An unencrypted laptop containing personal data of about 33,000 customers of the Clear registered traveler program was discovered missing and then found.
Verified Identity Pass (VIP), which operates the Clear program, said the laptop was found Tuesday morning in the same office where it supposedly had been stolen.
Moreover, VIP determined from a preliminary investigation that no one tried to access information on the laptop from the time it went missing in the office until the time it was found. Further forensic investigation is being conducted by law enforcement officials, said VIP.
Still, Clear cannot enroll new applicants, said the Transportation Security Administration (TSA), because of "vulnerabilities discovered in the company's storage of sensitive, personal information." The vulnerabilities came to light after a VIP laptop was discovered to be missing from San Francisco International Airport on July 26, said the TSA.
Clear customers pay an annual fee and submit biometric data in exchange for fast-lane access through airport security.
VIP said the laptop contains applicants’ names, addresses, birth dates, driver’s license numbers, passport numbers and alien registration card numbers. The laptop does not include any credit card numbers, Social Security numbers or biometric information, said VIP.
“We have now taken additional security measures to make sure that we have significant additional protection for this limited information, including encrypting it, which we should have done from the beginning, just the way we already encrypt all of the credit, Social Security number, biometric data and other information,” said VIP CEO Steven Brill.
TSA has instructed the San Francisco airport to "ensure that VIP immediately notifies the individuals impacted." In addition, San Francisco and all other airports using Clear have been instructed to ensure that VIP suspends enrollment, ceases use of any unencrypted computers and secures computers until encryption can be installed.
VIP must submit to an independent audit, verifying that the required security measures are in place, said TSA. Clear enrollment can resume once TSA verifies the audit.
The operation of Clear's expedited security lanes won't be affected by the suspended enrollment, said VIP.