I’m woefully behind on my blog reading these days, but apparently one topic the blogorati are up in arms about (judging from BoingBoing) is the fate of Chris Soghoian, a PhD student who put up a website that generates fake boarding passes and was later visited by the FBI. Soghoian’s defense is that he’s doing it to publicize a security loophole: "TSA/DHS cannot be expected to fix anything
unless they are publicly shamed into doing so," he wrote.
BoingBoingers and others seem to agree with the cocky Mr. Soghoian. Avi Rubin (a computer science prof in Soghoian’s department and electronic voting debunker) says: "Even if he has a legitimate point, it shows a real lapse in judgement."
You’re not allowed to break the law to prove a point. Counterfeiters can’t excuse themselves by saying they were only trying to help the government design less easily counterfeited money. Hackers can’t excuse themselves by saying they were only trying to expose vulnerabilities (well, maybe that worked in the early days, but no longer).
We all know that the TSA could do a better job with security, and that the FBI has better things to do than track down some geek who made a dumb mistake. So call your congressman or something.
Soghoian may be right that he’ll cause the government to finally do something about the boarding pass loophole. If this gets enough airplay, and you can count on the bloggers for that, Homeland Security will apply the same methodology that got us taking off our shoes and throwing out bottled water. They’ll come up with some ridiculously expensive anti-counterfeit RFID-chipped boarding passes and totally ignore the other holes in the system or more preventative law enforcement work.
BoingBoing has continuing, breathless coverage of all this: Boing Boing: Congressman on Boarding Pass Generator guy: Uh… oops? (includes links to previous stories).
You can also read Soghoian’s own play-by-play on his blog, slightparanoia.blogspot.com, where he’s asking for donations for his legal defense. In a recent post he writes "The legal advice I’ve gotten thus far has been to not talk to the press for now." Dude, I think that means don’t blog either.