkers with magnifying loupes and black lights, the revised ID rules that affect people with no ID and developing Secure Flight. All that considered, we’re not naïve enough to say the system is foolproof. We’ve seen the “boarding pass generator” websites and know how to use Photoshop. In fairness, between the marking of boarding passes by TSOs at the checkpoint and the use of barcode scanners at the gate for most flights, it’s neither easy nor predictable to board a flight with a fake boarding pass. But the broader point is accurate – we could be better on this issue.

Some months ago, a team of people at TSA went to work on it. They’re working very closely with our airline partners to incorporate a strong digital signature into the barcode on every boarding pass. The technique we’ve selected allows existing 2D barcode scanners to read the basic flight information, but scanners equipped with the appropriate security keys can authenticate the information and determine if the name, date, flight number or any other information has been changed. It’s simple but very effective. The net result will be a boarding pass that is extremely resistant to tampering or forgery.

We’re already testing this concept in the field. Thanks to terrific cooperation from our airline partners, we’ve launched eight test sites where passengers can receive boarding passes on their mobile phones or PDAs (wait until you try it – it’s pretty slick). Click here to learn more about participating airports and airlines.
These mobile boarding passes have digital signatures embedded in the barcodes. Officers who do the document checking are equipped with handheld barcode scanners (generously on loan from our partners) and can confirm the authenticity of the boarding pass instantly. This isn’t rocket science – the (2010 NL East Champion) Nationals use the same process at their new ballpark – and it’s working really well for both TSA and passengers.

Next up, we’ll work on expanding from mobile boarding passes at a few sites to all formats of boarding passes across our system. Looking back on the progress that we’ve made over the past several weeks, we greatly appreciate the cooperation and commitment of our partners on this effort. In the meantime, you can check back here or at www.tsa.gov for specifics on where you can try the new mobile boarding passes.

2 Comments:

Blogger Jim Huggins said...

Lynn,

First of all, I'm glad to see this moving forward. This closes one of the big loopholes (in my opinion) in the current screening process.

But I do have to nitpick a little bit (gee, what a surprise) ...

We’ve seen the “boarding pass generator” websites and know how to use Photoshop. In fairness, between the marking of boarding passes by TSOs at the checkpoint and the use of barcode scanners at the gate for most flights, it’s neither easy nor predictable to board a flight with a fake boarding pass.

I think you're missing the most obvious security hole, though. Currently, I can use two boarding passes to bypass security: one fake, one real.

Assume I'm a known terrorist. I buy a plane ticket under an assumed name (presumably, one not on the various selectee lists). I print my boarding pass at home for that flight. Also, at home, I print a forged boarding pass with my real name (which should be on a selectee list).

When I approach the checkpoint, I offer the TSA my fake boarding pass and real ID. The ID card matches the boarding pass, and the ID card looks genuine, so I get through security. I then throw the fake boarding pass away and use my real boarding pass (under my fake name) to board the aircraft.

Of course, this scenario becomes much more unlikely with the barcode scanner system ... you are now verifying that the boarding pass is legitimate, and that the boarding pass matches the presented ID. (Nothing is perfect, of course, but this will make the system much better.)

September 16, 2008 10:50 PM

 
Anonymous Miller said...

We’re already testing this concept in the field. Thanks to terrific cooperation from our airline partners, we’ve launched eight test sites where passengers can receive boarding passes on their mobile phones or PDAs (wait until you try it – it’s pretty slick).

I can't wait to hand over my cell phone to someone who is clueless and wants a chunk of paper. No thanks.

Click here to learn more about participating airports and airlines.These mobile boarding passes have digital signatures embedded in the barcodes. Officers who do the document checking are equipped with handheld barcode scanners (generously on loan from our partners) and can confirm the authenticity of the boarding pass instantly.

TSA still has problems with the basic requirements of security such as keeping weapons, incendiary devices, and explosives off of the aircraft. Get that down and then branch out into different areas. You're losing focus of your primary mission.

This isn’t rocket science – the (2010 NL East Champion) Nationals use the same process at their new ballpark – and it’s working really well for both TSA and passengers.

So how much did it cost them per seat? Again FOCUS. Gate to gate and airport to airport inconsistencies within TSA make this one of those 'what were they thinking when they came up with this scheme' moments.

September 16, 2008 11:06 PM

 

Post a Comment

Links to this post:

Create a Link

<< Home