Fake Boarding Pass Generator Underscores ID Woes

Yesterday, the blogosphere crackled with news that ‘net surfers could use a website to generate fake boarding passes that would enable them to slip past airport security and gain access to airport concourses. The news provides a good opportunity to illustrate a credentialing (and identity) system, how it works, and how it fails.

It’s very complicated, so I’m going to try to take it slowly and walk through every step.

The Computer Assisted Passenger Prescreening System (CAPPS) separates commercial air passengers into two categories: those deemed to require additional security scrutiny — termed “selectees” — and those who are not. When a passenger checks in at the airport, the air carrier’s reservation system uses certain information from the passenger’s itinerary for analysis in CAPPS. This analysis checks the passenger’s information against the CAPPS rules and also against a government-supplied “watch list” that contains the names of known or suspected terrorists.

Flaws in the design and theory of the CAPPS system make it relatively easy to defeat. A group with any sophistication and motivation can test the system to see which of its members are flagged, or what behaviors cause them to be flagged, then adjust their plans accordingly.

A variety of flaws and weaknesses inhabit the practice of watch-listing. Simple name-matching causes many false positives, as so many Robert Johnsons will attest. But the foremost weakness is that a person who is not known to be a threat will not be listed. Watch-listing does nothing about people or groups acting for the first time.

In addition, a person who is known and listed can elude the system by using an alias. The use of a false or synthetic identity (and thus an inaccurate boarding card) could assist in this. But the simplest wrongful use of this fake boarding card generator would be to make a boarding card that allows a known bad person to receive no more security scrutiny than all the good people.

When CAPPS finds that a passenger should be given selectee status, this is transmitted to the check-in counter where a code is printed on the passenger’s boarding pass. At the checkpoint, the boarding pass serves as a credential indicating that the person is entitled to enter the concourse, and also indicating what kind of treatment the person should get — selectee or non-selectee. The credential is tied to the person bearing it by also checking a government-issued ID.

In a previous post, I included a schematic showing how identification cards work (from my book Identity Crisis). This might be helpful to review now because credentials like the boarding pass work according to the same three-step process: First, an issuer (the airline) collects information, including what status the traveler has. Next, the issuer puts it onto a credential (the boarding pass). Finally, the verifier or relying party (the checkpoint agent) checks the credential and accords the traveler the treatment that the credential indicates.

Checking the credential bearer’s identification, a repeat of this three-step process, and comparing the names on both documents, ties the boarding pass to the person (and in the process imports all the weaknesses of identification cards).

Each of these steps is a point of weakness. If the information is bad, such as when a malefactor is not known, the first step fails and the system does not work. If the malefactor is using someone else’s ticket and successfully presents a fake ID, the third step has failed and the system does not work.

The simple example we’re using here breaks the second step. A person traveling under his own name may present a boarding pass for the flight for which he has bought a ticket — but the false boarding pass he presents does not indicate selectee status. He has eluded the CAPPS system and the watch list.

The fake boarding pass generator does not create a new security weakness. It reveals an existing one. Though some people may want to, it’s important not to kill the messenger (who, in this case, is a Ph.D. student in security infomatics at Indiana University who created the pass generator to call attention to the problem). As I’ve said before, identity-based security is terribly weak. Its costs — in dollars, inconvenience, economic loss, and lost privacy — are greater than its security benefit.

Hopefully, the revelation that people can use fake boarding passes to elude CAPPS and watch-lists is another step in the long, slow process of moving away from security systems that don’t work well, toward security systems that do. Good security systems address tools and methods of attack directly. They make sure all passengers on an airplane lack the capacity to do significant harm.

It’s Not Fair, Your Schools Are Designed to Work Better!

Charter schools, which often live and die on the whims of public officials, are at best a pale shade of choice. Still, at least in Los Angeles, even charters have enough freedom to work better than traditional public schools. And that just ain’t fair.

District officials, as well as the president of the teachers union, bristle at assertions by the Charter Schools Association that middle and high school charters are significantly outperforming their district counterparts.

A fairer comparison would be with the district’s magnet schools, which outperform charters, school board member Jon Lauritzen said.

“I think it’s basically unfair to compare an entity that is able to take their entire budget and focus it entirely on their own schools,” he said. “They have some real advantages over our schools in the flexibility of actually providing the type of education that a particular community wants, whereas we are trying to provide a curriculum that works for everyone all across the school district.”

