NOT READY FOR TAKEOFFF A C E SCAN S AT AIRPOR T DEPA R TUR E GA TES

www.airportfacescans.com

DECEMBER 21, 2017

NOT READY FOR TAKEOFF
FACE SCANS AT AIRPORT DEPARTURE GATESHarrison Rudolph, Associate
Laura M. Moy, Deputy Director
Alvaro M. Bedoya, Executive Director

RESEARCH

Clare Garvie, Associate
Sabrina McCubbin, Chief Research AssistantLaura Ashley Harris, Research Assistant
Megan Iorio, Research Assistant
Nur Lalji, Research Assistant
Caroline Zitin, Research Assistant
DESIGN

Rootidwww.airportfacescans.com

DECEMBER 21, 2017

TABLE OF CONTENTSI.

EXECUTIVE SUMMARY

1

		Sidebar 1: What Is Biometric Exit?

4

II.

FINDINGS

5A.

5Biometric Exit Is a Solution in Search of a Problem

		Sidebar 2: What Is Visa Overstay Travel Fraud?

6

B.

DHS’ Airport Face Scan Program May Violate Federal Law

7

C.

DHS’ Airport Face Scan Program May Be Technically Flawed8		Sidebar 3: Understanding Face Recognition Mistakes

9

D.
		

11

DHS’ Airport Face Scan Program Raises Broader Concerns
About the Expansion of Government Surveillance		Sidebar 4: Face Recognition and Bias

12

E.
		

14

DHS’ Airport Face Scan Program Also Increases Private Entities’
Access to Sensitive Traveler Data

III.

RECOMMENDATIONS

16

IV.

CONCLUSION

17V.

ACKNOWLEDGEMENTS

18

VI.

ABOUT THE AUTHORS

19

VII. ENDNOTES

20

VIII. COPYRIGHT

25

1

I. EXECUTIVE SUMMARYAt Boston’s Logan International Airport,
travelers at one international boarding gate will
be surprised that they are being told to stop
before what looks like a sophisticated camera.1
But it’s more than just a camera—the devicecompares each traveler’s face to a Department ofHomeland Security (DHS) biometric database
to verify her identity and flags as many as 1 in
25 travelers for further scrutiny. These face scans
have been deployed at eight other airports, too.2

In Atlanta, Chicago, Las Vegas, Miami, NewYork City, Houston, and Washington, D.C.,
travelers departing on certain international
flights have their faces scanned by DHS. If DHS’
current plans are executed, every traveler flying
overseas, American and foreign national alike, willsoon be subject to a face recognition scan as partof this “biometric exit” program (see Sidebar 1).

Figure 1: A man waits as his face is scanned at Logan Airport in Boston prior to boarding a flight to Aruba. (Photo: Boston Globe, all rights reserved)

2

Not Ready for TakeoffThis sophisticated biometric screening system
could cost up to one billion dollars.7 Congress has
already created a “9-11 Response and Biometric
Exit Account” to fund a biometric exit programin that amount.8 Yet, curiously, neither Congress
nor DHS has ever justified the need for the
program. Congress never provided a rationale forit. For its part, DHS says that airport face scans
are designed to verify the identities of travelers
as they leave the country and stop impostors
traveling under someone else’s identity. But DHS
itself has repeatedly questioned “the additional
value biometric air exit would provide” comparedwith the status quo and the “overall value andcost of a biometric air exit capability,” even as it
has worked to build it.9

DHS should not be scanningthe faces of Americans as
they depart on international
flights—but DHS is doing it
anyway.
DHS’ biometric exit program also stands on
shaky legal ground. Congress has repeatedly
ordered the collection of biometrics from foreign
nationals at the border, but has never clearly
authorized the border collection of biometrics
from American citizens using face recognition
technology.10 Without explicit authorization,
DHS should not be scanning the faces ofAmericans as they depart on international
flights—but DHS is doing it anyway.11 DHS also
is failing to comply with a federal law requiring
it to conduct a rulemaking process to implement
the airport face scanning program—a processthat DHS has not even started.12

Making matters worse, the face scanningtechnology used by DHS may make frequentmistakes. According to DHS’ own data, DHS’
face recognition systems erroneously reject as
many as 1 in 25 travelers using valid credentials.13
At this high rate, DHS’ error-prone facescanning system could cause 1,632 passengers
to be wrongfully delayed or denied boarding
every day at New York’s John F. Kennedy ( JFK)International Airport alone.14 What’s more,
DHS does not appear to have any sense of how
effective its system will be at actually catching
impostors—the system’s primary goal.15
The privacy concerns implicated by biometric
exit are at least as troubling as the system’s legal
and technical problems. As currently envisioned,
the program represents a serious escalation of
biometric scanning of Americans, and there areno codified rules that constrain it.16 It may also
lead to an even greater and more privacy-invasive
government surveillance system. In addition,
the program may hasten the development anddeployment of privacy-invasive commercial
technology by the airlines and technology
vendors participating in biometric exit.
For now, DHS is moving forward with thisexpensive program. But Americans should
consider whether it would be wiser to abandon
DHS’ airport face scan program and invest those
funds elsewhere. If the program is to proceed,
however, then at a minimum:•

DHS should justify its investment in facescans by supplying evidence of the problem it
purportedly solves.

•

DHS should stop scanning travelers’ faces
until it has completed a federally required
rulemaking proceeding.

3•

DHS should stop scanning the faces ofAmerican citizens as they leave the country.

•

DHS should prove that airport face scans
are capable of identifying impostors withoutinconveniencing everyone else.

•

DHS should adopt a public policy thatprohibits secondary uses of the data collectedby its airport face scan program.

•

DHS should provide fairness and privacy
guarantees to the airlines with which it
partners.

In addition, in service to their customers, airlines
should not partner with DHS in the future to
conduct biometric screening of their passengers
without first ensuring that DHS does all of
the above, and without obtaining transparent
and enforceable privacy, accuracy, and anti-bias
guarantees from DHS.

Figure 2: A traveler has his face scanned as a Customs and Border Protection agent provides instruction. (Photo: Associated Press, all rights reserved)

4

The Perpetual Line-Up

SIDEBAR 1:
WHAT IS BIOMETRIC EXIT?

“Biometric exit” is a program that DHS operates that uses biometric data—data about aperson’s body—to verify travelers’ identities as they leave the country. DHS initially tried touse fingerprint-based verification systems. These, however, disrupted traveler flow throughairport terminals and were time-consuming and labor-intensive for administering personnel.3
Under the latest iteration of the program, DHS has turned to face recognition.
Prior to departure of an outbound international flight, DHS prepopulates its “Traveler
Verification Service” (TVS) with biometric templates of all travelers expected on the flight.4
Upon reaching the airport gate to board the plane, each traveler is then asked to stand fora photo in front of a camera. The camera transmits the traveler’s in-person photo to TVS,
which compares it against the biometric templates on file. TVS then either confirms that thetraveler’s face matches the on-file biometric template(s) for an expected traveler—and creates a“biometrically verified exit record” for her—or rejects the traveler’s face as a “non-match.”5
If the traveler is rejected by the system, her credentials will be checked manually by a Customs
and Border Protection (CBP) agent, or she will be subjected to another biometric check, suchas a fingerprint comparison.6

