Papers, Please! – The Identity Project

Sep 16 2024

TSA again backs down from its REAL-ID threats

The Transportation Security Administration (TSA) has again backed down from its decades-old threats to start requiring all airline passengers to show ID that the TSA deems to be compliant with the REAL-ID Act of 2004. But the new rules proposed by the TSA would create new problems that won’t go away until Congress repeals the REAL-ID Act.

In a notice published in the Federal Register on September 12th , the TSA has proposed another two-year postponement of the most recent of the “deadlines” the agency has imposed on itself for REAL-ID enforcement. But that postponement would be combined with interim rules for the next two years that ignore the law and invite arbitrariness in how travelers are treated.

The TSA notes that “frustrated travelers at the checkpoint may also increase security risks” if the TSA stopped allowing travelers to fly without REAL-ID. But the TSA doesn’t mention its current procedures for flying without any ID or its position in litigation that no law or regulation requires airline passengers to show any ID. Instead, The TSA claims without explanation that without this postponment, “individuals without REAL ID-compliant DL/ID or acceptable alternative would be unable to board federally regulated aircraft.”

Comments from the public on the proposed rule are due by October 15, 2024. Dozens of comments have already been submitted, almost all of them opposing requiring REAL-ID to fly.

We’ll be submitting comments opposing the proposed rules and reminding the TSA that (1) no state is yet in compliance with the REAL-ID Act, which would require sharing of driver and ID databases with all other states, and (2) neither the REAL-ID Act nor any other Federal law requires air travelers to have, to carry, or to show any ID.

Unless the law is changed to try to impose an unconstitutional ID requirement as a condition on the right to travel by common carrier, the TSA must continue to recognize the right to fly without ID. Any distinction by the TSA or other Federal agencies between state-issued ID, when no state complies with the REAL-ID Act or could do so until all states participate in the national REAL-ID database (SPEXS), would be arbitrary and unlawful.

Sep 06 2024

Planned new European travel restrictions follow US precedents and pressure

Citizens of the USA and some other most-favored nations have long been able to travel to many European countries for tourism or business without visas or prearrangements and with minimal border formalities, as long as they didn’t stay too long or seek local residence or employment.

This is scheduled to change with the imposition of new controls on foreigners — including US citizens — visiting Europe starting in November 2024. This is to be followed by a further ratcheting up of control and surveillance of foreign travelers to Europe scheduled for some time in 2025.

Some US citizens are likely to be shocked and humiliated — as any traveler anywhere in the world should be, regardless of their citizenship — to be subjected to fingerprinting and mug shots and additional questionning on arrival in Europe and, starting next year, a de facto visa by another name that they will have to apply and pay for and have approved before they can board a flight (or international ferry or train) to any European destination.

European citizens can and should object to the imposition by their governments of these new restrictions on foreigners, including foreign tourists and business visitors and foreign citizens who reside in Europe. Europe could, and should, set a better example of respect for freedom of movement as a human right that shouldn’t depend on citizenship.

But US citizens who object to these new European measures should direct their objections and, more importantly, their agitation for changes in travel rules to the US government.

These impending new European travel control and surveillance measures are modeled on systems developed in, already in use in, and actively promoted to European and other governments around the world by the US government.

By its precedents and international pressure, the US government is making travel more difficult for everyone, including US citizens, everywhere in the world including in Europe.

Sep 03 2024

Congress asks more questions about TSA blacklists

The “No-Fly” and “Selectee” lists managed by Federal agencies through the joint Watch List Advisory Council (WLAC) aren’t the only blacklists and watchlists that are used to determine who is given US government permission to board an airline flight, and how they are treated when they fly.

Senior members of relevant House and Senate Committees are asking overdue questions about the blacklists created and used by the Transportation Security Administration (TSA) to target selected travelers for special scrutiny, surveillance, and searches when they fly.

