Papers, Please!

The Identity Project

Category Archives: Biometrics

Mar 15 2023

TSA confirms plans to mandate mug shots for domestic air travel

In an on-stage interview yesterday at South By Southwest by a reporter for the Dallas Morning News, the head of the US Transportation Security Administration made explicit that the TSA plans to make collection of biometric data  mandatory for airline travel:

According to a report in today’s edition of the newspaper by Alexandra Skores on the statements by TSA Administrator David Pekoske:

Biometric technology, such as facial recognition, is increasingly being used in TSA’s identity verification process….

He said passengers can also choose to opt out of certain screening processes if they are uncomfortable, for now. Eventually, biometrics won’t be optional, he said.

Mandatory mugshots for all airline passengers have been part of the TSA’s road map since at least 2018, despite objections such as those raised by the ACLU and the Identity Project.

TSA Privacy Impact Assessments have claimed that air travelers could, for now, opt out, of mug shots, but the TSA has never complied with the notice requirements in the federal Privacy Act and Paperwork Reduction Act (PRA).

So far as we can tell, there’s never been any PRA approval for collection of biometrics from domestic air travelers, or any PRA notice at a TSA checkpoint.

Since the TSA has never applied to the Office of Management and Budget (OMB) for approval of this information collection, as required by the PRA, we don’t know what legal basis it would claim for this collection of biometric information.

As at US Customs and Border Protection inspection stations and kiosks for international travelers, domestic travelers asked to submit to mug shots at TSA checkpoints  are protected not only by the US Constitution and international treaties but also by federal laws including the PRA. As with declining to show ID or provide other information, you have the right not to provide biometric information unless and until the TSA gets approval from OMB to collect this information, and provides notices that comply with the PRA.

In 2021, the TSA tried to get Congress to exempt some of its activities from the PRA. But Congress turned it down, making clear that Congress intends the PRA to apply to the TSA.

For now, it remains the law (44 U.S.C. § 3512) that:

(a) Notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information that is subject to this subchapter if—

(1) the collection of information does not display a valid control number assigned by the Director [of the Office of Management and Budget] in accordance with this subchapter; or

(2) the agency fails to inform the person who is to respond to the collection of information that such person is not required to respond to the collection of information unless it displays a valid control number.

(b) The protection provided by this section may be raised in the form of a complete defense, bar, or otherwise at any time during the agency administrative process or judicial action applicable thereto.

Unless and until this changes, no matter what the TSA says, you do have the right to opt of facial imaging at TSA checkpoints.

Nov 23 2022

The airport of the future is the airport of today — and that’s not good.

(video; slides)

[Facial recognition at each step in airline passenger processing. Slide from presentation by Heathrow Airport Holdings Ltd. to the International Civil Aviation Organization (ICAO) Traveler Identitification Program symposium, October 2018]

Today, the day before Thanksgiving, will probably be the busiest day for air travel in the USA since the outbreak of the COVID-19 pandemic in early 2020.

If you are flying this week for the first time in three years, what will you see that has changed?

Unfortunately, many of the most significant changes made during the pandemic are deliberately invisible — which is part of what makes them so evil.

During the pandemic, largely unnoticed, the dystopian surveillance-by design airport of the future that we’ve been worried and warning about for many years has become, in many places, the airport of today.

While travelers were sheltering in place during the COVID-19 pandemic, airports have taken advantage of the opportunity to move ahead with expansion and renovation projects. While passenger traffic was reduced, and terminals and other airport facilities were operating well below capacity, disruptions due to construction could be minimized.

A characteristic feature of almost all new or newly-renovated major airports in the U.S. and around the world is that they are designed and built on the assumption that all passengers’ movements within the airport will be tracked at all times, and that all phases of “passenger processing” will be carried out automatically using facial recognition, as shown in this video from a technology vendor, Airport of the Future:

[Stills from 2019 vendor video, Airport of the Future.]

