Today the Transportation Security Administration (TSA) announced that it has launched a “pilot” at Washington National Airport (DCA) of yet another scheme for biometric identification and tracking of domestic air travelers.

[Screen capture from TSA video]

The new “touchless ID verification” stations at DCA include a webcam (at top center of photo above) a magnetic-stripe reader (lower left) for drivers licenses and other ID cards, and a photographic scanner for passports (lower right).

Travelers who volunteer to use the new system are directed to insert their drivers license, ID card, or passport into the appropriate reader, stand on a marked spot in front of the webcam, and remove their face mask, so that the image from the ID (or, more likely, from some back-end image database linked to the ID, although that hasn’t been disclosed) and the image from the webcam can be compared by some undisclosed algorithm.

[Traveler being directed by TSA staff to remove her face mask for digital mug shot.]

As we’ve noted previously, it appears to us that (1) the TSA has no general authority to require travelers to show their faces or remove face masks, and (2) in many jurisdictions, orders issued by state or local health authorities currently require all people in public places such as airports to wear masks.

The TSA describes this system as “touchless”. But while TSA staff don’t have to touch travelers’ IDs, each traveler has to touch the same ID card or passport scanner. Then, immediately after touching the scanner, they have to touch their face again to put their mask back on.

The TSA press release (reproduced in full below, since it doesn’t seem to be available on the TSA’s website) doesn’t say how long this “pilot” will last. In practice, expansions of TSA tracking of travelers have typically been rolled out incrementally, initially announced with reassuring statements that “this is only a test” and is “voluntary”, but then continued indefinitely and made compulsory as a condition of passage through TSA checkpoints.

The TSA signs at the new ID verification stations says that mug shots are voluntary, but that “You must still insert or scan your identity document in the device, even if you do not have your photo taken.” No legal basis for this purported requirement is specified:

[Sign at TSA “touchless ID verification” station]

The TSA signs (visible in full on this TSA video released in conjunction with today’s press release) include — typically for the TSA and DHS — no OMB Control Number or Paperwork Reduction Act notice, both of which are required for any collection of information by a Federal agency, regardless of whether the collection of information is optional or mandatory, and regardless of whether the information collected is retained.

As with the TSA’s illegal “ID verification form” (Form 415), we believe that in the absence of OMB arpproval, assignment of an OMB Control Number, and a valid PRA notice including that OMB Control Number, the PRA provides an absolute defense against any sanctions for declining to have data from an ID card or passport collected by the TSA.

It wouldn’t be difficult for the DHS to comply with the requirements for OMB approval and PRA notices, and the failure to comply with these limited procedural  rules isn’t what’s fundamentaly wrong with requiring travelers to identity themseves.  But the DHS’s cavalier disregard for the PRA is indicative of its general disregard for even more significant laws.

Please let us know what happens if you decline to have your ID card or passport scanned (on the basis of the PRA) or to remove your face mask (on the basis of local health orders).

The card readers and scanners show Idemia labels, but it’s unclear whether Idemia has also provided the image-comparison software or database connectivity:

[Mag-stripe card reader (left) and passport scanner (right)]

The TSA’s solicitation for proposals from contractors for other new ID verification systems for air travelers expired last Friday. Today we filed a Freedom of Information Act (FOIA) request for all responses to the solicitation and TSA evaluations of the proposals.

The following is the full text of today’s TSA press release:

TRANSPORTATION SECURITY ADMINISTRATION

PRESS RELEASE

FOR IMMEDIATE RELEASE

September 1, 2020

TSA continues piloting “self-service” checkpoint technology

Effort promotes social distancing, reduces contact between officers and passengers

WASHINGTON – The Transportation Security Administration (TSA) is piloting a new touchless “self-service” technology that matches a traveler’s live photo with the photo on their ID. The initiative automatically authenticates a traveler’s ID, matches the live photo with the image on their ID, and confirms their flight information in near real time.

“In light of COVID-19, advanced health and safety precautions have become a top priority and part of the new normal for TSA,” said TSA Administrator David Pekoske. “As a result, we are exploring rapid testing and deployment of this touchless, self-service technology. At the conclusion of the pilot, we expect to be able to determine how positioning the new technology will allow passengers to use it themselves thereby providing a safer checkpoint experience, while adding significant security benefits.”

The current pilot at Ronald Reagan Washington National Airport (DCA) follows a previous 30-day test of the credential authentication technology with a camera in September 2019 at McCarran International Airport with volunteer TSA PreCheck™ passengers. Following that pilot, TSA refined the technology in partnership with the vendor and industry experts. The pilot at DCA also includes volunteer TSA PreCheck travelers, who generally have the shortest wait times and the least amount of physical contact while at a TSA checkpoint.

Travelers at DCA are now able to voluntarily participate in the pilot. Passengers will be able to approach the device and insert their own ID into the scanner for authentication, rather than physically handing it to a TSA officer, thus promoting social distancing and reducing physical contact. The device will also verify the identity of passengers by taking a photo of the traveler and comparing it with the image on their ID. The device will display results for face matching, ID authentication, and flight information to the TSA officer, who will be behind an acrylic shield to further minimize contact between the officer and passengers.

The credential authentication technology units authenticate several thousand types of IDs including:

• U.S. driver’s licenses and photo IDs issued by state motor vehicle departments
• U.S. passports/Permanent resident cards or visas
• U.S. military common access cards/Retired and Uniformed service military ID cards
• Department of Homeland Security Trusted Traveler ID cards

Photographs of travelers taken as part of the program are not saved, as there is no capacity to do so. The photographs are only used for identity verification to confirm that the photo matches the image on the traveler’s ID and ensure the passenger is the true bearer of an authentic ID. Signs near the checkpoint will provide notice to passengers on how to participate in the pilot, in addition to providing instructions on how to decline having their photo taken, although passenger IDs will still have to be scanned through the device for identity verification. Participating travelers may complete a brief survey via a QR code regarding their experience and satisfaction with the self-service system and its usability.

For broadcast content, please see TSA courtesy B-roll of the new machines in use at DCA.