Major airlines may have been secretly selling your flight data to DHS, report claims

Independent

a day ago

Americans' flight data may have been sold to Customs and Border Protection (CBP) without their knowledge, internal CBP documents obtained by 404 Media suggest.
A data broker, the Airlines Reporting Corporation (ARC), owned by several of the top airlines in the U.S., including Delta, American Airlines, and United, reportedly gathered the flight records of U.S. travelers and sold access to CBP.
Part of the contract was that CBP wasn't allowed to share where the data had originated from, the report says. The data included passengers' names, itineraries, and financial information, according to Wired.
CBP is part of the Department of Homeland Security. The agency has stated that it requires the data to support state and local law enforcement in tracking individuals of interest.
This comes after Immigration and Customs Enforcement (ICE) outlined how it also bought the data.
'The big airlines—through a shady data broker that they own called ARC—are selling the government bulk access to Americans' sensitive information, revealing where they fly and the credit card they used,' Democratic Sen. Ron Wyden said in a statement. "ARC has refused to answer oversight questions from Congress, so I have already contacted the major airlines that own ARC—like Delta, American Airlines, and United—to find out why they gave the green light to sell their customers' data to the government."
Publicly shared documents show that ARC is owned and operated by at least eight top U.S. airlines.
Delta, Southwest, United, American Airlines, Alaska Airlines, JetBlue, as well as European airlines Lufthansa and Air France, in addition to Air Canada, all have representatives on the company's board of directors.
Over 240 airlines use ARC's services for ticket settlement. The company also connects airlines and travel agencies, locating travel trends with other companies such as Expedia. It also provides fraud prevention, the ARC YouTube channel and website show.
The selling of travel information is conducted via the company's Travel Intelligence Program (TIP).
The documents obtained by 404 Media via a Freedom of Information Act request state that CBP needed access to the information 'to support federal, state, and local law enforcement agencies to identify persons of interest's US domestic air travel ticketing information.'
The documents reveal that ARC asked CBP to 'not publicly identify vendor, or its employees, individually or collectively, as the source of the Reports unless the Customer is compelled to do so by a valid court order or subpoena and gives ARC immediate notice of same.'
The data delivers 'visibility on a subject's or person of interest's domestic air travel ticketing information as well as tickets acquired through travel agencies in the U.S. and its territories,' the documents state.
According to a DHS Privacy Impact Assessment, the data is updated daily and includes more than a billion records over the course of 39 months of travel, both past and future. TIP can be searched using names, credit cards, or airlines. However, the data only includes travel arrangements made using a travel agency accredited by ARC, such as Expedia.
'If the passenger buys a ticket directly from the airline, then the search done by ICE will not show up in an ARC report,' the assessment states. It also says that data is included on both U.S. and non-U.S. persons.
The deputy director of the Center for Democracy & Technology's Security and Surveillance Project, Jake Laperruque, told 404 Media that 'While obtaining domestic airline data—like many other transaction and purchase records—generally doesn't require a warrant, they're still supposed to go through a legal process that ensures independent oversight and limits data collection to records that will support an investigation.'
'The government seems intent on using data brokers to buy their way around important guardrails and limits,' he added.
A spokesperson for CBP told Wired that the agency 'is committed to protecting individuals' privacy during the execution of its mission to protect the American people, safeguard our borders, and enhance the nation's economic prosperity.'
'CBP follows a robust privacy policy as we protect the homeland through the air, land and maritime environments against illegal entry, illicit activity or other threats to national sovereignty and economic security,' the spokesperson added.
ARC earlier told The Lever that TIP 'was established after the September 11 terrorist attacks to provide certain data to law enforcement … for the purpose of national security matters' and criminal probes.