5

II. FINDINGS

A. BIOMETRIC EXIT IS A
SOLUTION IN SEARCH OF A
PROBLEM

A review of the biometric exit program’s history
reveals that Congress never provided a rationale
for it. DHS now claims the program is designed
to detect a particular type of fraud defined in thisreport as “visa overstay travel fraud” (see Sidebar
2).17 But available data on visa overstay travel
fraud does not suggest that the problem is great
enough to necessitate a massive and resourceintensive solution such as biometric exit.
The 9/11 Commission first recommended
the adoption of a “biometrics-based entryexit system” at the nation’s borders in 2004.18
Congress heeded the commission’s call and, soonafter, ordered DHS to “include a requirement
for the collection of biometric exit data” fromforeign nationals at the border.19 Both the 9/11
Commission and Congress were clear thatbiometrics should be collected from foreign
nationals entering the country to help detectcriminals and terrorists before they set foot on
American soil.20 Neither, however, ever explained
why it was necessary to collect biometrics fromforeign nationals leaving the country.
DHS, for its part, has never studied whether
there is a problem that necessitates a change in
its approach to tracking travelers’ departures.
DHS claims that the aim of the program is todetect visa overstay travel fraud and to improve
DHS’ data on the departure of foreign nationals

by “biometrically verifying” the exit records it
already creates for those leaving the country.21
Visa overstay travel fraud could—in theory—bea problem worth solving. Foreign nationals whowish to remain in the country undetected past
the expiration of their visas could be arranging
to have others leave the country in their placeusing fraudulent credentials. But DHS has only
ever published limited and anecdotal evidenceof this. For example, one Immigration andCustoms Enforcement (ICE) agent reportedly
stated that the brother of a foreign national had
traveled under his identity to generate a false exit
record.22
Because the rationale for a biometric exit
program is unclear, DHS has repeatedly
expressed fundamental reservations about
biometric exit. In 2012, DHS’ Science andTechnology (S&T) Directorate conducted aninternal analysis of past failed fingerprint-based
programs and came away skeptical of the very
idea of biometric tracking at the border. S&T
concluded that “significant questions remained”
concerning “the additional value biometric air
exit would provide” compared with the statusquo and the “overall value and cost of a biometric
air exit capability.”23 Four years later, in January
2016, DHS told the Government Accountability
Office that it was still developing a report—and
could not estimate when it would be completed—answering these two basic, fundamental
questions.24 As of publication of this paper, DHS
had yet to release any such report.

6

Not Ready for Takeoff

SIDEBAR 2:
WHAT IS VISA OVERSTAY TRAVEL FRAUD?

“Visa overstay travel fraud” refers to a situation in which a foreign national wishes to remainin the United States undetected past the expiration of his visa and, to do so, arranges to havea conspirator leave the country in his place using the visa holder’s credentials. This creates an“exit record” in the visa holder’s name, fraudulently leading the government to believe that thevisa holder has left the country, when in fact he has remained past the expiration of the visa,
or “overstayed.”For example, if John Doe were about to overstay his visa, he could ask a conspirator, John Roe,to leave the country using his passport. If successful, DHS’ departure tracking system would
believe Doe had left the country when, in reality, only Roe had left.
DHS describes an exit record generated after a face scan as a “biometrically verified exit
record.” A fraudulent biometrically verified exit record would be an exit record where an
impostor’s face was scanned and erroneously accepted at the boarding gate.

7

DHS’ uncertainty about biometric exit extends
to the current face scan-based program. At
a DHS Data Privacy and Integrity Advisory
Committee meeting in September 2017, acommittee member asked how DHS’ facescanning system would benefit the nation’s
immigration system. Instead of identifying
these benefits, a senior DHS official paused,then responded tellingly: “It’s not the role of theadministrative agency to question what laws are
passed. It’s our job to implement laws that are
duly passed by Congress.”25
B. DHS’ AIRPORT FACE SCAN
PROGRAM MAY VIOLATEFEDERAL LAW

DHS’ current face scan-based program also
may not comply with federal law. The program
may exceed the authority granted to DHS
by Congress because Congress has never
explicitly authorized biometric collections
from Americans at the border.26 Even if DHS
has sufficient legal authority for the program,
DHS has failed to complete a prerequisite
public rulemaking process for the program, as
mandated by federal law.

If Congress wanted to tell
DHS to collect Americans’biometrics at the border, iteasily could have done so. Itnever has.
Congress has passed legislation at least ninetimes concerning authorization for the collectionof biometric data from foreign nationals, but
no law directly authorizes DHS to collect thebiometrics of Americans at the border.27 Congresshas authorized the collection of biometrics atthe border from, variously, “every alien departing
the United States,”28 “all categories of individual
who are required to provide biometric entry
data,”29 and “every alien participating in thevisa waiver program,”30 but U.S. citizens havebeen conspicuously absent from the statutory
text of every law under this program for the last
14 years.31 If Congress wanted to tell DHS tocollect Americans’ biometrics at the border, iteasily could have done so. It never has. Without
explicit authorization, DHS cannot and should
not be scanning the faces of Americans as they
depart on international flights, as it is currently
doing.
Even if it had the necessary authorization from
Congress, DHS’ biometric exit program would
still be legally problematic because DHS has
failed to complete a rulemaking process, which
the federal Administrative Procedure Act (APA)
requires it to do.32 In a “notice-and-comment
rulemaking,” an agency solicits and considers
feedback from interested members of the public
before adopting an important new policy.
Rulemaking provides the public an opportunity
to participate in agency policymaking, but it
also serves to put the public on notice of what
an agency is doing and why, and what rules
apply to an agency’s new policy. In July, theTrump administration ordered DHS to initiate arulemaking for the program by October 2017.33
But DHS has not even begun the required
process, even though DHS has already scanned
the faces of tens of thousands of travelers acrossnine American airports—more than 36,000 in
Atlanta alone.34
This is not the first time DHS has deployed a
new privacy-invasive tool without conducting
a required rulemaking process. In fact, a few
years ago, under similar circumstances, a federal

8

Not Ready for Takeoff

appeals court held that DHS was required
to go through the rulemaking process before
using body scanners at Transportation Security
Administration (TSA) checkpoints.35
DHS must conduct a rulemaking because
mandatory biometric screening, like the bodyscanners program, constitutes a policy with theforce of law. As the court found in the bodyscanners case a few years ago, even thoughrequiring a passenger to pass through an existing
checkpoint “is hardly novel,” the adoption ofa new screening technology at the existing
checkpoint may nevertheless amount to a
substantive change necessitating a rulemaking
when it raises substantial privacy interests.36
As with body scanners, privacy advocateshave expressed deep concerns about airport
biometrics,37 and DHS itself has repeatedly
raised privacy interests as relevant to its facescanning systems.38 DHS is apparently awareof its obligation to conduct a rulemaking on
biometric exit; several years ago, it initiated arulemaking for a now-defunct fingerprint-based
biometric exit program.39
The fact that DHS’ airport face scanning
program is only in operation at nine airports
so far does not relieve DHS of its obligation
to conduct a rulemaking process. As the court
found in the body scanners case, rulemaking
requirements apply at the point in time whenan agency’s pronouncement is “of present
binding effect.”40 In that case, even though bodyscanners were only in use in some airports, thecourt found that the scanners were nevertheless“binding” on passengers, because any individual
passenger would still be “bound to comply withwhatever screening procedure the TSA is using
on the date he is to fly at the airport from which
his flight departs.”41 Face scans at specific exit
gates are similarly binding on the travelers who

pass through those gates. Face scans are strictly
mandatory for foreign nationals, and although
DHS has said that face scans may be optional
for some American citizens, it is unclear whether
this is made known to American travelers.42 A
rulemaking is therefore overdue.
C. DHS’ AIRPORT FACE SCAN
PROGRAM MAY BE TECHNICALLYFLAWED

DHS’ face scan-based biometric exit program
may also fail as a technical matter: DHS has
never measured the efficacy of airport face scansat catching impostors traveling with fraudulent
credentials.43 There is good reason to be skepticalof the system’s efficacy. Due to the challenges
inherent to face recognition, it would be difficult
for DHS to develop a system that is effectiveat catching every impostor without severely
inconveniencing all other travelers.

