Wednesday, March 10, 2010

How to park at Oakland airport without paying - and some interesting security and privacy revelations

So I came back today from my weekly trip to LA. Got in my car, parked as always in OAK daily parking, and headed out. Inserted my ticket into the pay-by-credit-card machine, and... after a minute, it spat the card back at me saying a processing error occurred and that I should go to a cashier.

OK, been there before once or twice. Backed up and drove to a cashier.

This is where things became interesting.

The cashier takes the card, puts it in the machine, and waits. Then he closes the window and gets on the phone. I'm getting a little irritated at this point. I become a whole lot more so when he gets out of his booth to write down my license plate number, then gets back into the booth and gets on the phone again.

Five minutes later he opens the window and apologizes, saying there's a problem and he's waiting for them to tell him what to do. "What problem?" I demand. He says "the machine says it's a swap ticket".

A what now?

So somebody comes from the main office and they have a hushed discussion and then the machine finally displays a number - $374. Not bad for one and a half days of parking. I get really upset at this point.

More back and forth and it transpires that for some reason, their system has decided that my ticket wasn't mine, but somebody else's. I was angry by now, but then it hit me - I can treat this as a game. My goal - to inflict as much financial damage to OAK as I can in arguing my position, and as a secondary goal, I will get out tonight without paying.

Smiling to myself, my entire demeanor changes.

When the guy comes back (now 30 minutes into this ordeal) and says "look, just show us your itinerary and we'll honor the printed time stamp on the ticket", I look him back and say "oh no you don't. I have the itinerary right here on my screen" (covering it with my hand, having pulled it up on my laptop earlier expecting to have to show it) "but you won't get to see it until you promise me that if you are proven wrong in your false accusation of my honesty, I get to leave without paying".

I also wink at the cashier, to whom I have already shown the itinerary previously, and who is at this point completely on my side. I told him what I was doing and why; after all, I don't really care about paying because I expense it to the client, but rather it's a matter of principle. He liked it. So much in fact he said "I admire you for doing it, our system sucks".

It's rush hour at OAK, and there are long lines of car assembling at the other two cashier booths, not to mention all the messy maneuvering that is taking place with cars coming in and then backing out of our lane. I look the office person in the eye and tell him "I am now messing up traffic and freezing one third of your capacity to handle traffic by blocking this lane at your busiest evening hour. I urge you to consider this matter favorably quickly". He runs back to the office. I grin and wink at the cashier, enjoying myself thoroughly.

Eventually the guy comes out, comes over and almost begs "please show us the itinerary. We'll let you out for free". I instantly smile and show it to him. He says can you email it to me? I say "why don't I come to the office and print it out for you?". We do just that.

And that's when I finally understood the entire business of what was going on, and learned some very interesting things about security and privacy at OAK.

They tell me that the system says I got in on 2/22. They even show me a picture of my license player and an entry from that date.

Aha!

It's all very simple really. I park at OAK every week. Have you ever noticed that whenever you come in and go out, there is a big a spotlight that shines on your car for a second? and that there are cameras in every lane?

Well, guess what. It seems like our friends at the airport are using a system similar to the one Fastrak uses, where everyone coming in has their license plate pictured and noted in a database, and then matched up with the exit record when you put your ticket into the machine. That's how the "swap ticket" problem can exist; the parking system doesn't just rely on the information encoded on the magnetic stripe on the parking ticket, but rather matches it up with the database entry reflecting the related license plate.

Of course, if you have multiple recent entries... and the wrong one gets pulled up... you get a "swap ticket" warning.

Now this is a rather complex and expensive system to operate. So for them to invest all the money and effort into doing this means one of two things:

1) airport parking scams are costing them a lot (I highly doubt that this is true); or
2) they got homeland security funding to install the system so that our government can also have a record of all those license plates and entry/exit records.

Guess which of the two is more likely?

Oh, and I did get out for free.

0 Comments:

Post a Comment

<< Home