In the airport of the future, or in a growing number of present-day airports, there’s no need for a government agency or airline that wants to use facial recognition to install cameras or data links for that purpose. As in the new International Arrivals Facility at Sea-Tac Airport, which opened this year, the cameras and connectivity are built into the facility as “common-use”  public-private infrastructure shared by airlines, government agencies, and the operator of the airport — whether that’s a public agency (as with almost all U.S. airports) or a private company (as with many foreign airports).

Read More →

Sep 22 2022

Freedom to travel to get an abortion

[Arrows indicate populations of states where abortion is, or is likely to become, illegal, and directions and distances to the nearest states where abortion is legal. Note that some of the routes shown are more likely to be followed than others, since abortion is more or less heavily restricted in some states where it is shown on this map as legal. Diagram by Bloomberg News based on data from the Guttmacher Institute.]

Increasing variations between state laws related to abortion are prompting an increase in the already large numbers of women who travel across state lines to obtain abortions.

For women in many states, bans on abortion are making the right to interstate travel an essential prerequisite to the right to obtain an abortion.

Both anti-abortion vigilantes and state laws criminalizing actions related to abortion, including facilitating abortion-related travel, are prompting women seeking abortions as well as those who support abortion rights to think about how to protect abortion travelers and their supporters against identification, surveillance, stalking, harassment, or legal sanctions.

In this context, the right to anonymous travel has acquired new importance and urgency. If you’ve wondered, “Why would anyone want to travel anonymously?” now you know one of the reasons.  But what’s needed is “right to travel” legislation, not just “privacy” legislation. Current Federal “privacy” bills would do little to protect abortion travelers.

What are the patterns of abortion-related travel? How could state authorities or private vigilantes identify or track the travels of these women — whether they drive or take buses, trains, planes, or automobiles? What, if anything, can women traveling across state lines to obtain abortions do to protect themselves against being identified, tracked, and potentially prosecuted or subjected to retaliation, harassment, or other sanctions?  What could the Federal government do to protect these women’s right to travel, and to do so privately and safely?

As discussed in detail below, the possibilities for technical self-defense against threats to the right to travel are limited. Congress needs to act to include protection for the right to travel — regardless of the purpose for which you  travel — in any abortion rights legislation.

Read More →

Sep 19 2022

CBP aggregates and disseminates travel data from warrantless searches

A series of revelations in recent months have highlighted a pattern of misuse by US Customs and Border Protection (CBP) of data about travelers and their activities.

Information obtained without a warrant or probable cause under a under a variety of exceptions to the Fourth Amendment (including administrative searches and mug shots at airports, border searches, and “consent” to collection of location information by private third parties) has been aggregated, indexed, and made available for search and retrieval by other CBP staff, other law enforcement agencies, and foreign governments.

Use of the fruit of this surveillance of travelers hasn’t been limited to the government agency that first obtained it from travelers or commercial third parties, or to the purpose that purportedly allowed CBP to obtain it without warrant or probable cause. No access logs are maintained for some of these databases of travel surveillance data, so it’s impossible to audit how they have been used.

Here’s some of what CBP has been up to with its travel surveillance databases:

Read More →

May 20 2022

New reports on DHS surveillance and profiling

Two new reports from university think-tanks call attention to surveillance and profiling — including surveillance of, and action against, domestic and international travelers — by the Department of Homeland Security and its components.

A Course Correction for Homeland Security, a report by the Brennan Center for Justice at New York University, cites to some of our work and some examples of cases we have been involved with in its analysis of DHS data collection (surveillance), and “risk assessments” (algorithmic profiling and control), especially as they relate to travelers.

American Dragnet: Data-Driven Deportation in the 21st Century, a report by the Center on Privacy and Technology at Georgetown University Law School, focuses on DHS’s Immigration and Customs Enforcement (ICE) division, especially ICE access to facial images and other information obtained from drivers licenses and commercial data brokers.

A common theme of both reports is that DHS surveillance is more pervasive, more intrusive, and less visible than is generally recognized.

Airline reservations and demands for ID from travelers are used not merely to check for currently blacklisted would-be travelers, but are retained and used to build travel histories and social networks maps that are then used by suspicion-generating guilt-by-association algorithms to expand the web of surveillance, profiling, and extrajudicial blacklisting.

