The Washington PostDemocracy Dies in Darkness

Those airport cameras tracking your face may not be legal, study finds

A passenger's identification and travel documents are verified at the Transportation Security Administration passenger screening area at Hartsfield-Jackson Atlanta International Airport in Atlanta. (Erik S. Lesser/European Pressphoto Agency)

A Department of Homeland Security program that would collect facial scans of every American citizen traveling overseas may skirt the law, come at enormous cost, exhibit technical flaws and invade the privacy of innocent people, a new report finds.

Published Thursday by three researchers at the Center on Privacy and Technology at Georgetown University’s law school, the report examined a DHS pilot program currently underway at nine U.S. airports with overseas flights. In an effort to prevent visitors from overstaying their visas or using fraudulent travel documents, border agents scan the faces of travelers before they depart, and compare the biometric scan against a DHS database.

Visitors and U.S. citizens alike who are traveling on certain international flights originating from cities including Washington, D.C., Atlanta, New York, and Chicago will have their faces captured. According to the study, DHS plans to extend the face scanning program to every airport in the United States that sends passengers abroad.

The government tested facial recognition tech on thousands of travelers at a Washington-area airport

But the researchers urge policymakers and the public to consider abandoning the biometric exit program, which they say is “riddled with problems” and “offers no tangible benefits.” Congress has never clearly authorized the collection of facial data at the border from American citizens, the report says, and DHS has not begun a rulemaking process on the facial scanning program that it is required by federal law to conduct.

The $1 billion program may prompt more invasive forms of government surveillance, including passive biometric scans at domestic airports and the use of facial recognition in other public spaces not associated with air travel, according to the report. That may lead to the chilling of free speech and free association, the researchers said.

In a statement, Jennifer Gabris, a spokeswoman for U.S. Customs and Border Protection, said that the agency takes its privacy obligations seriously, and that U.S. citizens can currently opt out of the facial scanning process.

“In addition, in an effort to be transparent, CBP held a dialogue with privacy advocates in August 2017 and will do so again in January 2018,” she said. Gabris added that CBP has instituted a rigorous process to review the performance of the biometric pilot program, which has a “matching rate in the high 90 percentile.”

“CBP is working to meet the Congressional mandate for biometric exit in a way that’s most efficient and secure for the traveler and that is least disruptive for the travel industry, while also effectively enhancing border security,” she said.

But in addition to legal and privacy implications raised in the study, the researchers found that DHS itself had acknowledged technical flaws in how the facial scanning system functions. Citing DHS's own data, the report states that the agency's facial recognition system erroneously rejects as many as 1 out of every 25 travelers who display valid credentials. Applying that error rate to New York's John F. Kennedy International Airport, 1,632 innocent passengers could be wrongfully delayed or denied boarding every day under DHS's system, the study found.

What's more, DHS appears to not have measurements in place to evaluate how well its facial scanning systems actually detect would-be impostors, according to the study. The 1-out-of-25 error rate measures only false positives, not accurate detections of fraud.

The study likened DHS's lack of a positive detection metric to a bar owner who hires a bouncer without asking him how well he can spot fake IDs. “DHS appears to have no idea whether its system will be effective at achieving its primary technical objective,” the study said.

The report also found DHS is unable to determine whether the accuracy of its facial scans drops because of a traveler's demographic traits. Citing industry research and DHS's own inconclusive findings, the report argues that its likely the agency's biometric scanning systems may discriminate against people based on their race and sex. “Innocent people may be pulled from the line at the boarding gate and subjected to manual fingerprinting at higher rates as a result of their complexion or gender,” the report said.

If the program does continue, the researchers offered six recommendations. They include DHS offering a justification for biometric scanning and identifying and quantifying the problem they are trying to solve; excluding Americans from facial scanning; and for the DHS to adopt a policy restricting the use of facial data for verifying the identify of foreigners, and not for other purposes.