Fake Boarding Pass Fears Inflated


Dec 12, 2012

man at airport security checkpoint

This commentary originally appeared on USA Today on December 11, 2012.

With the holiday season upon us, the number of Americans traveling by air will be climbing. Airline reservations for this Christmas are already more than 50% higher than the same time last year. So security concerns about the increasing ease of reading or modifying the bar codes on boarding passes are also soaring.

Blame technology. Widely available free smartphone and Web-based applications can be used to read or alter the information on boarding passes, which can be accessed online 24 hours before a flight. This includes passenger identification, flight data and the information that determines whether a passenger is eligible for expedited screening. For some security analysts, expedited screening poses the biggest concern because those passengers are allowed to keep their shoes and belts on, and to keep their laptops and small containers of liquids in their baggage at checkpoints.

TSA wrongly bashed

Not surprisingly, critics have chastised the Transportation Security Administration for its latest policy innovation. In this case, the critics have got it wrong. The TSA should be applauded, and the program should be dramatically expanded beyond the five airlines and 29 airports that currently participate.

It's called PreCheck, and it enables certain frequent fliers to receive expedited screening at the airport. PreCheck is configured so that these passengers are not supposed to know whether they will receive expedited screening until their boarding pass is scanned at the airport entrance to security. Given the free applications to decode the information, however, passengers have been able to determine their PreCheck status before they arrive at the airport.

The ability to decode your boarding pass raises two fears. First is that you might be able to change the data in a boarding pass to give yourself PreCheck status and then use that status to smuggle contraband. Second, the fear is that if a terrorist knows he's getting PreCheck in advance, he could better plan an attack. Both fears are unfounded.

Layers of security

A number of other security measures are in place. Carry-on bags are still X-rayed, metal detectors can be configured to randomly select PreCheck travelers for additional security, and anyone caught trying to circumvent security can be denied PreCheck in the future.

The boarding passes of most, but not all, airlines contain a digital signature to ensure that the ticket and any of the personal information in the bar code has not been modified. Though the other elements of security are a hedge against this fraud, more countries and airlines should implement a digital signature, which then gets properly checked by the TSA. With this ability to verify that no information has been changed, the spoofing of a boarding pass will not be an option.

The reality is that locked cockpit doors and passenger and crew knowledge of the need to intervene during an incident provide a high level of security. Instead of ratcheting back the PreCheck program because of manufactured fears about security lapses, TSA should be encouraged to expand this program to more airlines, more airports and more infrequent travelers.

It's a Christmas present that more travelers deserve.

Jack Riley is vice president and director of the National Security Research Division and Lily Ablon is an information systems analyst at the non-profit, non-partisan RAND Corporation.

More About This Commentary

Commentary gives RAND researchers a platform to convey insights based on their professional expertise and often on their peer-reviewed research and analysis.