Portrait of A Young Airport Security Hacker

Christopher Soghoian, the graduate student behind the Northwest Airlines Boarding Pass Generator, has been testing the Transportation Security Agency's airline security rules since June, when he was inspired by hearing John Gilmore challenge a government privacy advisory panel to attempt to fly home without identification (Wired News story on the one member who did here.)

Since then he's flown without showing identification four times and, as he's blogged, learned that it's much easier to say "I don't have my I.D." than "I'm asserting my rights as defined by the Ninth Circuit Court of Appeals to fly without showing identification."

Now with his generator, Soghoian hopes to get the attention of Congress:

I want Congress to see how stupid the TSA's watch lists are. Now even the most technically incompetent user can click and generate a boarding pass. By doing this, I'm hoping [Congress] will see how silly the security rules are. I don't want bad guys to board airplanes but I don't think the system we have right now works and I think it is giving us a false sense of security.

Even without his generator, the government's watch lists are useless, according to Soghoian.

If you can purchase a ticket over the internet with a pre-paid debit card and can fly without I.D., then for domestic flights the No-Fly list doesn't work.

More, including the hilarious explanation of the photo and Soghoian's plans for the liquid ban, can be found after the jump.

Soghoian, like any security researcher, wants to see how well his hack works and considers it to be legitimate research -- even a public service.

But he is waiting for clearance from lawyers at Indiana University and the Identity Project, a partnership between John Gilmore and the First Amendment Project. The lawyers are concerned about the legalities of showing fake documents to government employees. Soghoian, whose family lives overseas, worries that he could end up on the No Fly list, or worse, be sent to Guantanamo Bay with no recourse to habeas corpus for providing material support to terrorists.

I
think the airport security needs to be tested. In the computer security world, you have black hats and grey hats and white hats probing defenses. Terrorists shouldn't be the only one testing it but it's legally dubious whether you can test it.

He isn't content to stop just with boarding passes.

He's also been testing the liquid ban -- first by bringing KY lube through the airport when only medicines were allowed through -- and now is considering printing his own labels so he can label a 10 oz. bottle of liquid as a 3 oz. bottle of liquid, since TSA screeners won't let a bottle of liquid through security if the container can hold more than 3 ounces, even if the bottle is a 4 ounce bottle that is only half full.

It's all part of Soghoian's disdain for what he considers non-sensical rules.

"You can take 5 bottles that are 3 ounces each, so why not one 15 ounce bottle?" Soghoian asks.

Photo: Christopher Soghoian (Pictured -- Soghoian showing off a pocket knife he took on a flight in India after surrendering it at security and then having an airline employee sneak it back to him.)