Recent Issues Regarding Security and Privacy

• The first two readings are about a simple, but elegant Java-related security hole that was discovered by some researchers at Princeton. Something to consider when you read these two reports: Is this a security hole in Java or a problem with DNS?
  • Sun's original response.
  • The reply to Sun's response.

• The third reading is a Frequently-Asked-Questions (FAQ) document on Social Security Numbers. The author takes the stance that SSN's are (in general) an invasion of privacy. Is he justified in his reasoning, or is he just being paranoid?
  • The Social Security Number FAQ

• The final reading is a short message that was sent to a list called the Privacy Forum. The message is about the recently imposed requirement that all passengers show some form of ID when checking in their baggage at the airport.

----------------------------------------------------------------------
PRIVACY Forum Digest       Monday, 11 March 1996       Volume 05 : Issue 06
----------------------------------------------------------------------

Date:    Sat, 24 Feb 1996 12:50:39 -0800
From:    Wulf Losee 
Subject: Flying the friendly skies anonymously

Recently, when taking a business flight from LA to San Francisco, I
encountered a new an obnoxious "security" requirement that the FAA
has imposed.  I was asked to show a photo ID when checking my
luggage at the ticket counter.

Normally I do not carry my driver's license with me when I fly to cities
with good public transportation systems (unless I'm going to rent a car).
I've found that it's too easy to lose important documents (such as a
driver's license) in the hustle-and-bustle of traveling.  When the United
Airlines check-in clerk asked me for a photo ID, ironically, I was able to
produce my license which, this time, I had forgotten to leave safely at
home.  I asked the counter clerk what would have happened if I didn't
produce a photo ID -- would they have not let me on the plane?  She
looked troubled (as if that situation had never come up before?), and
replied that my luggage might be subjected to extra scrutiny and that I
might be "monitored".   I asked her why they are doing these ID checks,
and she replied that it has been FAA policy since the Unabomber threat
against LAX.

Having had a security background, I was also interested in how United
(and their FAA masters) would handle a passive challenge to their photo
ID regulation on my flight back from San Francisco.   Being the
subversive and stubborn individual that I am, I was prepared to go as far
as missing my flight to see what their response would be.  When I
checked my luggage, the clerk asked me for a photo ID, and I said I had
none.  She said: "You *must* have a photo ID!"   I said: "sorry, no one
notified me that I had to bring a photo ID with me to fly".  She left her
booth to get assistance.  An audible groan went up with the people
trapped in line behind me.  The woman directly behind me started to
harangue me -- "Everybody knows you have to bring an ID with you fly
now!"  I'm afraid I told her she was full of something -- something that the
CDA won't allow me to mention over the Internet.  A harried supervisor
returned and expressed his amazement that I didn't have a photo ID.  I
replied that I didn't know we had become a police state where we had to
prove who we were every time we travel.  "Well, it's FAA policy," he
replied.  I said that they were welcome to search me and my luggage to
see that I was carrying nothing dangerous or illegal.  He took me out of
line at that point.  He started calling *his* supervisor, pleading what to do.
"Well, do you have *any* ID?  Any ID at all?" he asked.  I produced a
credit card (not one of those cards with photos on them).  He sighed in
relief (but he didn't even check my name against the name on the ticket)
and let me proceed through.

Upon arrival at LAX, I could detect no signs that my checked luggage had
been searched.

It occurs to me that the days when one could anonymously purchase a
ticket with cash are over.  Being able to travel anonymously in the US (at
least by air) is no longer a real possibility (unless one has access to
counterfeit IDs).  It seems likely that airports will soon become, if they are
not already, a point where the government actively tracks the
movements of its citizens (for their own good, of course!).  Likewise, I
was surprised at how poorly airline security responded to my ploy of
claiming not to have a photo ID.   I suspect that my ploy will not be
possible in the near future, as the airlines and FAA develop ways to
tighten up on security.

Any comments from my fellow Privacy readers?

Thanks,
Wulf

I do not speak for my employer, and my employer does not speak for me.

        [ The airport system operates on the basis of various "alert"
          levels.  In the wake of terrorist activity anywhere in the world,
          these levels may be raised here in the U.S., and afterwards may
          not rapidly fall to their original levels.  Additionally,
          the standard of "normal" security is being gradually raised
          throughout the system.  One of the most serious of these
          security issues relates to checked baggage.  The airlines need
          to try make sure that no baggage gets onto a plane that doesn't
          have an identifiable face to go with it.  Are these measures
          overly intrusive?  Probably not, given the scope of the potential
          problem.  In some parts of the world the "normal" security
          standard is much higher, and definitely more intrusive.
          Are these measures guarantees against terrorist events?
          Of course not; a determined person who doesn't care about their
          own safety is nearly impossible to stop--as recent events
          again underscore.  But in an imperfect world, it's all a matter
          of balance.
                        -- MODERATOR ]

------------------------------

6.033 Handout 17, issued 3/8/96