Fake Boarding Passes Land Student in Heap of Trouble
Nov. 2, 2006 — -- Christopher Soghoian is knee-deep in trouble.
The 24-year-old Indiana University Bloomington doctoral student created a Web site that enabled anyone with a computer to make fake boarding passes good enough to get past security but not onto an airplane.
Over the weekend, the FBI raided his home and confiscated his computer and other belongings just a day after Rep. Edward Markey, D-Mass., called for his arrest.
The raid marked his second visit from federal agents in two days.
"I came back today, to find the glass on the front door smashed," he wrote in his blog, slightparanoia.blogspot.com.
"Inside, is a rather ransacked home, a search warrant taped to my kitchen table, a total absence of computers -- and various other important things. I have no idea what time they actually performed the search, but the warrant was approved at 2AM. I'm sincerely glad I wasn't in bed when they raided the house. That would have been even more scary."
According to Soghoian's blog, the boarding pass generator Web site had been shut down by Friday evening.
Although no charges have been filed yet, a spokeswoman for the FBI, special agent Wendy Osborn, confirmed that the bureau was working a joint investigation on Soghoian with the Transportation Security Administration.
Advised not to comment further by his attorney, the clearly shaken computer-security student -- who last week called his actions a "public service" in an interview with ABCNEWS.com -- is now hearing a swelling chorus of both support and condemnation for what he's done.
Senators and Congress People Chime In
Soghoian gets praise from supporters on the Facebook Web site he has created to help raise money for his legal defense fund.
His school has informed him that it will not cover his legal fees or provide him with an attorney.
Even Markey has done an about-face after learning the young man was studying computer security and created the fake boarding pass generator to expose a frightening loophole in our national security.
"Under the circumstances, any legal consequences for this student must take into account his intent to perform a public service, to publicize a problem as a way of getting it fixed," wrote Markey in a statement. "He picked a lousy way of doing it, but he should not go to jail for his bad judgment. Better yet, the Department of Homeland Security should put him to work showing public officials how easily our security can be compromised."
The Web site prompted Sen. Charles Schumer, D-N.Y., to call on the Senate to act swiftly on a bill he introduced making the use of fake travel documents a crime.
In 2005, Schumer laid out a similar scenario to the one Soghoian played out that could end with a terrorist on an airplane.
Schumer's scenario had the fake terrorist, "Joe Terror," buy a ticket under a different name with a stolen credit card to avoid being matched up with his name on the domestic no-fly list.
Joe Terror would then print a fake boarding pass in his real name that would get him past security and ultimately onto the airplane.
The senator says that the loophole still exists today. Soghoian's actions are proof that anyone with a little know-how could do it themselves.
"It is five years after 9/11, and we still have this enormous hole in airport security," Schumer wrote in an e-mail. "The people out there determined to do us harm are not stupid, and this loophole is a glaring opportunity for them to exploit. In this post 9/11 era, the terrorists will find our weakest link and this one is in plain sight. We have spent millions of dollars investing in screening equipment and airports security, but right now anyone forging a boarding pass, including a terrorist, is treated like a 19-year-old who makes a fake ID to buy a six-pack of beer."
It's a Problem With a Solution
Soghoian said that one of the things that had prompted him to make the site was that he wanted to show people who perhaps aren't as technology savvy how easy making a fake boarding pass could be.
But while he stirred the pot by writing the program, he also has some suggestions for how to improve what he thinks is a broken system.
"The easiest solution is to give TSA [the Transportation Security Administration] the means to check the validity of boarding passes at the security gate," he said last week. "Give them a computer and a scanner, and let them check the boarding passes themselves."
Soghoian said it might not be cheap to supply all of those agents with scanners.
However, scanners, coupled with a second ID check at the airplane jetway, would make it incredibly difficult to fake your way past security.
Soghoian and aviation experts also agree that the agents who check passenger IDs against their boarding passes before passing through the TSA-manned security checkpoints should be TSA agents and not privately employed by the airlines.
The agency would like to see greater control over the general security of the nation's airports but is restricted by current limitations it would like to see changed.
"At some smaller airports, TSA does conduct the ID and boarding pass checking," said Ann Davis, a TSA spokeswoman.
"At the larger airports, TSA has been limited to a certain number of personnel nationwide by Congress, and we have to continue to manage our work force with a cap of 43,000 screeners nationwide."
Though it's unclear exactly when, Davis said there are "discussions" taking place right now to try and change that.