Sometime this past spring, I accepted an invitation through my Marriott membership for a free, one-year membership to Clear, a company offering pre-authorized airport security. After a lengthy internal debate about whether I wanted to be in their system, I decided, what the hell, and filled out an online application. I knew I wouldn’t be traveling more than once or twice over the year, but wanted to experience “fly[ing] through airport security" before my privileges expired.
There are a handful of airports currently operational (my home port, Boston, is not among them), and in order to activate the account, I have to present myself at one of the participating airports to supply my biometrics—consisting of fingerprints and an iris scan. Denver is one of the airports in which Clear is up and running, and since I’m signed up to volunteer at the Democratic convention, I thought I’d complete the process in August.
Last Wed, August 7th, I received an email from Clear. I assumed it was going to be information about my enrollment: there were more airports online where I could report to complete the process; or they’d decided I wasn’t qualified to be among the elite to whom they cater; or too much time had passed between my internet application and showing up at the airport. I don't have a good enough imagination to have come up with the actual reason for their email.
This, from a company dedicated to helping keep our airports secure:
From: Clearsupport@flyclear.com
Subject: Information About Your Clear Enrollment
Date: August 6, 2008 4:47:28 PM EDT
To: (ME)
Reply-To: Clearsupport@flyclear.com
ABOUT YOUR CLEAR ACCOUNT
Dear (ME),
We take the protection of your privacy extremely seriously at Clear. That's why we announced yesterday that a laptop from our office at the San Francisco Airport containing a small portion of your pre-enrollment information (but not your Social Security number or credit card information) recently went missing. And we were prepared to send you the appropriate notice yesterday morning detailing that situation.
However, the laptop was recovered yesterday just before that email went out. And, we have determined from a preliminary investigation that no one logged into the computer from the time it went missing in the office until the time it was found. Therefore no unauthorized person has obtained any personal information.
We are sorry that this theft of a computer containing a limited amount of your personal information occurred, and we apologize for the concern that the publicity surrounding our public announcement might have caused. But in an abundance of caution, both we and the Transportation Security Administration treated this unaccounted-for laptop as a serious potential breach. We have learned from this incident and we have suspended enrollment processes temporarily until all pre-enrollment information is encrypted for further protection, which means you cannot complete in-person enrollment at this time. We will let you know as soon as you can. The personal information on the enrollment system was protected by two levels of password protection, but Clear is in the process of completing a software fix - and other security enhancements - to encrypt the data, which is what we should have done all along, just the way we encrypt all of your other data. Clear now expects that the fix will be in place within days. Meantime, all airport Clear lane operations continue as normal.
The data in question included a limited amount of your personal information, but did not include any credit information, including credit card numbers. And it did not include your Social Security number. And of course, it did not include any biometric information, such as your fingerprint or iris images which are only supplied during the second, in-person enrollment process that takes place at the airport. All of that data is already encrypted and not stored locally at any enrollment center or Clear lane.
As you may know, our Privacy Policy states that we will notify you of any compromise of your personal information regardless of whether any state statute requires it. This letter is a good example of our policy: no law requires that we notify you of this incident because our investigation of the recovered laptop revealed no breach. But we think it's good practice to err on the side of good communication, especially when, in this case, we did make a mistake by not making sure that limited portion of information was encrypted.
Please call us toll-free with any questions at 866-398-8151. Again, we apologize for the confusion. We look forward to welcoming you to a Clear enrollment center just as soon as we've reopened enrollment.
Sincerely, Steven Brill Clear CEO
P.S. A reminder: One of Clear's unique privacy features is that all members and applicants are given an identity theft protection warranty which provides that, in the unlikely event you become a victim of identity theft as a result of any unauthorized dissemination of your private information by - or theft from - Clear or its subcontractors, we will reimburse you for any otherwise unreimbursable monetary costs directly resulting from the identity theft. In addition, Clear will, at its own expense, offer you assistance in restoring the integrity of your financial or other accounts. So had there been any actual compromise of your personal information, you would have been additionally protected.
I felt compelled to visit the CLEAR website for more wise words from the CEO.
This is the second of three points in a mission statement on a page-long venue for the CEO to espouse his altruistic reasons for starting his company. (The same person who wrote, or at least, signed, the email. Nah, what am I saying? Of course he wrote it! That email certainly was not the product of a PR firm!)
Second, we think we have a special responsibility to protect your privacy. Yes, we are using biometric identifiers such as fingerprints and iris images. Yes, your enrollment application will be submitted to the government for a basic security threat assessment before we can issue you a Clear card. But we do not believe the process and the questions stop there. We know that this kind of new idea and new process is bound to make many people uneasy about what we are doing with their personal information, especially at a time when every day seems to bring new headlines about identity theft. I started this company because I thought there was a right way to do something like this - a way that confronted privacy issues head on and embraced uncompromising dedication to privacy protection.
So, there you have it. I suppose by broadcasting this on the web, I can probably kiss my clearance goodbye.
Of course, when it comes to protecting my right to write about this, there’s always the ACLU!
No comments:
Post a Comment