Schneier on Security

Change Your Name and Avoid the TSA Watchlist

Shhhh. Don't tell the terrorists:

The U.S. Department of Homeland Security wrote a letter to Labbé in 2004, saying he had been placed on their watch list after falling victim to identity theft. At the time, the department said there was no way for his name to be removed.

Although Labbé wrote letters to the U.S. department, his efforts were in vain, prompting him to legally change his name.

"So now, my official name is François Mario Labbé," he said.

"Then you have to change everything: driver's license, social insurance, medicare, credit card -- everything."

Although it's not a big change from Mario Labbé, he said it's been enough to foil the U.S. customs computers.

Tags: air travel, borders, DHS, homeland security, identity theft, no-fly list, security theater, terrorism, watch lists

Posted on September 15, 2008 at 1:25 PM • 30 Comments

Henning Makholm • September 15, 2008 1:43 PM

The plain English meaning of "theft" is that the victim no longer possesses what was stolen, but the thief does.

I've been wondering how "identity theft" fit with that. Now we know!

Foxdie • September 15, 2008 1:44 PM

Looks like Foxdie is coming...

Karl Lembke • September 15, 2008 1:49 PM

I'm sure the resemblance of François Mario Labbé's name to the author of "Diet for a Small Planet" is pure coincidence.

Optimist • September 15, 2008 1:51 PM

Maybe someone in the government remembered him, noticed that he changed his name, and figured:

1. It's the perfect way to tell between fake (potential terrorist) Labbe and real Labbe; and
2. Even though our software caught this, let's give the poor guy a break and put his new name on a whitelist.

You never know!

kaszeta • September 15, 2008 1:58 PM

I've been wondering if you could work this the opposite way, by changing your name to, say, Michael Chertoff or Edward "Kip" Hawley, and then get yourself *on* the no-fly list.

matt a • September 15, 2008 1:58 PM

What about identity thieves that steal identities then legal change those identities! Aha! And they change those names to other names they have already stolen (Jim Red becomes Mark Stone and Mark Stone becomes Jim Red)! Then they give the "new" id back to their "old" owners! That will mess with TSA's head...(its messing with mine, advil time...)...

kangaroo • September 15, 2008 2:00 PM

This is my favorite part:
Liberal Senator Colin Kenny says his son, a lawyer, has the same problem and that Transport Canada is powerless to help.
Officials at the agency said "'it's not my problem, go and talk to the Americans,'" Kenny told CBC News.

Isn't Kenny part of a sovereign government? Isn't there something they could do -- like refuse to cooperate with a system so completely broken? Or is he just a state senator for the 51st state?

Ian Woollard • September 15, 2008 2:20 PM

Somebody should change their name to 'George W. Bush' or the name of a top judge and then do something innocuous, but likely to get their name on the list, and something might actually get done about this stupid list!

Michael Ash • September 15, 2008 2:29 PM

@kangaroo

The problem occurs when trying to enter the US, so Canada being a sovereign government doesn't mean they can make the US stop being stupid to people who enter the US.

Davi Ottenheimer • September 15, 2008 2:33 PM

Wonder how many people would agree to change their name to Dick Cheney just to see how the system reacts?

Davi Ottenheimer • September 15, 2008 2:41 PM

As discussed in 2004, it is like someone thinks Kafka's "The Trial" is a playbook for American security policy rather than a fictional thriller:

www.schneier.com/blog/archives/2004/12/the_digital_per.html

"In the book, a vast faceless bureaucracy constructs a huge dossier about a person, who can’t find out what information exists about him in the dossier, why the information has been gathered, or what it will be used for."

The book's ending is not pretty.

kangaroo • September 15, 2008 2:41 PM

@Michael Ash:

Doesn't Canada forward data to the US on passengers flying into the US? Isn't that the backside of the system? Can't they play games on their cooperation with this system? Or add some bureaucratic foolishness that tends to inconvenience American flyers?

This is an old game. Even little countries know how to play this - but Canada seems to lack the chutzpah to do anything. Like I said, 51st state.

Anonymous • September 15, 2008 2:50 PM

Getting W or Dick Cheney on the list won't matter. Those guys never have to deal with the consequences.

Matt • September 15, 2008 3:02 PM

Also works, based on my own experience: Book a ticket using your middle name, middle initial, or full name: Jonny middlename smith.

Used to be I couldnt check in online etc etc, this method fixed that.

Mikey • September 15, 2008 3:08 PM

Wouldn't this be the easiest way to catch the ID thief? As soon as "Mario Labbé" flies, they know they have the fake Mario Labbé, and he can be arrested.

Macgyver • September 15, 2008 3:10 PM

$10 Bucks says he's back on the list now.

