Papers, Please!

The Identity Project

Apr 21 2026

D.C. Circuit Court of Appeals keeps U.S. citizen on “no-fly” list

In an interlocking pair of decisions issued the same day by the same panel (one opinion written by the same judge who dissented from the other), the U.S. Court of Appeals for the D.C. Circuit has denied U.S. citizen Saad bin Khalid any meaningful review of the U.S. government’s decision to blacklist him and prohibit him from air travel to, from, within, or overflying the U.S. or on U.S.-registered aircraft.

Having been harassed by FBI and other U.S. agents every time he entered the U.S. since he was 16 or 17 years old, Mr. bin Khalid now lives in Pakistan with his wife and children.

The dissent from one of the two opinions tries hard to tease out a hypothetical procedural pathway to judicial review of a no-fly order in some circumstances. But the practical effect of this pair of decisions is that Mr. bin Khalid will have to fly to Mexico or Canada, then enter the U.S. by land, every time he he wants to return to the country of his citizenship. He will have to repeat that process in reverse to leave the U.S. and rejoin his family in Pakistan.

The knotted logic of both decisions rest primarily rests on 49 U.S.C. § 46110(c), a facially unconstitutional law stripping U.S. District Courts of jurisdiction over TSA “orders” and allowing review by Courts of Appeal only on the basis of the one-sided and secret “record” selected by the TSA for presentation to the Court of Appeals, with no confrontation of witnesses or adversary fact-finding at any stage of the process.

As the dissent sums up the problem in the panel majorities’ logic:

The majority ultimately reads section 46110 to strip the district court of more jurisdiction than it confers on this court. That means that neither we nor the district court can review Khalid’s claims that the Center improperly placed him on the terrorist watchlist.

The Court of Appeals also upheld the Constitutionality of basing this “no-fly” decision in part on evidence provided to the court but not to Mr. bin Khalid or his lawyers, and in part on evidence supposedly relied on by the Threat Screening Center to recommend blacklisting Mr. bin Khalid, but disclosed neither to Mr. bin Khalid, his lawyers, the Court of Appeals, nor the Administrator of the Transportation Security Administration (TSA) who was nominally responsible for the “order” adding Mr. bin Khalid’s name to the more than a million mostly Muslim names  on the U.S. no-fly list.

This was based on a finding  that  the right to travel by common carrier is not a “fundamental” right, and that in today’s world, the ability to travel by land or sea — between, say, Pakistan and the U.S. — is an adequate substitute for air travel:

Khalid may continue to travel to, from, and inside of the United States by means other than airplanes. As a result, the TSA Administrator’s order maintaining Khalid on the No Fly List does not infringe a fundamental right.

Given the unlikelihood that the Supreme Court will choose to review, much less overturn, these decisions of the Court of Appeals, what can be done?

The simplest way to insure that people like Mr. bin Khalid get their day in court would be for Congress to enact the Freedom to Travel Act. This bill would address each of the reasons that the Court of Appeals denied justice to Mr. bin Khalid. It would (1) write explicit recognition of the right to travel into Federal law, (2) create an explicit cause of action for deprivation of that right, and (3) removing TSA orders from the restrictions on judicial review in 49 U.S.C. § 46110(c).

Apr 08 2026

When you fly, you fly with ICE

Further confirming and providing more details about a story first reported here and later confirmed by the New York Times, Ted Hesson and Kristina Cooke of Reuters report that more than 31,000 records of domestic airline reservations obtained by the Transportation Security Administration (TSA) through its Secure Flight passenger surveillance and control system were passed on by the TSA to Immigration and Customs Enforcement (ICE) in the first year of the Trump 2.0 Administration. More than 800 arrests by ICE during that time were based on Secure Flight data.

The TSA has exempted Secure Flight records of domestic air travel from the provisions of the Privacy Act that would normally entitle each traveler to obtain, on request, an “accounting of disclosures” showing what information about them was disclosed by the TSA to which other agencies or third parties. So there is no way for you to find out whether the TSA has provided ICE with your air travel plans, so that ICE can arrange an unwelcoming party for you at the airport on departure or arrival or while changing planes. You have to assume that ICE has the details of all of your planned air travel in the U.S.

