Detailed information on the Secure Flight Programme can be found at

For USA flights starting 1 November 2010: Secure Flight Final Rule and Ticketing Inhibition The Secure Flight Programme, set up by the United States Transportation Security Administration (TSA), aims to increase the security on international flights and flights within the United States. The United States authorities achieve this by optimising comparisons with the so-called watch lists, for example, to prevent persons who are on no-fly lists from making their way on board an aircraft. It is imperative that the following Secure Flight Passenger Data (SFPD) be provided in the passenger name record with the flight booking for flights entering or departing the United States starting 1 November 2010: - Complete name (as it appears on an official passport) - Date of birth - Sex - Redress Number * (if available) These data must be sent by the airline to the TSA no later than 72 hours prior to departure. Flight bookings without SFPD will be rejected by the Secure Flight Programme. In this case, there is a risk that a boarding pass would not be able to be printed either at the check-in machines or online, and that additional security screenings would be required at the airport. It is also possible that the passenger would be prohibited from boarding the flight. The required Secure Flight data can be entered into the flight booking by using an SSR DOCS element. Alternatively, for existing bookings, passengers can complete the information themselves by entering their file-key at lufthansa.com > My Bookings > My booking summary. The Secure Flight Passenger Data entered at lufthansa.com will be forwarded to all participating airlines and is shown as an SSR DOCS element in the booking. Ticketing Inhibition In the scope of the Secure Flight Programme, Lufthansa will follow the express recommendation from the IATA to inhibit ticketing and as of 1 November, we will prohibit issuing a LH etix (220) for all bookings which include a flight affected by the Secure Flight Programme (operated by LH and/or an interline partner) and which have no Secure Flight Passenger Data, e.g., booked via Amadeus. This ticketing inhibition applies both for initial ticket issuance as well as for rebookings. This is to avoid a situation in which Lufthansa passengers would be denied access as a result of missing or incomplete information that is required by the United States transport authorities. For bookings with travel dates on or after 1 November 2010, for which a ticket has already been issued without Secure Flight data, the issuing travel agency will receive a notification via queue message from Lufthansa with the request that the necessary information be added, either by the travel agency or by the traveller directly at lufthansa.com. Detailed information on the Secure Flight Programme can be found at www.tsa.gov. For more information from Lufthansa about the Secure Flight Programme, visit lufthansaspecialist.com

* Persons who have been incorrectly flagged can request a redress number at www.dhs.gov/trip to avoid false identifications in future.

Secure Flight Final Rule Questions and Answers Date: 05.10.2010 Version 4 Updates in this Version Ticketing inhibition Content TSA Secure Flight Program... 2 How does Secure Flight affect Air travelers?... 2 What are the benefits of Secure Flight?... 2 Where do customers find further information about the secure flight program?... 2 Does the name on the ticket/boarding pass need to match the name on the passengers ID?... 3 In which format are Secure Flight Passenger Data entered into the booking (PNR passenger name record)... 3 Ticketing inhibition general information... 3 Ticketing Inhibition at Lufthansa and Austrian... 4 APIS and Secure Flight... 4 ESTA and Secure Flight... 4 What happens if the Secure Flight Passenger Data are not entered into the booking?... 4 What happens if Secure Flight Passenger data are incomplete by error wrong?... 5 When should the SFPD be collected?... 5 Are short term bookings (less than 72hs before departure) still allowed?... 5 Yes, but in these cases TSA requires to collect SFPD at time of booking... 5 As data is to be sent to TSA 72 hours before departure, will there be problems for booking changes or new bookings which are done in less than 72hours?... 5 Are Travelers allowed not to provide SFPD to Lufthansa?... 5 Are the Lufthansa rules also applicable for code share flights?... 5 Which Lufthansa Flights are affected by the Secure Flight Program and will Lufthansa show this information at time of booking?... 6 What happens to existing, old booking which do not contain SFPD... 6 Does Lufthansa have any plans to queue new bookings that do not contain SFPD at a given time before departure to the booking office?... 6