The TSA’s Secure Flight program is used to determine, on the basis of identifying and itinerary information from ID documents and airline reservations, what Boarding Pass Printing Result (BPPR) to send to the airline for each would-be passenger. The ruleset included in the Secure Flight algorithm includes list-based and profile-based Quiet Skies rules created by the TSA itself, independent of the interagency No-Fly and Selectee travel blacklists.

These Quiet Skies rules are used to flag certain airline passengers as “Selectees” to be searched more intrusively at TSA checkpoints (even if they aren’t on the interagency Selectee list), and to assign Federal Air Marshals (FAMs) to follow, watch, and file reports on their activities in airports and on flights. A secret alert is sent to FAMs, based on airline reservations, 72 hours before each planned flight by a person on the Quiet Skies list.

The Quiet Skies program was implemented secretly in 2012. “In March 2018,” according to a later report on the Quiet Skies program by the DHS Office of Inspector General (OIG), “in addition to enhanced checkpoint screening, TSA began surveillance (observation and collection of data) of Quiet Skies passengers beyond security checkpoints, as part of its Federal Air Marshal Service’s (FAMS) Special Mission Coverage flights.

The No-Fly list and profile-based no-fly rules are used in the Secure Flight travel control and surveillance algorithm to determine who is allowed to fly. The Selectee and Quiet Skies lists and rules are used to determine who to search and surveil when they fly.

The Quiet Skies program came to light later in 2018 when FAM whistleblowers went to the Boston Globe with their complaints that the wrong travelers were being targeted, mis-prioritizing which flights FAMs were being assigned to. These FAM whistleblowers complained, that, for example, anyone identitied from airline reservations as having traveled to Turkey was put on the Quiet Skies list and had a FAM assigned to each US flight they took for the next several months, including domestic flights. Travelers’ reports of being followed through airports (presumably by FAMs) and subjected to more intusive searches at TSA checkpoints after trips to Turkey supported these allegations.

The TSA initially declined to confirm the existence of the Quiet Skies program. But in response to questions from Congress and follow-up reprting by the Globe, the TSA released a belated Privacy Impact Assessement (PIA) for Quiet Skies in 2019. However, that PIA specified none of the Quiet Skies rules and gave no demographic or other information about who those rules had targeted.

Additional descriptions of the program, including the flowchart above, but still not including any of the Quiet Skies rules, were included in a critical DHS OIG report on the program in 2020.

Since January 6, 2021, there has been a new round of complaints by travelers and disgruntled FAMs that participants in the activities that day at the US Capital have been put on the No-Fly, Selectee, and/or Quiet Skies lists.

This month a redacted version was made public of a formal complaint to the DHS OIG by a FAM who says his wife was put on the Quiet Skies list and “targeted for FAMS ‘Special Mission Coverage’ simply because she attended President Trump’s January 6, 2021 speech at the ellipse in Washington, D.C.” FAMs also said that former US Representative and Presidential candidate Tulsi Gabbard has been put on the Quiet Skies list because of her role in the January 6, 2021 events. When she read those reports, Gabbard said that, “The whistleblowers’ account matches my experience” of disprate treatment at TSA checkpoints.

We’ve been unable to confirm or disprove these reports. But we find them plausible and — whether or not they are true — indicative of fundamental problems in these arbitrary, secret, extrajudicial schemes for making decisions about the exercise of our right to travel by common carrier and to be free from unreasonable searches and seizures.

Aug 27 2024

100,000 passport applicants have gotten the long form

More than 100,000 US citizens — almost ten times as many as the State Department had projected — have been required to complete one or both of two impossible “long form” supplements to their applications for US passports, according to records we received this month in response to a Freedom Of Information Act (FOIA) request we filed in 2011.

[Numbers of passport applicants sent each of the two version of the long form passport application each year since 2014, as reported to us this month by the State Department in response to our 2011 FOIA request.]

