Airport face scanning runs into privacy fears

Who’s in charge? The Department of Homeland Security’s U.S. Customs and Border Protection unit is leading the charge, promoting the technology on its website as “the ideal technology path to a more seamless travel experience.” President Donald Trump added urgency with a 2017 order that called for security officials to make biometrics a priority.

Meanwhile, the Transportation Security Administration, another Homeland Security agency, has been collaborating with CBP on biometrics and has set a series of goals. One is face-scanning travelers in TSA Precheck lines (and integrating that data with fingerprints). Another is face scanning more domestic travelers (on a voluntary basis) and perhaps integrating that data with driver’s license data by way of Homeland Security’s Real ID program.

How fast is this moving? In an April report, Homeland Security officials said that within four years, they intend to scan the faces of 97% of passengers, including U.S. citizens and foreign nationals, on outbound international flights.

How many U.S. airports are doing it? Ongoing biometric exit operations (including facial recognition) are used at 22 U.S. airports, including Los Angeles International Airport, San Diego and San Francisco, a CBP spokesperson reported in an Aug. 14 email.

The agency also is doing biometric entry processing at 11 U.S. airports and at airports in Abu Dhabi, United Arab Emirates; Aruba; and Dublin and Shannon, Ireland, that send travelers to the U.S. CBP location lists can be found at cbp.gov/travel/biometrics.

How does facial recognition work? Passengers submit to a photo instead of showing a passport or boarding pass. Authorities access encrypted cloud data, then compare the fresh image against existing images in government databases.

If no match materializes, airlines or CBP officials ask for ID or run checks with more government sources.

CBP officials say the process takes just under two seconds per person, with an accuracy rate of more than 97%.

What happens to these new photos? CBP says that “all photos of U.S. Citizens are deleted within 12 hours of identity verification.” Images of noncitizens may be retained longer, even up to 75 years, depending on circumstances.

The CBP noted in a report last year that “an approved partner may collect photos of travelers using its own equipment under its own separate business process for commercial purposes.”

What if I say no? The CBP and TSA say that U.S. citizens have that right and that airport authorities should be ready to process travelers the old-fashioned way. (Some noncitizens can say no, but for many it’s required. For details, check CBP’s FAQs.)

What do critics say? Many say that CBP technology is dangerously fallible, that facial recognition software elsewhere has delivered inaccurate results and that this new approach can undercut civil liberties.

U.S. Sens. Edward J. Markey, D-Mass., and Mike Lee, R-Utah, wrote a letter July 26 calling for greater transparency, warning of data leaks and asking why Homeland Security has failed to release a biometrics report that was due July 2.

The CBP spokesperson said Aug. 14 that Homeland Security’s biometric report “is in the internal review process.”

Fight for the Future, a privacy advocacy group, has launched a banfacialrecognition.com campaign calling for travelers to avoid airlines that use the technology. If the government had facial recognition surveillance technology at the time of the Stonewall Riots in New York in 1969, Fight for the Future spokeswoman Evan Greer said, “it’s hard to imagine the LGBT rights movement ever forming.”