Sep 09 2020

Portland bans facial recognition by city agencies or in places of public accommodation

Today the City Council of Portland, Oregon, voted unanimously to ban the use of facial recognition technology by City agencies or by private entities in places of public accommodation within the City limits, including at the Portland International Airport (PDX), effective immediately.

Many local and national organizations and individuals testified eloquently in favor of these proposals. We don’t need to repeat all of their general arguments.

But a point of particular concern and particular pleasure for us is that the Port of Portland asked the City Council for an exemption from the ban to allow use of facial recognition “for air carrier passenger processing” — and was turned down.

No member of the City Council mentioned the Port’s request for a carve-out for facial recogntion of air travelers during the City Council discussion, and the proposals were adopted without amendment except for making the ban on private use of facial recognition in places of public accommodation effective immediately, as had already been proposed for the ban on use by city agencies. (The amendment to make the private entity ban effective immediately was made verbally during the City Council meeting, so it isn’t reflected in the advance text of the proposal.)

This is an important precedent , as Portland is only the second jurisdiction in the US to consider local rules related to facial recognition at its airport.

Earlier this year, after behind-the-scenes threats by the US Department of Homeland Security (DHS) to make life difficult for the Port of Seattle if it didn’t collaborate with DHS facial recognition schemes at Sea-Tac International Airport (SEA) and allow airlines and contractors also to do so, the Port of Seattle Commission reneged on the aspirational policy principles it adopted in 2019  and decided to buy and operate common-use facial recognition cameras integrated with DHS and airline databases and operations.

(See our written testimony to the Seattle Port Commission on use of facial recognition at SEA: 1, 2, 3., and articles in our blog here and here.)

The decision by the Port of Seattle was made just before the COVID-19 pandemic drastically reduced traffic at SEA and other airports and delayed the need for the new gates at SEA where the DHS-linked cameras were to be installed. A broad coalition of local and national community and civil liberties organizations has called on the Seattle Port Commission to use the opportunity provided by this delay to reconsider its decision on facial recognition.

Portland did significantly better than Seattle in working to distance itself from and isolate the DHS — not surprisingly in light of the object lesson the DHS has provided in Portland recently with respect to DHS trustworthiness (not), self-restraint (not), commitment to the rule of law (not), and respect for civil and human rights (not). Portlanders don’t trust the DHS to behave any better at PDX Airport than it’s been behaving on the streets of Portland.

PDX airport is located within the City of Portland but operated by the Port of Portland, a special-purpose agency of the state of Oregon governed by a board appointed by the Governor of Oregon. The City of Portland can’t prevent use of facial recognition by the DHS or the Port of Portland, but can regulate or prohibit its use by private entities, including airlines, within the city limits, including at the airport.

The Port of Portland has the authority to enter into contracts, borrow and spend money, manage its employees, and enact rules for activities at PDX Airport. But in addition to the requirements of due process and other Constitutional rights, and the obligations on the airport as a publicly owned and operated place of public accommodations and common-carrier facility, the legislative authority of the Port is limited to the issuance of rules consistent with city ordinances. That appears to mean that the Port may not prohibit that which the city has duly prohibited. (If readers have more expertise on this jurisdictional issue, feel free to leave a comment or drop us a line.)

The Federal government could preempt the Portland ordinances if it enacted valid laws or promulgated valid regulations mandating use of facial recognition by Federally-regulated airlines and/or airports. But no law mandates use of facial recognition for US citizens, even when traveling internatoinally, or for passengers on domestic flights

The DHS has refrained from promulgating any such regulations, preferring to operate outside the law than to establish any legal framework for its use of facial recognition or subject it claim of authority to notice-and-comment rulemaking or judicial review. A petition for rulemaking on use of biometrics for traveler identification submitted to the DHS by the Portland-based World Privacy Forum has been ignored by the DHS for almost two years.

While the DHS has engaged in heavy-handed behind-the-scenes lobbying and threats to “persuade” airlines and airport operating agencies to become its “partners” in biometric surveillance and control of air travelers, as it did in Seattle, the DHS has continued to maintain — correctly — that this “cooperation” is entirely voluntary. In declining to participate, and by exercising its jurisdiction to prohibit airlines or other contractors form doing so within the city limits, the City of Portland is doing only what the DHS has consistently said that local jurisdictions have the authority to do, if they so choose.

The July 14, 2020, letter from the Port of Portland to the Portland City Council requesting exemption from the facial recognition ban made numerous false factual claims and specious arguments. Since these bogus arguments are likely to be raised again in other cites despite having failed to persuade any of the members of the Portland City Council, it’s worth noting and debunking them:

Read More

Sep 03 2020

GAO report on DHS use of facial recognition on travelers

The Government Accountability Office (GAO) has released a new report requested by Congressional oversight committee chairs describing and assessing the ways that US Customs and Border Protection (CBP) and the Transportation Security Administration (TSA) use facial recognition to identity and track international (CBP) and domestic (TSA) travelers.