Back in 2011, the State Department proposed an outrageous long form to be sent to some subset of applicants for US passports. The form includes a bizarre list of questions which most applicants would be unable to answer.

Do you know, or do you have any way to find out, the dates, addresses, and names of doctors for each of your mother’s pre-natal medical appointments, or the names, addresses, and phone numbers of everyone who was in the room when you were born?

Sending someone the suppllemental long form is a pretext for denying their application for a passport. As we said in our comments to the State Department:

The proposed form reminds us unpleasantly of the invidious historic “Jim Crow” use of a literacy or civics test of arbitrary difficulty, required as a condition of registering to vote and administered in a standardless manner. By making the test impossible to pass, voter registrars could use it as an arbitrary and discriminatory – but facially neutral – excuse to prevent any applicant to whom they chose to give a sufficiently difficult test from registering to vote, on the ostensible basis of their having “failed” the test.

In a similar way, choosing to require an applicant for a passport to complete the proposed Form DS-5513, which few if any applicants could complete, would amount to a de facto decision to deny that applicant a passport. And that decision would be standardless, arbitrary, and illegal.

After we publicized this proposal, thousands of people submitted comments to the State Department calling for the proposed form to be withdrawn.

Although the State Department had falsely claimed in its application for approval that this was a “new” form, commenters reported that they had already (illegally) been required to fill out a version of this form, even though it had not been approved.

As soon as we learned this, we filed a Freedom of Information Act (FOIA) request in April 2011 to find out how long the long form had been in use illegally without approval, how many people had been told to fill out the long form, and what if any criteria had been established for when to require a passport applicant to fill out the long form.

Aug 15 2024

Travel blacklists target political critics

US government travel blacklists (euphemistically described by the government as merely “watchlists”) are being used to restrict airline travel and target searches of electronic devices of organizers of protests against US support for Israel’s military actions in Gaza, according to a complaint filed this week in Federal court by attorneys for two blacklisted Palestinian-American US citizens, Dr. Osama Abu Irshaid and Mr. Mustafa Zeidan.

It might be tempting to interpret the allegations in this complaint as indicative of the need for oversight or guardrails to prevent “abuse” of the blacklisting and travel control system. But we think it makes more sense to see this case as indicative of the risk of political weaponization inherent in the system of algorithmic, identity-based, extrajudicial administrative control of travel. This case shows why this travel control system should be abolished entirely, and why any restrictions on the right to travel should be imposed through existing judicial procedures for restraining orders and injunctions — adversary procedures that incorporate notice, the right to confront one’s accusers, and the other elements of Constitutional due process.

The heavy lifting that makes this use of travel controls to restrict political dissidents possible was carried out when airlines were required to install communication and control lines enabling the US government to decide, in real time, on the basis of information from airline reservations and travelers’ ID documents, whether or not to give airlines “permission” to transport each would-be passenger. That entailed more than $2 billion, by the US government’s own underestimate, in unfunded mandates imposed on airlines and their IT providers for changes to their reservation and departure control systems.

Now that this infrastructure is in place, only the ruleset needs to be changed to change who is, and who is not, allowed to travel by air, or how they are treated when they fly.

Names and other selectors (phone numbers, IP addresses, etc.) can be added to list-based rules. New category-based rules can be added to the ruleset. New real-time “pre-crime” profiling and scoring algorithms can be applied to fly/no-fly decision-making. New external databases and actors can be connected to the system.

All of this has, in fact, been done, making it harder and harder for anyone to exercise effective oversight over the system or the decisions generated by its secret algorithms.

The potential for targeting of dissidents and political opponents is a feature, not a bug, of secret administrative decision-making, especially in the absence of judicial review.

Here’s how it played out in this case, according to the complaint and other reports: Read More →

Aug 01 2024

Customs officers need a warrant to search your cellphone at JFK

Judge Nina Morrison of the US District Court for the Eastern District of New York (Brooklyn, Queens, Staten Island, and Long Island) has ruled that police, including officers of U.S. Customs and Border Protection (CBP), need a warrant to search your cellphone at JFK International Airport, even when you are entering or leaving the US.