Mac

Anonymous • September 15, 2008 4:24 PM

So if Osama changed his name to for instance Osama Bush Laden he could just travel without hassle.

Since the info they can see include the previous names, also from other countries, do they simply ignore those fields? Too much vertical scrolling for TSA?

Herman • September 15, 2008 6:46 PM

It is probably a good time to get a brand new identity - go down to Texas and pretend to be a flood victim. Look dirty and bedraggled, splash some booze on your T-shirt and show up at a shelter, claiming that you had some menial job, lived in someone's garden shed and lost everything. Eventually, you should be able to get a new SIN and other papers. This should be a lot easier than trying to get a green card.

ann • September 15, 2008 10:42 PM

Part of the problem is that passenger info has to be turned over to US security if the flight passes through American airspace. About 3/4 of all Canadian flights do. So in the case the Senator's sons, they can't even fly within Canada.

charlie • September 15, 2008 10:50 PM

Sigh. Back when TSA was threatening to put anyone who showed up without ID onto the no-fly list late, you could have a lot of fun. Show up, claim to be a friendly rival -- and watch as your friendly rival spends the rest of his life trying to fly. hahahaha.

James • September 16, 2008 5:06 AM

This actually works: a colleague of mine from the US, has a rather common name, and apparently this name is on the list. He was stopped and checked at security checkpoints more frequently than statistically possible, when he had to fly for his work.
Someone suggested to add his middle initial to his name when making reservations and checking in... Bingo, no more checks for him since.

curtisk • September 16, 2008 8:40 AM

That hurts my head to think they don't parse the name fully and that a extra character or two (valid as it may be) can completely break it. Would the same work for someone named Joseph and uses Jos.?? Albert / Bert? Jr. Sr. III?

Anne O'Nimus • September 16, 2008 8:49 AM

Here's an idea. Execute a long string of name changes, accumulating valid IDs along the way. End with your original name, so you don't have to really change everything. Using the names of each of a bunch of famous people you hate, get on the list. Resume life as yourself. Hilarity ensues.

(Okay, okay, in most places it takes too long to change your name, for this to happen in a reasonable amount of time. Fine. I didn't say it was a GOOD idea....)

Dave Aronson • September 16, 2008 8:54 AM

@curtisk: Bingo. That's kinda the point of the whole ridicule we've been subjecting the No-Fly List to for, well, as long as it's been around. Between the ineffectiveness and the side-effects, the entire concept is just so incredibly stupid, as a security measure, that the only explanation that makes any sense at all, is that it's not really for the sake of security, but part of a process to desensitize people to a planned police-state. (No, I don't believe that myself -- government actions don't HAVE to make sense of any kind, and this is merely the latest example.)

ed • September 16, 2008 3:22 PM

@Dave Aronson

A more likely explanation is the list is purely a bureaucratic CYA. If they were to stop using the list and some terrorist (or even someone vaguely resembling a suspicious person, like the artist formerly known as Cat Stevens) actually DID get on an airplane under his/her own name, then the public outrage against the bureaucrats would mean Heads Would Roll. Since bureaucrats are quite aware of this, and since current public against the list is diffuse and not directed against any one in particular, the safest course of action (from a CYA viewpoint) is to leave the list in place, regardless of how stupid or ineffective it is demonstrated to be. In other words, no bureaucrat ever got fired for continuing a stupid but ineffective "security" policy, but some HAVE gotten fired for removing policies that bear some trappings of security.

Scientology+Anonymous=True • September 16, 2008 4:26 PM

I think this could open opportunities for a new recession-proof business.

Want to be able to fly without hassle? Buy yourself a new name!

We can change your name to Bruce Schneier for $500, Michael Jackson for $50, or Dick Cheney for $50000. Call now, operators are standing by!

Anonymous • September 16, 2008 10:13 PM

Those recommending someone change their name to "George Bush" or "Dick Cheney" should really consider whether those people are even going to fly regular airlines.

They'll take their private jets.

There is a vector of attack here, however, as I am willing to bet that not everyone in the higher ups of the US Gov't has their own private jet.

Hessel • September 17, 2008 6:11 AM

If this avoidance of the No Fly List is possible, then the whole No Fly List is more useless the it already was. If regular people can change their names, the "so called" terrorist suspects can also change their names and avoid the No Fly list.

godel_56 • September 21, 2008 5:09 PM

A quick search on Google shows there are a number of companies in different countries that will facilitate a change of name for a small fee, including providing customised forms for hundreds of companies and govt. organisations.

ike • September 22, 2008 2:05 AM

@Henning Makholm,

Identity infringement, then?