DHS appears to have noidea whether its system will
be effective at achieving its
primary technical objective.
Problematically, DHS uses the wrong metricto evaluate the system’s success. DHS currently
measures performance based on how often
the system correctly accepts travelers who areusing true credentials.44 But if the aim of thissystem is to detect and stop visa overstay travel
fraud—as DHS suggests—it is critical andperhaps more important to assess how well it
performs at correctly rejecting travelers who areusing fraudulent credentials. Yet DHS is notmeasuring that.45

The Perpetual Line-Up

9

SIDEBAR 3:
U N D E R S T A N D I N G F A C E R E C O G N I T I O N M I S T A K E S 47

Face recognition technology is not perfect.47 If it were, it would always correctly accept—andclear for boarding—each traveler using her own valid credentials (a “True Accept”) andwould always correctly reject any traveler using fraudulent credentials, e.g., someone else’s
identification documents (a “True Reject”).
In reality, face recognition systems make mistakes on both of those fronts. In the case of a“False Reject,” a system fails to match an airport photo of a traveler’s face to the photo on thetraveler’s own valid identification documents. A system may mistakenly reject a traveler flying
under his own identity, for example, because his photo on file was taken four years prior andhe has changed appearance since then.
In contrast, in the case of a “False Accept,” the system mistakenly matches an airport photo ofa traveler’s face to someone else’s photo. For example, a face scanning system may mistakenly
accept an impostor fraudulently presenting someone else’s travel credentials as her own.

10

Not Ready for Takeoff

As an analogy, consider a bouncer hired to check
IDs at a bar. The bar’s owner may be annoyed ata bouncer who accidentally turns away customers
using their real IDs. But the owner will almost
certainly fire a bouncer who consistently allows
entry to underage patrons using fake IDs. Likea bar owner who has not even asked how well abouncer can identify fake IDs, DHS appears tohave no idea whether its system will be effectiveat achieving its primary technical objective.

calibrated to reduce rejections of travelers using
valid credentials will increase acceptance rates
for impostors.46 For biometric exit, DHS may
therefore have to choose between a systemthat catches impostors at a high rate but also
incorrectly rejects valid credentials at a highrate—shunting innocent travelers into additional
screening and causing delays—and a system that
rejects valid credentials at a much lower rate but
also underperforms at catching impostors.

In fact, it may not be possible, given the current
state of face recognition technology, to succeed
on both of these fronts. There is an unavoidable
trade-off between these two metrics: A system

Figure 3: A face recognition device at a United Airlines gate at Houston's George Bush Intercontinental Airport.
(Photo: Associated Press, all rights reserved)

11

DHS clearly is focusing on making its facescan system minimally inconvenient for
travelers using valid credentials. DHS’ soleaccuracy requirement for the system is that 96
percent—or at least 24 out of 25—of travelers
flying under their own identity are correctly
accepted by the system and allowed to proceed
to boarding.48 But due to the trade-off explained
above, emphasizing the success of the system atverifying valid credentials—perhaps to minimize
unnecessary hassle and delays at already-busy
international airports—may increase the risk that
impostors go undetected.
Indeed, analysis of face recognition algorithms
indicates that some likely comparable systems
would not perform well at screening the typeof impostor the system is likely to encounter:someone who fraudulently uses the boarding
documents of a different person of the sameage, gender, and country of origin or ethnicity.
According to research conducted by the National
Institute of Standards and Technology (NIST),
face recognition systems, like humans, have aharder time distinguishing among people wholook alike.49 The algorithms tested by NIST are
more likely to falsely match individuals whoare similar in appearance, a fact that NIST
notes “present[s] a security vulnerability to, forexample, a passport gate."50
DHS has also acknowledged that it is unable todetermine whether its airport face scans’ accuracy
varies depending on travelers’ demographic
characteristics—even though the latest researchsuggests that DHS’ system may performdifferently based on travelers’ race and gender(see Sidebar 4). DHS indicated that it has
been testing whether its face scanning system
exhibits bias.51 DHS even tasked the DHS Data
Privacy and Integrity Advisory Committeewith investigating solutions for such problems.52

But DHS has conceded that its internal testingremains inconclusive because of the limited
sample size.53 As a consequence, DHS may well
be deploying a system that will exhibit race- or
sex-biased decisions.

Innocent people may be pulledfrom the line at the boardinggate and subjected to manual
fingerprinting at higher rates
as a result of their complexion
or gender.
Differential error rates could mean that
innocent people will be pulled from the line
at the boarding gate and subjected to manual
fingerprinting at higher rates as a result of theircomplexion or gender. But because DHS has
subsumed its evaluative process into a neutralseeming computer algorithm, this bias may goundetected.
D. DHS’ AIRPORT FACE SCAN
PROGRAM RAISES BROADERCONCERNS ABOUT THE
EXPANSION OF GOVERNMENTSURVEILLANCE

Following the January 2017 “Muslim Ban”
executive order that would have banned people
from seven Muslim-majority countries fromentering the U.S., demonstrators spontaneously
gathered at airports across the country to protest
the policy.59 What if the same technology
currently used at departure gates were also used
to identify protesters? What if it didn’t justverify individuals’ identities but also compared
their faces to those of suspected criminals or
terrorists?

12

Not Ready for Takeoff

SIDEBAR 4:
FACE RECOGNITION AND BIAS

Since February 2017, NIST has tested more than 35 different face recognition algorithms
designed to verify identities.54 Many of the algorithms tested exhibited different error rates
depending on the race and gender of the person being scanned.
Most face scanning algorithms function by first calculating the approximate similarity of
two images presented for comparison, then accepting the presented images if the similarity
calculation is greater than a predetermined match threshold, and rejecting the presented
images if the calculation falls below the threshold.55 According to NIST’s research, of thealgorithms tested that use this method, most have been found more likely to mistakenly
reject men, especially white men. At the same time, the tested algorithms were more likely to
mistakenly accept women, especially black women.56
These results differ from earlier research suggesting that certain face recognition systems may
more often fail to identify African-Americans and women,57 but the two bodies of researchshare a common, and concerning, conclusion: Face recognition may perform differently as aresult of variations in race or gender.58 This is a possibility that DHS must test and address.

