'Clear' registration halted after laptop theft

Aug. 5, 2008
Provider of TSA Registered Traveler services loses unencrypted enrollment data

Aug. 5--The federal government on Monday barred a registered-traveler service launched three years ago at Orlando International Airport from enrolling new members after an unencrypted company laptop containing personal information for about 33,000 prospective customers was stolen from a locked office.

The Transportation Security Administration said it has instructed all airports that contract with Verified Identity Pass Inc. -- which operates the "Clear" program at OIA and nearly 20 other airports across the country -- to suspend enrollment in the service and to secure all unencrypted computers until encryption software is installed. The agency also instructed San Francisco International Airport, where the laptop was lost, to ensure that Verified Identity Pass immediately contacts everyone whose personal information was stored on the missing computer.

TSA said it requires registered-traveler providers to encrypt all files containing participants' personal information.

In a written statement, Verified Identity Pass said most people affected were customers who had signed up online for the Clear program but who had not yet completed their enrollments in person. A "small number" of members who were in the process of re-enrolling were also affected.

The company said the information on the stolen laptop included applicant names, addresses and birth dates. The computer also contained drivers license numbers, passport numbers and alien registration card numbers for "some" customers -- but no credit-card information, Social Security numbers or biometric information. The company said the information was secured by two levels of password protection.

"We don't believe the security or privacy of these would-be members will be compromised in any way," Verified Identity Pass Chief Executive Officer Steven Brill said in a written statement. "There is no reason to believe this is anything other than the simple burglary of a laptop, which the local police are investigating."

Both TSA and Verified Identity Pass said existing Clear customers will not experience any disruption at the airport.

Clear customers pay a membership fee, submit to a background check and personal-threat assessment, and provide biometric information such as iris scans and fingerprints. They are then issued "Clear" cards and are allowed to use express security lanes at airports that have registered-traveler programs in place, whether operated by Verified Identify Pass or a competitor.

The Clear program last month celebrated its three-year anniversary. Since launching at OIA in July 2005, Verified Identify Pass has enrolled more than 190,000 travelers nationwide, including more than 40,000 in Orlando.