TSA Under Congressional Investigation

The Traveler Verification Identity Program web site from the United States Transportation Security Association, TSA, seemed like a great idea. Because of the US No Fly List, over 100,000 reported air passengers have faced difficulty boarding planes solely because they had a name similar to one on the list. The Traveler Verification Identity Program was designed to replace the traditional complaint and preparation plan, where a passenger would have to call the TSA and request a form that could take weeks to send by mail. The web site allowed potential travelers to provide this information online without any wait.

However, even on first sight, the Traveler Verification Identity Program seemed questionable. The web site was filled with spelling and grammatical errors. It requested highly personal information without any sort of encryption to protect that information. Because of the security risk, passengers attempting to use a wireless Internet connection at an airport faced a significant risk of identity theft with their unprotected data available to anyone with a knowledge of hacking.

Now, the House Committee on Oversight and Government Reform is investigating the TSA's design mistakes to see if they compromised government security and privacy regulations.

The TSA has been given until March 9 to turn over documentation about the design of the site. The Traveler Verification Identity Program web site was not hosted under an official government domain. It was also registered not through a physical address but a P.O. Box. Everything seemed to be controlled by Internet design company Desyne, creating the impression that the site was not a true TSA project, but rather a so called "phishing" operation, where hackers set up fake, unsecured forms to steal personal information.