13

DHS’ airport face scans raise importantquestions about the expansion of government
tracking tools in public spaces. As currently
envisioned, biometric exit is limited to certain
areas of specific airports, but the program may
be expanded to additional privacy-invasive
applications and may be made interoperablewith other law enforcement agencies’ systems
at the state, local, or federal level. The effectsof these policies on free speech and association
could be significant.
DHS intends to subject every single traveler
who departs for an international destination—
American and foreign national alike—tobiometric exit. As the Privacy Impact
Assessment for the program pointedly states,when traveling internationally, “the only way for
an individual to ensure he or she is not subject
to collection of biometric information . . . is torefrain from traveling.”60 American citizens makealmost 50 million international journeys by air
each year.61 With the added millions of trips
taken by foreign nationals departing from the
U.S. each year, the total number of face scans
annually will be even larger than that.62
Right now, scans generally take place atinternational departure gates and are conducted
as travelers board the plane, arguably with theawareness of the scanned individual. But DHS
is already exploring expansions to other areas of
the airport. At New York’s JFK Airport, travelers
headed for international flights recently wereasked to submit to a face scan by CBP personnel
at a TSA checkpoint—not at their departuregate.63 According to a DHS press release, “CBP
is assessing the use of biometric technology aspart of a future end-to-end process, from checkin to departure, in which travelers use biometrics
instead of their boarding pass or ID throughout
the security and boarding process.”64

As DHS invests hundreds of millions of dollars
into expanding its face scanning capability,
airport face scans could even be extended toinclude passive scans throughout American
airports—including of domestic travelers indomestic airports. One proposal in Congress—
the TSA Modernization Act—would authorize
TSA to use biometrics to identify and track
travelers at any area “where such deployment
would enhance security and facilitate passenger
movement.”65 That could mean real-time facerecognition surveillance cameras at “checkpoints,
screening lanes, bag drop and boarding areas.”66

The broader reaching andmore constant face scans
become, the more they will
threaten to chill free speech
and thwart free association in
airports.
The technology could also be adapted for
purposes unrelated to air travel, including
general law enforcement and counterterrorism
initiatives. For example, one high-profile billin Congress, the Border Security for America
Act, would require DHS to begin using airport
face scans to find matches against the FBI’s
Terrorist Screening Database.67 That expansion
would incentivize DHS to make its system
linkable to and interoperable with other FBI
or state criminal law enforcement databases.
Because face recognition technology makes
mistakes, counterterrorism and law enforcement
face scans could result in the investigation of
innocent people for crimes they didn’t commit.
These errors may also vary on the basis of thoseindividuals’ race or gender.

14

Not Ready for Takeoff

Figure 4: Crowds gather at San Francisco International Airport to protest the "Muslim Ban" in January 2017. (Photo: Peg Hunter, CC BY-NC 2.0)

The broader reaching and more constant facescans become, the more they will threaten tochill free speech and thwart free associationin airports. The perception of being undersurveillance encourages people to censor what
they say, especially when they hold minority
or dissenting viewpoints.68 Because airports
are increasingly prominent sites of politicalspeech, any ramp-up of biometric surveillancein these spaces—especially without data use
restrictions—could severely impact free speech
and association.69

E. DHS’ AIRPORT FACE SCAN
PROGRAM ALSO INCREASESPRIVATE ENTITIES’ ACCESS TOSENSITIVE TRAVELER DATA

So far, this paper has focused on concerns
arising from the government’s operation of its
biometric exit program. But this program also
makes travelers vulnerable to increased andunconstrained tracking by private companies.
That’s because DHS relies heavily on airlines
and technology vendors for central componentsof the airport face scan program, from provision

15

of software and hardware, to collection andtransmission of data, to processing of passenger
photos, and more. By relying on private entities,
DHS facilitates the sharing of sensitive traveler
information with outside companies that havetheir own business interests.70 Yet, despite therisk that airlines will use biometric exit data andtechnology for their own tracking purposes,71
DHS has not published any guidelines for or
agreements with its private partners.72
At every step of the biometric exit process,private entities are heavily involved. For example,
DHS is collaborating with JetBlue and air travel
IT and communications vendor SITA to buildand operate biometric exit for select JetBlue's
flights.73 Delta has been working with vendors
Vision-Box and NEC.74

There are few protections toensure that biometric exit data
and technology will not beabused.
Some airlines may well begin to explore ways tofurther monetize the technology they develop,
for example by enhancing targeted advertisingcapabilities in airports. Indeed, at a recent
event in Menlo Park, California, an investment
associate from JetBlue Technology Venturesindicated that the company’s airline is interested
in developing or using face scanning or otherbiometric technology to “hypertarget” customers
for advertising purposes.75

Some, if not all, of what airlines and technology
partners may do with any data or technology
to which they gain access through participationin biometric exit may be constrained byagreements with DHS. For example, DHS has
disclosed that it has reached a Memorandum ofUnderstanding with JetBlue that encompasses
JetBlue’s handling of biometric exit data.76
But as of publication of this paper, neither
that Memorandum of Understanding nor any
other agreement governing private entities’ useof biometric exit data has been made public.
Without greater transparency regarding suchprivate agreements and without substantive
rules governing the role of private entities
in the biometric exit process, there are few
protections to ensure that biometric exit data
and technology will not be abused.

Not Ready for Takeoff

16

III. RECOMMENDATIONS•

Recommendation 1: DHS should justify
the face scan-based biometric exit programby identifying the problem it is attempting
to solve, quantifying the scope of thatproblem, and explaining why this programis needed to solve it.

As it currently stands, the biometric exit
program is unjustified. If the program is indeed
designed to address visa overstay travel fraud,
then DHS should study how often this typeof fraud likely occurs, publish the results, anddemonstrate that it is a problem worth solving.
This could be done using data already available
to the agency. For example, DHS could review
historical data concerning the incidence of visa
overstays entering U.S. law enforcement or DHS
custody despite the existence of a biographic exit
record in DHS’ existing repository containing
data about the arrival and departure of travelers,
the Arrival and Departure Information System(ADIS).77 Such a study would lend muchneeded insight into whether visa overstay
travel fraud is common and thus into whether
a billion-dollar solution to the problem iswarranted.
•

Recommendation 2: DHS should suspend
airport face scans pending completion of afederally required rulemaking proceeding.

DHS should suspend all airport face scans at
departure gates until it comes into compliancewith federal administrative law. As detailed
above, the law requires DHS to solicit andconsider comments from the public before
adopting big-impact new programs likemandatory biometric scans. DHS must issue
a Notice of Proposed Rulemaking, respond to
public comments, and issue a Final Rule putting
the public on notice about airport face scans andthe rules that apply to them.
•

Recommendation 3: DHS should stopscanning the faces of American citizens as
they leave the country.

DHS should exclude Americans from any
biometric exit program. Congress has never
explicitly authorized DHS to routinely scan thefaces of U.S. citizens at airports. Unless and until
it receives a congressional mandate to resume
airport face scans of Americans, DHS should
work to preserve and improve upon manual
passport-face comparisons conducted at the
TSA security checkpoint by TSA agents and at
the boarding gate by gate agents.
•

Recommendation 4: DHS should
demonstrate that its technology is
sufficiently advanced to stop impostors
without inconveniencing everyone else.

DHS should study how well its face recognition
technology works and publish the results. DHS
should engage in an ongoing evaluation ofboth the effectiveness of its system at detecting
impostors under operational conditions and therate at which its system falsely rejects individuals
who are presenting their own valid credentials.
DHS should also evaluate its system’s
performance on a diverse population. Any resultthat indicates that the algorithm performs
differently based on travelers’ race or gender

17

would be unacceptable and must be correctedprior to deployment.
•

Recommendation 5: DHS should adopt a
public policy that ensures data collected byany airport face scan program will not be
used for other purposes.

To protect traveler privacy, DHS should
adopt public policies strictly limiting the useof data collected by face scanning systems to
the purpose for which it is to be collected—toverify foreign national travelers’ identities as
they depart from the United States. The use
restrictions applicable to data collected by any
airport face scan program should include an
explicit prohibition on sharing collected datawith state, local, or federal law enforcement
without a warrant or lawfully issued court order.
•

Recommendation 6: Airlines should
condition partnerships with DHS on
fairness and privacy guarantees.

