American Airlines confirms reservations used in CAPPS-II tests

American Airlines has finally confirmed that, as I reported last year on my Web site, more than a million archived American Airlines reservation records were turned over to each of four competing teams of contractors working on the CAPPS-II passenger profiling and monitoring system in the summer of 2002.

According to the Associated Press , the American Airlines PNRs were provided to the CAPPS-II contractors — led by HNC Software, Infoglide Software, Ascent Technology, and Lockheed Martin, as well as to the Transportation Security Administration itself, at the request (but not demand) of the TSA, by Airline Automation, Inc..

Airline Automation processes PNRs for American (whose reservation database is hosted in the Sabre CRS, originally created by American but now independent) and other airlines, mainly mining them to extract ticketing information which is used to enhance airline pricing and yield management. As I’ve previously reported , Airline Automation retains those PNRs, and used them for experiments in passenger profiling as early as late 2001.

In November 2003, Airline Automation was acquired by Amadeus, the only one of the four major CRS’s still owned by airlines and, more significantly in this context, the only one of the four based in the European Union and thus fully subject to EU data privacy laws throughout its operations. (The other three major CRS’s — Sabre, Galileo, and Worldspan — are all based in the USA.)

I’ve been pressing Amadeus for comment on Airline Automation’s past provision of archived PNR data for CAPPS-II testing, and whether Amadeus would be changing Airline Automation’s privacy practices to conform to EU data protection requirements. I’ve also been pressing Sabre for comment on how the Sabre PNRs from American and other airlines were provided to the CAPPS-II contractors in 2002. I suspect that it’s those enquiries that led American to investigate and realize that they couldn’t cover up or deny the story forever.

To minimize the immediate fallout, American released the story on Good Friday, when USA stock markets are closed, after the close of business in Washington and after American’s own spokespeople had left for the weekend. But this isn’t a story that will quickly fade away.

American and Airline Automation are reportedly arguing already about whether American’s contracts with Airline Automation for PNR processing did or did not allow Airline Automation to retain copies of the PNRs, and provide them to the government or government contractors.

But there are other, more serious, questions:

1. Why have the TSA and the Department of Homeland Security continued to deny — even in the face of specific questions by myself and others about these particular 2002 tests — that any real PNRs were used in CAPPS-II testing? Have they been lying, or has their oversight been inadequate? (European Union and other countries’ authorities should ask particularly hard questions about whether the TSA and DHS are capable of honesty and effective self regulation on privacy.)
2. What other airlines’ PNRs were used in the 2002 CAPPS-II tests? (As I reported last year, people who were involved in the tests have told me that multiple airlines’s PNRs were used.) Will those other airlines, Airline Automation, the TSA, and/or the CAPPS-II contractors come forward and acknowledge what they did with travellers’ personal information, now that American has begun to ‘fess up?
3. What will Amadeus do now to bring its Airline Automation subsidiary into compliance with EU law?
4. Most importantly, what will the USA Congress do to investigate the growing travel reservation privacy scandal, and to enact privacy protections for travel data to prevent it from recurring?

Ironically, I got the news that American had confirmed my reports about PNR usage in 2002 CAPPS-II tests as I was on my way out the door to the airport to catch an American Airlines flight, and I’m writing this in one of the American terminals at their hub in the Dallas/Ft. Worth airport while changing between American planes (blogging over an infrared connection from my Psion netBook to a GPRS mobile phone, about which I’ll have more in a future article).

I’ll be back in the USA on the 18th of April, and hope to talk about these issues with many of you at the session on travel and privacy CFP the following week.

[More from the Electronic Frontier Foundation: TSA and CAPPS II — Anatomy of a Cover Up]