The Transportation Security Administration (TSA) has officially although quietly announced that, as it has planned for years, its deployment of mug-shot machines at airport checkpoints will move from pilot projects to the new normal for domestic air travelers.

According to a Privacy Impact Assessment (PIA) released last week, the TSA plans to integrate facial recognition into the Secure Flight profiling, scoring, and control system used by the TSA and other linked agencies to decide who is, and who is not, “allowed” to pass through TSA checkpoints to exercise their right to travel by airline common carrier.

Cameras to photograph would-be travelers’ faces will be added to each of the stations at airport checkpoints where TSA employees and contractors currently scan would-be passengers’ travel documents (boarding passes and, if they present ID, ID documents).

U.S. Customs and Border Protection (CBP), in collaboration with airlines and airport operators, already collects photos of many international travelers. CBP has been moving in fits and starts toward making mug shots mandatory even for U.S. citizens traveling internationally. As of now, mug shots are still officially “voluntary” for U.S. citizen international travelers, although many U.S. citizens have reported not being allowed to opt out. But last month, as we noted in an earlier blog post, the CBP official in charge of deployment of facial recognition said CBP plans to issue a Notice of Proposed Rulemaking (NPRM) for mandatory facial recognition of international travelers before the end of this year.

We expect that, consistent with the TSA’s “biometrics vision for all commercial aviation travelers”, deployment of facial recognition at TSA checkpoints for domestic air travelers will follow the same steps as have been followed by CBP in rolling out facial recognition for international air travelers: first pilot projects, then universal deployment of “optional” mug-shot cameras at airports (on an allegedly “opt-out” basis), then increasingly adverse treatment (delay, more intrusuive and in time of pandemic dangerous groping, etc.) of those who opt out, and eventually — if most travelers “voluntarily” submit to mug shots — denial of travel to those who don’t. The PIA doesn’t say how soon any of this will happen.

The time to say “no” is now, while you still can. Don’t consent to being photographed at TSA checkpoints or airline check-in counters or kiosks. For your own safety as well the protection of your civil liberties, don’t remove your mask! TSA checkpoints, check-in counters, and all kinds of kiosks are among the places at airports where transmission of contagious diseases is most likely. We are very interested in hearing from any traveler who is ordered to remove a face mask.

The TSA claims that domestic air travelers will be allowed to “opt out” of facial imaging, but it will be up to you to spot the cameras and stay out of their field of view. Notably, the TSA’s Privacy Impact Assessment (PIA) doesn’t say what, if any, notices will be posted for travelers to see before they come into range of the mug-shot cameras.

The required notices are dictated by the Paperwork Reduction Act (PRA) and the Privacy Act, but the TSA has ignored both of these Federal laws in its facial recognition plans.

Even if a “collection of information” (including biometric information) by a Federal agency such as the TSA is voluntary, the PRA requires that it be approved in advance by the Office of Management and Budget (OMB) and assigned an OMB control number. That OMB control number and other notices specified by the PRA must be provided to  all individuals from whom information is to be collected.

Pursuant to the PRA, no penalties may be imposed for failure or refusal to provide information unless these approval and notice requirements are complied with.

The PIA for facial imaging at TSA checkpoints doesn’t cite an OMB control number, and so far as we can tell, there is none. If TSA checkpoint staff ask you to take off your face mask so that they can take your mug shot, ask for the OMB control number for this information collection and a copy of the applicable Paperwork Reduction Act Notice.

The TSA says that facial images collected by the TSA “will be retained for no longer than 24 hours after the flight departure time “. But regardless of how long this data is retained, any retention of personal identified information such as mug shots is prohibited by the Privacy Act unless the agency has previously published an applicable System Of Records Notice (SORN) in the Federal Register.  Operation of a system of records without proper notice is a crime on the part of the responsible agency officials.

The new PIA for the TSA’s facial recognition scheme for air travelers claims that the data collected would be covered by the Secure Flight SORN promulgated in 2015. But facial images collected at checkpoints are not among the categories of information listed in the SORN as included in that system of records.

The bottom line is that the TSA facial recognition scheme described in the latest PIA would violate both the PRA and the Privacy Act. To the extent that it would require or induce travelers to remove their face masks, it would exacerbate the pandemic hazards of travel to the health of travelers and airline, airport, and TSA staff and contractors.