Schneier on Secure Flight evaluation group

Bruce Schneier is now also a member of a working group evaluating the replacement of the CAPPS II passenger profiling programme, "Secure Flight."

"I am participating in a working group to help evaluate the effectiveness and privacy implications of the TSA's Secure Flight program. We've had one meeting so far, and it looks like it will be an interesting exercise.

For those who have not been following along, Secure Flight is the follow-on to CAPPS-I. (CAPPS stands for Computer Assisted Passenger Pre-Screening.) CAPPS-I has been in place since 1997, and is a simple system to match airplane passengers to a terrorist watch list. A follow-on system, CAPPS-II, was proposed last year. That complicated system would have given every traveler a risk score based on information in government and commercial databases. There was a huge public outcry over the invasiveness of the system, and it was cancelled over the summer. Secure Flight is the new follow-on system to CAPPS-I.

Many of us believe that Secure Flight is just CAPPS-II with a new name. I hope to learn whether or not that is true.

I hope to learn a lot of things about Secure Flight and airline passenger profiling in general, but I probably won't be able to write about it. In order to be a member of this working group, I was required to apply for a U.S. government SECRET security clearance and sign an NDA, promising that I would not disclose something called "Sensitive Security Information."

SSI is one of three new categories of secret information, all of I think have no reason to exist. There is already a classification scheme -- CONFIDENTIAL, SECRET, TOP SECRET, etc. -- and information should either fit into that scheme or be public. A new scheme is just confusing. The NDA we were supposed to sign was very general, and included such provisions as allowing the government to conduct warrantless searches of our residences. (Two federal unions have threatened to sue the government over several provisions in that NDA, which applies to many DHS employees. And just recently, the DHS backed down.)

After push-back by myself and several others, we were given a much less onerous NDA to sign."

So why is he participating at all given his concerns? He says:

" I hope I can help make Secure Flight an effective security tool. I hope I can help minimize the privacy invasions on the program if it continues, and help kill it if it is ineffective. I'm not optimistic, but I'm hopeful.

I'm not hopeful that you will ever learn the results of this working group. We're preparing our report for the Aviation Security Advisory Committee, and I very much doubt that they will release the report to the public."