Computer-Assisted Passenger Prescreening System

The Computer-Assisted Passenger Prescreening System (CAPPS) was a counter-terrorism system in place in the United States air travel industry that matches passenger information with other data sources. The United States Transportation Security Administration (TSA) maintains a watchlist, pursuant to 49 USC § 114 (h)(2),^[1] of "individuals known to pose, or suspected of posing, a risk of air piracy or terrorism or a threat to airline or passenger safety." The list is used to pre-emptively identify terrorists attempting to buy airline tickets or board aircraft traveling in the United States, and to mitigate perceived threats. These functions are now conducted through the Secure Flight program.

CAPPS systems rely on what is known as a passenger name record (PNR). When a person books a plane ticket, certain identifying information is collected by the airline: full name, date of birth, address, etc. This information is used to check against another data source (including the TSA No-Fly List, the FBI Ten Most Wanted Fugitive List, and other databases) and assign a terrorism "risk score" to that person. High risk scores require the airline to subject the person to extended baggage and/or personal screening, and to contact law enforcement, if necessary.

The Computer Assisted Passenger Prescreening System I (CAPPS I) was first implemented in the late 1990s, in response to the perceived threat of U.S. domestic and international terrorism. The U.S. government started to implement counter-terrorism measures after several bomb attacks occurred, including the 1995 Oklahoma City bombing, the 1996 Olympics bombing, and the 1998 bombings of two U.S. embassies in East Africa. CAPPS I was administered by the Federal Bureau of Investigation (FBI) and the Federal Aviation Administration (FAA). CAPPS screening selected passengers for additional screening of their checked baggage for explosives. CAPPS selectees did not undergo any additional screening at passenger security checkpoints.^[2]

On the morning of the September 11 attacks (9/11), several of the hijackers were selected by CAPPS. Wail al-Shehri and Satam al-Suqami were selected for extra screening of their checked bags before they boarded American Airlines Flight 11 at Logan International Airport in Boston, Massachusetts. Waleed al-Shehri was also selected, but since he had checked no bags, the CAPPS selection had no effect on him.^[2] Mohamed Atta was selected by CAPPS when he checked in at Portland International Jetport.^[3]

All five of the hijackers on American Airlines Flight 77 were CAPPS selectees, with Hani Hanjour, Khalid al-Mihdhar, and Majed Moqed chosen by the CAPPS criteria. Nawaf al-Hazmi and Salem al-Hazmi were selected because they did not provide adequate identification, and had their checked bags held until they boarded the aircraft.^[2]

Ahmed al-Haznawi was the only hijacker selected of those on United Airlines Flight 93, and none of the hijackers of United Airlines Flight 175 were selected by CAPPS.^[2]

In response to the 9/11 attacks, the U.S. government authorized the creation of the Transportation Security Administration (TSA) to oversee airport security, which was previously handled by private contractors. It was signed into law by President George W. Bush on November 19, 2001. The agency was initially placed under the United States Department of Transportation but was moved to the Department of Homeland Security when that department was formed on March 9, 2003. In November 2001, control of CAPPS was transferred to the TSA, where it has "... expanded almost daily as Intelligence Community (IC) agencies and the Office of Homeland Security continue to request the addition of individuals ..."^[4]

The Computer Assisted Passenger Prescreening System II (CAPPS II) was a proposal for a new CAPPS system, designed by the Office of National Risk Assessment (ONRA), a subsidiary office of the TSA, with the contracted assistance of Lockheed Martin. CAPPS II searched through information stored in government and commercial databases and assigned a color-coded level of risk to each passenger. U.S. Congress presented the TSA with a list of requirements for a successor to CAPPS I. Some of those requirements were:

• The government, not the airlines, would control and administer the system
• Every ticketed passenger would be screened, not just those who check bags
• Every airline and every airport would be covered by the system

Like its predecessor, the CAPPS II proposal would rely on the PNR to uniquely identify people attempting to board aircraft. It would expand the PNR field to include a few extra fields, like a full street address, date of birth, and a home telephone number. It would then cross-reference these fields with government records and private sector databases to ascertain the identity of the person, and then determine a number of details about that person. Law enforcement would be contacted in the event that the person was either present on a terrorist or most-wanted list or had outstanding federal or state arrest warrants for a violent crime.^[5]

Otherwise, the software would calculate a "risk score" and then print a code on the boarding pass indicating the appropriate "screening level" for that person: green (no threat) indicates no additional screening, yellow (unknown or possible threat) indicates additional screening, and red (high-risk) indicates prevention from boarding and deferral to law enforcement. Exactly how this risk score would be calculated was never disclosed nor subject to public oversight of any kind outside of the TSA.

