
Man Flies with Someone Else's Ticket and No Legal ID - drtse4
http://www.schneier.com/blog/archives/2011/07/man_flies_with.html
======
pg
30 years ago that headline would have been about as startling as "Man drinks
cup of coffee."

~~~
btilly
Most here are not old enough to remember this.

One way tickets cost as much as round trip tickets. So people would buy a
round trip ticket then sell the return ticket. This was standard practice And
they never used to ask for picture ID when you flew.

The requirement for picture ID was instituted on the behalf of airlines
seeking to end the practice. It wasn't about security. It was about money.

Incidentally there is no actual law requiring picture ID. Well, the FAA says
that it exists, but won't tell anyone what it is. (I wish I was making this
up.) This was the subject of a lawsuit that was lost in the 9th circuit and
not heard by the Supreme Court. See
<http://www.papersplease.org/gilmore/index.html> for more.

~~~
hammock
You can pass security and fly without a picture ID (You know this if you have
ever forgotten to bring your ID to the airport). They just make you do a
couple other things to identify yourself.

~~~
pavel_lishin
Like what?

~~~
keeganpoppen
I recently forgot my driver's license, and I showed them my student ID (which
did have my picture on it), and a couple of credit cards and I didn't even go
through extra security. The TSA website makes it clear that you can get
through security without a government-issued photo id (although they do
discourage it).

~~~
Lost_BiomedE
If you go to a state university, that is a legal state issued ID.

------
jgrahamc
I flew American Airlines coast-to-coast after 9/11 holding a boarding pass
with the name "Mary Cummings" on it. I was checked twice (at security and at
the gate) that my driver's license matched the boarding pass. During the
flight I alerted the flight attendant who found the lady who apparently had
boarded as me without difficulty.

------
juiceandjuice
I lost my ID on Friday right after I got off the plane (or still on the plane)
and now I have to get back to California today. After extensive research, I
found out you _can_ get through TSA without a proper ID in some cases. The TSA
website says they will try to verify your ID in other ways and issue enhanced
interrogation, and that you should have two other forms of ID (listed here:
<http://www.tsa.gov/travelers/customer/editorial_1029.shtm#1> ) I had my mom
overnight me my birth certificate, and I'm gonna use my credit card (and I
have two school IDs as well) so hopefully I don't TSA raped too hard on the
way in.

~~~
eru
Enhanced interrogation sounds painful.

~~~
pavel_lishin
Or fun, if you're into that sort of thing.

------
ibejoeb
Interesting about the downplaying of the ID authentication. I suddenly
realized what would make me happier with this whole security setup; one of
these two things:

1\. I would consent to their searches _if_ I did not have to identify myself
(and they made no attempt to identify me). This seems practical, as Schneier
suggests, because your identity doesn't really matter as long as you've been
screened.

2\. They adopt rigorous authentication procedures and authorize me to pass
without undressing, scanning, swiping, etc. My hunch is that this wouldn't be
too effective a preventive tactic, but what do I know...

I'm much more into (1), personally, but I'll take anything that makes travel
less cumbersome.

~~~
sbisker
I think (1) is already somewhat true, unless they changed a rule recently. I
flew in 2006 out of Boston Logan with a friend who had forgotten all of his
identification (save his boarding pass and maybe a college ID.) You can bet
they frisked him and patted him down to high heck, but he was still allowed on
his flight.

~~~
ams6110
Same report by a friend who flew with an expired driver's license (unrealized
until he got to the ID check). They did pull him aside for further questioning
and more thorough screening, but he was ultimately allowed to fly.

------
Shenglong
I've used my school ID to board planes on multiple occasions. It's easier than
pulling out a passport, and no one seems to really care. Actually, the only
time I even need to show ID at all is at the last step where I board the
plane... you can pick up a boarding pass by just answering some questions...
and in my experience, the TSA only really looks at your boarding pass.

I've also found that their security systems have problems with edge-detection.
I inadvertently brought a razor-sharp piece of metal in my carry-on with me
from Canada to the US once, and only realized it when I was unpacking. The
article is correct: mistakes happen all the time, but it's not a security
concern I'd worry about.

I'd more complain about the multiple times I get stopped by customs. US
Customs held me at DC for 3 hours because I had too many types of US stamps on
my passport. After waiting 3 hours and saying "I was a student", they let me
go.

