Inside the black box of predictive travel monitoring

In March 2020, Frank van der Linde entered the entry channel for EU citizens at Amsterdam Schiphol International Airport. Linde, a Dutch citizen and human rights advocate, was returning from a country outside the EU when immigration officials asked him a series of questions about his trip. Lind thought it was a random inspection; after a few minutes, he was allowed in. But unbeknownst to Linde, his answers were recorded and shared with Dutch prosecutors, who were gathering information about Linde's actions.

That day, every time you boarded a flight to the United States, much of Europe, and increasingly anywhere in the world, the official would learn of Linde's arrival through a seemingly innocuous act: Air Detailed personal data of each traveler is exchanged between companies. and government. This data, which retains your data for years, is increasingly valuable to tech companies that are trying to use algorithms to decide who can cross international borders.

Linde, who has been publicly outspoken about homeless rights, anti-racism and pacifism, was first secretly flagged by Dutch police as a person of interest in the city of Amsterdam's anti-terrorism program in 2017. In July 2018, Linde had a “strange feeling” that he was being watched; he eventually sued the government more than 250 times under the Freedom of Information Act to expose the extent of the surveillance. Although Linde was removed from the city's watch list in 2019 and later received a personal apology from the mayor of Amsterdam, scrutiny continues. When Lind learned that police had put his name on an international travel alert, he wondered whether they were also using his travel data to track him.

In October 2022, Linde requested his flight records from the government. The data, known as Passenger Name Records (PNRs), are digital trails of information related to ticket purchases. Most commercial airlines will send PNR records to the destination country approximately 48 to 72 hours prior to departure. While PNR records may seem innocuous, they contain highly sensitive personal information, including the traveler's address, mobile phone number, flight booking date, ticket purchase location, credit card and other payment information, billing address, baggage information, frequent flyer information, and Passenger-related general notes, intended travel date, complete travel itinerary, names of accompanying passengers, travel agency information, historical changes in air tickets, etc.

In December 2022, more than two years after Linde passed through Schiphol Airport, the Dutch PNR office, known as the Passenger Information Center, handed over 17 travel records to Linde. They said they didn't share his data with anyone else, but Linde doubted that. He quickly appealed. In March 2023, the Dutch government admitted that it had in fact shared Linde's PNR details with border police three times, including before a flight in March 2020, when immigration officials were ordered to secretly extract the information. (They also shared seven additional flight records, which they claimed were discovered only during the second search.)

When Linder reviewed his PNR records, he was surprised to find that some of the travel data the government had about him was incorrect—some flights were missing, and in four cases, the government had records of flights he never took. For example, a PNR record from 2021 shows that Linde traveled to Belfast, Northern Ireland; Linde said he had booked a flight but changed his plans and never boarded the flight. “What do companies do with this data?” Lind asked, scrolling through a copy of the PNR records on his laptop. “If commercial companies help analyze incorrect data, you can draw all kinds of conclusions.”