[Infowarrior] - 'Clear' traveller laptop found .. in the same office

[Richard Forno]

Lost laptop found in SFO office

Deborah Gage, Chronicle Staff Writer

Wednesday, August 6, 2008

http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/08/05/BU2V125HTF.DTL&tsp=1

(08-05) 15:37 PDT SAN FRANCISCO INTERNATIONAL AIRPORT -- A laptop  
containing personal information on 33,000 travelers enrolled in a fast  
pass program at San Francisco International Airport turned up Tuesday  
in the same airport office from which it had been reported missing  
more than a week ago.

Still, the Transportation Security Administration has halted signups  
for the program, called Clear, while the incident is investigated.  
Travelers already enrolled in the program are not affected by the  
suspension.

The machine belongs to Verified Identity Pass, which has a contract  
with the TSA to run Clear, a service that speeds registered travelers  
through airport security lines. Verified Identity operates the program  
at about 20 airports nationwide.

The laptop was reported missing to airport police and the San Mateo  
County Sheriff's Office on July 26 and to the TSA on July 28,  
according to Allison Beer, senior vice president for corporate  
development of Clear.

A preliminary investigation shows that the information was not  
compromised, she said.

The computer held names, addresses and birthdates for people applying  
to the program, as well as driver's license, passport and green card  
information. But, she said, the computer contained no Social Security  
numbers, credit card numbers, fingerprints, facial images or other  
biometric information.

"Yes, it was sensitive privacy information, but not the stuff that was  
most sensitive," she said.

According to Beer, someone downloaded the information from a company  
server onto the laptop, which was part of a kiosk that was taken to  
companies and downtown locations and used to enroll travelers in the  
Clear program.

The information was encrypted on the server, but not on the laptop,  
although it should have been, Beer said. However, it was protected by  
two levels of passwords.

The laptop was found Tuesday in the same airport office, but not in  
the same location from which it had been discovered missing, according  
to the sheriff's office, which is helping with the investigation.

Beer said the airport office is always locked, so if the laptop was  
removed, someone would have needed a key to return it.

Travelers in the Clear program pay to have the TSA verify their  
identities. In return, they receive a card that gives them access to  
special security lanes in airports so they can avoid standing in line  
to go through security.

Verified Identity was approved by the TSA in January 2007 as a  
Registered Traveler service provider and charges $128 a year for Clear.

The TSA said in a statement that Verified Identity was out of  
compliance with the administration's procedures because the  
information on the laptop was not properly encrypted. Now the company  
must undergo a third-party audit before Clear can resume, the TSA said.

Beer said Clear expected to resume "in a matter of days." She said  
software on all laptops at all airports associated with the program is  
being encrypted and that affected travelers are being notified.

"We take this very seriously," she said.

E-mail Deborah Gage at dgage at sfchronicle.com.