When discussing the notion of travel my barber once told me, "You can have a good trip... or you can have a good story." While this axiom doesn't hold true 100% of the time (my first visit to Hawaii comes to mind) it most surely applies to the most recent trip to Norway for HackCon 5.

HackCon selects speakers from a wide range of places, making for a remarkable package of talent at a very small conference. Some of the absolute rock stars who were present this year include: Moxie Marlinspike, Chris Nickerson, Morgan Marquis-Boire, Chema Alonso, José Palazon, Egypt from Metasploit, the Prez, Andrea Barisani, Daniele Bianco, and of course Renderman. For some reason they keep letting me slip past the selection committee, as well. With so many speakers coming from the States, it's always fun seeing who will be on flights together.

The story begins with Renderman, Grey Frequency, and i heading to Newark airport for the voyage across the Atlantic. I was traveling with my customary array of 81mm mortar round cases for luggage. Now, as anyone who has seen my Flying with Firearms talk will know, i typically pack a gun in every piece of checked luggage in order to allow myself to use heavy-duty, non-TSA locks. On some international trips, that involves extra paperwork. Sadly, on this bounce to Norway, i didn't take the time to clear that in advance and consequently wasn't prepared for such measures. I opened a small package of TSA-compliant locks that Daisy Belle bought me for just such an occasion, and was glad to be able to lock my luggage in some fashion, even if it did look a bit silly to see such puny, tiny locks on my massive, rugged cases...

I checked-in and started heading towards the departure gate. I was amused by a call from Renderman just before i proceeded through passenger screening. "So i suppose you're somewhere in the airport already, yes? We just saw your cases zip past us on a luggage belt." Heh, they are quite distinctive.

The three of us grabbed a table at the Sam Adams Brew House, enjoyed a meal and some drinks, changed a little currency, and then we were off on the first leg of our journey, to Copenhagen. The next morning we awoke as the plane landed there in Denmark. After a brief stroll through CPH airport, we caught our small commuter flight (also operated by Scandinavian Air Service) to Oslo. Upon arrival, i instantly noticed that one of my three cases was no longer sporting a TSA lock on the outside.

I inspected the case to find no trace of the lock (sometimes if a baggage inspector is lazy or in haste they will place the lock inside the bag when closing it up), no "Notice of Inspection" paper form, and came to see that i was missing some belongings. My pepper spray, my knife, and Jackalope's birthday gift were gone. Since these were among the last things added to the case, they were right near the top. The trip was off to a great start.

We met up with Dag and Håkon, two fellows who have become good friends to us in Norway over the years, and proceeded to the hotel. We would later learn that a number of other travelers had luggage incidents (typically just misrouted or delayed bags) and this is nothing new for SAS.

HackCon itself was wonderful, as always. Spending time with everyone in Oslo was outstanding, snow and all...

When it came time to pack our luggage on the last night, i faced a conundrum. I was short one luggage lock. I had three options at that point:

1. Attempt to purchase a replacement TSA lock. This hardly seemed like a good plan, since most of the shops were closed and since it was uncertain if i could even find such a lock in a nation that couldn't give a damn about the policies of a bumbling government agency over 4,000 miles away.

2. Simply use a carabiner or some other simple clip to hold my case shut. I do this on occasion during transport in my vehicle, simply as insurance against the little "clasps" popping open. A carabiner will at least prevent catastrophe. However, virtually every single time i have had one on the exterior of a piece of luggage it gets stolen.

3. Use a proper padlock of some kind. It may come as little shock to you that i had some available.  ;-)  However, all of the locks with me are ones that i value. Some i had purchased on this very trip. I had little interest in applying a brand-new, good-quality lock to a piece of luggage only to have it potentially cut off and thrown away mere hours later. I've had locks cut off in the past, back in the days before i flew exclusively with firearms. It's never a pretty sight when the cases would come out at baggage claim...

I wound up going with a modified version of door number three... i chose to lock the last case using a "real" lock, indeed... i went with one of my government-grade Abloy Protec shackle-less puck locks, the same one i use when transporting actual firearms...

My reasoning was based on the fact that on this direction of the trip, the airlines have no regulations concerning what locks are "approved" and which ones aren't. Passengers are typically allowed to lock luggage and if a security alert happens, they are paged or otherwise located by the airlines if possible. Since Oslo airport was very small, it seemed quite likely that we would be located if any problems arose.

However, none did. I informed the check-in staff of the locked luggage (two cases with TSA locks, one with the Abloy Protec) and they had no complaints at all... the only concern they had was whether i should be using the primary or the "special" baggage drop area.