~~~
goatforce5
> in my experience, the TSA only really looks at your boarding pass

I flew out of Boston Logan on Sunday. The TSA (?) guy just before X-Ray
machine and free groping took my passport and boarding pass, shining a little
black light Maglite at my first name on the boarding pass and passport, put a
check mark next to my first name on the boarding pass, and then proceeded to
do the same for my last name. Black light was also shined on the flight number
and a couple of other things, and each was check marked. He then turned to the
next blank page in my passport and had a good look at that with his black
light.

Probably took less than 30 seconds, but he was very thorough in making sure my
ID matched my boarding pass and neither had been tampered with.

------
ShabbyDoo
If we presume that the TSA wants to maximize actual passenger safety given
certain budgetary and passenger annoyance constraints, most of its policies
and procedures make little sense. When we add in the goal of making the public
perceive that it is increasing safety levels and the resulting "security
theater" tactics, they start to appear more rational. Does the general public
believe that terrorists can't acquire fake ids and print out boarding passes
to match? I suspect the majority of Americans don't think they are more secure
because of id checking. So, why does the TSA do it? Perhaps the airlines have
requested it as a way of circumventing ticket sharing, exchanges, etc.? Have
they enlisted the government as the enforcer of their price discrimination
model? When things don't make sense, I always presume there are some
facts/circumstances of which I am unaware.

~~~
tesseract
> Perhaps the airlines have requested it as a way of circumventing ticket
> sharing, exchanges, etc.? Have they enlisted the government as the enforcer
> of their price discrimination model?

I think you nailed it. Obviously not all of the TSA's actions can be explained
this way, but the insistence on ID that matches the boarding pass is so
beneficial to the airlines that it's hard to ignore the possibility of
'regulatory capture'.

------
ghouse
"Man Flies with Someone Else's Ticket and No Legal ID" yet the world remains
safe.

------
hzay
Off-topic but...

In India, if you look like an Indian, you can pay $20 and get a passport with
obviously-faked documents. You can get a driver's license for $5 without ever
driving anything.

If you are a woman, it's the simplest thing to take a small-sinister-object
past airport security. Buy a large book, cut a small-sinister-object-shaped
hole, put the thing inside and pretend to read the book while waiting for
security checks. You are asked to place the book on the table while they check
you. They don't look into the stuff you put on the table, unless it's a
wallet.

Sometimes I wonder if I miss it all.

~~~
pavel_lishin
Do they not have x-ray machines?

~~~
hzay
They use x-ray only on bags. They check you with a handheld metal detector.

~~~
pavel_lishin
They don't make you empty your pockets? Neat.

~~~
hzay
They do, if the metal detector beeps.

------
mdiep
Ha! Remarkable because I know Seun. He's not dangerous, but he does have a
thick Nigerian accent.

I can't help but wonder if his accent helped him get through security and on
the plane. It's hard to catch someone in a lie when you're struggling to
understand what he's saying.

------
peterwwillis
IDs are not that hard to fake really, once you know how to take them apart
without destroying them. What's always amazed me more, though, is how your
address is never actually physically verified. Ever.

I can order a copy of my drivers license and change the address to "1600
Pennsylvania Avenue, Washington, DC" and they'll ship it to me quick as can
be. If you happen to find somebody who looks a lot like you (or you can modify
your face to look like them) you can just get their social or drivers license
# and order a copy to a different mailing address. The original owner is never
notified.

If you want to just make yourself a brand new ID under someone else's identity
you can get a new driver's license under someone else's name. Bring two forms
of ID (a birth certificate which you can order with a SSN or a faked
certificate of US citizenship along with a faked insurance card), a faked
telephone or utility bill, and a proof of social security number (a faked
payroll statement and a faked insurance or IRS statement with name and SSN).
Then make an appointment at the DMV and get a fully valid new government ID
with your picture and someone else's name.

That's something a terrorist could do without much trouble once they had
someone to target. You don't even need Photoshop to fake those documents; just
a Kinkos, MS Word, Paint and some scissors. Just get the guy's name and SSN
(which thanks to LulzSec there are plenty of leaked to the internets) and go
to town. Should take about a week, maybe two if the fake birth certificate
takes a while to ship. You can also do without the birth certificate if you
just order a copy of the person's drivers license.

So yeah. The fact that the TSA doesn't check your ID past glancing at it and
putting a mark on your ticket isn't that scary to me, since anyone who really
wants to can get a valid ID which will pass all checks in a couple weeks.

