Even before the Secure Flight proposal goes into effect (and before there is any experience of whether it can be implemented or how it will work), the TSA is proposing to extend its air travel control and surveillance principles from passenger airlines to general aviation and all-cargo flights.

On October 9, 2008, the TSA issued a press release and a Notice of Proposed Rulemaking (NPRM) for a so-called “Large Aircraft Security Program” (LASP) for unscheduled and noncommerical flights.  LASP is explicitly modeled on Secure Flight, but with an additional twist: Instead of being required to submit personal information about each passenger to, and receive permisison from, the TSA, operators of “large” general aviation and cargo aircraft will be required to submit this data to, and get permisison from, a new class of private commercial data aggregation companies: “Watch-List Service Providers”.

It’s unclear whether the existing Computerized Reservation Systems (CRSs) or Global Distribution Systems (GDSs) will apply for accreditation by the TSA as Watch-List Service Providers, or whether new companies will be formed for this purpose.  Each Watch-List Service Provider will be required to publish a privacy policy, but there’s no requirement that it actually provide for any privacy protection. It would satisfy the proposed rule to publish a privacy policy stating, “We’ll do whatever we feel like with any data we obtain from and about you, without notice, consent, or compensation.” Watch-List Service Providers would be forbidden to “further release or disseminate any information that TSA or a large aircraft operator indicates as proprietary information and provides to the watch-list service provider,” but no such restriction would apply to information that an individual passenger or crew member might wish to designate as confidential.

Presumably, part of the profit model of Watch-List Service Providers will be the monetization of aggregated and individual data concerning the movement of passengers and freight on private and cargo flights.  That’s particularly problematic, of course, because one reason for the use of private aircraft is to protect the confidentiality of business activities (such as executive travel for mergers-and-acquisitions negotiations) against industrial espionage, and to protect celebrities and potential terorrist targets against privacy invasion or other threats.

“Large aircraft” doesn’t mean what you might think: the threshhold is a maximum allowable takeoff weight (MTOW) including the airplane, fuel, passnegers, crew, and cargo of 12,500 pounds.  That’s the minimum size at which a co-pilot is required for commerical operations.  It excludes most single-engine aircraft and some of the smallest twin-engine private jets that carry no more than about 6 to 8 passengers, but includes most twin-engined private turboprops and most types of corporate jets.

At a meeting called by the TSA last week to present the LASP plan to the general aviation industry, National Business Aviation Association (NBAA) President and CEO Ed Bolen told TSA officials, “We’re frustrated that the proposal as written doesn’t reflect an understanding of how these private operations really work.”

Members of the Aircraft Owners and Pilots Association (AOPA) are similarly “troubled” by the LASP proposal:

“This proposed rule is an unprecedented imposition of security requirements on the general aviation community, affecting 10,000 individual operators and hundreds of airports,” said Andy Cebula, AOPA executive vice president of government affairs. “An overwhelming majority of our members surveyed last week expressed strong concerns about the proposal.” In the survey, members questioned the limits on personal freedom, financial impacts, and potential implications of the rule for the broader GA [General Aviation] community.

The Experimental Aircraft Association (EAA) is also concerned:

“On first glance, these new regulations would compel many operators of … vintage aircraft, …turboprops, and others over 12,500 pounds to comply with new, costly, and burdensome requirements which, frankly, do not appear to equate with their risk assessment profiles,” said Doug Macnair, EAA vice president of government relations. “The proposal also ignores that fact that private operators of general aviation aircraft are not carrying the public and are in all instances personally acquainted with their passengers in the same manner as a passenger in your personal automobile. We do not feel that personal-use aircraft should be painted with the same broad brush as commercial and charter operators who carry the public.

The TSA press release on October 9, almost 2 weeks ago, said that the LASP proposal had already been transmitted to the Federal Register for publication, which is normally a purely clerical process that happens within a few days.  But it hasn’t been published yet, perhaps because the TSA wasn’t prepared (as it should have been) for the criticism the plan has received from every segment of the affected industry.

The LASP proposal will be open for public comment at Regulations.gov for 60 days from whenever it is eventually published in the Federal Register.

[Update: Notice of Proposed Rulemaking: Large Aircraft Security Program, Other Aircraft Operator Security Program, and Airport Operator Security Program (73 FR 64789, October 30, 2008, Docket No. TSA-2008-0021. The comment deadline has been extended through  February 27, 2009 (73 FR 71590, November 25, 2008).]