Fake boarding passes can fool airport security

WASHINGTON — More than 11 years after the Sept. 11 terrorist attacks, it remains possible to use fake boarding passes to get through airport security checks, according to new evidence from security researchers and official documents.

The security vulnerabilities could allow terrorists or others on “no-fly” lists to pass through airport checkpoints with fraudulent passes and proceed through expedited screening. They could even allow them to board planes, security analysts warn.

The Washington Post was alerted to the vulnerabilities by concerned passengers and verified them through independent security experts. At the request of U.S. officials, The Post is withholding details that would make it easier for the vulnerabilities to be exploited.

The security gaps center on airline boarding passes, which can be issued up to 24 hours before a flight’s departure. According to security researchers, the bar codes on those passes can be manipulated with widely available technology to change the information they contain: passenger identification, flight data, and codes indicating whether a passenger has qualified for expedited screening.

Information about reading and altering boarding pass bar codes has circulated on online forums for several months, and has recently been picked up by security researchers. Many of them note that the potential for tampering with the passes has been exacerbated by the proliferation of smartphones that can read the bar codes and free software that can manipulate them.

Security guidelines set by the Transport Security Administration allow airlines to add an encrypted “digital signature” to prevent board passes from being altered. But some experts said they were surprised to learn that not all passes include authentication.

“It’s alarming – this basically negates the no-fly list,” said Chris Soghoian, a fellow at Indiana University’s Center for Applied Cybersecurity Research and principal technologist at the American Civil Liberties Union.

It remains difficult to establish the full extent of the vulnerabilities without information from the TSA, which does not comment on security procedures.

In response to written questions, John Pistole, the administrator of the TSA, said that the potential for tampering with printed boarding passes has existed since the inception of e-ticketing but that the agency has added protective measures “both seen and unseen.”

“We continue to explore and implement additional mitigation measures to prevent the manipulation of boarding passes and are working with the airlines to develop systems and methods to prevent illegal tampering,” Pistole said.

Under U.S. law, it is illegal to tamper with airline boarding passes. But security experts said individuals with limited technical expertise would be able to do so. At the very least, passengers would be able to modify their passes so they could proceed through the TSA’s “PreCheck” screening, a paid-for program in which passengers are allowed to keep laptop computers and approved containers of liquid in hand baggage. Security experts say it’s a program terrorists could possibly exploit.

The no-fly list was created after the Sept. 11, 2001, attacks, and includes the names of U.S. citizens and foreigners not permitted to fly into or out of the United States because of specific security concerns. The identity and exact number of people on the no-fly list is not public, but an FBI official told NPR last year that it includes about 10,000 people.

Thousands more are reported to be on a list requiring mandatory secondary screening, a requirement that would be noted on boarding passes for the affected passengers. Some passengers also receive these checks through random selection and other procedures.

One passenger who contacted The Post, Michael Williams, president of a small information technology firm, said his concern was that the security flaws could give someone on the no-fly list an opportunity to get onto a plane.

“Without forging any identification cards, someone on the no-fly list could easily use the current flaws to board an aircraft,” Williams said.

Williams said he has not attempted to tamper with boarding passes. A handful of others who contacted The Post after an earlier story on TSA security claimed they had tampered with their boarding passes and provided documentation as evidence. They spoke on the condition of anonymity.

Bruce Schneier, chief security technology officer at BT Managed Security Solutions and a long-term critic of U.S. aviation security, said the new evidence suggests it remains possible to evade the TSA’s security measures.

“The boarding pass checks have never been any good – they’ve always been fakeable,” he said. “You can fake a pass quite easily. In the past, I’ve done it. There’s software out there.”

Some security experts say the TSA could limit the potential for tampering with bar codes by requiring that all airlines include encrypted “digital signatures” on all boarding passes. Doing so would make it near impossible to tamper with the bar codes. Asked why only some boarding passes include such encryption, Pistole said the TSA “does not comment on specifics of the screening process and will always incorporate random and unpredictable security measures throughout the airport.”

Even if digital signatures were made mandatory, other security gaps remain, experts warn. Airlines cross-check passenger names against federal databases containing the names of passengers who are on the no-fly list or subject to additional screening. But the names are not cross-checked by TSA once passengers reach airport checkpoints with boarding passes in hand.

To do so, the TSA would need to have electronic scanners with networking capabilities to communicate with the federal databases. Technical documents issued by the agency confirm that its system does not have such capabilities and does not routinely check boarding passes against federal databases.

“The TSA has a real problem here,” said Matthew Green, assistant research professor at the Johns Hopkins Information Security Institute. “They need to convey information from a variety of airlines to a whole bunch of different scanners scattered throughout an airport, and they need to do it securely.”

Between January and August of this year, 375 million passengers passed through TSA security, a rate of 1.8 million passengers screened at U.S. airports each day.