In service to their customers, airlines should
not partner with DHS in the future to conduct

biometric screening of travelers without firstobtaining enforceable privacy, error rate, andguarantees against bias. The airlines should
also demand that DHS adopt a policy that, asdetailed above, limits the use of data collectedby any airport face scanning program to the
purpose for which it is collected. The airlines
should ensure that all policies applicable toairport face scans are made publicly available andeasily accessible to travelers. And airlines should
require that any updates or revisions to thesepolicies be accompanied by a public notificationof the alteration. These requirements should be
paired with commitments from DHS to study
and remedy system bias and to enhance systemaccuracy rates.
It may fall to airline shareholders to inform thecorporate boards of the risks of unmitigatedairport biometric technologies. To that end,
shareholders may wish to recommend via
shareholder resolutions that the corporate boards
adopt a policy prohibiting voluntary participationin Homeland Security biometric projects.

IV. CONCLUSION

The face scan-based biometric exit program that
DHS is beginning to deploy at international
airports across the country is extremely
resource-intensive. But despite its $1 billion
price tag, the program is riddled with problems.
It is unjustified. It is legally infirm. It may betechnically flawed. And it may implicate serious
privacy concerns.

For all of the above reasons, Americans should
consider whether perhaps it would be wiser toabandon DHS’ face scan-based biometric exit
program, which is costly but offers no tangible
benefits and many concerns. If DHS persists
with the program, significant reforms are vitallynecessary.

18

Not Ready for Takeoff

V. ACKNOWLEDGEMENTS

The Electronic Privacy Information Center’s important work litigating a case regarding the privacy
implications of body scanners in airports—cited multiple times in this report—was in many ways
foundational to this report, as were the oversight actions of the Government Accountability Office,and the reports and stakeholder meetings of the Department of Homeland Security. This report wasalso made possible by the research of Clare Garvie, the Center on Privacy & Technology’s resident facerecognition expert, and the vigilance and gentle guidance of Katie Evans, who handles both operations andcommunications for the Center.
Critical guidance and close reading were provided by Professors Paul Ohm and David Vladeck, both ofwhom are Center faculty directors. The remainder of our expert reviewers will remain anonymous, but weare deeply thankful for their time and attention to this effort. We would also like to thank the Center's
research assistants, our copy editor, Joy Metcalf, our communications firm, Spitfire, and our design and web
development firm, Rootid.
The Center on Privacy & Technology at Georgetown Law is supported by the Ford Foundation, theMacArthur Foundation, the Media Democracy Fund, the Omidyar Network, the Open Society Foundations,and the Georgetown University Law Center. We are particularly grateful for additional support from the
MacArthur Foundation that allowed us to successfully complete this report.

19

VI. ABOUT THE AUTHORS

Harrison Rudolph is an associate at the Center on Privacy & Technology at Georgetown Law. Harrison
received his B.A. from The George Washington University and his J.D. from Georgetown Law. Before law
school, Harrison worked as a paralegal at a law firm focusing on issues impacting consumer credit reporting
agencies.
Laura M. Moy is the deputy director of the Center on Privacy & Technology at Georgetown Law. Before
joining the Center, Laura was acting director of the Communications & Technology Clinic at Georgetown
Law’s Institute for Public Representation. Prior to that, she worked at New America’s Open Technology
Institute and Public Knowledge. Laura completed her J.D. at New York University School of Law and her
LL.M. at Georgetown.
Alvaro M. Bedoya is the founding executive director of the Center on Privacy & Technology at Georgetown
Law and co-author of The Perpetual Line-Up: Unregulated Police Face Recognition in America, the Center’s
2016 report. Previously, he was chief counsel to the Senate Judiciary Subcommittee on Privacy, Technology &the Law. He is a graduate of Harvard College and Yale Law School.

20

Not Ready for Takeoff

VII. ENDNOTES

1.

2.

See Board in a Snap: JetBlue to Launch First-of-Its-Kind SelfBoarding Program Using Facial Recognition, JetBlue (May31, 2017), http://www.mediaroom.jetblue.com/investorrelations/press-releases/2017/05-31-2017-112155081.
See CBP Deploys Biometric Exit Technology to Miami
International Airport, U.S. Customs and Border Protection(Oct. 20, 2017), https://www.cbp.gov/newsroom/localmedia-release/cbp-deploys-biometric-exit-technologymiami-international-airport.

3.

U.S. Government Accountability Office, GAO-13-683,
Overstay Enforcement: Additional Actions Needed toAssess DHS’s Data and Improve Planning for a Biometric
Air Exit Program Report to Congressional Requesters
27–28 ( July 2013), https://www.gao.gov/assets/660/656316.
pdf.

4.

To prepopulate TVS with biometric templates of expectedtravelers, DHS draws from photos captured by CBP
during previous entry inspections, photos from U.S.
passports and U.S. visas, and photographs from other
DHS encounters, which “may include those from DHS
apprehensions or enforcement actions, previous bordercrossings, and immigration records.” U.S. Departmentof Homeland Security, DHS/CBP/PIA-030(c), Privacy
Impact Assessment Update for the Traveler Verification
Service (TVS): Partner Process 4 ( June 12, 2017), https://www.dhs.gov/sites/default/files/publications/privacy-piacbp030-tvs-june2017.pdf (hereinafter “Traveler Verification
Service (TVS): Partner Process”). Because accuracy is highly
dependent on image quality, the inclusion of photos fromsources other than passport and visa databases, such as
law enforcement encounters, likely lowers overall systemaccuracy rates beyond what is assumed in this paper. See
Patrick Grother & Mei Ngan, NIST Interagency Report
8009, Face Recognition Vendor Test (FRVT) Performanceof Face Identification Algorithms, National Institute ofStandards and Technology 26–27 (May 26, 2014), http://
ws680.nist.gov/publication/get_pdf.cfm?pub_id=915761(demonstrating that comparing webcam images (a proxy forlower quality photos from other DHS encounters) againstmugshot images (a proxy for the in-person traveler phototaken at the gate) yielded the lowest recognition accuracy
rates due to the heterogeneity of image types and quality).

5.

See Traveler Verification Service (TVS): Partner Process,supra note 4.

6.

See id. at 2, 5. Rejected foreign travelers will be subjected to“manual officer exception processing.” Id. Under the system’s
most recent prior iteration, manual officer processing
involved a fingerprint query in the IDENT database,and where an officer “was unable to locate an IDENT
fingerprint record” a “separate criminal history check in

the Federal Bureau of Investigation’s Next Generation
Identification” database. Id.
7.

Consolidated Appropriations Act, Pub. L. No. 113-114 §411(c)(2)(B), 129 Stat. 2242, 3006 (2016), https://www.
congress.gov/114/plaws/publ113/PLAW-114publ113.pdf.

8.

Id. § 411.

9.

U.S. Government Accountability Office, GAO-16358T, Actions Needed by DHS to Address Long-Standing
Challenges in Planning for a Biometric Exit System: Before theSubcommittee on Immigration and the Nat’l Interest, Committee
on the Judiciary, U.S. Senate, 115th Cong. 8 ( Jan. 20, 2016)(Statement of Rebecca Gambler, Director Homeland Sec.
and Justice), https://www.gao.gov/assets/680/674704.pdf.

