Student creates Web site that automates fake boarding passes

MINNEAPOLIS — A computer-security student says terrorists would have no trouble getting around the government's no-fly list, and to prove it he set up a Web site that prints fake boarding passes.

The passenger name on the fake boarding pass is "Bin Laden/Osama," although travelers can put in their own name — or a fake one — and change the flight information.

Christopher Soghoian, 24, a doctoral student at Indiana University, said he set up the site to prove the Transportation Security Administration (TSA) isn't taking airline security seriously.

Others have pointed out before that savvy computer users could modify an airline Web page to print fake boarding passes, but Soghoian took it a step further and automated it.

"Before, any 12-year-old could have done it," Soghoian said Friday. "Now any 30- or 40-year-old could do it as well."

Soghoian said terrorists on the no-fly list could use a fake boarding pass to avoid the no-fly list because IDs are only checked when the passenger passes through TSA screening.

So someone could use a fake boarding pass with an ID that matches and get through the screening.

They'd then need a real boarding pass — presumably bought under a fake name — to get on the plane.

TSA spokesman Christopher White said other security measures are in place, including metal detectors, even if someone boards under a fake name. He condemned the Web site.

"The Web site really has the potential to promote illegal activity," he said. "Showing fraudulent documents to get through security is against the law."

Soghoian said he built his Web site to mimic Northwest Airlines boarding passes because he had one handy after flying Northwest earlier this week. He said he has nothing against the airline.

Soghoian said the fake boarding pass couldn't get anyone onto a flight — as long as the airline's computers were working — because the bar code wouldn't match the other information on the pass.

Northwest spokesman Roman Blahoski said the airline immediately notifies the TSA and law-enforcement agencies if it discovers a fraudulent boarding pass.

Soghoian said taking nail clippers and liquids away from travelers is giving them a false sense of security, and he's trying to show where the real threats are.

"When they say 'For security reasons,' everyone shuts up, everyone follows the rules and no one questions authority. And I don't think that's right," he said.

He said no one from the government had complained to him about the site, yet.

"If I get a letter from the government telling me to take it down, then I'll take it down straightaway," Soghoian said.

Attempts to access the site late Friday were unsuccessful.