The point at which things got interesting was once we had boarded our small SAS flight bound for Copenhagen. We seemed to be taking quite a long time to push back from the gate. Eventually the pilot came on the PA system, informing us that there was a concern about how compressed the plane's front shock absorber appeared. It was probably nothing, he assured us, but they wanted a specialist to come and inspect it before we went wheels up.

Twenty to twenty-five minutes later, that matter was cleared and we were given a green light. The additional time spent on the tarmac in blizzard conditions meant another round of deicing, which added maybe five minutes more to our already considerable delay. SAS prides themselves on being "Europe's most Punctual Airline" and while this is often the case, today was the exception to that rule.

We hit the sky and less than an hour later were safely wheels down in Denmark. Now this is when the Americans began to worry. We had originally been booked with a layover of approximately one hour in Copenhagen. The airport is large, busy, and hard to navigate. Being that we were departing the EU, a clearing of Passport Control is also necessary. We were all in the rear of the aircraft which was slow to unload, and had to make a mad dash to an entirely different terminal once we deplaned.

After hasty and flustered goodbyes with Moxie and the Prez, the three of us started racing through CPH, desperate to make our connection. As we proceeded around the vast array of duty-free liquor, decadent chocolates, and grossly overpriced lingerie we spoke with a uniformed fellow to see if we were on the right track. He motioned up to a large electronic display board... "Yes, you want gate C-33, but it appears that the door is already shut," he informed us. Our hearts sank. There, in letters formed by the angry glow of little yellow LEDs, was the word CLOSED staring down at us like a cackling gargoyle perched on a gothic building ledge.

Dejectedly we walked back to the Transfer Center where we hoped to learn of an alternate flight leaving sometime later in the day. It was still quite early (shortly after 10:00) so our hopes were high. We took a number and waited in line. Render and Grey were pleased to be in my "traveling party" since my Star Alliance Gold card caused the ticket queue machine to produce a number far lower than those issued to the other displaced travelers who milled about with sour looks.

We hadn't been in line for more than a minute, however, when we heard a shocking announcement on the airport's loudspeakers... SAS was paging our names to the allegedly "closed" gate! The Scandinavian voice echoing through the rafters in a tinny, almost robotic, way acted as a starting gun and again we were off to the races.

We cleared passport control (delayed for a moment by a young girl with reddish hair who seemed to be traveling halfway across Europe with no documents beyond an expired student ID like Franka Potente in The Bourne Identity) and arrived, panting, at our gate. The faces of the SAS staffers there did not inspire confidence.

"Where the devil have you been?" one of them asked. We started offering explanations about everything from the mechanical problem to the error on the big board to the ordeal of running across multiple terminals when i abruptly cut in... "It doesn't quite matter what happened before, what matters is we're here and we don't want to take up any more of your time. Can we board now?"

With a "i love giving people bad news" look in her eyes, the lady who had first addressed us (i'll simply call her the Head Cunt In Charge, or HCIC for short) said that she'd look into the matter and would let us know in one second. She proceeded back to the jetway and spoke on a phone, i assume to the pilots or the flight attendants on board. When the HCIC returned to the counter, her expression told us everything before she even opened her mouth. "I'm afraid they're ready to go. You won't be able to board." We pressed and pleaded for them to open the door. We reminded them that they had just paged our names minutes ago on the PA system. No luck.

I attempted to make these people see reason. "Let me get this straight," i inquired. "You aren't willing to let us board the plane and take our seats... an act that would take maybe two minutes, tops. But you are willing to keep us off this flight... which necessitates the removal of all our checked luggage from the belly of the plane. That alone could take as much as ten to fifteen minutes. Where is the logic in that??"

The HCIC countered this by asserting that due to our connection's late arrival, our bags were among the last ones loaded on the plane and consequently they were right by the cargo door. Thus, she asserted, they have already been removed.

I was incredulous at this point. I simply couldn't believe that they would have taken the measure of removing passengers' bags mere moments after issuing a page for said passengers to proceed to the gate for departure. It simply didn't make sense. The HCIC and her ilk would have none of it. We were not going to be flying today, at least not on SK 909. As we turned to walk away, we could actually hear them giggling to one another about our predicament.

We proceeded back through the now semi-vacant halls, through passport control again (with the quizzical "didn't we just see you" looks that were to be expected on the faces of the border agents), and to the Transfer Center. It was there that we were helped by Charlotte, who couldn't have been nicer. She was infuriated to learn of the behavior of the HCIC and others at the gate. She couldn't imagine why we would have been paged and still bumped from the flight. She did everything in her power to make things right... including booking us with good seats the following morning on a flight through Sweden, arranging for a hotel, meal vouchers, etc.

