In a case we’ve been following closely, the 9th Circuit Court of Appeals has ruled that orders requiring the Sabre computerized reservation system to provide real-time reports to the FBI on any reservations made in or through Sabre associated with specific individuals can continue to be kept secret, at least as long as warrants for these individuals’ arrest remain outstanding, which could be indefinitely.

The wanted individuals aren’t US citizens and aren’t believed to be in the US. US Customs and Border Protection (CBP) already receives complete mirror copies 72 hours in advance of all international airline reservations (Passenger Name  Records) for flights to, from, or via the US. CBP has a well-established system of TECS alerts — which don’t even require a warrant — that it can use to generate a message to the FBI or other law enforcement agencies whenever planned travel to or from the US by a person of interest is detected.

This is a much simpler process than going to court to get an order directing Sabre to maintain a lookout and report to the FBI on planned travel by a suspect.

Why, then, has the FBI repeatedly gone to court to get orders requiring Sabre and in some cases other CRSs to watch for, and report, planned travel by persons of interest? The only reason would be for the US to obtain advance notice of a suspect’s planned travel within or between countries other than the US, so that the US could try to persuade some allied government to arrest and deport or render the wanted person to the US for trial.

Everyone should be concerned that reservation hosting companies are secretly monitoring and reporting their travel plans to the US government.

Other countries should be concerned that the US government is forcing CRSs that are based or have a presence in the US to carry out ongoing real-time monitoring and reporting to the US government of planned flights by non-US persons between non-US points — in effect, serving as remote agents of US surveillance within other countries.

The case in the 9th Circuit was brought by a journalist. But the court noted that Sabre or other CRSs would have a stronger basis than journalist or other third parties to contest the government’s attempt to force them to spy on travelers and rat them out to the government:

[T]he notion that technical assistance proceedings will forever go unchallenged or unnoticed absent a constitutional right of access is overstated. Petitioners themselves assert that there today exists a robust public debate over these investigatory devices. The government acknowledges that AWA [All Write Act] technical assistance orders may still be subject to challenge through different legal pathways, such as by the suspects themselves or by entities like Sabre, who receive the AWA orders.

So far as we can tell, however, neither Sabre nor any other CRS, nor any airline, has contested any of the US government’s requests or demands for information from airline reservations. No CRS or airline has issued a “transparency report” on its responses to government requests or demand for information about travelers.

CRSs and airlines should stand up for the traveling public against government spying.

Travelers, and airlines that care about travelers, should demand that the “Big Three” CRSs — Sabre, Travelport, and Amadeus — promise to challenge any government demands for information about travelers, and issue regular transparency reports on what requests or demands for travel records they have received from the government (including both case-by-case information requests and ongoing bulk feeds of PNR and API data) and what they have done to resist compliance.

The 9th Circuit opinion notes that, according to the FBI, Sabre “processes roughly one third of all air travel reservations.” That may be an understatement, because Sabre has records of reservations whenever either the airline’s reservations are hosted by Sabre or a codeshare airline or travel agency (including an online travel agency) uses Sabre to make the reservation.

If a travel agency uses Sabre to make a reservation for a flight on an airline hosted in Amadeus, for example, separate PNRs are created in both Sabre and Amadeus. So Sabre has records of flights within the European Union, by EU citizens and residents, on airlines based in the EU and hosted in Amadeus, if reservations were made through a travel agency that uses Sabre — even an agency based and operating in the EU.

This systematic US government access to airline reservations for flights outside the US, including even domestic flights with other countries appears to violate the terms of the US-EU agreement on government access to PNR data. And Sabre subscriber airlines and travel agencies that fail to disclose to travelers that their reservations for non-US flights could be monitored and reported to the US government may be violating data protection laws.

The 9th Circuit notes that in a parallel case, a US District Court in another circuit has ordered that a similar order to Sabre be unsealed. The key difference in that case seems to have been that the suspect had already been arrested, while the suspects subject to the travel-monitoring orders at issue in the 9th Circuit are still at large. The 9th Circuit left open the question of whether the orders to Sabre should be unsealed if the targets of the trvavel monitoring and reporting orders are eventually arrested.