Follow-up reports have provided more details but also raised more questions about the incident last month in which the US government refused to allow an Air France flight en route from Paris to Mexico City to follow its normal route through US airspace, because the passengers included a journalist on the US “no-fly” list.  The orders from the US authorities, coming while the plane was already in flight, resulted in a lengthy detour to avoid overflying US territory, and an unscheduled refueling stop in Martinique.  (Air France’s Paris-Mexico flights used to stop in Houston, but these days they are scheduled to operate nonstop, in significant part to spare through passengers the need for US transit visas and US-VISIT processing including fingerprinting and photgraphing, now required even for foreign passengers merely transiting a US airport.)

As with previous incidents of blacklisted passengers and delayed, diverted, or canceled flights, this episode should be a reminder that the problems with the “no-fly” list are not limited to mistaken for other people on the watchlist.  The problem, in this case, is that one of the passengers actually was on the list of people administratively banned from the US, without any way of knowing why, confronting his accusers or the evidence (if any) against him,  or obtaining judicial review of their decision to deny him the right of passage by common carrier through US airspace (a right guaranteed by international treaties to which the US is a party).

Also at issue has been how, when, and through what intermediaries or data pathways US authorities learned who was on the plane, espcially since it wasn’t scheduled to touch US soil.

The journalist blacklisted by the US, Hernando Calvo Ospina, is a Colombian citizen who was on his way via Mexico to an assignment in Nicaragua for the Paris-based Le Monde Dilomatique.  As a result, most of the initial reporting was either in Spanish (focusing on what role authorities in Mexico may have played in alerting the US to Mr. Calvo Ospina’s presence on the flight) or in French (focusing on the actions of Air France and the TSA).

Mr. Calvo Ospina has now publshed his own account in English of what happened, which gives more details but doesn’t resolve the controversy over how the US learned he was on the Air France flight to Mexico.

It’s hard to tell what really happened behind the scenes. The first French report on the incident qoutes an Air France speokesperson as saying the passenger list was retrieved by the TSA directly from Air France, but that’s almost certainly not true. Air France doesn’t host its own reservation database, but outsources it to the Amadeus computerized reservation system (CRS).  And it’s the DHS division of Customs and Border Protection (CBP) that gets flight data from the CRSs and tells airlines which passengers, crew members, and/or flights are or aren’t permitted to enter US airspace.  The TSA doesn’t expect to be ready to take over that role, as the last phase of the transition to its new Secure Flight system, until late in 2010.

This report and Le Monde both quote Air France as syaing that, “Since 1 February 2009, the list of passengers on each flight destined to the US is automatically transmitted to the American authorities,” and that the TSA (which, again, almost certainly means the CBP) then sends a message to the airline if a blacklisted passenger is on the manifest.  It’s not clear what the Air France spokesperson is talking about, since there was no publicly disclosed change of procedures effective on that date of February 1, 2009.

The revised APIS regulations requiring the pre-departure transmission of passenger manifest data to the CBP for all flights touching US territory or airspace (including nonstop overflights), and the receipt by the airline of individualized permission from the CBP before each passenger can be permitted to board, took effect February 18, 2008.  If there is any significance to the date of February 1, 2009, almost a year after the effective date of the regulations, we can only guess that it must have been the effective date of some of the secret orders from the CBP to the airlines implementing the APIS regulations.

Air France professes surprise that this data was obtained by the US for a flight to Mexico.  If they really don’t know how the US retrieved the data that’s because (1) Air France has outsourced its reservations hosting to Amadeus, so that Amadeus could have given the US government (or anyone else) access without Air France even knowing about it, (2) Passenger Name Records (PNRs) have change logs but no access logs, so even Amadeus probably doesn’t know who retrieves the reservations unless they made special efforts to preserve that data.  When specifically asked by passengers for these records, Air France has recently claimed to have no records at all about what Amadeus has done with Air France PNRs (in fact, the CBP has “root” access to all of them), and no records of who has actually retrieved Air France passenger data.

There has never been any doubt, though, that the revised APIS rule applies to overflights.  This provision was especially unpopular in Canada, both with the public and the government, because of concerns about US interference or retaliation with travel between Canada and Cuba.  Most Canada-Cuba flights overfly the US, just as many USA-Latin America flights go through Cuban airspace.  We wonder what US citizens would think if American Airlines were required to send their names to the Cuban government, and get their permission, before they could board a flight from Miami to South America.  Air France is fully aware of this rule, and in fact is obligated by French data protection law to forewarn anyone considering making reservations on their Paris-Mexico flights that their data will be sent to US authorities.

Moreover, the APIS rules and the Seecure Flight rules which will eventually replace them don’t provide for the CBP or TSA to tell airlines “when someone on the no-fly list is on the manifest”.  Both of these rules, once implemented, change the default to “no”, so that the airline isn’t allowed to board any passenger until they receive an affirmative, individualized permission message that the passenger is “cleared” for that flight. The fact that Mr. Mr. Calvo Ospina was allowed to board, and that Air France is getting messages only for watchlist hits instead of clearance mesage for all passengers,  suggests that the CBP has not yet been able to implement this part of the revised APIS rule, which requires a whole new real-time bidirectional messaging system between the CBP and each airline, closely integrated into airlines’ check-in and departure control systems.

The only way we will likely find out what really happened, of course, will be if Mr. Calvo Ospina exercises his rights to see his dossiers with the CBP, Air France, and in this csase especially Amadeus  — and  if other travelers likewise demand to see their travel records, and to know who else has seen them.   If Mr. Calvo Ospina or others get their files, we stand ready to assist them in interpreting them.