Web Site Lets Anyone Create Fake Boarding Passes

Oct. 27, 2006 — -- A 24-year-old computer security student working on his doctorate at Indiana University Bloomington has created a Web site that allows anyone with an Internet connection and a printer to create and print fake boarding passes for Northwest Airlines flights.

The passes look virtually identical to the ones printed from the airline's site, and are intended to get you past security -- but not onto an airplane.

By entering your name and plugging in information about the flight -- flight number, gate, seat number, departing city, destination, departure, and arrival times and class -- the site generates a boarding pass the program's creator says will get you past security checkpoints, even without ID.

Christopher Soghoian, creator of "The Northwest Airlines Boarding Pass Generator," knew he would be opening up a can of worms by writing the program and creating the site, but says it's the only way to show people how deeply flawed airport and airline security are.

"I don't want to help terrorists or help bad guys do bad things on airplanes, but what we have now is what we in the industry call 'security theater.' It's made to make you think you're secure without actually making you secure," Soghoian said. "As a member of the academic research community, I consider this to be a public service."

Soghoian admits that he hasn't actually tried to use one of the boarding passes yet.

"Testing this in reality could land you in Gitmo [Guantanamo Bay, Cuba]," he said, but he added that the point shouldn't be lost that anyone with a little know-how and the will to do it could get past security at almost any airport in the country."

Spotlighting Security Risk or Creating One?

The Transportation Security Administration says that what Soghoian has done is illegal and that using one of these bogus boarding passes would be illegal as well.

But, TSA officials also believe that it would do little to aid anyone looking to do harm to airline passengers.

"While you may be able to get access to the terminal's interior through the security checkpoint," said Ann Davis, a TSA spokeswoman, "TSA assures that every individual introduced to the sterile environment beyond the checkpoint and their accessible property have been thoroughly checked and screened."

With airport security a hot-button issue, and Election Day drawing near, news of the site is generating some heated responses from politicians that include calls for his arrest.

"The Bush administration must immediately act to investigate, apprehend those responsible, shut down the website, and warn airlines and aviation security officials to be on the look-out for fraudsters or terrorists trying to use fake boarding passes in an attempt to cheat their way through security and onto a plane," wrote Rep. Edward Markey, D-Mass., a senior member of the Committee on Homeland Security, in a statement.

"There are enough loopholes at the backdoor of our passenger airplanes from not scanning cargo for bombs; we should not tolerate any new loopholes making it easier for terrorists to get into the front door of a plane," Markey wrote.

Aviation expert John Nance says Soghoian may have shed light on a gap in airport security, but it's not something he should be commended for.

"My knee-jerk reaction to this is extreme concern," he said. "There's a free speech issue of course, but this is under the same legal categorization as screaming fire in a crowded theater."

While Nance agrees that there are significant problems in the airport screening process, and some policies he'd like to see changed, he says there's no need to assume that anyone could get any further with this ability than through security and he doesn't think that's a problem.

"You or I can very easily go to an airline ticket counter, buy a refundable ticket for a particular flight, go through security, and come right out and sell it back," Nance said.

He thinks the real problem, in part, is that we're too concerned with who can get into the airport terminal when it's the airplanes we should be more worried about.

"The issues that are raised by this spotlight an inefficiency in our thinking about who should have access to the interior of an airport," he said.

"Our biggest worry is not having them in the terminal -- anyone can get in the terminal and get into a big crowd of people and set off an explosive or something. Anyone can do that on either side of the security checkpoint."

Ironically, Soghoian agrees.

"If Osama bin Laden is sitting next to you on a plane, that shouldn't be a problem," he said. "It might make you uncomfortable. You might not like it, but what's really a problem is if there's a ticking bomb or a knife or something."

A History of Pushing the Boundaries

When you go to the airport these days, the TSA security agents manning the airport's security checkpoint check passengers' boarding passes and IDs to make sure the names on both match.

But if you've ever forgotten your ID when traveling, you know that you don't have to show ID to get through security or even to get on an airplane.

If you have a boarding pass but no identification, you're simply subject to a more extensive search by airport security.

"They just mark your boarding pass with a bunch of S's, which means you're a candidate for secondary screening," Soghoian said.

Soghoian tested that out during one trip by going to the airport and refusing to show ID.

"The poor security checkers at the gate -- you know making $8 an hour -- didn't know what to do," he said. "But the supervisor at the airline was really friendly and told me to just let them know the next time I was coming."

From there, he says, he was able to board the plane and make his trip.

That experience taught him that the ID check was basically useless and that the secondary screening designation had a pleasantly surprising side effect, he was taken to the front of the busy security line.

He says that after that, he started doing it as a matter of course when traveling, ensuring he wouldn't have to wait in the long, snaking line that preceded the security checkpoint.

The key problem as he sees it is that the TSA and the airlines are relying on each other to ensure our safety -- and neither are doing a very good job.

"The airline doesn't know who you are, and they're not checking IDs at the gates. They rely on the TSA for that," he said.

"The TSA's job is to make sure nothing gets past them like a bomb or a gun."

But after a recent report showed that security screeners at Newark International Airport in New Jersey had flunked 20 out of 22 tests to identify hidden bombs and guns, and with similar reports coming out all the time, it seems that system may not even work.