TSA Secure Flight Program Secure Flight Final Rule is a program developed to provide uniform watch list matching by the U.S. American Government Agency, the Transportation Security Administration (TSA). The mission of the Secure Flight program is to enhance the security of international and domestic commercial air travel through the use of improved watch list matching e.g. to prevent individuals from the No Fly list from boarding an Aircraft. Each Airlines has an individual implementation date, therefore it may happen that Airlines communicate different Dates. As a general rule, TSA does not accept any bookings without Secure Flight Passenger Data (SFPD) as of 01.11.2010 for all Airlines. How does Secure Flight affect Air travelers? To comply with the Transportation Security Administration's Secure Flight policy, the following information must be provided and must match the government-issued photo identification that will be used for travel: Full name (as it appears on passenger's government-issued ID) Date of birth Gender Redress Number (if available)* *Those who encounter misidentification are invited to apply for redress at www.dhs.gov/trip to help prevent watch list matching misidentifications in the future. TSA requires all Airlines which operate a flight to/from the USA to send this data 72 hours for ticketed bookings before the scheduled flight. TSA will match it against the No Fly and Selectee watch lists. TSA will transmit the result of the matching process to the operating Airline at time of check-in, and if the match is negative (passenger is not on the watch lists) the boarding pass can be printed the passenger may start his journey and is allowed to travel to the USA. (Other existing entry requirements have to be observed as well) In case of a positive match, Secure Flight will serve to prevent individuals on the No Fly List from boarding an aircraft, as well as to subject individuals on the Selectee List to enhanced screening (e.g. via TSA Call Center) or determine if they are permitted to board an aircraft, that is to start the booked journey. What are the benefits of Secure Flight? Secure Flight provides numerous benefits to the traveling public. First, Secure Flight protects sensitive watch list data. The program also enables officials to address security threats sooner, keeping air travel safer. By implementing one watch list matching system, the program provides a fair and consistent matching process across all airlines and reduces the chance of being misidentified. Secure Flight offers an improved redress process, so that those who are mistakenly matched to the watch list can avoid further problems in the future. For more information on the redress process, visit www.dhs.gov/trip. Where do customers find further information about the secure flight program? Detailed information on secure flight is published under www.tsa.gov.

Does the name on the ticket/boarding pass need to match the name on the passengers ID? Due to system restrictions it may happen that the name on the ticket/boarding pass does not fully match the name on the passenger s ID. But the name provided for Secure Flight Passenger Data (SFPD) is used to perform the watch list matching and needs to match the name on the passengers ID. Small differences between the name on the ticket and the name provided for SFPD should not have any serious impact. Nevertheless a close as possible match may help to avoid potential mis-interpretations. In which format are Secure Flight Passenger Data entered into the booking (PNR passenger name record) The entry format follows the APIS format it is done via special service request SSR elements. It is recommended to enter the carrier code YY as in that case the Data is transmitted automatically to all booked carriers. Examples for entry formats: Amadeus Secure Flight passenger data (SFPD): SRDOCS YY HK1-----30JUN73-M--MUELLER-PAUL/P1 (male adult) SRDOCS YY HK1-----30JUN77-F--MUELLER-PETRA/P2 (female adult) SRDOCS YY HK1-----12JAN10-FI--MUELLER-SONIA/P2 (Infant) Additional information: SFPD (DOB, Gender, full name) data elements will be set as mandatory fields in SSR DOCS, in case information is missing, following error message is displayed: INVALID FORMAT - NOT ENTERED.Corrections of the SSR Elements are done via cancellation and re-entry. Redress number information (not mandatory - only inserted if passenger advises they have a redress number) SRDOCO YY HK1--R-123456789---US/P1 SRDOCO YY HK1--R-45675567---US-I/P1/S3 (Infant) Galileo: (SSR created for segment 1, SFPD) SI.P1S1/DOCS*////12JUL66/M//MAIER/JOHN/PAUL Apollo: (SSR created for segment 1, SFPD) 3DOCSN1/////12JUL66/M//MAIER/JOHN/PAUL Abacus/Infini/Sabre: (SSR created for segment 1, SFPD) 3DOCS1/DB/12JUL66/M/MAIER/JOHN/PAUL-1.1 (Adult) 3DOCS1/DB/07JUL2008/MI/ADAMS/BABY-1.1 (Infant) Worldspan: 3SSRDOCSYYHK1/////12JUL66/M// MAIER/JOHN/PAUL -1.1 More detailed information regarding the entries can be obtained via the local GDS s helpdesks or helppages. Ticketing inhibition general information Following the ATA vote of resolution 20/60 and 20/61, latest as of 01.11.2010 for ARC (US) Travel Agencies it will not be possible to issue a ticket if no SFPD has been entered into the booking Furthermore, within IATA a Recommended Practice was approved, which recommends Airlines to inhibit the ticket print in case of missing SFPD. Abacus, Infini, Sabre and Travelport announced that they will follow this recommended Practice and will implement a world-wide Ticketing Inhibition. For Travel Agents working with these GDSe it will not be

