[ISN] Fly At Your Own Risk: A Hole In Airport Security

From: InfoSec News (alerts@private)
Date: Mon Feb 05 2007 - 23:21:08 PST


http://cbs2chicago.com/local/local_story_036223611.html

By Dave Savini
Feb 5, 2007

(CBS) CHICAGO -- An airport worker, carrying a bag with a hidden camera, 
easily gets into OHare International Airport, onto the tarmac near 
airplanes and luggage without being screened by security.

The video, recorded by 2 Investigators, exposes a side employee gate 
that lacks metal detectors, bag inspections and employee searches. It 
shows how easy it can be to access sensitive security areas.

To gain this access, there is one thing needed an aviation security 
badge. Badges are worn by law enforcement officials, baggage handlers, 
pilots, flight attendants and independent contractors.

CBS 2 found thousands of these badges are missing. Even worse, it could 
take weeks or months before the badges are electronically turned off. 
Until then, these badges can be used to get through the unsecured back 
employee gate.

In a hidden camera report, 2 Investigator Dave Savini reports how poor 
tracking of these badges can mean passengers fly at their own risk.

The situation is prompting criticism.

We need to screen all the workers, said Charles Slepian, an aviation 
security expert. You need to check what theyre carrying into the 
workplace. If you have access to an airliner, for instance, you may put 
on-board a weapon or an explosive device.

CBS 2 obtained a database, from Chicagos Department of Aviation. It 
reveals, since 2004, there have been 3,760 missing badges.

These were not returned by employees who quit, were reassigned or fired 
including Illinois State Police officers, FBI agents, federal air 
marshals, U.S. Customs agents and workers at the agency responsible for 
the badges Chicagos Department of Aviation. Most of the missing badges 
were issued to the airlines or private contractors.

It should be a matter of law. If you keep your badge after you have been 
terminated it should be a criminal act, said Slepian, who works as a 
consultant on airport security matters. I guess the bottom line is, the 
badge, in and of itself, doesnt provide a heck of a lot of security.


Discarded records

CBS 2 first learned these types of badges were missing from confidential 
records thrown into a garbage bin by an airport contractor. Scrub Inc., 
of Chicago, provides cleaning crews for airplanes and terminals.

Inside its dumpsters, sensitive employee information was found, and it 
wasnt shredded. The discarded documents included FBI fingerprint and 
signed badge application forms, employees Social Security numbers, badge 
numbers, phone numbers, home addresses, copies of birth certificates and 
state identification cards.

We cant confirm that there has been, or will be, any internal 
investigation into these issues and any amendments to our ID badging 
policies and procedures, said Wendy Abrams of the Chicago Department of 
Aviation.

The U.S. Transportation Security Administration, the agency responsible 
for airport security, is now investigating these findings.

First of all we take that very, very seriously because we work closely 
with airports across the country, said Earl Morris, the agencys deputy 
assistant administrator with the office of security operations in 
Washington D.C.

We will work with the airport to fix the problem. Morris said. It is not 
something we condone or think is acceptable. It is totally unacceptable. 
I cant reiterate strong enough that is totally unacceptable.


Gaping hole in security

Its a life or death issue, thats how important it is, said Slepian, who 
believes the CBS 2 investigation has exposed a gaping hole in airport 
security.

Once you have access to a secure area, you can grant others access to 
that area. You can have access to doors, you can open doors, you can 
move around the back part of the terminal where we dont want to you be, 
Slepian said.

Transportation Security Administration officials say they also are 
concerned about security-sensitive information not being shredded.

Agency officials confirmed they do surprise random inspections of 
workers entering the side employee entrance. However, they wouldnt know 
if someone gained illegal access using a badge thats supposed to be 
terminated, unless it was immediately reported missing.


Naperville connection

Thats inexcusable. Theres no way we can excuse that kind of incompetence 
and its a lack of concern for the public, says Ginny Lacy of Naperville 
who lost her brother Robert Cruikshank during the Sept. 11, 2001 
attacks.

Lacy had hoped air travel had become safer but was disappointed to hear 
about the lack of security at the employee gate and about contractors 
tossing out critical employee information.

Our citizens died on 9/11, and they are going to die again if we dont 
correct this, she said.

Another airport cleaning contractor, Prospect Airport Services in Des 
Plaines, also failed to shred sensitive employee files.

There are security issues. Its not OK, its not acceptable, said Vicki 
Strobel, Prospects president.

She says she couldnt believe someone in her company just threw away 
confidential information regarding airport workers without shredding it. 
Now that youve shown it to me, it will be taken care of. Again, Im 
totally shocked.


Unaccounted badges

Strobel says if an employee fails to return a badge, the company holds 
that persons last paycheck. She said the Department of Aviation is then 
contacted so the badge can be deactivated.

Using Scrub Inc.s records, CBS 2 tracked down some former employees. One 
is Obang Omat from Sudan. He says he quit in September, but the 
Department of Aviations database shows his badge was still active until 
Nov. 14.

I sent the badge and my uniform back to the company in the mail after 
Sept. 22, Omot said. Thats when I quit and moved to Minneapolis.

Omot has two aliases associated with his criminal record in Cook County 
and, since 2001, he has been arrested seven times for crimes including 
aggravated assault with a deadly weapon and for exposing himself. He was 
convicted on charges of resisting arrest and reckless conduct. His badge 
is still listed as missing.

OK, I will have to look into it, says Mark Rathke, a spokesperson for 
Scrub Inc.

Rathke wouldnt answer specific questions about Omot or the 148 missing 
badges the company is listed as not having turned over in the department 
of aviation database. It is Scrub Inc.s position that we cannot discuss 
any security matters related to OHare International airport.

?We like to feel like we are safe here, said Napervilles Lacy, who hopes 
changes are made immediately. And we are assured by the government we 
would be safe and we spent billions and billions, but we are not safe.

CBS 2's Michele Youngerman contributed to this report.

(Copyright MMVII, CBS Broadcasting Inc. All Rights Reserved.)


______________________________________
Subscribe to the InfoSec News RSS Feed
http://www.infosecnews.org/isn.rss



This archive was generated by hypermail 2.1.3 : Mon Feb 05 2007 - 23:43:12 PST