ICE represents itself as an agency with jurisdiction only over non-US citizens, but in fact runs photos and drivers license and location data about a large fraction of the entire population of US citizens through its profiling and enforcement algorithms. DHS lurks (usually invisibly) in the background, “ingesting” or obtaining access to personal information, when individuals pose for drivers license photos, make airline reservations, or interact with businesses that “share” data directly or indirectly with DHS.

What is to be done about this sorry state of affairs?

Both of these reports suggest that some reforms could be made by policy, at the direction of the President, the Secretary of Homeland Security, or the heads of DHS components.

However, given the thoroughly bipartisan continuity of support by both Democratic and Republican administrations for the continual expansion of DHS surveillance, especially of travelers and foreigners and most especially of border crossers, since its creation 20 years ago, we have little hope for reform from within DHS or at the behest of the White House.

Exposure of abuses is good, but more is needed than a change of administration policy.

While we welcome any additional attention paid to the problems with the DHS, we think they call for court action to uphold the Constitutional and treaty rights of travelers and other individuals, and Congressional action to effectuate those rights and to facilitate judicial review and redress for government actions that violate those rights.

The DHS, as these reports reveal, is an ever-growing dragnet surveillance agency, operating outside the rule of law. What are we going to do to alter or to abolish it?

Apr 12 2022

Facial recognition signage at new Sea-Tac terminal flunks legal test

For several years the Identity Project has been engaging with the Port of Seattle over its expansion of automated facial recognition to track travelers at Sea-Tac Airport.

Today we made yet another (virtual) visit to the Port of Seattle Commission to give the following comments (PDF) on the latest test of the new International Arrivals facility at Sea-Tac, scheduled to open  next week:

Comments of the Identity Project to the Port of Seattle Commission
for the Commission meeting of April 12, 2022, re: signage for travelers about the collection of facial images at the International Arrivals Facility at Sea-Tac Airport

Members of the Port of Seattle Commission:

The Identity Project (PapersPlease.org) is a nonprofit civil liberties and human rights organization with expertise in identity-based surveillance and control of travelers.

We are submitting these comments to call to your attention the failure of both the Port of Seattle and US Customs and Border Protection (CBP) to provide notice to travelers of CBP’s collection of facial images (“biometrics”) at the new International Arrivals Facility (IAF) at Sea-Tac International Airport, as required both by Federal law and by the policies on use of biometrics adopted by the Port Commission.

Read More →

Jan 30 2022

ID-Me-Not

The IRS is reportedly reconsidering its previously-announced plan to require taxpayers to share facial images and other personal data with an unregulated private company, ID.me, in order to file tax returns online or access information about their filings, payments, and returns through the IRS website.

The hesitation by the IRS comes after ID.me was caught lying about whether it uses “one to many” facial recognition to try to identify facial images against large databases of selfies or other mug shots. ID.me had falsely claimed that it only uses “1 to 1” matching to “verify” that a selfie matches previously stored images of a specific person. But the company has now admitted that’s incorrect. ID.me actually  compares selfies submitted by taxpayers (or by hackers or identity thieves, who could easily copy a facial image from a targeted victim’s or their friend’s social media posts) to its own “internal” database of images of tens of millions of people aggregated from unknown sources.

Read More →

May 19 2021

A race to the bottom: DHS “Biometric Tech Rally”

Today the U.S. Department of Homeland Security (DHS) announced a competition between hardware and software vendors to demonstrate the facial-recognition systems that are most useful for surveillance and other malign uses: cameras or other sensors and facial and/or other biometric matching algorithms that can identity travelers (or other people in public places) even if they are wearing masks:

[T]he 2021 Biometric Technology Rally will focus on evaluating the ability of systems to reliably collect and/or match images of individuals, including those wearing face masks. The intent is to improve the ability to recognize people without requiring travelers to remove protective equipment….