Here’s how the GAO says it works  (click flowchart for larger version): The GAO report doesn’t address several of the most significant issues with DHS use of facial recognition to identify travelers, including:

Read More

Sep 01 2020

TSA tries out another (illegal) biometric “ID verification” system

Today the Transportation Security Administration (TSA) announced that it has launched a “pilot” at Washington National Airport (DCA) of yet another scheme for biometric identification and tracking of domestic air travelers.

[Screen capture from TSA video]

The new “touchless ID verification” stations at DCA include a webcam (at top center of photo above) a magnetic-stripe reader (lower left) for drivers licenses and other ID cards, and a photographic scanner for passports (lower right).

Travelers who volunteer to use the new system are directed to insert their drivers license, ID card, or passport into the appropriate reader, stand on a marked spot in front of the webcam, and remove their face mask, so that the image from the ID (or, more likely, from some back-end image database linked to the ID, although that hasn’t been disclosed) and the image from the webcam can be compared by some undisclosed algorithm.

[Traveler being directed by TSA staff to remove her face mask for digital mug shot.]

As we’ve noted previously, it appears to us that (1) the TSA has no general authority to require travelers to show their faces or remove face masks, and (2) in many jurisdictions, orders issued by state or local health authorities currently require all people in public places such as airports to wear masks.

The TSA describes this system as “touchless”. But while TSA staff don’t have to touch travelers’ IDs, each traveler has to touch the same ID card or passport scanner. Then, immediately after touching the scanner, they have to touch their face again to put their mask back on.

Read More

Jun 26 2020

Federal bills would restrict airport facial recognition

A bill introduced yesterday in both houses of Congress would, at least initially, prohibit all or most current and planned use of facial recognition or other biometric identification at US airports and borders by the Transportation Security Administration (TSA) and US Customs and Border Protection (CBP).

The Facial Recognition and Biometric Technology Moratorium Act of 2020 was introduced by Sen. Edward Markey (D-MA) as S. 4084 and by Rep. Pramila Jayapal (D-WA) as H.R. 7356. The new bill has already been endorsed by a broad coalition of civil liberties organizations. Sen. Markey has been a leading Congressional critic of facial recognition at airports.

This Federal proposal, if enacted as introduced, would fill a significant gap in ongoing efforts to rein in facial recognition through state laws and local ordinances.

Read More

Jun 23 2020

TSA wants more authority for ID demands, “vetting”, and data use

The Transportation Security Administration (TSA) wants more power to require ID from travelers (“credentialing”), control who is and who is not allowed to exercise their right to travel (“vetting”), and use and share information about travelers with more third parties and for more purposes (“expanded data use”).

These TSA priorities for the next two years are included in a 2020 update released today to the 2018 implementation road map for the TSA and White House long-term strategic plans for travel surveillance and control.

TSA Administrator David Pekoske’s oddly-named “Intent 2.0” strategy update also prioritizes “biometric vetting and [identity] verification”, a “near-contactless experience” at TSA checkpoints, and “vetting as a service”.

The “near-contactless experience” would be achieved, it appears, not through reduced hands-on groping or fewer demands for ID, but through increased use of remote sensing such as facial recognition.

“Vetting as a service” refers to allowing airlines, airport operators, and perhaps other government agencies and/or commercial third parties to use the TSA’s databases of profiles, risk scores, travel histories, free-text comments in reservations by travel industry workers, unverified aggregated derogatory data form other sources, and biometric and other identifiers for their own purposes. This not only expands the potential adverse impact of arbitrary secret algorithmic profiling based on secret databases, but gives airlines a financial incentive to carry out facial-recognition surveillance on the TSA’s behalf in order to get a free ride to use the TSA’s identification/vetting service for business process automation, personalization (including personalized pricing), or other purposes.

None of the TSA’s strategy documents say how the TSA hopes to acquire “expanded vetting and credentialing authorities” or “expanded approvals for data use”. Will the TSA seek to have these included in new laws? Or will to try to grant itself wider authority through  rulemaking or press releases, as it has often done in the past?

At least now we know, if we didn’t already, what to watch out for from the TSA in the months and years ahead.

Jun 08 2020

TSA to take mug shots of domestic air travelers

The Transportation Security Administration (TSA) has officially although quietly announced that, as it has planned for years, its deployment of mug-shot machines at airport checkpoints will move from pilot projects to the new normal for domestic air travelers.

According to a Privacy Impact Assessment (PIA) released last week, the TSA plans to integrate facial recognition into the Secure Flight profiling, scoring, and control system used by the TSA and other linked agencies to decide who is, and who is not, “allowed” to pass through TSA checkpoints to exercise their right to travel by airline common carrier.

