House hearing on CAPPS-II shows continued TSA distortions, growing airline concerns

Testimony at last Wednesday’s hearing on CAPPS-II before the Subcommittee on Aviation of the USA House of Representatives Commiteee on Transportation and Infrastructure continued the Transportation Security Administration’s campaign of lies about CAPPS-II, while revealing increasing concern by airlines — even those in the USA — about the cost and logistical burden of CAPPS-II on the travel industry.

Acting TSA Administrator David M. Stone tried to deny those implications by claiming, falsely, that:

“Currently, the CAPPS II system is being designed to … Obtain available Passenger Name Record (PNR) data from airlines and computer reservation systems. At a minimum this data will include full name, home address, home telephone number, and date of birth.

In fact, Stone and the TSA know full well (at least if they bothered to read any of the formal comments I and others submitted, starting more than a year ago, on their CAPPS-II proposals) that this data is not now “available”: the items Stone listed are not part of the data which, “at a minimum”, PNRs include (if PNRs exist at all, which they don’t for e.g. passengers on most charter flights).

As James C. May, President and CEO of the Air Transport Association (the lobbying association for major USA-based airlines), told the same hearing:

Passenger name records do not contain all the categories of information that TSA contemplates will be required for CAPPS II. CAPPS II will consequently require airlines to change significantly their practices for acquiring information from customers….

Airline reservation systems and the reservation systems of global distribution systems and online reservation systems will have to be reprogrammed to respond to the new information collection requirements. This will create substantial new resource demands on airlines and other providers of reservation services.

Because of the necessary reservation system reprogramming and revision of reservation agent practices to accommodate CAPPS II, airlines will need to know the technical requirements for and implementation schedule of CAPPS II well in advance of its startup. TSA, however, has not yet provided airlines with specifics about the CAPPS II system architecture.

May didn’t give any estimate on behalf of ATA for the caost of CAPPS-II to airlines or other companies that collect and process airline reservations, such as travel agencies and CRS’s/GDS’s.

But such an estimate was given earlier in the week by the International Air Transport Association, representing airlines worldwide, in a 15 March 2004 working paper prepared by IATA for the session of the International Civil Aviation Organization’s “Facilitation Division”, that begins today, 22 March, and runs through 2 April 2004 in Cairo, Egypt.

The preparatory documents for the ICAO standard-setting session include a wide variety of proposals for surveillance and monitoring of travellers, including mandatory machine-readable RFID and biometric passports, travel documents, and tranasportation worker credentials; profiling of passengers; comprehensive monitoring of passengers and cargo; and standardization of PNR formats and additional data collection requirments to faciliate uniform government access to, and sharing of, reservation data.

But IATA’s backgrounder on “Airline reservation system and passenger name record (PNR) access by States” [i.e national governments], the most comprehensive survey of CAPPS-II costs and other implications yet made public from within the airline industry, shows the increasing recognition by airlines that they can’t afford these measures — and that governments haven’t ackowledged their costs, and may not be able to afford them either.

IATA’s briefing paper warrants careful study in its entirety, and reinforces the comments I and others have made on the requirement of CAPPS 2.1 that additional data be provided by airlines, in a standard format, for each passenger. According to IATA’s latest assessement:

Since only portions of Airline Reservation Systems are regulated by Industry standards, significant parts of the underlying architecture vary. Any movement to impose changes on the industry with respect to the way that PNRs are constructed, stored or exchanged would require a massive restructure of the entire industry’s underlying IT base. While no firm analysis has been undertaken to identify the final cost of such a restructuring across the industry - including within the Travel Agency community - some in the industry have estimated that the costs could conceivably exceed US $2 billion.

That’s a sign that my own earlier estimate that CAPPS-II could cost US$1 billion or more — itself an extrapolation from earlier IATA comments on much narrower government-imposed data collection requirements — may have been overly conservative.

TSA Acting Adminitrator Stone also told this week’s House Subcommittee hearing that, “CAPPS II will not be an intelligence gathering system.”

But IATA directly contradicted that claim in its backgrounder for the upcoming ICAO Facilitation Section Session:

There is a consensus within the industry that access to PNR data by any government agency is in fact an intelligence gathering operation…. Accordingly, the air transport industry firmly supports the premise that the costs associated with access to airline reservation data should be borne solely by the government(s) requesting those data [rather than by the industry].

Stone also told the House that, “We [the TSA] are designing CAPPS II so it will not maintain data files on passengers beyond the time necessary to complete their itineraries.” But of course he failed to mention that airlines, CRS’s/GDS’s, travel agencies, and other companies that handle reservations would be free under the lastest CAPPS-II proposals to keep this data — provided to them under government orders — for as long as they like, and to use, rent sell, or disclose it to anyone (inlcluding any government officer or agency) for any prupose, without notice to, or the consent of, the traveller or anyone else (such as the travel agent making the reservation or the person paying for someone else’s ticket) identified in the reservation.

And while Stone boasted that the TSA has “issued two Interim Privacy Act notices to date” on CAPPS-II, he neglected to tell Congress that the first of those notices hid its real interntions by never mentioning CAPPS-II; that the TSA has yet to make public most of the comments it received in response to those notices; that in response to the comments on the first Privacy Act notice, the revised CAPPS 2.1 involved more extensive, intrusive, and burdensome reservation data requirements than CAPPS 2.0; and that the TSA’s purported “analysis” of the comments failed even to acknowledge that there were any comments — much less to respond or make any changes in response to them — questioning whether the proposal is Constitutional, whether it is authorized by statute or conflicts with other laws such as the Privacy Act and the Airline Deregulation Act, or whether the notice is deficient in failing to include an economic impact analysis and failing to include people other than travellers whose personally identifiable information is included in airline reservations.

Finally, several members of the Subcommitttee reportedly expressed particular concern about the possibility that — as pointed out in testimony by Kevein Mitchell for the Business Travel Coalition and three European business travel organization’s, and exploed in more detail in a recent law column in Travel Weekly (free registration and cookie and popup acceptance required) by Mark Pestronk — the TSA could be held liable for consequential damages of “false positives” and delays to travellers as a result of CAPPS-II errors.