The 2021 Biometric Technology Rally will be held at the Maryland Test Facility (MdTF) in Upper Marlboro, Maryland, later this fall. Testing will be performed in controlled scenarios relevant to DHS operations….

Providers of face and multi-modal biometric acquisition systems, as well as providers of biometric matching algorithms, are encouraged to participate.

Requiring travelers to remove their masks at checkpoints operated by or on behalf of the Transportation Security Administration (TSA) and/or other DHS components endangers travelers and makes clear that the U.S. government has put surveillance and tracking of travelers ahead of safety and health.

But the way to completely eliminate the threat to travelers’ health and safety posed by unmasking is to stop trying to identify travelers,  which is based on the “pre-crime” fantasy that identity-based algorithms can read travelers’ minds and predict which of them intend to  commit future aviation-related crimes. Instead, the TSA should confine its searches to those intended to detect genuinely threatening objects: weapons and explosives.

Feb 01 2021

CDC orders air travelers to unmask for government surveillance

Putting government surveillance and control of travelers ahead of what is supposed to be their mission of protecting of the public against infectious diseases, the U.S Centers for Disease Control and Prevention (CDC) has ordered that, effective today, all air travelers must risk their lives by removing their face masks on demand of Transportation Security Administration (TSA) checkpoint staff or airline ticketing or gate agents.

Until today, as we have noted previously, many state and local health orders issued in response to the COVID-19 pandemic required everyone in public indoor spaces such as airports to wear face masks, without any exception that would have applied at TSA checkpoints. Although we are not aware of any litigation that ensued, air travelers could have asserted their right — and even their  duty — not to remove their face masks, under pain of criminal penalties for violating public health orders.

The CDC order effective today appears to be designed to preempt those state and local health orders, and open the door for the TSA, TSA contractors, and airline staff to endanger the lives of air travelers in the interest of surveillance and control (by the TSA) and “revenue protection” against transfers of nontransferable tickets  (by airlines):

The requirement to wear a mask shall not apply under the following circumstances: … When necessary to temporarily remove the mask to verify one’s identity such as during Transportation Security Administration screening or when asked to do so by the ticket or gate agent or any law enforcement official.

The CDC order aloows — and, in fact, requires — TSA and airline staff and contractors to leave their masks on. Only travelers’ lives are to be endangered.

It remains unclear, of course, whether it is “necessary .. to verify one’s identity” either to the TSA, its contractors, or airline staff, much less whether looking at faces is the way to do so. We think not. But whatever the legality of “ID verification”, the CDC officials responsible for this unmasking order should be ashamed of their betrayal of their medical mission and for promulgating an “insecure flight” requirement.

Dec 21 2020

We say “No” to mug shots at airports and borders

[Illustration from CBP website. The claim that facial recogntion “helps to prevent the spread of germs” is especially bogus, since facial recognition requires travelers to remove their face masks wherever it is used.]

Today the Identity Project (IDP), Restore the Fourth, Privacy Times, and the National Workrights Institute  filed joint comments with U.S. Customs and Border Protection (CBP) in opposition ot the CBP proposal to require mug shots (and possibly collection of other biometrics) from all non-U.S. citizens at all border crossings and international airports and seaports:

The purported NPRM [Notice of Proposed Rulermaking] was promulgated under purported authority delegated by an official purporting to exercise the duties of the Secretary of Homeland Security. That official was not appointed in accordance with the Vacancies Reform Act and therefore lacks authority to promulgate notices of proposed rules or final rules, or to delegate authority to do so which they do not themselves hold….

The proposed rules and procedures would violate the Privacy Act, and must therefore be revised or withdrawn.

The proposed rules and procedures would violate the Paperwork Reduction Act (PRA), and must therefore be revised or withdrawn.

The impact assessment in the NPRM is incomplete, inaccurate, and grossly underestimates the costs which would be imposed on individual travelers by the proposed rule. The NPRM fails to consider how many (more) individuals would opt out of collection of biometrics, if they were provided with the notices required by the PRA, or the cost to those travelers who are so delayed that they miss their flights. The impact assessment must be revised.

Read More →