Does SAAS stand for “software as a service” or “surveillance as a service”?

As we’ve reported previously, the UN Security Council and ICAO have illegally ordered all UN and ICAO members to create national agencies for surveillance of airline passengers and global sharing of airline reservations (PNR) and passenger manifest (API) data.

Through bilateral and multilateral efforts and the UN Countering Terrorist Travel program, the US and Dutch governments have made available ready-made software for creating and managing travel watchlists, blocklists, and profiling algorithms and rulesets.

These aren’t the only options, though, for national governments wanting or feeling pressured by the US, UN, and/or ICAO to get on the traveler profiling bandwagon.

Caitlin Chandler of Wired, in conjunction with Andrew Couts, Crofton Black, Ariadne Papagapitos, and Daniel Howden of the European nonprofit newsroom Lighthouse Reports,  has a ground-breaking report putting the spotlight on four commercial providers of outsourced and privatized air travel surveillance, profiling, and control systems: Swiss-based SITA (an established joint venture formed by airlines to provide shared IT services) and Travizory, French-based Idemia, and Dutch-based WCC.

These are the companies that make presentations, lurk on the sidelines and in the booths, and negotiate public-private partnership agreements at the annual FTE Global trade show, ICAO’s  annual TRIP symposium in Montreal, and similar regional events.

Each of these companies offers a turn-key solution, either user-installed or cloud-based, to governments that want to jump-start their air travel surveillance and control programs  and “push their borders offshore”, as one of these vendors describes their service.

Another vendor quoted by Wired says that with their system and its interconnections, “Participating governments are then able to respond to the carrier … in real-time, authorizing or denying the boarding of each and every passenger.” These systems are also designed to interface with electronic travel authorization (departure permission) systems.

Each of these systems supports drag-and-drop importing of watchlists and blocklists from other countries, creation and addition of entries to new watchlists and blocklists, and creation of new profiling and travel blocking algorithms and alerts. Each also allows government customers to enable the vendor’s preconfigured pre-crime and artificial unintelligence profiles and algorithms as part of their surveillance, blocking, and alert ruleset.

In interviews reported in Wired, these companies disclaim responsibility for how these tools are used by government customers or what rules customers add to their algorithms — a claim that is at best disingenuous, especially when government customers turn on pre-crime and AI profiling and scoring algorithms provided by the vendor as part of a black box.

It would be a mistake to focus too much on these surveillance-as-a-service providers, to the exclusion of the governments that have contracted and paid for their services. That governments and their commercial partners are illegally interfering with the right to freedom of movment, the right to leave any country, the right to travel by common carrier, and the right to asylum is more significant than the specific systems they are using to do so. But the report in Wired outing these companies and their role in travel surveillance and control is an important step. These vendors and their surveillance-as-a-service products, as well as the government agencies they work with, deserve continuing scrutiny and oversight from human rights activists and international human rights bodies alike.

Effective January 8, 2025, the United Kingdom began requiring citizens of the USA and most other countries who previously could enter the UK without visas for short visits for tourism and some other purposes to obtain a so-called Electronic Travel Authorization (ETA) as a new precondition for admission to the UK for those purposes.

The UK ETA is significant both in its own right and as a case study in what’s wrong with similar requirements and systems already in effect in other countries, including the USA, Canada, Australia, and in preparation in many more countries including all members of the European Union.

The requirement for an ETA is intended for a pupose fundamentally contrary to international treaties on aviation and the rights of refugees, and has been implemented in ways that facilitate surveillance of ETA applicants and arbitrary control by a few private companies of who can and who can’t travel to the UK.

We hope the EU and other countries will learn from and avoid, not emulate, this bad example set by the UK.

The UK ETA system is not the first of its kind, but it’s the first that most US citizens, except those who have traveled to Australia, will encounter. US citizens don’t generally see what foreign citizens have to go through to enter the US, even as tourists or in transit. And US and Canadian citizens visiting each other’s countries are exempt from the electronic travel authorization requirements that their governments apply to visitors from other countries.

But while it may be a new experience for US citizens, the UK ETA is similar to what’s already required for most tourists and short-term business visitors to the USA, Canada, or Australia. And the UK ETA is similar to the system that the EU plans to roll out for citizens of the US, Canada, UK, and many other countries.

Australia pioneered this concept with its ETA system, beginning in 1996 (and modified several times since them). The USA launched its ESTA system, modeled on the Australian ETA, in 2009. Canada followed with its eTA system in 2016. Now the UK is rolling out its similar ETA system in 2025.

The EU EES and ETIAS schemes were planned to go into operation several years ago, sooner than the UK ETA, but have been postponed repeatedly. The most recent announcement by EU authorities is that EES — a system for collecting mug shots and fingerprints of visitors to the EU, as the US already does with visitors —  will be launched sometime in 2025, and ETIAS — an electonic travel authorization like the US ESTA and the UK ETA — will go into effect six months after the EES launch. (The EU is also considering a related system for a “travel permission app” with problematic implications.)

Acronym soup and national variations aside, what’s an ETA? How do ETA requirements violate international law? What’s wrong with the way the UK has implemented its ETA program? Read More →

Judge Nina Morrison of the US District Court for the Eastern District of New York (Brooklyn, Queens, Staten Island, and Long Island) has ruled that police, including officers of U.S. Customs and Border Protection (CBP), need a warrant to search your cellphone at JFK International Airport, even when you are entering or leaving the US.

This ruling is certainly a positive development. It’s a break with a line of judicial decisions that have made US borders and international airports a Fourth Amendment-free zone, even for US citizens. It’s likely to influence other judges and other courts, even though — as a ruling from a District Court rather than an appellate court — it doesn’t set a precedent that’s binding even on other judges in the same Federal judicial district.

But there are important issues that weren’t addressed in this case, and important things you need to know to exercise your rights at JFK or other airports — even if judges in future cases in the same or other judicial districts are persuaded by the ruling in this case.
Read More →