A data broker that is owned by major airlines will stop selling hundreds of millions of customer travel records to government agencies in the coming weeks. News that the Airlines Reporting Corporation (ARC) will shut down its controversial Travel Intelligence Program (TIP) surfaced in a letter ARC CEO Lauri Reishus recently sent to a bipartisan group of lawmakers.
The Travel Intelligence Program (TIP) was a data initiative operated by ARC, a company owned by major airlines. Through TIP, ARC aggregated and sold access to hundreds of millions of customer travel records, including details about when and where individuals flew and the credit cards used to purchase tickets, to various government agencies. The program catalogued ticket transactions made through travel agencies and popular booking websites but did not include tickets bought directly from airlines. TIP's database enabled government clients not only to search for historical travel data but also to set up automated, recurring searches for ongoing or future ticket bookings that matched specific criteria, a practice critics described as "prospective surveillance."
On 17 November, the lawmakers sent nine airline CEOs a letter demanding they shut down TIP. In the letter, the lawmakers revealed that the IRS failed to obtain a warrant before accessing an ARC database containing hundreds of millions of records showing when and where individual citizens flew and the credit cards they used to purchase tickets.[1]
The IRS acknowledged that it had violated federal law and agency policy when it bought ARC’s airline data, the lawmakers’ letter said. Specifically, the agency did not conduct a privacy impact assessment or do a legal review to “determine if the purchase of Americans’ travel data requires a warrant,” the letter says. ARC has been facing pressure from lawmakers since news of its data sales to government agencies was first revealed by 404 Media in September.
ARC advertises that its database allows government agencies to search for approximately 722 million ticket transactions for a 39 month-period of past and future travel. Any ticket bought from a travel agency, including popular websites like Kayak and Expedia, is catalogued by ARC.
The lawmakers highlighted that tickets purchased directly from airlines are not included in the ARC database. “Conveniently, direct sales of airplane tickets without a travel agent are also the most profitable for airlines,” the letter says.
ARC also allows government agencies to conduct what the lawmakers called “prospective surveillance” by allowing for automatic and recurring searches so that agencies “will be notified as soon as tickets matching certain criteria are booked,” the letter says. “Under federal law, the government must meet a higher bar to obtain approval for surveillance of activities in the future than surveillance of historical data and that is in the limited situations where Congress has even authorized prospective surveillance,” the letter says. “Unfortunately, that principle goes out the window when government agencies buy Americans’ data from shady data brokers like ARC.”
BTW - The FBI also buys data - teh Babel Street, which sells information on individuals’ whereabouts historically - Privacy oversight board finds FBI does not buy real-time location data | The Record from Recorded Future News
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5207428251321676122
[1] https://therecord.media/airline-data-broker-stop-selling-to-government/
Comments