Facial Scans at U.S. Airports Violate Americans’ Privacy, Report Says

WASHINGTON — A new report concludes that a Department of Homeland Security pilot program improperly gathers data on Americans when it requires passengers embarking on foreign flights to undergo facial recognition scans to ensure they haven’t overstayed visas.

The report, released on Thursday by researchers at the Center on Privacy and Technology at Georgetown University’s law school, called the system an invasive surveillance tool that the department has installed at nearly a dozen airports without going through a required federal rule-making process.

The report’s authors examined dozens of Department of Homeland Security documents and raised questions about the accuracy of facial recognition scans. They said the technology had high error rates and was subject to bias, because the scans often fail to properly identify women and African-Americans.

“It’s telling that DHS cannot identify a single benefit actually resulting from airport face scans at the departure gate,” said Harrison Rudolph, an associate at the center and one of the report’s co-authors.

“DHS doesn’t need a face-scanning system to catch travelers without a photo on file. It’s alarming that DHS still hasn’t supplied evidence for the necessity of this $1 billion program,” he added.

A spokesman for the Customs and Border Protection, an arm of the Homeland Security Department, did not have an immediate comment in response.

The report comes as Homeland Security officials begin to roll out a biometric exit system that uses facial recognition scanning in 2018 at all U.S. airports with international flights.

Customs and Border Protection has been testing a number of biometric programs, partnering with several airlines in Atlanta, Boston, New York and Washington. It will cost up to $1 billion, raised from certain visa fee surcharges over the next decade.

Customs officials say the biometric system has also produced some successes in the pilot testing and has helped catch people who have entered the United States illegally and are traveling on fake documents. They noted that facial scans and fingerprints — unlike travel documents — cannot be forged or altered and therefore give agents an additional tool to ensure border security.

But Sens. Edward J. Markey, D-Mass., and Mike Lee, R-Utah, expressed concerns about the report’s findings. In a letter to Kirstjen Nielsen, the Homeland Security secretary, the senators urged the department to delay rolling out the facial scans until it addresses the privacy and legal concerns identified in the report.

In 1996, Congress ordered the federal government to develop a tracking system for people who overstayed their entry visas. After the Sept. 11, 2001, attacks, an entry- and exit-tracking system was seen as a vital national security and counterterrorism tool. The 9/11 Commission recommended in 2004 that the newly developed Department of Homeland Security complete a system “as soon as possible.” Congress has since passed seven separate laws requiring biometric entry-exit screening.

But for years, officials have struggled to put a biometric exit system in place because the technology to collect the data was slow to take hold. And many American airports, unlike those in Europe and elsewhere, do not have designated international terminals, leaving little space for additional scanning equipment.

The biometric system being tested by the Department of Homeland Security can be used either with a small portable hand-held device or a kiosk equipped with a camera.

The system snaps a picture of a passenger leaving the United States and checks whether that person is supposed to be on the plane. It compares the person’s face with a gallery of photos that the airline has collected of passengers on its travel manifest. It also checks the person’s citizenship or immigration status against various Homeland Security and intelligence databases. For American citizens, the facial scans are checked against photos from State Department databases.

Officials at Customs and Border Protection said that while the system does take facial scans of U.S. citizens, the information is used in a very limited way. The officials said scans of Americans are only used to verify identity — not to collect new information.

The officials acknowledged the privacy concerns, but said the agency is working to answer them before the facial scans are placed in all international airports in the United States.

Laura Moy, who helped write the report, said the Customs and Border Protection assurances are not sufficient.

“They can change their minds on how they use this data at any time, because they haven’t put policies in place that govern how it’s supposed to be used,” said Moy, the deputy director of the Privacy and Technology Center at Georgetown Law. “This invasive system needs more transparency, and Homeland Security officials need to address the legal and privacy concerns about this system, before they move forward.”

An executive order signed in January by President Donald Trump would require all travelers to the United States to provide biometric data when entering and exiting the country. Currently, foreign visitors provide biometric data only when they enter the United States. The executive order also calls for Homeland Security officials to speed up the deployment of the biometric system to airports.

The United States continues to trail other nations in adopting the technology to collect biometric information. Nearly three dozen countries, including in Europe, Asia and Africa, collect fingerprints, iris scans, and photographs that can be used for facial recognition of people leaving their countries.