10. See infra Section B.
11. Under federal law, it is unlawful for any DHS action to be“in excess of statutory jurisdiction, authority, or limitations,or short of statutory right . . . .” 5 U.S.C. § 706 (2)(C).
12. See 5 U.S.C. § 553(b).
13. See Traveler Verification Service (TVS): Partner Process,supra note 4, at 13 (“CBP requires an accuracy goal of 96%
TAR for facial images acquired in an airport/seaport exit
environment”); infra Section C (defining True Accept rates).
14. According to the latest data available, taking the extra timeto process rejected passengers could translate into moretime spent on the tarmac for every traveler. When CBP
deployed a fingerprint-based biometric solution, it took
six CBP officers 45 minutes to collect fingerprints from75 passengers. Government Accountability Office, GAO17-170, Border Security: DHS Has Made Progress inPlanning for a Biometric Air Exit System and Reporting
Overstays, but Challenges Remain 15 (Feb. 2017), https://www.gao.gov/assets/690/683036.pdf. This is equivalent
to approximately 3.6 minutes per passenger for each
CBP agent. CBP has never suggested that more than
one CBP officer or airline gate agent will fingerprint
rejected travelers. At a reject rate of 1 in 25—DHS’ own
standard—a face scanning device screening the 335 travelers
boarding a Dreamliner aircraft would reject approximately
14 passengers. If all of these rejected travelers are foreign
nationals, then according to the GAO report, it would take3.6 minutes to fingerprint each one. At that rate, assumingthat false rejections occur at a regular interval (and are notback-loaded, which would delay boarding even further),
CBP would need more than 50 minutes from the beginningof boarding just to screen rejected travelers. Separately,
approximately 40,799 passengers depart on international
flights from JFK each day. See Airport Traffic Report,

21

The Port Authority of New York and New Jersey 50 (Apr.
1, 2016), https://www.panynj.gov/airports/pdf-traffic/
ATR_2015.pdf. If 1 in 25 of those travelers is falsely
rejected—the highest acceptable error rate by DHS’ own
standard—that would mean approximately 1,632 passengers
would be wrongfully denied boarding. At Boston Logan
International Airport, 494,741 international travelers
deplaned or boarded during the month of January 2017. See
Monthly Airport Traffic Summary, Massport ( Jan. 2017),
http://www.massport.com/media/1962/0117-avstatsairport-traffic-summary.pdf. If half of those passengers were
outbound departures, 247,371 passengers in January—or
7,980 passengers each day—departed from Boston Logan
International Airport. At a rate of 1 in 25, that would mean
319 passengers would be wrongfully denied boarding at
Logan Airport on a daily basis.
15. See infra Section C.
16. See infra Section D.
17. See Traveler Verification Service (TVS): Partner Process,supra note 4, (“[T]he TVS . . . confirm[s] the identity ofthe traveler, create[s] an exit record, and biometricallyconfirm[s] the exit of in-scope non-U.S. citizens.”); U.S.
Department of Homeland Security, DHS-2008-0039-0002,
Air/Sea Biometric Exit Project: Regulatory Impact Analysis
67–68 (Apr. 17, 2008), available at https://airlineinfo.com/
dhspdf/3.pdf; see also Ron Nixon, Border Agents Test Facial
Scans to Track Those Overstaying Visas, New York Times(Aug. 1, 2017), https://www.nytimes.com/2017/08/01/us/
politics/federal-border-agents-biometric-scanning-systemundocumented-immigrants.html (“The pilot effort is part ofa decades-long push to more accurately identify people whooverstay their visas and remain in the United States, a groupthat represents the largest number of people in the UnitedStates illegally . . . . Homeland Security officials say they
believe the entry and exit biometric system can also be used
to crack down on illegal immigration . . . . In the absence ofa biometric entry and exit system, the agency depends on
incomplete data from airline passenger manifests to trackpeople who leave the country.”).
18. National Commission on Terrorist Attacks upon the U.S.,
The 9/11 Commission Report 389 ( July 22, 2004), available
at https://www.9-11commission.gov/report/911Report.
pdf (hereinafter “9/11 Commission Report”) (“funding
and completing a biometrics-based entry-exit system is an
essential investment in our national security.”).
19. Congress codified the Commission’s recommendationby amending DHS’ biographical system for tracking visa
overstays at the border to require collection of biometric
exit data “for all categories of individuals who are required
to provide biometric entry data.” Intelligence Reform andTerrorism Prevention Act of 2004, Pub. L. No. 108-458,§ 7208 (2004), https://legcounsel.house.gov/Comps/
Intelligence%20Reform%20And%20Terrorism%20
Prevention%20Act%20Of%202004.pdf. This includes
foreign nationals except those who are under the age of 14,
over the age of 79, and diplomats. Id.
20. See 9/11 Commission Report, supra note 18; Intelligence
Reform and Terrorism Prevention Act of 2004, Pub. L. No.
108-458, § 7208(a) (2004) (“Congress finds that completinga biometric entry and exit data system as expeditiously as

possible is an essential investment in efforts to protect theUnited States by preventing the entry of terrorists.”).
21. See Ron Nixon, supra note 17.
22. Office of Inspector General, OIG-17-56, DHS Tracking of
Visa Overstays is Hindered by Insufficient Technology 21(May 1, 2017), https://www.oig.dhs.gov/sites/default/files/
assets/2017/OIG-17-56-May17_0.pdf.
23. See supra note 9.
24. Id. at 10.
25. U.S. Department of Homeland Security Data Privacy andIntegrity Advisory Committee (DPIAC) Meeting (Sept. 19,2017) (notes on file with author); see also U.S. Departmentof Homeland Security, DPIAC Meeting Minutes 5(Sept. 19, 2017), https://www.dhs.gov/sites/default/files/
publications/DPIAC%20Meeting%20Minutes-Sept%20
19%202017.pdf (alternatively noting the cited interaction
as: “Q(LG): does this solve your problem with overstaying/terrorism? A(MH): not our role to question duly passed
laws from Congress. We think it gives us immigration andcounterterrorism benefits. We trust in Congress and 9/11
Commission.”).
26. See supra note 11.
27. See Immigration Reform and Immigrant Responsibility
Act of 1996, Pub. L. No. 104-208, 110 Stat. 3009-546(1996); Immigration and Naturalization Service DataManagement Improvement Act of 2000, Pub. L. No. 106215, 114 Stat. 337 (2000); Visa Waiver Permanent Program
Act, Pub. L. No. 106-396, 114 Stat. 1637 (2000); Uniting
and Strengthening America by Providing Appropriate
Tools Required to Intercept and Obstruct Terrorism Act
of 2001 (PATRIOT Act), Pub. L. No. 107-56, 115 Stat.
272 (2001); Enhanced Border Security and Visa Entry
Reform Act of 2002, Pub. L. No. 107-173, 116 Stat. 543(2002); Intelligence Reform and Terrorism Prevention
Act of 2004, Pub. L. No. 108-458, 118 Stat. 3638 (2004);
Implementing Recommendations of the 9/11 Commission
Act of 2007, Pub. L. No. 110-53, 121 Stat. 266 (2007);
Consolidated Security, Disaster Assistance, and Continuing
Appropriations Act, 2009, Pub. L. No. 110-329, 122
Stat. 3574 (2008); Consolidated and Further Continuing
Appropriations Act, 2013, Pub. L. No. 113-6, 127 Stat. 198(2013).
28. H.R. Rep. No. 104-828 (1996).
29. Intelligence Reform and Terrorism Prevention Act of 2004,
Pub. L. No. 108-458, § 7208, 118 Stat. 3638, 3819 (2004).
30. Implementing Recommendations of the 9/11 Commission
Act of 2007, Pub. L. 110-53, § 711, 121 Stat. 266, 345(2007).
31. When courts review the text of a law to determine
congressional intent, courts will often apply a canon of
statutory construction known as expressio unius est exclusio
alterius, or more plainly, the expression-exclusion rule. This
doctrine essentially provides that “expressing one itemof [an] associated group or series excludes another left
unmentioned is only a guide, whose fallibility can be shown