Cameras to photograph would-be travelers’ faces will be added to each of the stations at airport checkpoints where TSA employees and contractors currently scan would-be passengers’ travel documents (boarding passes and, if they present ID, ID documents).

Read More

Jun 02 2020

“Immunity passports”, opportunism, and COVID-19

Today the Appropriations Committee of the California Assembly held another hearing on A.B. 2004, a bill that would add to state law a provision that:

An issuer, including an issuer that is a public entity, of COVID-19 test results or other medical test results may use verifiable credentials, as defined by the World Wide Web Consortium (W3C) for the purpose of providing test results to individuals.

What does this mean? Why does it matter? Is it part of a larger pattern?

Read More

Apr 09 2020

The Port of Seattle shouldn’t collaborate in Federal surveillance of travelers

The Identity Project is one of thirty organizations that have issued a joint open letter  calling on the Port of Seattle Commission to reverse its decision to purchase and deploy facial recognition systems, in collaboration and sharing data with US Customs and Border Protection (and through CBP with an unknown  variety of other Federal, foreign, and private entities), to track travelers passing through the  Seattle-Tacoma International Airport:

We, the undersigned organizations dedicated to protecting people’s rights and civil liberties urge the Commission to reverse the decision authorizing the Port to work collaboratively with U.S. Customs and Border Protection (CBP) to procure and implement facial recognition technology at SeaTac International Airport.

The Port of Seattle Commission:

  1. Has a choice to not collaborate with CBP.
  2. Should not facilitate the infrastructural expansion of powerful face surveillance technology.
  3. Should not facilitate CBP’s unauthorized surveillance of US citizens.
  4. Should abide by its professed principles by rejecting collaboration with CBP.

On March 10, 2020, Port Commissioners voted unanimously to collaborate with CBP in rolling out its facial recognition program, ignoring the many privacy, civil liberties, and community organizations that urged the Port to reject participation.

Instead of taking into account the serious constituent concerns about the Port participating in CBP’s unlawful mass collection of biometric data, Commissioners voted to authorize a $5.7 million Request for Proposal (RFP) to procure and implement a facial recognition system at SeaTac International Airport….

We urge you to reject collaboration in CBP’s face surveillance program and reverse the decision to
authorize the procurement of facial recognition systems.

The real motives of the members of the Port Commission in reneging on their professed principles and spending $5 million in Port funds to build an infrastructure of facial recognition surveillance into the new international terminal at Sea-Tac remain unclear.

But the reduction in demand for air travel during the COVID-19 pandemic, which will delay any need for a new terminal for many months, gives the members of the Port Commission time to reconsider and reverse the hasty decision they made last month under CBP pressure.

Do you live, work, or travel in the Seattle area? Do you care about the right to travel? The Port of Seattle Commission needs to hear from you.

The Port Commission has suspended in-person meetings. It’s not clear when the Commission’s next public meeting will take place, or what means of public input or participation will be available. So if you want to be heard by the Commissioners, it’s best to e-mail them now.

If you’d like to join us and the other 29 allied organizations in this call for action, the ACLU of Washington state has a form on their Web site to send a customizable message to each of the members of the Port of Seattle Commission.

Mar 30 2020

“Known Traveler Digital Identity” (KTDI)

On March 26, 2020, the World Economic Forum published specifications  and launched a new website for a project it has christened “Known Travel Digital Identity” (KTDI):

KTDI is a “surveillance-by-design” vision for tracking and control of travelers more dystopian than anything we have seen before.

KTDI would use a blockchain-based distributed ledger to bind together, through an app on a traveler’s mobile device, all of the following data:

  • Biometrics (initially facial images, possibly also fingerprints, etc.)
  • Government-issued ID credentials (passport number, etc.)
  • Travel history including logs of border crossings, hotel stays, and possibly also car rentals and/or other events
  • Purchase logs and possibly bank account information and/or other financial and transaction records
  • Pre-crime predictive “risk assessment” and profiling scores generated at each “intervention” point before and during each trip or transaction

Read More

Mar 24 2020

How drivers license photos are aggregated and shared

During a press conference yesterday, President Trump announced a postponement of the “deadline” previously announced by the Department of Homeland Security for “enforcement” of the REAL-ID Act of 2005 at TSA checkpoints:

I’m also announcing that we’re postponing the deadline for compliance with REAL ID requirements…. We will be announcing the new deadline very soon. It’s going to be announced in a very short moment.

The REAL-ID Act “deadline” was set by DHS press release, not by law or regulation. It’s unclear if a new date will be announced by decree of the Secretary of Homeland Security, or by promulgation of regulations. There has been no further announcement by the DHS, and there is no notice of rulemaking in the Federal Register today.

As we noted yesterday, neither a postponement nor any of the other proposed amendments to the REAL-ID Act would address the central problems in this law: the requirement for states that want to be deemed “compliant” to share their drivers’ license and state-ID databases with all other states.

Read More