Paparazzi steal passenger lists, itineraries from airlines
Major airlines have been informed of a serious security threat to their passenger booking systems exposing the private details of high-profile, wealthy travellers.
Virgin Australia is among the airlines investigating the use of confidential passenger data by paparazzi after being handed evidence of widespread breaches, allowing flight numbers, highly sensitive booking numbers and arrival and departure times to be passed between agencies and photographers, amid fierce competition in the celebrity news trade.
The Weekend Australian has been given screenshots of Virgin travel itineraries for celebrities including Margot Robbie, Naomi Watts, Rebel Wilson and Keith Urban and, most disturbingly, one of his children with wife Nicole Kidman. “This is an issue that affects airlines around the world and Virgin Australia is currently working actively with a number of other airlines to advocate for our system provider to improve its audit controls,” a Virgin spokeswoman said.
Wendy Day, Kidman’s representative, said it was “extremely disturbing” that clients and their families’ movements were being tracked, as the data could fall into the hands of stalkers or terrorists “in the world we live in today”. “It is absolutely horrific for anyone to have their children’s safety endangered,” Day said.
While celebrities knew that a level of public attention was to be expected as part of their roles, “no one deserves for their children to be placed in jeopardy”, she said.
Top celebrity agents contacted by The Weekend Australian say the practice is widespread and wellknown.
Travel experts confirmed that the airline bookings seen by The Weekend Australian appeared to have been sourced from Sabre, a global booking system used by airlines and travel agents worldwide.
Computer security experts have identified flaws within Sabre and Amadeus, a similar booking system used by Qantas, which leave them vulnerable to being hacked.
Airlines are lobbying for increased security features to be built into both systems, calling for fingerprint technology to enable them to determine who has accessed a flight booking. At present, this occurs only if a booking is modified.
Known as global distribution systems, these databases are used to co-ordinate travel bookings between airlines, travel agents and online booking sites, using a sixcharacter Passenger Name Record generated by all flight bookings.
German computer security firm SR Labs released a report in late 2016 that found that PNR numbers were easy to guess and that passengers’ itineraries could easily be hacked.
Amadeus has introduced some measures to protect against unauthorised access since the research findings were published. Virgin has introduced extra security controls around employee access to Sabre.
The Weekend Australian has also seen celebrity travel itineraries sourced directly from the Virgin website, which can be easily accessed using the PNR number.
The value of travel itinerary information to paparazzi extends beyond the standard shots of celebrities arriving at airports.
While these shots are only valuable if they contain exclusive content — such as the images of Network Nine host Karl Stefan- ovic kissing girlfriend Jasmine Yarbrough at Los Angeles airport in April, believed to have sold for $35,000 — celebrities are followed to their hotels and throughout their holidays, making their travel itineraries a valuable resource for paparazzi. Yet even seasoned paps are concerned about illegally accessed data, saying rogue operators are bringing the sector into disrepute by “flagrantly” breaking the law.
The ease with which airline security protocols can be breached was highlighted when fanturned-paparazzo Jayden Seyfarth used the self-serve check-in facility at Sydney Airport to print off the boarding passes of Bachelorette stars Sophie Monk and Stuart Laundy and access the Virgin lounge — resulting in the airline banning him indefinitely.
In order to print a boarding pass on domestic Australian flights, all you need is the traveller’s surname and destination.
A Virgin spokeswoman said the safety and security of guests, crew and aircraft was “our No 1 priority”.
A Qantas spokesman said it would “immediately” act upon any breaches reported to the airline.
An Amadeus spokesman said the company had implemented extra security since the SR Labs research was published, including “additional layers of authentication”.
Nicole Kidman, Keith Urban and their children
Margot Robbie arrives at Brisbane International