She turned to the topic of our checked luggage. "Did we want it brought to us right now so we'd have it this evening?" she asked. All of us agreed that it would be nice. "Not a problem. You have to head down one level to Ground Transport for your vouchers, and the baggage claim is right there. Your belongings will be on belt number seven."

We went down to the lower level. Our bags weren't on belt number seven, but then again... hardly anyone's bags seemed to be there. We shrugged and assumed they'll be along shortly. In the mean time, we spoke to Kirsten at the SAS desk down there. She came across as rather dour and cold (although, compared to the delightful Charlotte even Katie Couric might seem a bit stoic) but was able to sort out our paperwork and handle everything we needed in relatively short order. "So, you've claimed your bags from the belt then?" she asked at the conclusion of our exchange.

"Uhm, no," we responded. With quizzical looks on our faces we asked her if it looked like we had our bags. "Well, they should have been on belt seven just behind you." We looked over our shoulders...

Now, there were virtuallyno bags on belt number seven. Or any other belt, for that matter. We were at a severe arrival lull in the airport's schedule (it was past the morning rush but before the midday flights at this point) and the room was fast becoming deserted.

Kirsten was at a loss as to what could have happened. She placed additional calls to other staffers at various extensions. When i inquired if there was any chance our bags had never been removed from SK 909, she immediately responded, "No. That can not happen. Planes are not allowed to fly with luggage if the passenger isn't on the flight." Well, "duh, lady" i thought to myself... that's only rule #1 for anti-terrorism planning.

As the three of us sat and waited on a bench, a number of SAS ground crew and baggage throwers appeared and disappeared. Some spoke to us, asking if we were sure that none of the items on the belts were our bags. At one point i all but lost it and blurted out, "You're right... the two small backpacks and the baby stroller that we've seen trundle past us fifty times now actually are our bags. We just didn't notice them until you pointed them out! Thanks, buddy!" Eventually, i resorted to pulling up a DEFCON photo showing my cases on the curb at the Riviera so as to indicate to these employees exactly the size and scope of the missing items. These aren't pieces of luggage that slip off a cart and go unnoticed or get mixed in with a pile of similar-looking generic Samsonites.

I asked each new person that spoke with the same question... could our luggage be on the originally-scheduled flight. Each person kept asserting "no way" with greater and greater fervor. And yet, in spite of all their assurances, no one could find our luggage. CPH airport is large, but it's not infinite. There simply weren't that many places our luggage could be. After nearly two hours, i was certain something was very wrong.

Finally, we were approached by a fellow wearing a proper, full suit. It was then that i knew the shit had probably hit the fan completely. His name was Christopher Norris, and his "Supervisor" nametag seemed a bit more commanding than all of the others we'd seen that day. "We have found your luggage," he stated dryly.

I wasn't even wearing a watch, but for dramatic effect i pulled back the sleeve of my sweater and pretended to look at my forearm and do a little math in my head. "Let me guess," i stated, "it's somewhere over Iceland right about now?"

Mr. Norris admitted this was the case. The bags had never been unloaded from SK 909. We had been lied to by the HCIC, who had (i surmise) lied to the gate staff in order to assist the aircraft in taking off without any delay. After a bit of facepalm all-around, Mr. Norris offered sincere apologies and expressed dismay over what a violation of security this was. "Yes, i am quite aware of that," i replied. It was then that he noticed the Secret Service shirt i was wearing.

"Hmm... is this going to get, uhm, written up somehow?" he asked? When i stated that yes, it was, he was pleased. "Good... that's just what should happen. It was unacceptable for them to do that." So score one for Mr. Norris, whose attention to duty as well as regulation would be a fine addition to some of his co-workers' routines.

We went to the local hotel, without our luggage but in possession of these smart little SAS "we're sorry we kinda screwed the pooch" kits that include sundries and a sleep shirt. The hotel was of a prim and efficient design, with lots of simple wood surfaces and an absolutely delightful contraption in the dining room that i took to calling the "Cheese-O-Matic." If anyone can ever find one of these for sale, i just might kiss you. We stayed up late, drinking Aquavit and watching the video game documentary Frag. It was nice to have a quiet evening with just Render and Grey.

The following morning, we went back to the airport and boarded our flight to Sweden. After a brief layover there, (and a wholly intrusive but amazingly ineffective pass through an inexplicable bit of boarding-gate security) we were off to the United States... each one of us curious to see what fate awaited us and our baggage once we made it back to America's shores.

