While there’s scrutiny over who can and can’t enter the country on a plane, there’s no official method that federal law enforcement can use to track passengers on domestic flights. However, an investigation revealed that the country’s major airlines sold the flight records of domestic travelers to Customs and Border Protection (CBP) for only $11,025 on the grounds that the agency doesn’t reveal where this data came from. One would assume that this massive breach of public privacy would be worth more than five figures.
The bulk data sale was conducted by the Airlines Reporting Corporation (ARC), a broker owned and operated by American, Delta, United, Southwest, Alaska, JetBlue and Air Canada. Typically, ARC is an intermediary between airlines and travel agencies, allowing third-party airline ticket resellers to operate and offering valuable market data to carriers.
The product sold to the government was much more ominous than travel trends. CBP purchased access to the Travel Intelligence Program in a $11,025 transaction, according to a contract obtained by 404 Media. The agency claims it needs the data “to support federal, state, and local law enforcement agencies to identify persons of interest’s U.S. domestic air travel ticketing information.” However, the Department of Homeland Security now has access to a constantly updating database with over a billion records covering 39 months of travel, searchable by name, credit card, or airline.
The Feds don’t need a warrant to access the TIP database
The data offered by the TIP isn’t protected in any meaningful way. Despite the claims that it will be used to track persons of interest, CBP and other federal agencies don’t need a warrant to search for someone in TIP’s database, and there is no independent oversight into how this access is used. The database’s only blind spots are tickets sold directly by airlines. The database only contained sales made by third-party agencies, like Expedia. While this is ostensibly being done to safeguard national security, it seems like ARC isn’t particularly proud of it. One crucial clause in the contract reads:
“not publicly identify vendor, or its employees, individually or collectively, as the source of the Reports unless the Customer is compelled to do so by a valid court order or subpoena and gives ARC immediate notice of same.”
It seems like a morally dubious loophole for law enforcement agencies to simply purchase information that’s typically only accessible through court orders. This isn’t the first time corporations have been caught selling personal data for next to nothing. Last year, two U.S. Senators blasted General Motors, Hyundai and Honda for selling driving data from millions of vehicles to insurance companies. The automakers were hauking the data for as little as 26 cents per car. In today’s digital age, your privacy has become a commodity available to the highest bidder, no matter their intention.
