SoylentNews

upstart [soylentnews.org] writes:

████ This is just here to be deleted. ████

Submitted via IRC for AnonymousCoward

Airline tracks Twitter user’s real-world ID, publishes her flight number [arstechnica.com]

A security consultant who took to Twitter to call out inappropriate comments made by a Southwest Airline flight attendant received a surprising response when the airline’s official Twitter account included her flight number in its reply while the flight had yet to take off.

The consultant, peeved that the airline tracked down her real-world identity and then broadcast her location, sent a follow-up saying the number amounted to personally identifiable information that the airline was obligated to keep private. The airline’s response: flight numbers aren’t PII. The conversation started out with a tweets like this one, reporting that an attendant on the flight she was boarding was making jokes some passengers found to be offensive:

Forgive me because I don’t often fly this airline, but are there boundaries around jokes made by FAs or is that totally at their discretion?@SouthwestAir

— Jackie (@find_evil) August 8, 2019

A Southwest representative using the name Emilia responded with this:

While Southwest Airlines Employees are encouraged to express their creativity and unique personalities when performing their job duties, they should also use good judgment, meet all Safety requirements, and maintain an astute regard for the comfort (1/2) -Emilia

— Southwest Airlines (@SouthwestAir) August 8, 2019

In a follow-up that wasn’t deleted until after Ars asked Southwest for comment, Emilia went on to include the flight number of the plane the consultant was boarding. The now apoplectic consultant responded with this:

Did you just drop my fucking flight number to the world????????

We haven’t even taken off, why would you do this? I haven’t even DMed you! You just dropped my PII pic.twitter.com/dBq1CvHWZl

— Jackie (@find_evil) August 8, 2019

Emilia sent a response that has also now been deleted that insisted flight numbers aren’t PII. Emilia also reminded the consultant that she was “welcome to reach out to us privately in the future if you do not wish to discuss your travel publicly.”

The consultant, who identified herself as Jackie Singh, told Ars that a few days earlier, she had used Twitter to commend the service provided by another Southwest agent. In a direct message, a Southwest representative had asked Singh for her flight confirmation number. Singh told Ars that she believes Emilia used that previous interaction to tie Singh’s Twitter account to her real-world identity. And with that, Emilia tracked and then tweeted the flight number of the plane Singh was boarding.

A variety of onlookers came to Singh’s defense by trying to explain to Emilia how broadcasting the flight number of a plane a passenger was boarding allowed others to know Singh’s location. And for some passengers, this might pose a threat. One onlooker even posted this image showing Singh’s real-time location:

evil_found pic.twitter.com/WaxIvTNuhM

— Neural Netmork (@starsprout) August 8, 2019

Ars asked Southwest if it was standard policy for representatives to tweet flight numbers of its passengers. More than four hours later, a company official wrote:

The Safety and personal comfort of our Employees and Customers is always our top priority, and that includes protecting their right to privacy. Our Team is equipped to respond to Customer inquiries on social media and is trained on handling sensitive Customer data, and they are coached to proactively gather relevant information to understand our Customers’ need and quickly resolve their issue and provide an individualized and personal response. It is not our policy to publicly share personally identifiable information about our Employees or our Customers. We have reached out to the Customer to express our apologies and regret over their disappointment, and we look forward to the opportunity to resolve this issue.

But at the time Ars received the statement, Singh had yet to receive any communication from Southwest. It was only after Ars followed up with the representative and asked if the representative was sure an apology was sent that Singh received a DM from Southwest. It read:

Hello Jackie, my name is Colin and I work in Customer Relations here at Southwest Airlines. I wanted to reach out and apologize for the interaction you had last night regarding your flight with us and the subsequent public post from us outlining your flight number. Our Social Care Team is equipped to respond to Customer inquiries on social media and is trained on handling sensitive Customer data, and we are coached to proactively gather relevant information to understand our Customers’ need and quickly resolve their issue. I can definitely understand where your frustration came from as you had not posted your flight number publicly prior to our reply to your complaint. I sincerely apologize for this experience, we hope to see you onboard again soon. -Colin

The Southwest representative never responded to a question asking if the company planned to train employees not to drop flight numbers of other private passenger information in social media.

Original Submission