We were able to depart the plane and clear passport control with ease. Things then became unclear as we wandered around the baggage claim. Was our luggage from the previous day going to arrive on the belts now? After a brief period, it became obvious that this was not the case. Was the CBP holding it somewhere and would we have to speak with them? Apparently not, since every Customs official that we could find told us there was no provision for such a scenario. "Isn't that sort of the job of Customs?" i murmured to Render, "to... you know... hold on to items before they are cleared to enter or leave a country?"

In the end, we wound up exiting the border control zone and walking into Newark airport proper. In the US, we learned that Scandinavian Air has a very small personnel contingent. We found the SAS help counter, staffed by one lone fellow named Jonathan...

Right away, we began to learn that the entire SAS operation here in EWR airport knew about the "three people from yesterday whose bags came on the previous flight." Everyone was livid over what SAS Denmark had done; apparently it was not the first time that happened.

Jonathan told us that we had done the right thing by exiting customs. SAS had our bags and our luggage would be brought to us out here. "What about the Customs Inspection process?" i asked. "Don't the bags have to be screened before they can arrive fully in the United States?" We were told that the procedure in such an event is for the bags to be summarily opened and screened. I explained that my cases had been locked. "Well, it's likely that they would have cut the locks off," came the reply.

"Heh, i don't think you quite understand how these cases were secured," i tried to explain.   ;-)

After some more minor delays and confusion, we were moved along to other areas of the airport and spoke with additional SAS employees. It quickly became clear that everyone... Wayne, Joanne, Ian... they all knew about our incident. Sadly, none of them seemed to have a clear picture of where our bags actually were and when they'd be brought to us. Eventually, Ian told us that our luggage had been in a storage office and was being delivered out at the curb in a "white truck."

So, we wandered outside... looking for O.J. Simpson and Al Cowlings to perhaps arrive with our luggage. Right when i thought the whole process had gotten silly to the point of being someone's idea of a joke, guess what pulled up...

The driver swung open the side panel and started unloading baggage. Render and Grey spotted items of theirs. Then came the familiar clatter of my metal cases. One came out, and i could clearly see the TSA lock missing. Another came out... same story. Then the third one was unloaded.

It was still locked.

I couldn't believe it. The lock was still in place. There is absolutely no way on earth that anyone would have been able to open the case. And as you'll see in subsequent photos, they surely did try! There were obvious pry marks around the lid, particularly on the left side...

And when that attempt clearly failed, it appears they then considered attempting to cut the lock... and realizing they had about as much chance for success as a one-legged man in an ass-kicking contest, they appear to have tried to cut the shackle of the hasp. You can see the scratch marks where it appears they attempted to insert bolt cutters behind the puck padlock but were unable to get any room to execute that plan...

Someone also seems to have then had the notion of unscrewing the hasp itself. Little did they know that the nuts on the underside have been welded to the bolts and the lid of the metal case, fusing the whole affair into solid, immobile metal. The CBP figured that out soon enough, however, when they started mangling the tips of their screwdrivers...

Once i was able to stop laughing, i started to become aware of the full impact of this situation.

This effectively means that an entire suitcase was brought into the country, without the accompanying passenger. And, i should point out... without the name actually matching a real identity... since the organizers of HackCon often misspell or incorrectly input our names due to language barriers. This year was no exception, and many of us (myself included) were in the system under a wrong name. Also, this particular case contained a six-pack of beer.

 

So now... are you following along, people? Let's review what we have in this situation...

 

1. My luggage contains a large quantity of canisters of liquid.

2. The luggage was secured with impenetrable locks.

3. Said luggage was tagged with a name that didn't match a real person's identity.

4. This luggage was allowed to fly on a commercial airliner, inbound to the US on an international arrival, without the owner actually on the plane.

5. The luggage was then processed through Customs... and quite clearly someone really wanted to get into my one case at some point, then essentially said "ah, screw it."

6. We were given the luggage curbside up outside of any secure area of the airport (at someone from SAS did check our baggage tickets, although we were unattended at the curb for quite a while and could have easily driven away)

7. When i asked the last person from the airlines who assisted us if there was anything else we needed to do, he said "nope, you're all set," and we drove away from the airport never having been screened or scanned by Customs for any of the luggage.

I have subsequently followed-up with SAS Airlines, the TSA, Customs, and the FAA regarding this whole ordeal. Here are brief summaries of the exchange between all parties...

 

Transportation Security Administration

me: "I had a lock cut off, a bag opened, and stuff taken. No notice of inspection was present. Was that you guys or someone else?"

