Flaw in boarding pass check system puts fliers in danger

Everybody knows by now that airline boarding passes have barcodes that, when decoded, show a series of letters and numbers that “summarize” the main information about one’s flight – name, flight number, seat assignment, the codes for the airports from which the flight departs and lands, and so on.

But what you might not know is that it also includes a code that tells the U.S. Transportation Security Administration (TSA) officers whether you are eligible for TSA’s Precheck Program, and could consequently pass through the security check after receiving the expedited screening treatment (shoes, light outerwear and belts can be left on, and laptops and compliant liquids in carry-on bags don’t have to be taken out of it for scanning).

This would not be a problem were it not for the fact that this information isn’t encrypted.

“What terrorists or really anyone can do is use a website to decode the barcode and get the flight information, put it into a text file, change the 1 to a 3, then use another website to re-encode it into a barcode. Finally, using a commercial photo-editing program or any program that can edit graphics replace the barcode in their boarding pass with the new one they created,” says John Butler, the aviation blogger who discovered the flaw.

“Even more scary is that people can do this to change names. So if they have a fake ID they can use this method to make a valid boarding pass that matches their fake ID. The really scary part is this will get past both the TSA document checker, because the scanners the TSA use are just barcode decoders, they don’t check against the real time information. So the TSA document checker will not pick up on the alterations.”

Luckily, the problem is easily solved by using encryption or by connecting TSA scanners to the airline database and check the boarding pass against the one recorded with the airline – or both.

The TSA has yet to comment on Butler’s discovery, but I suspect they will initially respond with the quote that it is included in the Precheck Program’s webpage: “TSA will always incorporate random and unpredictable security measures throughout the airport and no individual will be guaranteed expedited screening.”