This ruling is certainly a positive development. It’s a break with a line of judicial decisions that have made US borders and international airports a Fourth Amendment-free zone, even for US citizens. It’s likely to influence other judges and other courts, even though — as a ruling from a District Court rather than an appellate court — it doesn’t set a precedent that’s binding even on other judges in the same Federal judicial district.

But there are important issues that weren’t addressed in this case, and important things you need to know to exercise your rights at JFK or other airports — even if judges in future cases in the same or other judicial districts are persuaded by the ruling in this case.
Read More →

Jul 29 2024

5th Circuit reads travel blacklists into Federal law

In a decision issued last week, the 5th Circuit Court of Appeals has offered the first appellate opinion on whether there is any basis in law for the U.S. government’s creation and use of a system of “watchlists” (blacklists) to determine who is allowed to travel by air and how they are treated when they travel, as well as to impose other sanctions.

Numerous lawsuits have challenged various aspects of the government’s blacklistsing system and its application to airline passengers, but this is the first time that any U.S. appellate court has ruled on whether Congress has given the various agencies that created, maintain, and use these lists any statutory authority to so so.

The 5th Circuit panel found multiple mentions in Federal law of the use “databases” for “screening” of airline passengers. But that begs the question that was actually presented. As the Council on American-Islamic Relations (CAIR) argued in their brief on appeal:

Below, both the district court and the Government presented a mishmash of statutory language, none of which clearly authorizes any of the Defendant agencies to create, maintain, administer, or use a million-name list to infringe on the liberty of U.S. citizens and foreign nationals alike…. High-level congressional authorization of general law-enforcement and national-security activity is self-evidently inadequate to satisfy the major questions doctrine. Even the more precisely-worded statutory provisions that the Government offers to justify specific uses of the watchlist fall short because they nowhere authorize the creation or maintenance of the watchlist in the first place. At bottom, a survey of the Government’s cited authorities reveals that Congress did not create the watchlist—unelected bureaucrats did….

The district court did not conclude that the text of any specific statute clearly authorized federal agencies to create, maintain, and use the watchlist. Instead, the district court followed the Government’s lead and cobbled together (supposedly) clear statutory authorization from a hodgepodge of different laws, none of which—whether viewed separately or together—comes close to supplying clear congressional authorization….

Other cited provisions may grant TSA the power to use the watchlist to screen passengers but nowhere authorize any agency to create, maintain, or administer the watchlist in the first place.

Congress’s after-the-fact acquiescence to an agency’s power grab cannot provide the clear congressional authorization for the agency’s action. Rather, Congress’s clear authorization must come before the agency asserts the power to significantly intrude on the liberty of millions of Americans.

Jul 23 2024

What “consent” really looks like for the DEA and TSA

The Drug Enforcement Agency (DEA) and the Transportation Security Administration (TSA) have been working together for years to steal travelers’ money.

The DEA pays informers to finger people who might be flying with large amounts of cash, and gets the TSA to identify these people when they go through TSA checkpoints at airports, claim that they “consent” to be searched, and then find any money they are carrying and seize it through “civil forfeiture”.

The DEA carries out similar cash-seizure operations on Amtrak trains — mostly domestic trains that don’t cross the US border — in collaboration with US Customs and Border Protection (CBP).

A new video released by the Institute for Justice shows how this “consent” works in practice.

In the w video, a DEA agent won’t take “I don’t consent to a search” for an answer. The agent follows an airline passenger onto their plane (without objection by airline staff), snatches the passenger’s carry-on bag, carries it off the plane, and refuses to return it. The agent claims the right to keep the passenger’s bag as long as it takes to get a warrant (although they don’t have that right, and don’t actually get a warrant).