22

Not Ready for Takeoff

by contrary indications that adopting a particular rule or
statute was probably not meant to signal any exclusion of its
common relatives.” United States v. Vonn, 535 U.S. 55, 65(2002). See also Chevron U.S.A. Inc. v. Echazabal, 536 U.S.
73, 81 (2002) (“The canon depends on identifying a seriesof two or more terms or things that should be understoodto go hand in hand, which is abridged in circumstances
supporting a sensible inference that the term left out musthave been meant to be excluded.”) (citing E. Crawford,
Construction of Statutes 337 (1940)); Ford v. U.S., 273
U.S. 593, 611 (1927) (“This maxim properly applies only
when in the natural association of ideas in the mind of thereader that which is expressed is so set over by way of strong
contrast to that which is omitted that the contrast enforces
the affirmative inference that that which is omitted must
be intended to have opposite and contrary treatment.”).
Under this canon of statutory construction, courts would
likely read the aforementioned nine laws and conclude that
Congress did not authorize face scans of Americans exiting
the country.
32. See 5 U.S.C. § 553.
33. Office of Information and Regulatory Affairs, Executive
Office of the President, RIN 1651-AB12, Collectionof Biometric Data upon Entry to and Exit from theUnited States (2017), https://www.reginfo.gov/public/do/
eAgendaViewRule?pubId=201704&RIN=1651-AB12.
34. Examining the Problem of Visa Overstays: A Need for Better
Tracking and Accountability: Hearing Before the Senate
Subcommittee on Border Security and Immigration ( July 12,2017) (joint statement of Michael Dougherty, Assistant
Secretary, Office of Strategy, Policy, and Plans, U.S.
Customs and Border Protection; John Wagner, Deputy
Executive Assistant Commissioner, Office of Field
Operations, U.S. Customs and Border Protection; and LouisA. Rodi, III, Deputy Assistant Director, National Security
Investigations Division, Homeland Security Investigations,
U.S. Immigration and Customs Enforcement) (as ofJune 2017), https://www.judiciary.senate.gov/imo/media/
doc/07-12-17%20Dougherty-Wagner-Rodi%20Joint%20
Testimony.pdf.
35. Electronic Privacy Information Center v. Department ofHomeland Security, 653 F.3d 1, 8 (D.C. Cir. 2011). The
court considered each exemption in turn and held thatDHS needed to issue a notice and comment rule, or toclaim an alternate exemption, to “cure the defect in its
promulgation.” Id. at 8.
36. Electronic Privacy Information Center, 653 F.3d at 6(“overly abstract account of the change in procedure at thecheckpoint elides the privacy interests”).
37. See, e.g., Frank Bajak & David Koenig, Face scans for US
Citizens Flying Abroad Stir Privacy Issues, AssociatedPress ( July 12, 2017), https://www.apnews.com/
acf6bab1f5ab4bc59284985a3babdca4 (expressing privacy
advocates’ concerns about airport biometrics).
38. Electronic Privacy Information Center, 653 F.3d at 6 (toconfirm the relevance of privacy issues, “we need lookno further than [the agency’s own] assurances”); see, e.g.,
CBP Meets with Privacy Groups to Discuss Biometric Exit,
U.S. Customs and Border Protection (Aug. 1, 2017),
https://www.cbp.gov/newsroom/national-media-release/cbp-meets-privacy-groups-discuss-biometric-exit (“Weare fully committed to meeting existing privacy laws andregulations while ensuring and safeguarding the privacyof all travelers.”); CBP Deploys Biometric Exit Technology
to Chicago O’Hare International Airport, U.S. Customs
and Border Protection, ( July 11, 2017), https://www.
cbp.gov/newsroom/national-media-release/cbp-deploysbiometric-exit-technology-chicago-o-hare-international(“CBP remains committed to protecting the privacy of all
travelers.”).
39. See 73 Fed. Reg. 80 (Apr. 24, 2008).
40. Electronic Privacy Information Center, 653 F.3d at 7
(unless one of the other exemptions of the Administrative
Procedure Act applies).
41. Id.
42. See Traveler Verification Service (TVS): Partner Process,supra note 4. (“[A]greements between CBP and the partnerorganization will guide opt-in/opt-out procedures. For someparticipating airlines, for instance, a traveler may request not
to participate in the TVS and instead present credentials toairline personnel.” It is not possible to evaluate the specificopt-in/opt-out procedures set forth in the referenced
agreements, because the text of these agreements has notbeen made public.).
43. DHS stated in its June 2017 Privacy Impact Assessmentthat the Science and Technology Directorate “is generatinga report identifying how each algorithm performed as atrue positive rate, false positive rate, false match rate, andfalse non-match rate.” Traveler Verification Service (TVS):
Partner Process, supra note 4. However, in a more recent
public meeting, in response to a question about testing for
accuracy, a DHS spokesperson acknowledged it cannot
measure impostor rates, stating: “On false positives it’s hardbecause we wouldn’t know.” See supra note 25.
44. See Traveler Verification Service (TVS): Partner Process,supra note 4, 13 (“CBP requires an accuracy goal of 96%
TAR for facial images acquired in an airport/seaport exit
environment.”).
45. See supra note 25.
46. See, e.g., Patrick Grother, Mai Ngan & Kayee Hanaoka,
NISTIR XXXX Draft, Ongoing Face Recognition
Vendor Test (FRVT) Part I: Verification, NIST Figure 4(Nov. 16, 2017), https://www.nist.gov/sites/default/files/
documents/2017/11/16/frvt_report_2017_11_16.pdf(hereinafter “NIST FRVT 11-16-17”) (illustrating thedetection error trade-off between false nonmatch (False
Reject) rates and false match (False Accept) rates). At a
False Reject rate of 1 in 1,000 travelers, the 38 most recent
algorithms studied produced an average False Accept rateof 9.4 percent. Lowering the rate of false rejects to 1 in
100,000 travelers raised the average rate of False Accepts
to more than 27 percent. Id. (False Accept rates configured
in typical operational systems). This is also intuitive. A facerecognition system that allows everyone to board will haveno false rejections, but it will allow 100 percent of impostors
through the gate. In reverse, a system that rejects everyone
would never permit an impostor to board but would have a
False Reject rate of 100 percent.

23

47. See NIST FRVT 11-16-17, supra note 46.
48. See Traveler Verification Service (TVS): Partner Process,supra note 4.
49. NIST determined that the face scanning algorithms it
evaluated generally had higher False Accept rates if theimpostor’s age, gender, and country of origin matched thedemographics of the photo on file. See NIST FRVT 1116-17, supra note 46. Figure, 101–160 (same sex and same
region impostor pairs by age of impostor); NIST FRVT
11-16-17, supra note 46. Figure 18 (“These curves apply to
zero-effort impostors . . . . [False Accept Rate] is higher for
demographic-matched impostors.”).
50. See NIST FRVT 11-16-17, supra note 46.
51. See supra note 25.
52. Letter from Philip S. Kaplan, Chief Privacy Officer to Ms. Lisa
Sotto, Chair of DHS Data Privacy and Integrity Advisory
Committee (DPIAC), (Sept. 18, 2017), available at https://www.dhs.gov/sites/default/files/publications/CBP%20
Facial%20Recognition%20Tasking_FINAL%20_20170911.
pdf (“I ask that the Committee address the following: . . . .
Facial matching algorithms have often proven less accuratewith certain demographic groups. What are businessstandard measurements for ensuring facial recognition
accuracy across all demographics? Please provide
recommendations . . . .”).
53. See supra note 25.
54. NIST FRVT 11-16-17, supra note 46, Table 1.
55. For example, if the threshold were set at 95 percent, thenif the traveler’s face were calculated to have a 95 percent or
higher similarity to the photo on file, the traveler would beconsidered a “match.”
56. NIST FRVT 11-16-17, supra note 46, Figure 15. (Notethat this section of the FRVT examines the algorithms’
performance on mug shots, not visa images. The FRVT
mugshot dataset is broken down explicitly by race, while thevisa image dataset is not.)57. It is important to note, however, that the earlier researchconcerned face identification systems, in which a single
photo of an unknown person is compared against a large
database of known persons to find a match. The current
data emerging from NIST regarding bias concerns face
verification systems, in which a photo of a person iscompared against one photo of whom the system attempts
to determine whether the person is who they claim to beor is where they are expected to be. This difference, as well
as necessary differences in match thresholds set for the
performance of the different types of systems, may explain
the apparently contradictory results.

