The US (and almost every government) has reliable ways to covertly move a person that don't involve putting SQLi in their own codebases.

The classic way to covertly move a person is to give them a new passport to travel under, and have them move around like every other schlub on the planet. Competent intelligence services make sure that this isn't easy to detect by making the fake passport's identifier indistinguishable from real ones. Russia has prominently failed to do this several times[1][2].

[1]: https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how...

[2]: https://www.bellingcat.com/news/2022/08/25/socialite-widow-j...

yes, they _definitely_ need to access flycass to achieve this. Almost certainly no other way.

I think a TLA would jsut generate the proper flight crew credentials.