Yeah! Lauritzen is right! I mean, the nerve of people creating schools that can provide what parents and communities want!

It’s no wonder that, a few months ago, Mr. Lauritzen proposed a moratorium on charter schools, and that public schooling’s defenders fight even harder against reforms like vouchers and tax credits. After all, who could just sit by and watch parents get schools they want when an old, hopeless system is suffering?

Growing Well

Robert Frank has an excellent column on happiness, well-being, and economic growth in today’s New York Times. Frank rightly notes that the fact that self-reported life satisfaction does not increase with economic growth does not imply that growth is optional.

Many critics of economic growth interpret this finding to imply that continued economic growth should no longer be a policy goal in developed countries. They argue that if money buys happiness, it is relative, not absolute, income that matters. As incomes grow, people quickly adapt to their new circumstances, showing no enduring gains in measured happiness. Growth makes the poor happier in low-income countries, critics concede, but not in developed countries, where those at the bottom continue to experience relative deprivation.

All true. But these statements do not imply that economic growth no longer matters in wealthy countries. The reason, in a nutshell, is that happiness and welfare, though related, are very different things. Growth enables us to expand medical research and other activities that clearly enhance human welfare but have little effect on measured happiness levels.

Frank is right. Happiness is a component of welfare or well-being, but well-being includes much more than happiness. Health, longevity, opportunity, the realization of potential, and meaningful work are aspects of well-being that go beyond how good we feel. Growth promotes all those things. But there is also some decent evidence, which I report in this Prospect article, that economic growth has about as strong a positive correlation with self-reported happiness as anything else. Furthermore, I say:

The fact that average self-reported happiness has not risen with average incomes does not imply that there is no point in becoming richer. A steady rate of growth may be necessary to keep happiness and other good things at a high stable level. (Imagine a guillotine, on which a kitten is strapped, connected to a bicycle that must be pedalled ever more quickly to keep the blade aloft. Slow down, and the kitten gets it.) In The Moral Consequences of Economic Growth, Harvard economist Benjamin Friedman argues that steady economic growth “fosters greater opportunity, tolerance of diversity, social mobility, commitment to fairness and dedication to democracy”—a list I doubt any politician would come out against.

Frank also mentions Friedman in this regard, to good effect. In short, the evidence clearly points to the fact that economic growth is incredibly good for well-being, as Frank explains so well, and that it correlates positively with happiness as strongly as almost any other variable. (Life-expectancy or economic freedom look even better, depending on the study you consult.) There is no good happiness-based case against growth, and there is an exceedingly strong well-being-based case for growth.

Crime Map

The Washington, DC Police Department has launched a new crime-mapping tool on its web site.  This tool will allow anyone to create a map of a section of the city and then see what crimes have happened there over the past year.

I ran a check on crimes happening around the Cato Institute and got this result for thefts.

I tried to check on drug offenses in the neighborhood, but the police department does not map drug crimes at all.  I guess the “crime” that overwhelms the cop on the beat would also overwhelm the web staff at the department and just make the folly of drug prohibition even more obvious to web surfers.

We at Cato have a crime-map too.  Our map tracks the government.  In particular, drug raids where the police break into people’s homes without abiding by the Knock and Announce doctrine.  To check it out, go here.

Be Careful What You Wish For…

A couple of people over recent days have asked my opinion on the prospects for reform of agriculture policy should Democrats take over the House and/or the Senate. My usual reply is to lament the depressingly bipartisan nature of support for farm subsidies and trade barriers, and to also point out that the recent farm bill (implemented by a Republican congress) has been one of the most expensive in history: $23 billion last year. In a nutshell, I had thought that the prospects for reform could not be any worse under the Democrats than under Republicans.

It turns out that I may be wrong (yes, it happens occasionally). In a recent press release from Texas A&M University, the ranking member of the House Agriculture Committee (and probable chairman of that committee should the Democrats regain the majority in the House), Colin Peterson (D-MN) seems to support extension of the current farm bill, egregious though it is, but with yet more pork added.

Rep. Peterson would implement permanent crop disaster relief (I have blogged on this idea previously), and was indirectly quoted as calling renewable energy derived from crops ”the most exciting development in agriculture in his lifetime.”

