Violating its own privacy policy, JetBlue Airways gave 5 million passenger itineraries to a Defense Department contractor that used the information as part of a study seeking ways to identify "high risk" airline customers.

The study, produced by Torch Concepts of Huntsville, Ala., was intended to be a proof-of-concept analysis for a project on military base security, titled "Homeland Security: Airline Passenger Risk Assessment."

JetBlue, whose terminal at Oakland International Airport is a major hub for the low-cost carrier's popular cross-country routes, insisted the data was not shared with any government agency and that Torch has since destroyed the passenger records.

New York-based JetBlue said it has taken steps so the situation will not happen again. "This was a mistake on our part," JetBlue chief executive David Neeleman said in an apologetic e-mail sent to angry customers.

Silicon Valley privacy activist Bill Scannell, who first posted details of the study and JetBlue's involvement on his Web site, Don't Spy On Us, said Friday the privacy of anyone who flew JetBlue from its inception until September 2002 was compromised.

"Torch Concepts went and ran basically a 'total information awareness' on (travel records from 5 million customers). They got Social Security numbers, and from that were able to pull out the driver's records ... purchasing patterns, where they've lived," Scannell said.

"Had I been a JetBlue passenger, I would be getting a new Social Security number. I would assume my identity has been stolen."

Marc Rotenberg, executive director of the Electronic Privacy Information Center in Washington, said that by violating its privacy policy, JetBlue could be sued for "deceptive trade practices."

Rotenberg said his organization was contemplating filing a complaint with the Federal Trade Commission.

JetBlue "really should have known better," said Richard M. Smith, an Internet security and privacy consultant based in Cambridge, Mass. Smith said the content of the study raises serious questions about whether it was really aimed at military base security.

"It's basically a prototype for CAPPS II," Smith said, referring to the nationwide computer system being developed by the Transportation Security Administration. The Computer Assisted Passenger Prescreening System, ordered by Congress after the Sept. 11 attacks, will check such things as credit reports and consumer transactions and compare passenger names with those on government watch lists.

The TSA, the federal agency in charge of airline and airport security, said Friday it was not involved in the study.

Torch contacted the TSA last summer for airline industry contacts and the agency complied with the request, but "that was the extent of our involvement," TSA spokesman Nico Melendez said.

The Torch study analyzed the records JetBlue provided in September 2002, as well as other demographic data collected about the passengers, including Social Security numbers and information about their finances and families.

The apparent goal of the study, which was presented at a technology conference in February, was to determine the usefulness of combining passengers' travel and personal information in order to create a profiling system that would make air travel more safe.

One conclusion of the study was that "data elements have been identified which best distinguish normal JetBlue passengers from past terrorists."

Neeleman's e-mail said Torch "developed this information into a presentation, without JetBlue's knowledge, for a Department of Homeland Security symposium" and that he was "deeply dismayed to learn of it."

Neeleman said JetBlue provided passengers' names, addresses and phone numbers to Torch after an "exceptional request from the Department of Defense to assist their contractor, Torch Concepts, with a project regarding military base security."

Torch referred calls to its attorney, Richard Marsden, who did not immediately return a call seeking comment.

"This is a great lesson for all of us," Scannell said. "This is just 5 million citizens. What CAPPS II will do is do this to all of us."

"This is why we need to drive a stake through the CAPPS II vampire now."

More information can be found at Bill Scannell's Web site, www.dontspyon.us

©1999-2003 by MediaNews Group, Inc. and ANG Newspapers

###