The arrests at airports reported to date all appear to have been of non-U.S. citizens. As we noted when we first reported on the additional of immigration lookouts to the Secure Flight ruleset, the TSA has long wanted to expand its airport checkpoints into all-purpose law enforcement checkpoints by checking all airline passengers against the FBI’s aggregated NCIC database of wants and warrants. That still doesn’t appear to be happening, but we have no confidence that the TSA will confine its activities within Constitutional limits, especially in an area where it has exempted itself from accountability.

Please let us know if you hear of U.S. citizens being arrested at airports on outstanding warrants, especially if there is no obvious way police would have known of their travel plans without having been tipped off by the TSA based on airline reservation data.

Apr 06 2026

Is a meeting “public” if you have to show REAL-ID or pay a fee?

At our request, the Minnesota Commissioner of Administration has directed the state’s Data Practices Office (DPO) to issue an advisory opinion as to whether the Minneapolis-St. Paul Metropolitan Airports Commission (MAC) violates the state’s Open Meeting Law by holding its meetings in an area at the MSP airport accessible only by passing through a TSA checkpoint, which requires either REAL-ID compliant ID, a passport, or paying a $45 fee.

The Commissioner has complete discretion to decide when to issue an advisory opinion. We are pleased that they have decided to do so in this case. We thank the DPO for their (unsuccessful buy helpful) efforts at informal mediation with the MAC, which preceded our request for a formal advisory opinion.

So far as we know, this will be the first official review by any state or local government body, under any state or local open meeting law, of whether a meeting of a government body can be considered “public” or “open” if REAL-ID or a fee is required for entry.

As stated in the Commissioner’s notice of the preparation of an advisory opinion, under Minnesota law, “Although the advisory opinion will not be binding on the Board, a court must give the opinion deference.”

We look forward to the Commissioner’s opinion. According to the notice , “Section 13.072 requires the Commissioner to issue an opinion within 50 days of receipt of the request. Therefore, the Commissioner must issue the opinion by May 21, 2026.”

Apr 01 2026

OMB gives blanket approval for USCIS social media surveillance

The White House Office of Management and Budget (OMB) has approved a request by US Citizenship and Immigration Services (USCIS) to require all individuals applying for or associated with applications for US visas, visa-free entry, residency, or citizenship to identify all social media accounts they have used in the last five years.

The new “generic clearance” approved by OMB spares USCIS from having to justify the purpose, relevance, and legality of demanding social media account information separately for each USCIS form or web page on which this information is demanded.

This approval by the current White House expands on the demand for social media identifiers first approved by OMB as one of the last actions of the Obama Administration.

Along with some other agencies, USCIS has adopted a new format for its analysis and response to comments on its regulatory proposals. The summary of comments appears to have been generated by an artificial intelligence chatbot. Unlike previous responses to comments that typically ignored or distorted many of the objections to agency proposals, the summary provided by USCIS to OMB is surprisingly accurate and complete. But rather than actually responding to the objections raised by the Identity Project and others, USCIS simply regurgitates a summary of its original claims about the proposal.

For example, in response to comments pointing out that collection of social media postings violates the Privacy Act’s prohibition on collection of information about acts protected by the First Amendment without explicit statutory authorization, USCIS merely repeats the conclusionary claim that, “Consistent with the requirements of the Privacy Act (5 U.S.C. § 552a(e)(7)), DHS does not maintain records ‘describing how any [citizen of the United States or alien lawfully admitted for permanent residence] exercises rights guaranteed by the First Amendment, unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity.'” There’s no meaningful engagement with the comments or explanation of the basis for claiming that postings on social media aren’t protected by the First Amendment or that collecting this information is expressly authorized by any statute — which it isn’t.

The USCIS summary acknowledges our comments that social media surveillance violates US obligations pursuant to international human rights treaties. But in response, USCIS merely summarizes the statutes it claims implicitly authorize these actions — which of course says nothing about whether those statutes comport with US treaty obligations.

The response to comments also repeats the false and conclusionary claim that that, “Social media involves publicly available information that is accessible to anyone without a warrant”, even though in fact the identification of an individual with an anonymous or pseudonymous social media account isn’t otherwise accessible without a warrant.

We urge other countries not to follow this bad example of the US government.

Mar 22 2026

Your rights when an airport checkpoint is staffed by ICE agents

Last December we reported on indications that the Transportation Security Administration (TSA) had begun passing on information from airline reservations to Immigration and Customs and Enforcement (ICE) to enable targeting of domestic airline passengers for seizure and deportation. Ten days later, our report was confirmed by the New York Times.