Rep. Peterson does seem to have a point about the scope for the addition of expensive and agriculture-irrelevant rider amendments to ad-hoc disaster relief bills, but describing a permanent disaster relief program as a way to “save taxpayer dollars” is disingenuous, to say the least.

Rep. Peterson seems to have no truck with the idea that agriculture should contribute to deficit reduction, either: “I reject the idea that because we have a $9 trillion deficit, we have to get rid of farm programs. We didn’t cause that problem. In fact, agriculture was the only government initiative that actually spent less than was projected, $13 billion less so far. Besides, if you got rid of all agriculture programs, it wouldn’t make a dent in the deficit. So we need to do what’s right for agriculture, and that’s where I’m coming from.”

On ethanol, which my colleague Jerry Taylor has blogged about here, Rep. Peterson wheeled out the old “foreign oil dependency” issue and put his full support behind investing significant resources (that’s your resources) into more research into bio-fuels, describing the profits that investors are making currently from ethanol as “obscene.”

You said it, sir.

Staying the Course: 2006

At one point, we needed to stay in Iraq to establish a beachhead of liberal democracy in the Arab world. Today, if you listen to some of the war’s strongest supporters, our goals are considerably less inspiring. Here’s Frederick Kagan from today’s Washington Post:

The presence of American troops is vital to restraining Iraqi soldiers – the Iraqis know not to participate in death squad activities when Americans are around. The fact that large numbers of U.S. troops are not embedded with the Iraqi police is a main reason for the participation of those forces in the killings. When the U.S. troops go, the Iraqi army will probably go the same way.

And here’s Reuel Marc Gerecht writing in the Weekly Standard:

staying in Iraq ought to be a compelling choice…. We–not the Iraqis–need to lead a major effort to break the Sunni insurgency. We–not the Iraqis–must police the Shiite-dominated security services to ensure they don’t slaughter the Sunnis, especially as we and a Shiite-dominated army with an important Kurdish contingent make a more serious effort to control Baghdad, Ramadi, and the centers of Sunni resistance. We need to keep building up a Shiite-dominated Iraqi army and slowly deploying it in ways that it can handle–with integral American involvement, as at Tal Afar. We should expect a few Iraqi governments to collapse before we start seeing real progress. Yet our presence in Iraq is the key to ensuring that Shiite-led governments don’t collapse into a radical hard core.

This may be too much for the United States now. It certainly appears to be too much for the Democrats. We would have all been better off if President Bush and his team had done what Senator John McCain advised back in 2004, when the insurgency started to rip: Tell everyone that the war would be long and hard, and pour in more troops. If we no longer have the stomach for this fight–and it’s going to be ugly, with few sterling VIP Iraqis who will make us proud–then we should at least be honest with ourselves. Leaving Iraq will not make our world better. We will be a defeated nation. Our holy-warrior and our more mundane enemies will know it. And we can rest assured that they will make us pay. Over and over and over again. (Emphasis added).

We’re no longer fighting to create a democratic Iraq that will be an example to the Muslim world. Now we’re supposed to fight to put down the Sunnis while using the other hand to hold back the Shiites from doing it an overly zealous and gory fashion. In the best-case scenario, what rickety government we keep standing will not be one to make us proud, as Gerecht puts it. These are the war’s supporters. This is the case for staying. Not something I’d want my kid or yours to die for.

But any other course, Frederick Kagan declares, would be “morally contemptible”: “Both honor and our vital national interest require establishing conditions in Iraq that will allow the government to consolidate and maintain civil peace and good governance.” Which is a bit cheeky. One might wish for a little less moral bombast and a little more humility when being lectured on matters of honor and vital national interest from one of the people who helped lead us into the biggest foreign policy disaster in three decades.

But put that aside. We need to stay, Kagan says, to help the nascent Iraqi government “consolidate and maintain civil peace and good governance,” a phrase that comes just three paragraphs after Kagan tells us we need to stay because the Iraqi police forces are carrying out sectarian murders and the Iraqi army would quickly turn to “death-squad activities” but for our supervision.

“Civil peace.” “Good governance.” Through what method of social alchemy are our soldiers going to transform the army and the police force into institutions that even aim at providing those goods, let alone institutions capable of providing them? How long will that transformation take, and can that goal possibly be achieved? If it can’t, how moral is it to ask more Americans to die for it?