Soghoian, the Indiana University fellow, said he is concerned that the system has not improved since 2006, when he sought to draw attention to airline security vulnerabilities by building a website that permitted travelers to produce fake boarding passes. The warnings from Soghoian and others led to changes in security rules, including the introduction of security features such as digital signatures.

Soghoian suggested it is the patchy implementation of new rules that has left the system vulnerable. He said he thinks the TSA could vastly improve the system by simply requiring digital signatures on boarding passes.

“This is not a technical problem,” he said. “This is a policy problem.”

Talk to us

> Give us your news tips.

> Send us a letter to the editor.

> More Herald contact information.

More in Local News

A firefighter stands in silence before a panel bearing the names of L. John Regelbrugge and Kris Regelbrugge during the ten-year remembrance of the Oso landslide on Friday, March 22, 2024, at the Oso Landslide Memorial in Oso, Washington. (Ryan Berry / The Herald)
‘Flood of emotions’ as Oso Landslide Memorial opens on 10th anniversary

Friends, family and first responders held a moment of silence at 10:37 a.m. at the new 2-acre memorial off Highway 530.

Julie Petersen poses for a photo with images of her sister Christina Jefferds and Jefferds’ grand daughter Sanoah Violet Huestis next to a memorial for Sanoah at her home on March 20, 2024 in Arlington, Washington. Peterson wears her sister’s favorite color and one of her bangles. (Annie Barker / The Herald)
‘It just all came down’: An oral history of the Oso mudslide

Ten years later, The Daily Herald spoke with dozens of people — first responders, family, survivors — touched by the deadliest slide in U.S. history.

Victims of the Oso mudslide on March 22, 2014. (Courtesy photos)
Remembering the 43 lives lost in the Oso mudslide

The slide wiped out a neighborhood along Highway 530 in 2014. “Even though you feel like you’re alone in your grief, you’re really not.”

Director Lucia Schmit, right, and Deputy Director Dara Salmon inside the Snohomish County Department of Emergency Management on Friday, March 8, 2024, in Everett, Washington. (Ryan Berry / The Herald)
How Oso slide changed local emergency response ‘on virtually every level’

“In a decade, we have just really, really advanced,” through hard-earned lessons applied to the pandemic, floods and opioids.

Ron and Gail Thompson at their home on Monday, March 4, 2024 in Oso, Washington. (Olivia Vanni / The Herald)
In shadow of scarred Oso hillside, mudslide’s wounds still feel fresh

Locals reflected on living with grief and finding meaning in the wake of a catastrophe “nothing like you can ever imagine” in 2014.

Everett mall renderings from Brixton Capital. (Photo provided by the City of Everett)
Topgolf at the Everett Mall? Mayor’s hint still unconfirmed

After Cassie Franklin’s annual address, rumors circled about what “top” entertainment tenant could be landing at Everett Mall.

Everett
Everett man sentenced to 3 years of probation for mutilating animals

In 2022, neighbors reported Blayne Perez, 35, was shooting and torturing wildlife in north Everett.

Dorothy Crossman rides up on her bike to turn in her ballot  on Tuesday, Aug. 1, 2023 in Everett, Washington. (Olivia Vanni / The Herald)
Everett leaders plan to ask voters for property tax increase

City officials will spend weeks hammering out details of a ballot measure, as Everett faces a $12.6 million deficit.

Starbucks employee Zach Gabelein outside of the Mill Creek location where he works on Friday, Feb. 23, 2024 in Mill Creek, Washington. (Olivia Vanni / The Herald)
Mill Creek Starbucks votes 21-1 to form union

“We obviously are kind of on the high of that win,” store bargaining delegate Zach Gabelein said.

Lynnwood police respond to a collision on highway 99 at 176 street SW. (Photo provided by Lynnwood Police)
Southbound lanes on Highway 99 reopen after crash

The crash, on Highway 99 at 176th Street SW, blocked traffic for over an hour. Traffic was diverted to 168th Street SW.

The view of Mountain Loop Mine out the window of a second floor classroom at Fairmount Elementary on Wednesday, Jan. 10, 2024 in Everett, Washington. (Olivia Vanni / The Herald)
County: Everett mining yard violated order to halt work next to school

At least 10 reports accused OMA Construction of violating a stop-work order next to Fairmount Elementary. A judge will hear the case.

Imagine Children's Museum's incoming CEO, Elizabeth "Elee" Wood. (Photo provided by Imagine Children's Museum)
Imagine Children’s Museum in Everett to welcome new CEO

Nancy Johnson, who has led Imagine Children’s Museum in Everett for 25 years, will retire in June.

Support local journalism

If you value local news, make a gift now to support the trusted journalism you get in The Daily Herald. Donations processed in this system are not tax deductible.