First time here? Check out the site's "greatest hits" or read a random post from the archives. Feel free to ask a question, and consider subscribing to the latest posts via RSS or e-mail. Thanks for visiting!

A few days ago, an Indiana University PhD student in computer science named Christopher Soghoian decided to post a fake boarding pass generator on his personal webpage. The site let you enter a name, flight number, etc., to make it appear like a genuine Northwest Airlines boarding pass, good enough to get through security. Soghoian suggested three purposes for such a fake:

1. Meet your elderly grandparents at the gate
2. ‘Upgrade’ yourself once on the airplane - by printing another boarding pass for a ticket you’re already purchased, only this time, in Business Class.
3. Demonstrate that the TSA Boarding Pass/ID check is useless.

Number 2 is just stupid and tantamount to stealing. You’ll never upgrade yourself or get on a plane for free by forging your boarding pass, since the barcode won’t register the correct flight or seat when it’s scanned. You’d be trying to rip off the airline, and you’d be escorted out by security rather quickly…

Number 3 is a fair point, but one that’s been made before. Pointing out that a print-at-home boarding pass could be “hacked” is nothing new. Senator Chuck Schumer of New York detailed the process by which boarding passes can be hacked at a press conference last year, and the issue has been raised in Slate and Schneier.com. Someone else posted a way to forge your otherwise legitimate Southwest Airlines boarding pass, so it always registers in group “A.” And as for number 1, there are people who have simply been using Adobe Acrobat for years to edit the date on an old boarding pass so they can gain access to the secure area of the airport to meet someone — after submitting to screening, of course.

Posting a boarding pass generator was stupid, and got the site shut down, along with a visit from the FBI. But it’s really nothing new, and, I contend, at no point was there ever a real threat to security. Every single person who has ever used one of these little tricks still had to submit to a screening. If the checkpoint is doing its job, then the name or date on the boarding pass shouldn’t matter.

So why NOT let anyone go to the gate, if they’re willing to pass through security? Why even bother with checking identification?

For starters, the airlines don’t want you forging boarding passes, since they don’t make tickets transferable, and they want to make sure the person buying the ticket is actually the person flying. If your friend wanted to fly on your ticket, you could check yourself in, give your friend your real boarding pass AND a fake one in his name. He would use the forged pass at security and the real pass (with your name) at the gate.

There’s also the matter of the no-fly list. The airline is supposed to catch people on that list at the time of check-in. But like the friend using someone else’s ticket in the example above, a fake boarding pass, a fake id, and a separate, real boarding pass in someone else’s name could let you bypass the no-fly list and get you through security and on board. But even then, you still would need to submit to security. (And let’s leave the fact that the no-fly list is riddled with errors aside.)

Airlines also try to make sure that passengers are supposed to travel on the same plane as their luggage. Therefore, boarding pass hand-offs are frowned upon. But again, if the luggage is screened, and the passenger is screened, then there really shouldn’t be a concern about matching bags to passengers.

Finally, security personnel don’t want more work than necessary, and airports want to reduce wait times and lines. Allowing anyone to go to the gate would increase manpower expenses or wait times. Neither option is appealing to airport managers.

At the end of the day, it comes down to the ability of security personnel to find weapons and detect threats. And if people truly believe that the security at TSA checkpoints is adequate, then the fuss about forged boarding passes is all a waste of time. If security isn’t adequate, then that needs to be fixed, but it still doesn’t make a difference whose name is on the boarding pass.

UPDATE 11/1/06: Someone has posted a mirror of the original site here. Nothing ever stays secret once it’s on the internet… And as others such as Mere Rhetoric have pointed out, a forged boarding pass isn’t going to make or break security. The screening at the checkpoint will. And the screening has a number of gaps. Big gaps. Filling those gaps is more important than busting a computer programmer in Indiana.