In January, it was reported that ICE planned to set up immigration checkpoints for passengers on jetways at Minneapolis-St. Paul International Airport (MSP). That hasn’t happened, but the possibility prompted us to review some of the legal issues it raised.

Now President Trump has announced that starting Monday, March 23rd, ICE agents will be assigned to take over some of the work of TSA checkpoint staff, further merging and conflating the unrelated functions of aviation security and immigration enforcement.

What are your rights, especially as an airline passenger traveling within the US rather than seeking to enter or leave the country, if a checkpoint at the airport is staffed by ICE agents instead of, or in addition to, the usual TSA staff or TSA contractors?

Read More →

Mar 15 2026

DMV wants to upload California drivers license data to the national REAL-ID database

The California Department of Motor Vehicles (DMV) has requested more than $55 million in additional funding for costs related to uploading information about every California drivers license or state-issued ID card to the national REAL-ID database, SPEXS.

The DMV Budget Change Proposal is accompanied by a “trailer bill” and a “policy” bill, AB-2156, introduced in February on an “urgency” basis to take effect as soon as enacted, that would override the provisions of California motor vehicle and privacy law that currently prohibit this upload.

Both the budget and policy proposals have the support of the DMV and Governor Newsom. It will be up to members of the state legislature — and public pressure — to stop them before they are enacted into state law and have to be challenged in court.

These budget and policy proposals will need to go through both the Assembly and Senate Budget and Transportation committees. The first hearing on the budget proposal is expected to be this Thursday, March 19th, in the Senate Budget and Fiscal Review Committee, Subcommittee 5 on Corrections, Public Safety, Judiciary, Labor and Transportation. The first hearing on the policy bill is tentatively expected to be April 15th in the Assembly Committee on Transportation.

The DMV is asking for $32M in fiscal year 2026-2027 and $23M in 2027-2028 for what it describes as a “State-to-State Verification System (S2S) Project”:

The Department of Motor Vehicles (DMV) requests additional funding and personnel resources to continue DMV’s compliance with the REAL ID Act of 2005 by implementing the State to State (S2S) Program. California’s compliance date for State to State (S2S) is February 16, 2027, and the core DMV systems will interface and connect the driver license (DL)/identification card (ID) S2S data elements with the American Association of Motor Vehicle Administrators (AAMVA) electronic verification and history exchange.

This summary is in parts inaccurate, in parts misleading, and in parts incomplete.

Inaccurate, because California is not in compliance with the REAL-ID Act and, as the proposal is written, this project would not bring the state into compliance.

Misleading, because it doesn’t mention the SPEXS national ID database that is central to this system; characterizes as a “state-to-state” system what is actually a hub-and-spoke network in which data is shared between states and AAMVA, not directly between states;  and downplays the role of AAMVA from the owner and controller of the database to the mere operator of an “exchange”.

Incomplete, because it doesn’t explain that the “compliance date” it refers to was set by AAMVA (and could be changed or eliminated by AAMVA), not by any law; says nothing about the status of AAMVA as a private, non-governmental, out-of-state organization not subject to any of the open meetings, public records, due process, privacy, etc. laws that would apply to a Federal or state government agency; and doesn’t consider whether the proposals violate the state constitution.

The policy bill, AB-2156, has similar defects in addition to internal contradictions. These suggest that the drafters of the legislation didn’t fully understand what it would mean, why it’s so much worse than it appears, or that they have a real choice about whether to keep chasing the moving goalposts of Federal demands for REAL-ID “compliance”.

Read More →

Feb 17 2026

Show ID or pay a fee to attend a “public” meeting?

Is it an “open” meeting if you have to identify yourself, show ID, and/or pay a fee to attend?

That’s the question presented by today’s meeting of the Minneapolis-St. Paul Metropolitan Airports Commission (MAC), which is scheduled to be held in the “secure” area of the MSP airport reachable only by passing through the Transportation Security Administration (TSA) checkpoint.

As of February 1, 2026, this means individuals who want to attend a MAC meeting, including those who want to make public comments and those who just want to observe, must either (A) show ID credentials the TSA finds satisfactory or (B) pay the illegal $45 per person TSA Confirm.ID fee, answer whatever questions the TSA asks (based on records of the Accurint data broker), and be “allowed” by the TSA, in its unreviewable and arbitrary discretion, to enter the secure area of the airport. The MAC website says that “the MAC will cover this cost for up to three meetings”, but doesn’t say what will happen after that.