possible to issue a ticket in case Data is missing Flight subject to Secure Flight. (missing SSR DOCS Element in the booking). There is no differentiation based on the validating Carrier. As per current status, Amadeus will also implement a Ticketing Inhibition functionality based on the validating carrier -. In case the validating carrier follows the IATA Recommendation, it will not be possible to issue an eticket on his ticket stock, if the required SFPD Elements are missing. Ticketing Inhibition at Lufthansa and Austrian Lufthansa and Austrian will follow the Recommended Practice and will world-wide inhibit the issuance of tickets as of 01.11.2010 if no SFPD is entered in the booking (SSR DOCS Element). Due to this measure it will be avoided that Lufthansa and Austrian passengers are denied to board an Airplane due to missing or incomplete data and the requirements of the US-American government agencies. That means that for Travel Agencies working with Amadeus it will as of 01.11.2010 not be possible to issue a Lufthansa or Austrian etix (220 or 257-ticket) (first issue as well as reissue/exchange) as soon as a Flight subject to Secure Flight is part of the itinerary, but no SSR DOCS Element for this flight is available. This is independent of the operating carrier (either LH, Austrian and/or an Interline Partner) Abacus, Travelport and Sabre it will as of 01.11.2010 not be possible to issue any ticket independent of the validating carrier, as soon as Lufthansa or Austrian as operating carrier is part of the itinerary with a leg subject to Secure Flight, which does not have a SSR DOCS Element.. APIS and Secure Flight In case the booking contains full APIS information (Address, Travel ID, Name, Gender, Passport etc,) an additional element for secure flight is not required. But contrary to APIS Data, which can be added even at time of check-in, TSA mandates for secure flight that the data have to be transmitted via the booking 72 hours prior to departure. Data collection at time of check-in is not in line with the goal of the secure flight program, which is to have an early matching against the watch-lists to increase the security of international and domestic commercial air travel. ESTA and Secure Flight Since 20 March 2010 airlines are required to carry out ESTA checks: the transport of passengers wishing to enter the USA without a visa under the Visa Waiver Program is prohibited for all Airlines if passengers have not received an electronic entry permit in advance from the US authorities. Therefore, ESTA is not related to Secure Flight. The goal of Secure Flight is, to increase the security of international and domestic commercial air travel. What happens if the Secure Flight Passenger Data are not entered into the booking? TSA mandates Airlines to transmit all Reservations in/out of the USA to the US-Department of Homeland Security independent whether the Secure Flight Passenger Data are available or not. TSA announced in June 2010 that [ ] Passenger reservations without full SFPD will be rejected by Secure Flight [ ] Based on this information, the risk is that neither online nor kiosk check-in is available, as TSA only allows the print of boarding passes, if the match against the selectee/no Fly Watch lists is negative (passenger is not on the selectee or no fly list). In case no SFPD data is in the booking, the match can not be done, which may lead to the fact that the boarding pass can not be printed without additional