~~~
pak
What state are you talking about? AFAIK when you say

>I can order a copy of my drivers license and change the address to "1600
Pennsylvania Avenue, Washington, DC" and they'll ship it to me quick as can
be.

some states (e.g. New Jersey) mark the new license as a duplicate copy, which
causes increased scrutiny by police officers and other ID checkers. And most
states do send _something_ to the old address, if only a simple notice stating
the change of address.

Likewise, USPS sends a notice to both addresses if you activate their mail
forwarding service, so you can't forward somebody's mail to your address and
reorder their license. (Unless they are on vacation...) All of that is mail
fraud which is a federal offense and probably a felony.

That all gets you a license with somebody else's picture, so you need to be a
very close match with them to be able to use it--LulzSec isn't dumping
pictures of their targets yet, so that means for a lot of facebooking.

As for a brand new ID, I wouldn't say it's impossible to jump through all the
hoops you have described in para 3, but you'd have to pick somebody that does
not already have an ID in the state you are getting a license from, and
somebody that you are sure will not be contactable as a result of all your
shenanigans (i.e. missing without a death certificate), or your fake license
is bound to be useful for only a short period until the IRS and credit
agencies catch up with the real person and that victim files a report of
identity theft, freezing/suspending it. The next time you get pulled over with
that license, it's lights out. Additionally, you can't just walk out the door
of a DMV with a new license, you have to wait for it to be shipped a real
address and if your forgeries are detected before then, police may be waiting
to see who picks it up. That risk probably serves as a sufficient deterrent,
no?

~~~
peterwwillis
Florida and D.C. I believe there is some tiny print indicating a dup, and
nobody ever looks at it in the real world.

Neither send notice after changing the address on the license. There's no USPS
address change required here, so no notification.

Honestly, it's not hard to find somebody with a beard with kinda-close skin
color, and go to a party store and buy some makeup. Again we're talking about
somebody who just wants a quick fake and not, say, a terrorist or drug dealer
who can pay for a really good counterfit.

Why would they not already have an ID? You just get a reissue, or yes, go to
the state next door and get a replacement (which may void out the other
state's ID, but maybe you don't care if they find out after? I dunno).

As long as you don't use the stolen identity for anything but travel I don't
see how anybody would find out.

Also, i'm preeeeeety sure they do make new IDs at the DMV so you don't have to
wait for it to be mailed. I think I got one handed to me, but that was a while
back. Anyway, just specify a different mailing address for them to mail it to
("i'm moving and i don't live there yet"). _edit_ And seeing as Arizona will
hand you one as below commenter says, i'm 85% sure Florida does too.

Every 3.8 seconds someone has his or her identity stolen. This indicates to me
that there is not enough deterrent. Perhaps there are even easier ways than
what I outlined but I am not a criminal so I have no idea.

------
heyrhett
I'm failing to see the security threat here.

------
espeed
I lost my wallet last time I flew out to the Bay Area, and I was able to fly
back with just my ticket -- you just have to go through an extra security
check where they pat you down and go through your carry on.

------
wisty
From CNNNN (Australian satirical news program): <http://youtu.be/W3grHjibNdA>

Watch what happens at the end (about 1:40), when they get tickets in the names
of "Terry Wrist" and "Al Kyder".

------
AlexC04
...but did anyone from the TSA gently cup his balls?