This is the first time — in Minnesota or any other state — that we have seen a demand for ID, a demand for a fee, a limit on the number of meetings that can be attended without a fee, or delegation of authority (authority the MAC itself would lack) to an independent third party to demand answers to questions or to decide in its discretion  who to allow to attend a meeting of a government body required by law to be open to the public.

Is any of this legal? We doubt it.

Rules for meetings of government decision-making bodies vary by state. The MAC is a Minnesota state agency whose members are appointed by the Governor.  The Minnesota Open Meeting Law (Minnesota Statutes Chapter 13D) requires that all decision-making meetings of entities such as the MAC “must be open to the public”.

The Minnesota law doesn’t define what “open to the public” means, but we don’t think it includes any of these conditions and restrictions on attendance:

  1. Requiring individuals to identify themselves (rather than attending anonymously, as they may wish to do if e.g.  they fear retaliation for attending or making public comments).
  2. Requiring individuals to have or show ID credentials.
  3. Requiring individuals to answer questions including questions from a third party (in this case, the TSA).
  4. Require individuals to pay a fee, or limiting the number of open meetings an individual may attend without paying a fee. (In this case, the fee is patently illegal, and having agreed to pay the fee on behalf of individuals attending MAC meetings, the MAC itself would have standing to challenge the fee.)
  5. Granting a third party discretion to decide who will, and who will not, be allowed to attend a meeting. (The MAC website notes that “Verification is not guaranteed”, i.e that the TSA may choose not to allow an individual to pass through the checkpoint, even if they identify themselves verbally, pay the $45 fee or have it paid for them, and answer all of the TSA’s questions.)

None of this fits within any reasonable definition of “open to the public”.

Any member of an entity subject to the Minnesota Open Meetings Law who violates this law, including by attending a business meeting of an agency that isn’t open to the public, is personally liable for a $300 fine for each “occurrence”. They have to pay the fine themselves. The agency isn’t allowed to pay it for them. Under a “three strikes you’re out” provision of this law, any office-holder found guilty of three separate violations of the Open Meetings Law forfeits their office for the remainder of their term.

Meanwhile, we’re still waiting for a full response to our request under the Minnesota Government Data Practices Act for information about the basis for the MAC’s dubious claim that it lacks any authority to limit where in the airport Federal agents can go.

The last word we received is that we can expect a response to our public records request tomorrow — the day after the monthly MAC meeting today at which we and others might (if we were allowed by the TSA to attend) have asked questions of MAC members about the decision to give Federal agents free run of the airport without challenge.

Feb 11 2026

First-hand reports confirm you can still fly with no ID

First-hand reports confirm that some people can still fly with no ID card or documents, despite a new scheme of the Transportation Security Administration (TSA) to extort an illegal $45 fee from each airline passenger who doesn’t have, or doesn’t choose to show, ID that the TSA deems to be “compliant” with the REAL-ID Act.

As long as they pay the $45 fee, travelers with no ID or with noncompliant ID have been treated the same way as before the the TSA began demanding the fee on February 1, 2026:

We’ve seen no report of the TSA stopping travelers without ID or without REAL-ID from flying, as long as a they have paid the illegal $45 per person fee.

The only apparent change since the imposition of the $45 fee on February 1 of this year is that instead of phoning the TSA’s ID Verification Call Center (IVCC) and relaying questions and answers verbally between the IVCC and travelers without ID, TSA checkpoint staff are now using a laptop or tablet app to receive the questions and send back the  answers.

The TSA has complied with none of the legal requirements for notice and approval of the information-collection app being used for questioning of travelers without ID. This leaves it unclear whether a human is still involved in fly/no-fly decisions about travelers without ID or whether this decision-making has been delegated to secret algorithms encoded within the app or at the central site that connects the app to Accurint.

We haven’t yet seen any reports of what happens if a traveler without ID or without REAL-ID who hasn’t paid the $45 fee or tries to go through a TSA checkpoint, or doesn’t leave when told to do so. Nor have we heard what happens if a traveler without ID exercises their right to remain silent when questioned about their Accurint file by checkpoint staff. We expect that they would be arrested by local police and/or assessed a civil penalty by the TSA. The Paperwork Reduction Act provides a “complete defense” against any such penalties, but raising that defense would be risky and could be expensive.

