A series of revelations in recent months have highlighted a pattern of misuse by US Customs and Border Protection (CBP) of data about travelers and their activities.

Information obtained without a warrant or probable cause under a under a variety of exceptions to the Fourth Amendment (including administrative searches and mug shots at airports, border searches, and “consent” to collection of location information by private third parties) has been aggregated, indexed, and made available for search and retrieval by other CBP staff, other law enforcement agencies, and foreign governments.

Use of the fruit of this surveillance of travelers hasn’t been limited to the government agency that first obtained it from travelers or commercial third parties, or to the purpose that purportedly allowed CBP to obtain it without warrant or probable cause. No access logs are maintained for some of these databases of travel surveillance data, so it’s impossible to audit how they have been used.

Here’s some of what CBP has been up to with its travel surveillance databases:

Biometrics: The Department of Homeland Security (DHS), including CBP, is aggregating biometric information about both US citizens and foreigners into a database recently renamed as the Homeland Advanced Recognition Technology System (HART), previously called IDENT. The largest number of biometric records in HART are facial images.  “IDENT, contains 272 million unique identities, including 6.7 million iris pairs and 1.1 billion face images.” A large and growing percentage of these mug shots are photos of faces of (some) domestic and (most) international air travelers  taken by cameras operated by airlines and airports at check-in counters, boarding gates, and other airport locations. The HART database is hosted by Amazon, not on government servers, making it impossible for the government to be sure of whether other entities have obtained access to the records stored on Amazon’s servers.

Despite objections by the Identity Project and others to the legality of collecting mug shots of innocent travelers, CBP and DHS are working to expand both the contents of this database and the already large universe of its users. Documents released by European governments in response to inquiries by European legislators show that the US is seeking reciprocal access by US and foreign governments to each other’s biometric databases (primarily mug shots of innocent travelers) as a condition of visa-free entry for certain tourists and short-term business visitors. Israel is reportedly the first foreign country given access to the DHS biometric database through such a reciprocal agreement.

Travelers are often given no meaningful pathway to opt out of being photographed as they approach check-in counters, boarding gates, or CBP inspection stations, and none of the notices to which they are legally entitled. They are given no clue that airport mug shots will be shared with foreign governments, for purposes only those governments know. But CBP and DHS recognize no limitations on the recipients or purposes for use of these photos.

Location data from smartphone apps: Records released to the ACLU in response to a Freedom Of Information Act lawsuit show that CBP and other DHS components have spent millions of dollars to purchase timestamped location records correlated with cellphone numbers. These location records are “ingested” into the CBP Automated Targeting System.DHS claims that cellphone numbers aren’t “personally identifiable information” and that users of smartphone apps have knowingly and “voluntarily” given “permission” to app companies to track their movements and sell this information to the police or other government agencies. Here again, there appears to be no meaningful purpose or geographic limitation on further use or “sharing” of location data once it’s in the hands of the DHS.

Border searches of electronic devices:  In a briefing for staff of Sen. Ron Wyden on June 20, 2022, CBP officials revealed that data extracted from thousands of electronic devices each year that are seized without suspicion or warrant at borders and international airports is entered into a searchable CBP database accessible without access logs by thousands of CBP staff.  Data extracted from cellphones and other electronic devices and uploaded to the CBP Automated Targeting System (which has been largely exempted from the Privacy Act) includes contact lists, call logs, and messaging transcripts. Once again, there’s no limitation on the purposes for which this data can be used or shared, or the end users on whose behalf CBP staff can query the database of cellphone and device data.

In a letter requesting more information from CBP, Sen. Wyden rightly notes that “American have a right to return home.” Travelers whose electronic devices are seized are given a CBP “tear sheet” which “states that collection of travelers’ information is ‘mandatory,’ but fails to convey that CBP may not arrest an American or prevent them from entering the country if they fail to tell CBP their password.” Travelers’ data may also be protected from search or seizure by the federal Privacy Protection Act, but only if they know to assert their rights under this rarely-invoked law.

There’s a pattern here: CBP and DHS will maximize their misuse and sharing of any travel data they can get their hands on from any government or private source. The solution is not to allow them to collect this data without warrants or probable cause in the first place.