security measures at the Airport. Another potential result is that passenger(s) represented by that PNR be denied boarding on the covered flight. In case of missing SFPD, Lufthansa and Austrian will inhibit Ticketing as 01.11.2010 What happens if Secure Flight Passenger data are incomplete by error wrong? In case data is incomplete and/or wrong, they can either be added/changed via the above mentioned SSR Elements. Lufthansa and Austrian passengers can add/change SFPD via www.lufthansa.com by entering the Amadeus Record locator. Entry can be done via my booking Online input of additional APIS data for entry to the USA. The data entered via www.lufthansa.com will be transmitted to all carriers participating in the itinerary, and reflected in the booking as SSR DOCS Element. In case of wrong and/or incomplete SFPD, passengers run the risk that matching with the watch lists may give a wrong result. The passenger can get by error the status selectee or even no fly, which may result in additional security screening at the airport or that the passenger may be denied boarding on the respective flight. When should the SFPD be collected? It is recommended to collect the data directly at time of reservation and to enter it into the booking. Latest 72 hours before departure Data is mandatory in ticketed bookings, as at that time Airlines have to transmit the data to TSA. Are short term bookings (less than 72hs before departure) still allowed? Yes, but in these cases TSA requires to collect SFPD at time of booking. As data is to be sent to TSA 72 hours before departure, will there be problems for booking changes or new bookings which are done in less than 72hours? No, TSA mandated that all data captured in the bookings are to be sent to the TSA 72 hours prior to scheduled flight departure. For reservation data that is added or changed within 72 hours, data is updated and sent immediately. Therefore in these cases it is mandatory to enter the SFPD directly at time of booking. Are Travelers allowed not to provide SFPD to Lufthansa? According to the legal binding general terms and conditions, following rules apply to Lufthansa customers: 13.1.1. You are responsible for obtaining all required travel documents and visas and for complying with all laws, regulations, orders, demands and travel requirements of countries to be flown from, into or through which you transit. Lufthansa is entitled to refuse carriage, if [...] 7.1.1. Such action is necessary to prevent violation of any applicable laws, regulations, or orders of any state to be flown from, into or over [...]. Therefore Lufthansa customers are obliged to provide SFPD. Are the Lufthansa rules also applicable for code share flights? As TSA requires the transmission of SFPD from the operating Airline, it may happen that Airlines implement different measures. For LH marketing flight number on a flight operated by a partner Airline, the rules which are communicated by the respective partner Airline apply. For all Lufthansa operated

Flights, Lufthansa rules apply. (E.g. Obligation of the customer to provide the data according terms and conditions, and the following additional information/queue messages) Which Lufthansa Flights are affected by the Secure Flight Program and will Lufthansa show this information at time of booking? All Lufthansa operated flights in/out of the USA are affected by the Secure Flight Program. In order to help you to identify the affected flights, Lufthansa shows since 10 th of August following additional segment Information at time of booking: SEC FLT PSGR DATA REQUIRED 72 HBD SSR DOCS The information is shown below the booked segment and stored in the background of the booking. (E.g. in Amadeus it can be displayed via RTSVC) What happens to existing, old booking which do not contain SFPD The TSA requirement to add SFPD is valid for all Flights as of 01.11.2010 independent from the date the Booking was made. That means that it is mandatory to include SFPD also for already existing bookings for all Flights departing as of 01.11.2010. In order to allow you to identify existing bookings without SFPD, Lufthansa will queue on a regular basis old bookings (start of journey 01.11.2010) to the booking office. The bookings will contain a SSR ADPI element with following information: SEC FLT PSGR DATA REQUIRED 72 HBD. This allows you to contact your customers so that the data which is required from TSA can be collected. Does Lufthansa have any plans to queue new bookings that do not contain SFPD at a given time before departure to the booking office? Yes, in order to allow the collection of SFPD (either via the booking or via www.lufthansa.com) LH as an Amadeus Carrier will use a functionality currently under development at Amadeus. A SSR ADPI (Advise Passenger Information) will be used to provide following information (acc. AIRIMP Reso 760a): SSR ADPI 1A KK1 LH0400 REQ SEC FLT PSGR DATA 72 HBD FOR ALL PSGRS in the booking. The booking will be queued to the booking office. For Amadeus Agents the queue placement will be done in Q1C11, for other GDS s the GDS will define the respective Queue. Thank you for your support which contributes significantly to avoid potential transportation difficulties for your and our customers!