Feb 05 2026

CBP keeps its app for US visitors secret

Should a visitor to the US have to install and use a US government app that runs secret code to collect an unknown amount of data using any or all of their phone’s sensors, connects to other unknown data sources and recipients, and uses secret algorithms based on that secret dataset to “auto-deny” some ESTA applications to visit the USA?

We say no — and so does US law.

In December 2025, US Customs and Border Protection (CBP) announced that it planned to shift the Electronic System for Travel Authorization (ESTA) from a website to an app, greatly expand the range of data collected from ESTA applicants, and delegate authority to the app to “auto-deny” some applications.

CBP proposed no rules to govern the proposed “auto-denial” of ESTA applications. We can find no basis in any law for such an automated decision-making procedure. But CBP gave notice that it intends to seek approval for this new and revised app-based collection of ESTA information from the Office of Management and Budget (OMB).

According to the Paperwork Reduction Act (PRA), the request for OMB approval must be preceded by notice of the proposed collection of information, followed by a window of at least 60 days for members of the public to review and submit comments on the proposal.

PRA regulations at 5 CFR §1320.8(d)(2) require that this notice include a complete copy of the proposed collection of information or instructions on how any member of the public can obtain a copy, free of charge, and still have 60 days to review and comment on the proposal.

But CBP didn’t include a copy of the code or any other part of the ESTA app in any format in its notice in the Federal Register. As the 60-day notice-and-comment window runs out, CBP  still has not responded to our repeated requests for this information.

As we note in the comments we filed with CBP:

Since the day this notice was published in the Federal Register we have been diligently, but to date entirely unsuccessfully, attempting to request and obtain a copy of the proposed collection of information from the points of contacts specified in the notice.

This isn’t just a procedural error. The failure to provide valid notice denies us and all other members of the public the opportunity to provide informed comment on the ESTA app, which would require an expert review and audit of the source code.

As of now, we’ve seen none of the user interface screens of the proposed ESTA app; none of the PRA, Privacy Act, administrative appeal rights and procedures, and/or other notices (if any) provided to users of the app; none of the code specifying what data is collected, transmitted, and received by the app;  and none of the code embodying the algorithms and specifying the data they use as the basis for “auto-denial” of some ESTA applications.

The proposal for collection of more information and robo-adjudication of the equivalent of visa applications would be a bad idea even if PRA procedures were followed. We’ll have much more to say about these proposals if and when CBP provides us with proper notice and a chance to inspect the workings of the proposed new version of the ESTA app.

If you’re an Android and/or iOS app developer who might be willing to volunteer your expertise to help us analyze and audit the workings of the ESTA app, if CBP ever publicly discloses its code, please get in touch.

But as of now, because the  notice was plainly invalid, OMB can’t legally approve the CBP proposal.

CBP must either withdraw or abandon this proposal or provide a valid new notice, with a complete copy of the ESTA app including its source code, followed by a new 60-day comment period. If CBP submits this proposal to OMB without first doing this, OMB must reject it as being in clear violation of the PRA regulations.

CBP isn’t using the standard Regulations.gov system for submission of comments on this proposal. If you want to submit your own comments, send them by email by to CBP_PRA@cbp.dhs.gov by midnight EST Monday, February 9, 2026. Be sure to include “Comments to CBP re: OMB Control Number 1651–0111” in the subject line of your email message.

Feb 02 2026

“The TSA’s New $45 Fee to Fly Without ID is Illegal”

Edward Hasbrouck of the Identity Project has the lead article today on Frommers.com, “The TSA’s New $45 Fee to Fly Without ID is Illegal”, Says Regulatory Expert:

On Sunday, February 1, the Transportation Security Administration (TSA) began charging travelers without REAL ID $45 to fly.

This may come as a surprise, but no U.S. law requires you to show ID to get on a domestic flight—or pay the new $45 TSA fee.

It doesn’t matter if you have REAL ID or not. The law doesn’t mandate any ID….

The REAL-ID Act pertains only to which IDs are accepted by Federal agencies in circumstances where ID is required.

The Act did nothing to legally impose a new ID requirement where there wasn’t one already, such as for airline passengers….

Requiring ID won’t make us safer, but it enables surveillance and potential control of our movements….

If you try to defend your rights and refuse, you may be arrested and/or assessed a “civil penalty” by the TSA. Defending yourself in court or finding a lawyer with appropriate expertise may be hard.

But the law, as written, is clear: You have the right to fly without ID, without paying a $45 fee, and without answering questions. Exercising that right, however, is another matter.

Read the full article on Frommers.com.