This is not meaningful “consent”, and it’s not a valid legal basis for a search.

An ongoing class-action lawsuit by the Institute for Justice on behalf of air travelers who have been searched without probable cause on the pretextual claim of “consent” in order to find, seize, and “forfeit” their cash has shown just how common this pattern of illegal search and seizure is.

We reported on the filing of this lawsuit in 2020, and on the first substantive ruling in the case, in favor of the plaintiffs and allowing the case to move forward, in 2021.

Since then, the case has bogged down in foot-dragging by the DEA and TSA, resisting discovery of their records of searches and seizures of cash from travelers at airports.

The DEA and TSA continue to claim — despite the initial ruling against them on this point — that they don’t have an actionable “policy” of targeting travelers with cash for searches because they haven’t put this policy in writing. But the latest status report on discovery to date indicates that the DEA and TSA have made thousands of seizures of “bulk currency” from air travelers in recent years. This is clearly a routine and officially sanctioned agency practice, whether or not anyone has put it in writing.

The DEA and TSA claim that the volume of records of these searches and seizures would make producing them unduly burdensome. But the volume of these records is symptomatic of the scale and systemic nature of the problem — which is what the plaintiffs are trying to prove. The plaintiffs have suggested examining a statistical sample of the records of airport searches and seizures, but the DEA and TSA are resisting even that.

We wish the plaintiffs in this case and their lawyers success in their pursuit of justice for travelers.

Jul 12 2024

Opting out of facial recognition at airports

Next week the Algorithmic Justice League will be launching an awareness and sousveillance campaign focused on the use of facial recognition in airports by the Transportation Security Administration (TSA) and its airport and airline partners.

The #freedomflyers campaign includes efforts to make travelers aware that the TSA claims that submitting to facial recognition is “optional”. The campaign also includes a free online Freedom Flyers Summit on “Resisting Airport Face Scans” on July 19th and — perhaps most importantly — a scorecard for travelers to report what actually happens when they try to opt out of facial recognition at airports.

In many cases, staff or contractors of airlines, airport operators, or the TSA tell travelers that facial recognition is required. In other cases, facial recognition turnstiles are unattended by any staff, leaving no apparent way to opt opt. Some facial recognition turnstiles are attended only by “line-minders” or security guards or subcontractors with no authority to allow travelers to pass through without submitting to mug shots.

Asking “Did the tech work?” is, of course, a trick question.

The purpose of facial recognition in airports is to enable tracking of travelers, without our being able to tell when, where, or by whom we are being tracked. If “Did it work?” means, “Did it enable those who want to track you to track you, without your knowledge?”, than by definition, if it “worked”, you won’t know.

You may know that your face was scanned once, perhaps when you entered the terminal or checked in or checked your luggage, but you may not know how many other times it was scanned, where, when, by whom, or for what purposes. The goal of public-private partnerships in airport surveillance is seamless multi-purpose data sharing and “curb to curb” traveler tracking through common-use embedded facial recognition infrastructure.

One thing you can do to mitigate the risk of hidden cameras is to wear a face mask in the airport, except when you are ordered to remove it by someone who has identified themselves as an authorized agent of the TSA and has told you that removing your mask is required as a condition of travel. If you have to remove your mask so that a human TSA agent can compare your face to the picture on your ID, make sure that you stand out of the line of of any visible cameras. If they try to point a camera at your face while you have your mask down, hold up your hand to block the camera and tell them you don’t consent to having your face photographed.

The TSA claims that removing your mask for a human check is required, but that being photographed is not. To date, no court has ruled on whether the TSA can require travelers to remove face masks or submit to mug shots or automated facial recognition. Nor has any court ruled on whether a common carrier could require removal of masks or submission to mug shots or automated facial recognition as a condition of carriage.

We welcome the AJL campaign to educate travelers about facial recognition in airports and to encourage them to opt out. Merely opting out won’t put an end to the practice, but it’s an important step. We look forward with interest to the responses to the AJL survey.

