May court records related to orders requiring a travel reservations company to provide real-time updates to the U.S. government whenever a “person of interest” makes reservations for flights or other travel  be kept secret from the public, the press, and other travel companies including the airlines on which the target plans to travel?

That issue is now before the 9th Circuit Court of Appeals in the case of Forbes Media and Thomas Brewster vs. the United States (Court of Appeals Docket #21-35612).

The legal question before the 9th Circuit is whether courts can keep their own actions secret. That’s important, but the the underlying facts raise other issues as well.

In 2020, Forbes staff reporter Thomas Brewster found a court order in the PACER public database of Federal court  dockets and filings that required Sabre — one of the three globally dominant  computerized reservation systems (CRSs) used by airlines and travel agencies to store and transmit reservations (PNRs) — to provide “complete and contemporaneous ‘real time’ activity information” including any “travel orders, transactions, or reservations associated with” information related to a targeted traveler including a name, address,  phone and WhatsApp number, passport number, and email address.

Forbes published an article by Brewster that included a copy of the order to Sabre, and followed up with lawsuits in two different Federal districts seeking to have orders to CRSs and the related court dockets and pleadings unsealed.

In response, the government claimed that the order was supposed to have been sealed, had only accidentally (although for at least several months) been made public, and should be resealed.

US District Court Judges in both of those cases upheld the sealing of all information —  including docket sheets, motions, briefs, and orders — beyond what had already been publicly posted on PACER.

The only portion of the government’s argument that the District Court’s didn’t accept was its request to reseal the order order that had already been published: “The cat’s out of the bag: Secrecy is a one-way street: Once information is published, it cannot be made secret again. The court therefore DENIES the government’s request to seal the application.”

Forbes and Mr. Brewster, represented by the Reporters Committee for Freedom of the Press, appealed both of these District Court decisions to the 9th Circuit, where they were consolidated for briefing and argument. Initial briefing of the consolidated appeal by the plaintiffs and amici was recently completed. Amici supporting unsealing the court records include Restore the Fourth, EFF, and the ACLU. The government’s answer is due March 4th. Oral argument has not yet been scheduled.

The secrecy sought — and to date, pending appeal, obtained — by the government keeps us from knowing how many such orders there have been, at whom they have been directed, on what basis they have been applied for, or whether or on what basis they have been opposed.

The order to Sabre included a provision that prohibited Sabre from disclosing the existence or any of the details of the order to anyone except Sabre’s attorneys.

Significantly, there was no exception to this “gag order” for disclosures to  Sabre’s customers, or to their customers. Sabre was thus prohibited from telling any of the airlines or travel agencies around the world that use Sabre as a “software-as-a-service” CRM and database hosting provider (perhaps most comparable to the way businesses in other industries outsource CRM hosting to Saleforce.com), much less telling the targeted traveler, that Sabre was passing on information in real time to the U.S. Attorney’s office and the FBI.

The order to Sabre publicly available through PACER included citations to several others cases in which similar orders had been issued to Sabre, as well as one in which such an order was issued to Travelport, another of the big 3 CRSs.

There was no mention in the order found on PACER and published by Forbes of the third major CRS, Amadeus. Sabre Corp. is a US company publicly traded on the NASDAQ. Travelport LP is a privately held Delaware limited partnership.  Amadeus IT Group S.A. is a publicly-traded Spanish corporation. Amadeus may have been subject to other court orders not mentioned in the order to Sabre. Or the US government may have been uncertain of its authority to order a non-US corporation to provide information about a non-US person traveling between places outside the US on non-US airlines, or concerned that, unlike Sabre and Travelport, Amadeus might contest the application for a court order. Amadeus, like Sabre and Travelport, has declined to comment.

Even after the court order became public, Sabre has declined to comment on whether it opposed this order or how many other such orders it may have received.

As we noted the day after Forbes published its initial article, and as  EFF and the ACLU note in their amicus brief, some internet companies voluntarily publish annual or more frequent “transparency reports” disclosing how many times they have been ordered to turn over personal information to government agencies. But despite questions raised in the travel trade press in 2020 shortly after the article was published in Forbes, neither any of the big 3 CRSs nor any major airline or travel agency has yet published such a transparency report.

We welcome the challenge to judicial secrecy by Mr. Brewster, Forbes, and the amici supporting them. And we are pleased by the growing recognition evident in the EFF/ACLU amicus brief that government access to airline reservation data amounts to a form of  mass surveillance of location metadata— as we have long argued.

If successful, this lawsuit will lift some of the secrecy about the extent of the US government’s use of the CRSs as intermediaries for travel surveillance. It may also clarify what information the government hoped to obtain through these ad hoc orders that it wasn’t already getting through dragnet transmission to the DHS of API and PNR data, and the TECS alert system based on this data. But the journalist and news outlet who brought the lawsuit are seeking access to information, not an end to the surveillance.

A challenge to the use of CRSs as outsourced agents of government surveillance of travelers could only come from one of the CRSs themselves as the only entities with knowledge of what is happening and standing to object to it in court.

But the CRSs customers are airlines, travel agencies, and other travel companies, not members of the public. Instead of standing up for the rights of individuals, as some public-facing businesses have done, the CRSs have stonewalled all questions about  their participation — voluntary or compelled — in government surveillance.

What we already know is damning enough, both for the CRSs and for their customers.

As long as travel companies outsource hosting of reservations to CRSs, and as long as CRSs can be ordered to provide information from those reservations to government agencies while keeping those disclosures secret from airlines and travel agencies, it is impossible for those CRS subscribers to provide a complete accounting of disclosures of travelers’ data.

This means that it is impossible for any airline or travel agency that subscribes to Sabre or Travelport (or in many cases Amadeus, although that’s more complicated) to comply with data protection laws in any jurisdiction that requires an accounting of disclosures.

We hope that , whatever the outcome of the lawsuit and appeal by Forbes and Mr. Brewster, this case will focus more attention on the complicity in travel surveillance of the CRSs and will lead to more pressure on them to dissociate themselves from that role, to contest attempts by the government to enlist them as its surveillance partners, and to fight to be allowed to alert the public if they are forced to hand over data to the government.