refugees/97201416/ (“Protests erupted at airports aroundthe nation Saturday as Americans reacted in outrage to
President Trump’s sweeping order that banned people fromseven Muslim-majority countries from entering the U.S.
and suspended the nation’s refugee program.”).
60. See Traveler Verification Service (TVS): Partner Process,supra note 4, at 9 ( June 12, 2017) (emphasis added).
61. See U.S. Citizen Travel to International Regions, U.S.
Department of Commerce (Oct. 20 2017), https://travel.
trade.gov/view/m-2016-O-001/index.html.
62. While the State Department already collects Americans’
passport and foreign nationals’ visa photos in its Consular
Coordinated Database, DHS’ routine use of face recognition
on American citizens would be unprecedented. And
without codified data disposal policies, DHS could use its
face recognition deployment to create a database of highquality, recent images of American travelers.
63. CBP Deploys Facial Recognition Biometric Technology at 1
TSA Checkpoint at JFK Airport, U.S. Customs and Border
Protection (Oct. 11, 2017), https://www.cbp.gov/newsroom/
national-media-release/cbp-deploys-facial-recognitionbiometric-technology-1-tsa-checkpoint.
64. Id.
65. TSA Modernization Act, S. 1872, 115th Cong. (2017)https://www.commerce.senate.gov/public/_cache/files/
e308d392-65e8-4f3a-828b-4c43a348b114/4C4E6267970
C35B86B2BF21A5DA5529A.s.1872--tsa-modernizationact.pdf.
66. Id. § 216(2).
67. Border Security for America Act of 2017, H.R. 3548, 115th
Cong. § 418(e)(3) https://homeland.house.gov/wp-content/
uploads/2017/07/Bill-text.pdf.
68. See The International Justice and Public Safety Network(Nlets), Privacy Impact Assessment: Report for theUtilization of Facial Recognition Technologies to Identify
Subjects in the Field, 2, 17 ( June 30, 2011), available
at https://www.eff.org/files/2013/11/07/09_-_facial_recognition_pia_report_final_v2_2.pdf (“The potential
harm of [face recognition] surveillance comes from its
use as a tool of social control. The mere possibility ofsurveillance has the potential to make people feel extremely
uncomfortable, cause people to alter their behavior, andlead to self-censorship and inhibition.”); see Karen Gullo,
Surveillance Chills Speech—As New Studies Show—And Free
Association Suffers, Electronic Frontier Foundation (May19, 2016), https://www.eff.org/deeplinks/2016/05/whensurveillance-chills-speech-new-studies-show-our-rightsfree-association.

58. See Klare et al, Face Recognition Performance: Role of
Demographic Information, IEEE (Oct. 9, 2012), available at
http://ieeexplore.ieee.org/document/6327355/.

69. But see Int’l Soc’y for Krishna Consciousness v. Lee, 505
U.S. 672 679–680, 685 (1992) (recognizing limitations toFirst Amendment protection for speech within and outside
airport terminals).

59. See Hannan Adely & Keldy Ortiz, Protests Erupt at
U.S. Airports over Ban on Refugees, USA Today ( Jan. 28,2017), https://www.usatoday.com/story/news/nationnow/2017/01/28/protests-erupt-us-airports-over-ban-

70. See Traveler Verification Service (TVS): Partner Process,supra note 4, (“CBP is working with specified partners, suchas commercial air carriers and airport authorities, who willcollect the images of travelers and share the images with the24

Not Ready for Takeoff

TVS, often through an integration platform or other vendor. . . . CBP recommends that its partners delete the matching
results within 14 days . . . . However, once the images areshared with CBP, the airline or airport authority, along with
their approved integrator or vendor, may choose to retain
the newly-captured photos consistent with their contractual
relationship with the traveler.”).
71. See Alvaro M. Bedoya, Why I Walked out of Facial Recognition
Negotiations, Slate ( June 30, 2015), http://www.slate.
com/articles/technology/future_tense/2015/06/facial_recognition_privacy_talks_why_i_walked_out.html (“Facialrecognition lets companies identify you by name, from far
away, and in secret. There’s little you can do to stop it. You
can’t change your fingerprints or the unique dimensions ofyour face—not easily. And while you leave your fingerprints
on only the things you touch, every time you step outside,
your face appears, ready for analysis, in the video feeds andphotographs of any camera pointing your way.”).
72. See Traveler Verification Service (TVS): Partner Process,supra note 4, (“[S]igned Memoranda of Understanding(MOU) with CBP will govern [airlines’] retention
practices”).
73. See Justin Lee, JetBlue, CBP Continue to Work with SITA in
Biometric Exit Program, Biometric Update (Sept. 23, 2017),
http://www.biometricupdate.com/201709/jetblue-cbpcontinue-to-work-with-sita-in-biometric-exit-program.
74. See Kate Modolo, Delta Tests Next-Generation Biometric
CBP eGates in Atlanta, JFK, Delta News Hub ( June 13,2017), https://news.delta.com/delta-tests-next-generationbiometric-cbp-egates-atlanta-jfk.
75. See Lee Fang & Ali Winston, Private Companies Look
to Cash in as Homeland Security Brings Facial Recognition
to U.S. Borders, The Intercept (Nov. 29, 2017), https://theintercept.com/2017/11/29/facial-recognition-homelandsecurity-borders/.
76. See supra note 25.
77. See U.S. Department of Homeland Security, DHS/CBP/
PIA-024(b), Privacy Impact Assessment Update for the
Arrival and Departure Information System (ADIS) 2 (Apr.
28, 2017) (“ADIS consolidates entry, exit, and admission
status information from several DHS components” in“near-real time”), https://www.dhs.gov/sites/default/files/
publications/privacy-pia-cbp024b-adis-april2017.pdf.

25

VIII. COPYRIGHT

The text of this report is made available under the Creative Commons Attribution 4.0 International license.
This means you are free to:•Share­–copy and redistribute the material in any medium or format.

•

Adapt–remix, transform, and build upon the material for any purpose, even commercially.

Under the following terms:•

Attribution–You must give the authors of this report appropriate credit, provide a link to thelicense, and indicate if changes were made. You may do so in any reasonable manner, but not in any
way that suggests the licensor endorses you or your use.

•

No additional restrictions–You may not apply legal terms or technological measures that legally
restrict others from doing anything the license permits.

For more information about this Creative Commons license, please visit creativecommons.org.
This report contains images that belong to other authors and that have been licensed for inclusion.
All rights are reserved in any image found in this report, unless otherwise noted.