Jun 07 2024

“Who Lacks ID in America Today?”

As we discussed in our previous article, the issue in the current stage of the lawsuit challenging a Texas law requiring ID to visit some websites is what standard — “strict scrutiny” or “rational basis” review — courts should use to evaluate the Constitutionality of government-imposed restrictions on the exercise of First Amendment rights.

But legal briefs in the case also address the adverse and discriminatory impact of ID requirements on people without ID, and spotlight some important recent research on how many people in the US don’t have government-issued ID or don’t have ID that would satisfy ID-verification procedures and criteria, including those that include address verification.

A friend-of-the-court brief submitted to the U.S. Supreme Court by the Electronic Frontier Foundation and the Woodhull Freedom Foundation cites an analysis by the Center for Democracy and Civic Engagement at the University of Maryland of the results of a survey of a scientifically-selected national panel conducted in September and October of 2023.

Respondents were asked whether or not they have a driver’s license, whether their ID (if any) has their current name and address, and whether their ID, birth or naturalization certificate, or other evidence of identity and citizenship is kept in a quickly accessible place (rather than a safe deposit box or other off-site location).

The responses to the survey show just how many people can be excluded by ID demands:

Nearly 21 million voting-age U.S. citizens do not have a current (non-expired) driver’s license. Just under 9%, or 20.76 million people, who are U.S. citizens aged 18 or older do not have a non-expired driver’s license. Another 12% (28.6 million) have a non-expired license, but it does not have both their current address and current name….

If driver’s license records are incorporated into address-validation algorithms, someone who gives their current address may be more likely to be turned away by ID-based gatekeepers than an identity thief who can has obtained, and can regurgitate, the out-of-date or incorrect address associated with that ID in government records.

The survey also asked about other forms of government-issued ID including:

US passport or US passport card
US Naturalization Certificate
US Certificate of Citizenship
Military ID
Veterans ID
Student ID
Tribal ID
Hunting License
Gun/firearm permit

Millions of US adults have none of these government-issued credentials:

Just over 1% of adult U.S. citizens do not have any form of government-issued photo identification, which amounts to nearly 2.6 million people.

Unsurprisingly, Black, Hispanic and young adult Americans are less likely to have ID, or to have current addresses on file with government agencies, and are therefore more likely to be discriminated against by ID and address verification requirements:

Black Americans and Hispanic Americans are disproportionately less likely to have a current driver’s license. Over a quarter of Black adult citizens and Hispanic adult citizens do not have a driver’s license with their current name and/or address (28% and 27% respectively)… Eighteen percent of Black adult citizens, 15% of Hispanic adult citizens, and 13% of Asian/Pacific Islander adult citizens do not have a license at all, compared to just 5% of White adult citizens.

Young Americans are least likely to have a driver’s license with their current name and/or address. Younger Americans overall are far less likely to have a driver’s license with their current name and/or address, with 41% of those between the ages of 18-24 and 38% between the ages of 25-29 indicating this…..

Almost half of Black Americans ages 18-29 do not have a driver’s license with their current name and/or address (47%), and 30% do not have a license at all.

The questionnaire and the initial analysis of the responses appear to have been designed primarily to assess the impact of requirement to have and show ID to vote, but they have obvious implications for demands for ID in other contexts, including ID to fly or to travel by other modes of common carrier.

There’s been a lot of attention paid to what percentage of current driver’s licenses are compliant with the REAL-ID Act, for example, but much less attention paid to how many people don’t have any driver’s license or other government-issued ID credentials, or which IDs will satisfy current or proposed ID-verification criteria and procedures.

Our takeaway is that ID requirements are, and will remain, inherently unreliable, discriminatory, and illegitimate. Not everyone has ID, and not everyone’s ID will satisfy verification schemes that rely on inevitably inaccurate databases.