Long before JetBlue was sued this week for giving a military contractor computer data on a million passengers, NASA quietly sought upward of 15 million passenger records from Northwest Airlines for similar computerized security research.
Neither the airline — the world’s fourth-largest — nor the National Aeronautics and Space Administration would say yesterday whether the data actually were handed over in response to a letter NASA sent to Northwest’s security manager, Jay Dombrowski, at his suggestion during a Minneapolis meeting.
“We would like to request systemwide Northwest Airlines’ passenger data from July, August and September 2001,” said the letter signed by Thomas A. Edwards, chief of NASA’s Aviation Systems Division at NASA Ames Research Center, Moffett Field, Calif.
Northwest spokesman Kurt Ebenhoch said he did not know if his airline turned over the “PNR data” (passenger-name records), as the government asked.
“We are not able to comment due to security regulations. We would urge you to contact NASA or the Department of Defense,” said Mr. Ebenhoch, without explaining why the Pentagon would be involved.
Mr. Edwards of NASA initially told The Washington Times yesterday no “specific request” was made.
However, after hearing passages from his letter to Mr. Dombrowski with a request so detailed that it specified quick delivery either on CD-ROM or computer tape compatible with any one of three storage tech drives, Mr. Edwards referred a reporter to NASA spokesman Jonas Dino.
Mr. Dino said he would seek information on the project, but did not call again.
Both JetBlue and Defense Department contractor Torch Concepts emphasized this week that no government official had access to “identifiable customer data” in its PNRs, and said the material was destroyed when its existence was publicized.
“In hindsight, we realize that we made a mistake,” JetBlue CEO David Neeleman said Tuesday. At least three class-action lawsuits were filed against JetBlue this week, a response that cast NASA’s request to Northwest in a new light.
PNRs are for specific reservations generally stored in one of four commercial reservations systems. They include identifiers that allow linkage with unrelated travel records for the same person. Each PNR includes a passenger’s name, phone number, ticketing date and flight number. Optional PNR data includes address, form of payment, frequent-flyer numbers, hotel and rental car data, internal airline messages and information on minors traveling alone.
In addition to comparing the data with government no-fly lists, commercial software can use PNR data to detect double-booking and fictitious names.
Mr. Edwards’ request letter, and a separate e-mail from a NASA research director seeking information on Northwest’s security training, made clear the material would be used for upgrading computerized airline passenger screening in the wake of the September 11, 2001, attacks when 19 Islamic terrorists hijacked four airliners.
That research involved the forthcoming successor to the Computer-Aided Passenger Pre-Screening (CAPPS) system. CAPPS II is to include passengers’ birth dates, and its broader scope has been widely criticized as overly intrusive.
Patricia M. Jones, deputy division chief of NASA’s Human Factors Research and Technology, dispatched the e-mail requesting training and user manuals in preparation for later contacts with Northwest personnel in San Francisco.
Both documents were among two dozen pages obtained in a Freedom of Information Act request by the Electronic Privacy Information Center. The Times reported briefly on the PNR request in an August 2002 article devoted largely to the Northwest-NASA meeting that dealt with futuristic security research, including proposals to electronically analyze brain waves of airport travelers.
David Sobel of the Electronic Privacy Information Center said yesterday that EPIC would follow up to learn the fate of Northwest’s dealings with NASA. He said the revelation that both Northwest and JetBlue were involved in such research indicated the practice was much wider than he had feared.
“There is now a general concern that this kind of under-the-table request for sensitive personal information has been commonplace,” Mr. Sobel said. “The reaction to the JetBlue revelation shows the public is deeply concerned about the government receiving detailed information about their travel habits.”
He said the government has not properly justified its need for such data, and has not pursued it openly with advance notice to travelers.
“It can’t be done under the table. That’s what happened with JetBlue, and if a transfer occurred at Northwest, that’s what happened here. Seeking the information without putting the public on notice is certainly a problem,” he said.
Mr. Edwards was among a handful of NASA officials at that Minneapolis meeting Dec. 10-11, 2001.
“We did discuss whether passenger information would be of use in doing research. We didn’t get to the point of making a specific request. It was really just talking about airline security,” he said yesterday.
The letter faxed to Mr. Dombrowski 10 days after the meeting recalled NASA’s “need for three months’ of Northwest Airlines passenger data (your PNR data)” and expressed urgency in receiving it. The airline reported carrying 54.1 million passengers in 2001 and because of September 11 the third quarter of that year included both the high and low points of air travel.
“At that time you suggested a letter be sent from NASA Ames to Northwest Airlines requesting this data. … We would like to begin to use this data as soon as possible, since we [are] planning on having a demonstration of our technology in this area near the end of January,” Mr. Edwards told Northwest.