CAPPS II Gets Grounded
This month, despite it never being deployed or field-tested, the TSA declared CAPPS II dead — sort of. While the program as it was originally conceived is no more and its name is destined for history, certain aspects of CAPPS II may rise again in a future program, maybe even the Registered Traveler Program.
"A lot of this stuff never goes away," says Schneier, who has written a number of books on security, including Beyond Fear and Secrets and Lies: Digital Security in a Networked World. "It just changes its name."
Hasbrouck's opposition to CAPPS II began out of consumer advocacy. Most consumers aren't aware of the amount of data in travel records; not only where and when people travel, but where they stay, who they contact, and intimate details like the number of beds they request and information on medical conditions. That is changing now thanks to the uproar around CAPPS II. "What we've seen over the last 18 months is that travel data has moved into the inner circle of personal data that must be kept private, along with medical and financial data," Hasbrouck says.
That industry collects the data was not a shock to Hasbrouck and others, but it was the compulsory giving of that data to the government that seemed to threaten the Constitution. Hasbrouck also says that in following the development of CAPPS II, he noted a transformation in late 2002 and early 2003 when the program moved from the Department of Transportation to the TSA, where it became a "black" (secret) project. It went from a well-intentioned security program, allbeit one conceived in post-Sept. 11 panic Hasbrouck says, to something else entirely.
"Collecting lifetime dossiers on people's travel is not a security program," he says. "It's a surveillance program."
Critics of the two identity-based programs agree they were never going to provide effective security. "A lot of it is security theater," says Schneier. The problem, he said, with conducting surveillance on everyone to catch a few is that you rapidly reach the point of diminishing returns.
Schneier says the weak link in airports right now is the employees, a population small enough that some sort of biometric ID may be an effective way of identifying who they are. But the ideas behind CAPPS II and the Registered Traveler Program represent a growing trend of technology being asked to make people secure. In fact, it's not the technology itself, the databases or the biometrics, that are the real problem with either CAPPS II or the Registered Traveler Program. It's their applications.
"Good security is human-based," Schneier says. As an example of what is being done wrong in security in general, he points to observant security guards with good training being replaced by people trained to look at ID cards and badges because such programs have been implemented by leaders looking to cover their back if something goes wrong. "Spending a lot of money to get the bad guys to change their tactics doesn't get you anything."
In its report, the Sept. 11 Commission mentioned the amount of money being spent on security at the airport, and focused many of its recommendations on improvement to travel security — specifically the security of travel documents — that could be implemented before a suspect arrives at the airport. "Over 90 percent of the nation's $5.3 billion annual investment in the TSA goes to aviation — to fight the last war," the panel said in its report.
Hasbrouck agrees that the concern is disproportionate to the actual risk, and wonders why the government doesn't take such steps to protect Americans from drunk drivers, a group that kills more people in the United States than terrorists and who are more easily identified because many have a proven history of driving drunk.
Indeed, there is no way to secure every airport, airplane, shopping mall, arena, and stadium in the country. But the dollars devoted to security can be spent wisely, something Hasbrouck says the government isn't doing at the airport.
"I don't think you can make a rational case for spending billions of dollars to make the safest mode of transportation safer," he says.
Images
IE 7
Firefox 2.0