CAPPS II grounded innocent Americans due to false positives. One notable example is the grounding of Senator Ted Kennedy in 2004.^[6]

The CAPPS II system was criticized in a report by the United States General Accounting Office in early 2004, and faced increased opposition from watchdog groups like the American Civil Liberties Union (ACLU),^[7] ReclaimDemocracy.org, Electronic Frontier Foundation, and the Electronic Privacy Information Center (EPIC). These advocacy groups expressed concern that the system violated people's privacy rights and that it was possibly unconstitutional. They also believed it could actually undermine safety, as terrorists could use it to their advantage.

CAPPS II was cancelled by the TSA in the summer of 2004 due to privacy concerns with the intent of creating a new system.^[5][8] Shortly thereafter, the TSA announced a successor program, called Secure Flight, that would work in a way similar to CAPPS II. TSA hoped to test Secure Flight in August 2005 using two airlines, but it was blocked by Congress until the government could prove that the system can pass 10 tests for accuracy and privacy protection as follows:

1. Redress process - A system of due process exists whereby aviation passengers determined to pose a threat are either delayed or prohibited from boarding their scheduled flights by TSA may appeal such decisions and correct erroneous information contained in CAPPS II or Secure Flight or other follow-on/successor programs.
2. Accuracy of databases and effectiveness of Secure Flight - The underlying error rate of the government and private databases that will be used to both establish identity and assign a risk level to a passenger will not produce a large number of false positives that will result in a significant number of passengers being treated mistakenly or security resources being diverted.
3. Stress testing - TSA has stress-tested and demonstrated the efficacy and accuracy of all search technologies in CAPPS II or Secure Flight or other follow-on/successor programs and has demonstrated that CAPPS II or Secure Flight or other follow-on/successor programs can make an accurate predictive assessment of those passengers who may constitute a threat to aviation.
4. Internal oversight - The Secretary of Homeland Security has established an internal oversight board to monitor the manner in which CAPPS II or Secure Flight or other follow-on/successor programs are being developed and prepared.
5. Operational safeguards - TSA has built in sufficient operational safeguards to reduce the opportunities for abuse.
6. Security measures - Substantial security measures are in place to protect CAPPS II or Secure Flight or other follow-on/successor programs from unauthorized access by hackers or other intruders.
7. Oversight of system use and operation - TSA has adopted policies establishing effective oversight of the use and operation of the system.
8. Privacy concerns - There are no specific privacy concerns with the technological architecture of the system.
9. Modifications with respect to intrastate travel to accommodate states with unique air transportation needs - TSA has, in accordance with the requirements of section 44903 (j)(2)(B) of title 49, United States Code, modified CAPPS II or Secure Flight or other follow-on/successor programs with respect to intrastate transportation to accommodate states with unique air transportation needs and passengers who might otherwise regularly trigger primary selectee status.
10. Life-cycle cost estimates and expenditure plans - Appropriate life-cycle cost estimates, and expenditure and program plans exist.

The Intelligence Reform and Terrorism Prevention Act (IRTPA) of 2004 required the Department of Homeland Security (DHS) to assume from aircraft operators the function of conducting pre-flight comparisons of airline passenger information to federal government watch lists for international and domestic flights. TSA published the Secure Flight Final Rule on October 28, 2008, which went into effect on December 29, 2008, creating the Secure Flight program.^[9][10]

• Terrorist Identities Datamart Environment
• Secondary Security Screening Selection
• No Fly List

• The Electronic Privacy Information Center (April 2003). Documents Show Errors in TSA's "No-Fly" Watchlist.
• TSA customer service
• DenverChannel.com, accessed 7-25-2006: article on SDR

• CAPPS II Section of HR 2115, the "Century of Aviation Reauthorization Act" Archived 2005-11-19 at the Wayback Machine The language of proposed legislation (aclu.org)
• The Transportation Security Administration, promoters of CAPPS II
• EFF Backgrounder on CAPPS II
• The Dangerous Illusion of CAPPS II A critical article exploring multiple concerns with CAPPS II (reclaimdemocracy.org)
• ACLU page on CAPPS II
• "Computer-Assisted Passenger Prescreening System Faces Significant Implementation Challenges" (pdf) summary of report on CAPPS II by the General Accounting Office
• blog providing regular updates on CAPPS II
• "In These Times" 2003 article on CAPPS II
• ACLU's page on CAPPS II
• EPIC's Page on Passenger Prescreening Programs
• EFF's Page on CAPPS II
• Senator Kennedy's grounding by CNN.com