This is the second of two posts on Passenger Protect, Canada’s forthcoming no-fly list. Part 1 described how Passenger Protect is going to work.

Why we should be concerned about Passenger Protect

First of all, there’s the cost. Passenger Protect represents a huge increase in federal spending on border security. In fact, just a few months ago, CBC was reporting that the cost might keep the program from being implemented. Look at the numbers from the government’s own feasibility study: “Implementation costs for the RCMP, CSIS and the CBSA alone would range from $95 million to $270 million, the study estimates, with annual operational costs of between $19 million and $60 million. Costs for Transport Canada are not included in the estimate.” By way of comparison, the 2006 federal budget allocated $133 million for the entire Canadian Air Transport Security Authority, and about the same amount for hiring one thousand new RCMP officers. I’m no expert on government finance, but the Passenger Protect numbers don’t look good to me.

Second, and more importantly, there’s the question of effectiveness. Will the no-fly list actually make us safer? If the US example is anything to go by, probably not.

Now, to their credit, the designers of Passenger Protect have learned a thing or two from the disaster that is the US no-fly list. For example, unlike in the US, there will be an appeal process — so, in theory, you’ll be able to get your name off the list if it shouldn’t be there. Whether it will work that way in practice is another story, of course, but at least there will be a process in place. There are also specific criteria for adding names to the list, which as far as I can tell is something the US list lacks.

That said, there are still a number of big gaping flaws to reckon with. For one thing, Canada will almost certainly be sharing its no-fly list with the US. So if you end up on the Canadian list, you will also end up on the US list. And once you’re on the US list, you don’t get off it — just ask Maher Arar. (If a formal commission of inquiry can’t get you off the US no-fly list, what chance does a “Not-a-Terrorist” certificate from the Office of Reconsideration have?)

The Canadian no-fly list will also be using the US list as one of its information sources. Now, the US list is finally going to be cleaned up in the near future, but it’s certainly been the case in the past that that list was worthless. The Wikipedia article on the US list runs through some of the better-known false positives if you need examples. I frankly don’t understand how Canada’s security agencies will be able to extract reliable information from the US list. Our own records of individuals with ties to terrorism are far less comprehensive than American records, so I hope the Homeland Security people will be sharing everything they know about the 44,000 people on their no-fly list — because we’d have to be nuts to just use their list without evaluating the information it’s based on first.

Then there are the disturbingly vague criteria for including a person on the Canadian list. For example, the first class of people on the list includes any “individual who is or has been involved in a terrorist group, and who, it can reasonably be suspected, will endanger the security of any aircraft or aerodrome or the safety of the public, passengers or crew members.” Is the definition of a terrorist group restricted to designated terrorist organizations? Does involvement in such a group include just donating money? Does it include involvement antedating the group’s designation as a terrorist organization? Will such involvement itself qualify as reasonable grounds to suspect the person is a threat? These are not idle or unfounded questions. Remember, the agencies responsible for answering them have already helped send at least one innocent person off to be tortured in a foreign country; we can expect them to cast their nets wide and not worry too much if they catch a few innocent people along the way.

Also, the no-fly list will only work if the terrorists agree to use their real names when they book a flight. Which is kind of an important point, because it means we are spending hundreds of millions of dollars on a system that will only catch the really stupid terrorists. You know, the ones we probably would’ve caught anyway.

Incidentally, in the 18 months since Paul Martin’s Liberals first floated the idea, Passenger Protect has never once been debated in the House of Commons. The Special Senate Committee on the Anti-Terrorism Act did raise a few concerns about the program in the report they released this month (which recommends clarifying the criteria for adding names to the list and publishing guidelines on how to get your name removed), but the people you and I actually elected don’t seem too concerned about it. Maybe we should give them a nudge.

Canada is about to get its very own homegrown no-fly list. The initiative is called Passenger Protect, and it got its start under Paul Martin’s Liberal government back in 2005. The Liberals lost power before it could be implemented, but Stephen Harper’s Conservatives thought it was a good idea, so they’re going ahead with it. It’s set to take effect for domestic flights in March, and for international flights in June.

How it will work

The no-fly list will be compiled by a Transport Canada advisory group based on recommendations from CSIS and the RCMP. They’ll be adding the names of anyone who is or has been involved with terrorist groups and might pose a threat to aviation security; anyone who has previously been convicted of “serious and life-threatening crimes against aviation security”; and any convicted violent offenders who might harm the crew or other passengers.

