Christopher Soghoian, the 24 year old Indiana University Ph.D. student who created the now-shuttered Northwest Airline Boarding Pass Generator, has not been arrested as of Tuesday, though his university is reviewing whether the site is linked to his research at the Informatics department, according to the Indiana Daily Student.
Soghoian, who is no longer speaking to the press, is occassionally updating his blog and has established a legal fund. He would not say who is on his legal team, but told Wired News last week that one of the lawyers he was reaching out to Jennifer Granick, the director of Stanford's Center for Internet and Society. Granick, who represented Cisco security-hole whistleblower Michael
Lynn and who writes a bi-weekly column for Wired News, said she's unable to comment.
Soghoian hasn't completely lost his sense of humor and his IM status points to this page (not his), which lets anyone create a faux search warrant that looks like the one he found taped to his kitchen table Saturday when he returned home to find that the FBI had raided his house and removed his computer equipment just hours after he had met with agents voluntarily Friday night.
Speculation on what will and won't happen next, after the jump.
BoingBoing's Xeni Jardin, who also has been all over this story, filed this piece for NPR today.
What's likely to happen now?
Here's my speculation (and keep in mind I am not a lawyer):
The FBI will scour Soghoian's computer to find any proof that he actually used one of these boarding passes to enter a security line, something that Soghoian told me he had never done -- though he was interested in doing so once he got legal advice on its legality. If the FBI can find this, they have a rather open-and-shut fraud case.
But, if there's no such proof, then it will be up to the feds and the U.S. Attorney to decide whether to go after him on charges of helping others provide false identification to federal officials. That's a tougher case to make and may involve proving intent. My guess is that this is unlikely to happen, though Soghoian probably won't get back his computers for a good long while.
The government has largely made its point about creating a tool to exploit a known security hole. While I know there's code floating around on the internet that would let anyone with access to a server to set up a replica of the boarding pass generator, so far as I know, no one has. That said, any real would-be airline hijacker or bomber whose name was actually on the no-fly list could still get either a fake I.D. or use PhotoShop or a browser to get around the no-fly check.
The TSA could order airlines to stop allowing boarding passes to be printed out remotely, but this only narrows, and doesn't close the loophole that Soghoian was pointing to. In doing so, they'd also be admitting it took them years to deal with this hole and pissing off travelers. I don't think this will happen. TSA also has a point that airline security is made of layers, that include the no-fly list, the boarding pass check, magnetometers, random screenings, armed pilots, air marshals and reinforced cockpit doors.
What also won't happen? Well, screening of passengers at the gate (which eliminates Soghoian's hole) rather than at the entrance of to the terminals won't happen since it's too expensive to change.
We won't see Congress rethinking whether government watch lists actually do any good for domestic travel, as compared to their use in deciding who can and cannot enter the country or get a visa. No Congress Critter is going to vote for something that will later be characterized in a campaign ad as a vote to let Osama Bin Laden fly on a plane, even if that means members of Congress will continue to get snagged by the lists.
Previous Coverage:
- Congressman revokes call for imprisonment
- Soghoian's house raided
- Site shuttered by feds
- Soghoian not arrested in talk with feds
- Soghoian Comes Under Fire (full Wired News story)
- Interview with Soghoian
- First mention of boarding pass generator
Photo: Debaird