TSA: "We always leave a note, so it wasn't us. Talk to the airline."

me: "OK. Well, there's also this wickedly bad matter of airline security policy being violated. To whom do i report that?"

TSA: "Not us. Talk to the FAA."

 

Scandinavian Air Service

me: "You guys stole shit from my luggage."

SAS: "That was on your outbound flight? That seems to have been over a week ago. Your time window for telling us this has passed. Please feel free to fuck off."

me: "And what of the matter of your colossal fuck-up in Copenhagen?"

SAS: "Talk to SAS Denmark. Here's the contact info" (said info included an email at the domain of sas.se for some inexplicable reason)

me: emails sent to all SAS contacts i could find

SAS: no further response

 

Federal Aviation Administration

me: "Holy space monkey balls... violations of policy! colossal fail!"

FAA: "Thank you for leaving this message. We will look into the matter and get back to you." (no response)

 

Customs Bureau (national office)

me: "Super fail blah blah blah."

CBP: "If there are bags with no passenger present, we screen them and then turn them over to the airlines like lost luggage."

me: "Why were the TSA locks cut? Do you not have the master keys?"

CBP: "I couldn't say. Talk to Customs at Newark Airport"

me: "OK. And, by the way, what is your name, miss?"

CBP: <click>

 

Customs Bureau (EWR airport)

me: "Did i do something wrong by leaving the airport? Why were my bags not screened?"

CBP: "Well, you mention they were opened. So we did screen them."

me: "Not the one with the super-heavy lock, you didn't."

CBP: "Yeah, well... i'm sure we sent it through the x-ray and assumed that was sufficient."

me: "So... regarding my remaining TSA locks that were cut off. Don't you guys have the master keys? Or is that just the TSA only and not you folks in Customs?"

CBP: "No, we have those keys. We typically use them. But there's so many locks. Sometimes we just cut them off to save time."

 

So here we are now, at the heart of the issue.

The slapdash enforcement of policy and the almost improvisational means by which situations are addressed when "routine" breaks down is pitiful. Many of us hate seeing the TSA "notice of inspection" in our luggage when we arrive at a destination...

But at least this is a (sort of) clear indication that any disturbance to our belongings was at least made with something of an attempt at legitimate duty. What is infinitely more aggravating (at least to me) is when screeners don't follow procedure and neglect to place a notice in my luggage. What am i to think then? That there was an attempt at luggage pilferage by a bag thrower? The same goes for the TSA compliant locks. My associates and i have had them cut off just about as frequently as we have had them opened properly by the TSA. This is because only supervisor screeners have the master keys... but just about everyone has access to bolt cutters. On a busy day, they don't stop the line to get a supervisor, they just chop and go.

The entire baggage screening process should be revised, in my opinion. All passengers should remain with their luggage after check-in and should be present for the screening, much like what often takes place nowadays when one travels with a firearm. Our x-ray and chemical residue testing machines should be well-researched and modern enough to eliminate most false alerts. In my ideal world 95% of the time or more, passengers would give their locked cases to the TSA, a short scan would happen, and with a happy thumbs-up they'd be sent on their way. Only in the rare instance of an alarm would the passenger unlock the bag, step back behind a rope or other barrier that allows clear viewing, then re-lock the case after the completion of a hand-scan.

If that is a bit of a pipe dream right now, then we could at least enact the following rule... absolutely and and all instances of bag inspection must conclude with the insertion of a notice of inspection. All TSA screeners should be issued a stamp at the start of their shift... a stamp calibrated (like an old fashioned bank date stamp) with the date, their station ID, and some unique ID number that can be tied to them, so that passengers might be able to make a specific claim of damage.

And as far as Customs goes... i'm quite certain that they are even more well-versed in x-ray screening than the TSA. I'm confident that they didn't see anything particularly crazy in my luggage (of course, there was that large array of liquid-bearing cans) and that this wasn't a massive breach of national border security. Still, the lack of any formal storage area in the border zone for displaced or otherwise misrouted luggage is strange to me.

Heh, and after all of this... would you believe Renderman and Grey Frequency were still missing one bag? It was eventually found a few days later, having passed through Zurich of all places. In the words of Renderman, "It sucks that my bag went to Switzerland before I did."

Ah well, i leave this story here as an illustrative tale regarding how things can go wrong in a number of manifold ways and how badly the system can fail when some people aren't particularly dedicated to doing their jobs very well. At least we all made it home safe, sound, and in one piece.

May you all have safe and easy-going travels, even if that means you don't always have a story to tell when you get home.   ;-)

- dev