Last month US Customs and Border Protection (CBP) issued a final rule on Collection of Biometric Data From Aliens Upon Entry to and Departure From the United States.

If this new rule is Constitutional and otherwise valid, which we don’t think it is, it requires all non-US citizens entering or leaving the US to submit to mug shots. These will be used for a wide range of purposes in conjunction with automated facial recognition systems. Photography and automated facial recognition of all foreigners entering and leaving the US will be expanded from airports to all land border crossings.

This warrantless traveler surveillance and tracking program would cost more than $100 million per year, in CBP’s estimate (which explicitly puts zero value on privacy).

CBP proposed this rule in 2020, and we submitted comments (together with Restore the Fourth, Privacy Times, and the National Workrights Institute)  objecting to the proposal as procedurally improper — before even needing to reach the Constitutional issues it presented — and in violation of the Privacy Act and the Paperwork Reduction Act.

CBP says that, “After review of the comments, through this final rule, DHS is finalizing the proposed changes in the NPRM without substantive modification.” But CBP hasn’t cured the defects in the proposal, and brushed off our objections on the basis of patently false factual claims that can be disproved by even cursory review of CBP’s own website or the situation at any of the airports where travelers are being forced to submit to mug shots.

Along with its final rule, CBP announced another 30-day window for public comments, which closes today. But CBP only wants input on how to carry out this warrantless and surveillance and traveler-tracking program, not whether it is legal:

Comments submitted regarding any topic other than the specific collection process and costs and benefits on these newly implemented transportation modalities are out of scope for this final rule and will not be considered.

We have declined the opportunity to submit further comments on the “specific collection process” to be used by CBP for these unlawful warrantless searches. We’re not going to advise CBP on how to break the law. The rule is unlawful. If CBP is uninterested in comments on the validity of the rule, it can and should be challenged in court.

In response to our objection that CBP’s outsourcing of traveler surveillance to airlines and airports violates the Privacy Act, CBP said that:

DHS acknowledges that the Privacy Act requires that ‘‘each agency that maintains a system of records shall . . . collect information to the greatest extent
practicable directly from the subject.’’ 5 U.S.C. 552a(e)(2) … Nevertheless, as explained in the NPRM, CBP considered and piloted many types of biometrics collections. Using information gleaned from the pilots as well as public feedback, CBP has concluded that partnering with carriers and airports to capture facial images is the most viable large-scale solution as it is highly effective, cost effective, and less disruptive than other possible methods.

It’s unclear what CBP means by “most viable”, but this response doesn’t satisfy the law. Whether outsourcing to airlines and airports is “cost-effective” or “less disruptive” is irrelevant to whether it is meets the far higher standard in the law that the government must “collect information to the greatest extent practicable directly from the subject”.

Maintaining a system of records about individuals in violation of the Privacy Act is potentially a criminal violation of the Privacy Act, although we won’t hold our breath for Federal prosecutors to seek indictments of Federal officials for such crimes.

In our comments, we also pointed out that the Paperwork Reduction Act requires CBP, like all other Federal agencies collecting information from the public, to provide individuals with specific notices including the consequences, if any, for not providing the information, and the OMB control number for the collection of information.

In response, CBP falsely claims that, “CBP displays the OMB control number on signage.”  The final rule that includes this false claim even cites the CBP website that includes model signs and notices— none of which include any PRA notice or OMB control number.

It’s unclear whether the CBP staff and officials who prepared and signed off on the final rule never actually looked at their own website or signage, or whether they were knowingly lying about their signage and notices.

Regardless of the reasons for the absence of proper signage, the PRA (44 U.S.C. §3512) creates an absolute defense for anyone — regardless of citizenship — against any  penalty for not providing requested information, including not submitting to airport mug shots, in the absence of a valid PRA notice at the point of collection of information, including a valid OMB control number applicable to the specific collection of information.

“Furthermore”, the final rule claims, “CBP regularly conducts periodic signage audits that include local CBP personnel to ensure signs are accurate and placed appropriately.”

We’ve seen no signs in any airport that include the required PRA notice or the OMB control number (1651–0138) which CBP claims apply to traveler mug shots. Any diligent, competent audit would have spotted this. Was CBP lying outright, and there were no audits at all? Or were any audits conducted with a lack of competence and/or diligence?

Regardless of whether the CBP staff and officials knew the claims in final rule were false, didn’t care if they were true or false, or simply didn’t bother to fact-check what they were signing off on, a rule justified by such patently false claims — indicative of bad faith, incompetence, and or gross negligence — fits the definition of a rule that is subject to challenge in court, pursuant to the Administrative Procedure Act, as “arbitrary, capricious, an abuse of discretion, or… unsupported by substantial evidence.”

CBP may not be interested in any further comments from the public about the legality of warrantless mug shots of travelers at airports an borders. But its actions remain subject to challenge in court under multiple Federal statutes as well as the Constitution.