In addition to using their own records, CSIS and the RCMP will be relying on information from foreign intelligence sources, including the US no-fly list. The Canadian list will include each person’s name, gender, and date of birth, and in some cases their address, phone number, and passport number as well. All airlines flying through Canada will have access to the list, but they’ll be required to keep it confidential. However, Canada will almost certainly share its list with the US and other Canadian allies — so if you’re on the Canadian no-fly list, you can expect to end up on the US list, too.

When you go to get your boarding pass, your airline will check to see if your name is on the list. If it is, you won’t be able to print your boarding pass online or at a kiosk — you’ll have to proceed to the check-in desk, where airline staff will ask for your ID and check your gender and date of birth. If you’re still a match at this point, they’ll get in touch with a Transport Canada officer to verify your identity and status, and permit or refuse boarding accordingly. If you want to appeal their decision, you can talk to the Office of Reconsideration, an independent review board.

For more information, check out:

• Transport Canada’s information package on Passenger Protect
• Transport Canada’s response to the Privacy Commissioner’s questions
• Identity Screening Regulations

Coming soon: Why we should be concerned about Passenger Protect.

Last night, in the middle of a story on real estate fraud, CTV News inexplicably threw its support behind a national identity card. The segment claimed that such a card would ameliorate the risks of fraud and identity theft.

It’s not true. When it comes to real estate fraud, a national ID card offers no advantages over other identification documents. In fact, from a security standpoint, national ID cards are a singularly bad idea. Here’s why (and I’m getting this stuff from Bruce Schneier, so you can take his word for it):

• ID cards can be forged, no matter how “unforgeable” they’re designed to be.
• In order to get a real, official, government-issued ID card, you have to present other pieces of identification, which can be forged.
• ID cards have to be checked — usually by human beings, who are error-prone and often poorly trained.
• Finally, and most importantly, a national ID card would have to be backed up by a national ID database containing identifying information on everyone in the country. This database would need to be “widely and instantaneously accessible from airline check-in stations, police cars, schools, and so on.” It would contain data pulled together from all over the place, which means the data will be weird, inconsistent, and probably unreliable. Such a database would be a massive procedural and technological challenge (and that’s putting it mildly; Charlie Stross has convincingly argued that the UK’s plans for such a database could never work). It would also be a massive security risk: imagine what could happen if malicious hackers broke into the system and started messing with people’s records!

Schneier concludes, “That’s why, when someone asks me to rate the security of a national ID card on a scale of one to 10, I can’t give an answer. It doesn’t even belong on a scale.”

And yet the idea has been floating around in Canadian politics for a while now. It’s been on the table in national security discussions pretty much since September 11. Last February, Public Safety Minister Stockwell Day said that such a card is inevitable. I’d like to think the Canadian government will pay attention to security gurus like Bruce Schneier, learn from the debacle that Britain’s ID card scheme has become, and drop whatever plans it has to implement an ID card system of its own. But governments like to be seen to be doing something — especially when it comes to national security, which is the usual context for ID card proposals — and with major media outlets are talking favorably and uncritically about the idea, I suspect Ottawa will be pushing ahead with an ID card scheme. So maybe it’s time to start thinking about how to oppose such a plan.

Bruce Schneier points to a Washington Post article about the “Specially Designated Nationals List” (SDN), a.k.a. the “Bad Guy List.” Evidently everyone in the United States is supposed to make sure your name isn’t on the list before they sell you something. Meanwhile, I can’t even remember the last time a cashier bothered to check my signature when I used my credit card.

From the WaPo article:

The law prohibits anyone … from doing business with anyone whose name appears on the Office of Foreign Assets Control’s Specially Designated Nationals list … [A]ccording to the law, supermarkets, restaurants, pawnbrokers, real estate agents, everyone, even The Washington Post, is prohibited from doing business with anyone named on the list. “There is no minimum amount for the transactions covered by the OFAC requirement, so everyone The Post sells a paper to or a want ad to whose name appears on the SDN list is a violation … The law applies to you personally, as well.”

It’s a good thing those dastardly terrorists can’t obtain fake ID! Oh, wait.

Here’s the list.