The US government used a 233-year-old law to order two major global travel companies to track a Russian national so he could be arrested and extradited, Forbes magazine disclosed on Wednesday. The outlet sued to obtain the court records, aided by privacy advocates who have criticized such warrants as secretive and open to abuse.
The magazine also revealed that Aleksey Burkov, the alleged hacker at the heart of the affair, was sent back to Russia in 2021 under circumstances the US government has yet to fully explain.
A November 2015 court order told US-based Sabre and UK-based Travelport to provide “complete and contemporaneous real-time account activity” of Burkov’s travel for two years, and give weekly reports to the US Secret Service, Forbes reported. This was “significantly longer” in duration than a previous order issued to Sabre, telling the company to track another alleged hacker for a period of six months – which Forbes dug up in 2020. The court also banned the two companies from disclosing the order without prior permission.
Sabre and Travelport are major international tourism players. Along with the Spanish-based Amadeus, they dominate the global distribution system (GDS) industry in the West, coordinating bookings between airlines, hotels, car rental companies, and cruise lines.
Travelport is a private company, which was sold for $4.4 billion in 2018. Sabre says it processes over $120 billion of travel spending every year. It is publicly traded on NASDAQ, with a market capitalization of $2.5 billion.
To force the two companies to monitor Burkov, the US government invoked the All Writs Act of 1789. The archaic law gained attention – and notoriety – in 2015, during a probe into the San Bernardino, California terrorist attack. The FBI tried to force Apple to unlock an iPhone belonging to Rizwan Farook, an Islamic State (IS, formerly ISIS) terrorist group sympathizer who along with his wife killed 14 people in a mass shooting. Apple refused. The government was eventually able to unlock the phone, reportedly using Israeli software, but said it found nothing of use.
The US Justice Department declined to comment or provide further details to Forbes. Court filings do not show that either Sabre or Travelport fought the orders.
“Too much about these types of warrants is hidden from the public,” said Jennifer Granick, a surveillance and cybersecurity counsel at the American Civil Liberties Union (ACLU), as quoted by Forbes. She called the collection of information about future travel “particularly invasive and susceptible to abuse.”
“The police are capitalizing on private data collection to obtain revolutionary surveillance powers that are essentially unapproved and unsupervised by democratic processes,” she said.
As it turned out, Travelport and Sabre did not have to monitor Burkov for long. He was arrested on a US warrant while on vacation in Israel inn 2015. The Secret Service accused him of running a website called Cardplanet, which they said sold $20 million worth of stolen credit cards.
“I’m an average man. I was dealing with cyber security and programming, I worked with databases. I did have acquaintances among people complicit in hacking, but I myself didn’t commit those crimes – the Americans simply decided to blame all this on me,” Burkov told RT in October 2019.
He ended up taking a plea deal to serve nine years in prison, in order to avoid an 80-year sentence. He was extradited to the US in June 2020, and sent to a prison near Washington, DC. The DOJ has “yet to provide a full explanation” as to why he was released and sent back to Russia in September 2021.