Biometrics – Page 7 – Papers, Please!

Feb 16 2018

Will “continuous vetting” include new demands for travel information?

Congress is currently considering multiple “immigration” bills containing provisions for “continuous screening” or “continuous vetting” of foreign residents, visitors, and would-be visitors to the US. As we have noted previously, “continuous screening” and “continuous vetting” are euphemisms for “continuous surveillance and control”.

These so-called “immigration” bills would not be limited to foreigners. Many of them would include US citizens exercising our right to leave our country, and to return, in pre-crime travel surveillance and control schemes.

One question that has been raised about some of these proposals is (1) whether they would require airlines to provide the DHS with additional information about air travelers, or require information about potential passengers to be provided further in advance of scheduled flights, and (2) if so, whether this would violate the US “agreement” with the European Union regarding US government use of PNR data obtained from airlines.

Here’s some background, and some analysis, of what “continuous vetting” might mean for US government use of data from airlines, and for the US agreement with the EU:

Read More →

Jan 30 2018

Government and industry collaborate in travel surveillance

Senior officials of US Customs and Border Protection (CBP) came to San Francisco last week to meet with representatives of the Identity Project and other civil liberties and human rights organizations regarding CBP “biometric entry/exit” schemes. These CBP programs, some of which are already in operation, involve taking digital mug shots of international travelers — including US citizens — as they enter and leave the US. The meeting in San Francisco was a follow-up to one in Washington, DC, in August 2017.

Debra Danisek, CBP Privacy Officer, and John Wagner, Deputy Executive Assistant Commissioner in charge of the CBP “Office of Field Operations”, were accompanied to the meeting by CBP national, regional, and SF Bay Area local CBP policy and operations staff.

We welcomed the opportunity to point out to the CBP officials in charge of these programs that — especially as they apply to US citizens — they violate multiple Federal laws, involve unconstitutional warrantless, suspicionless dragnet surveillance of how we exercise our right to assemble as protected by the First Amendment, and should be abandoned.

It was an infuriating meeting, however. Rather than offering explanations for many of the CBP’s practices, the CBP officials across the table flatly denied much of what is happening at airports throughout the US, even in the face of first-person testimony to the contrary from many of the civil liberties advocates in attendance.

Since they wouldn’t admit that some of the most abusive CBP practices — the ones we thought the meeting had been called to discuss — are actually happening, the CBP officials wouldn’t talk about what, if any, legal basis these practices might have. Meanwhile, these unlawful practices by CBP and other DHS components continue and expand.

Here are some of the counter-factual claims made by CBP in our meeting, and some of the issues left unaddressed: Read More →

Sep 24 2017

Muslim Ban 3.0 blaimed on ICAO passport standards and “ID management”

Invoking memes that we’ve seen and warned about before under both Democratic and Republican administrations, President Trump has attributed the latest version 3.0 of his “Muslim ban”announced today (proclamation, FAQ, explainer) with the need to comply with ICAO and INTERPOL standards for passport issuance, “identity management”, and data sharing about travelers — as though US immigration and asylum policy should be determined by an international technical body for aviation operations, as though such a body has the authority to override US treaty obligations to freedom of movement and “open skies“, and as though predictive pre-crime profiling based on “biographic and biometric data” can be substituted for judicial fact-finding as a basis for denial of the right to travel.

We hope that seeing the “Muslim Ban 3.0” blamed on ICAO standards will lead human rights advocates to pay more attention to ICAO’s standard-setting role and opaque decision-making process in non-aviation matters such as passports, identity management, and data sharing.

Read More →

Sep 11 2017

California DMV proposes to “comply” with the REAL-ID Act

On September 1, 2017, the California Department of Motor Vehicles quietly published a notice of proposed regulations that would purportedly allow the California DMV to issue drivers licenses and state ID cards that would be “compliant” with the Federal REAL-ID Act of 2005:

Notice of Proposed Action
Initial Statement of Reasons
Proposed Regulatory Text
Proposed “Exception Process Application Form” (not posted by the DMV but provided to us by the DMV on our request)

For many years, the California DMV has appeared intent on eventual “compliance” with the REAL-ID Act, regardless of whether that compliance was authorized by the legislature. The current DMV rulemaking proposal to bring California into “compliance” with the REAL-ID Act by administrative fiat is the latest and most significant step along that path, and a disturbing effort to bypass legislative debate.

We encourage all Californians who are concerned about freedom of movement, Federal commandeering of state agencies to function as agents for enforcing Federal restrictions on individual rights, and lack of transparency, oversight and accountability for biometric and ID databases to submit comments opposing the proposed regulations and, if you can make it to Sacramento, to testify at the hearing on October 16th.

Read More →

Aug 01 2017

Biometric entry/exit tracking of US citizens

We were invited to a briefing session today at U.S. Customs and Border Protection (CBP) headquarters: “an information sharing session and open dialog … with external privacy stakeholders” to discuss “recent enhancements to CBP’s biometric exit initiatives” and “CBP’s implementation plans for a biometric exit system“.

Although we weren’t able to make it to Washington for today’s meeting, we have many questions about CBP’s ongoing (and illegal, as discussed below) photographing of the faces of US citizens entering the US, and the agency’s plans to expand the current (also illegal) trials of exit photography to include most or all US citizens leaving the country.

We look forward to another chance to quiz CBP officials about these programs and their (lack of) legal basis. More importantly, we hope that members of Congress and the public will ask hard questions about these programs if regulations or legislation are proposed that would purport to authorize them.

We share the general concerns raised by others about the use of biometric information such as facial photos (mug shots) for suspicionless dragnet surveillance of any travelers. The right to leave any country is explicitly guaranteed by international treaty (Article 12 of the ICCPR) as a human right independent of citizenship.

But we find it especially objectionable — and likely to be illegal — that CBP is extending these surveillance schemes to US citizens. Here are some of the issues: Read More →

Jul 16 2017

CBP is taking mug shots of US citizens who leave the country

US Customs and Border Protection (CBP) has expanded its photography of the faces of all non-US citizens entering or leaving the US (under the “US-VISIT” program) to add mug shots of US citizens leaving the country, starting with all passengers on a daily flight on United Airlines from Washington Dulles Airport (IAD) to Dubai, U.A.E. (DXB).

This exit photo scheme is part of a larger program of biometric traveler tracking for which CBP and DHS recently opened an entire new database management and airport procedures simulation facility.

US citizens have the legal right not to submit to this mass surveillance and travel control scheme. But as with your right to fly without ID, CBP notices at airports won’t tell you that. You need to know your rights and be prepared to assert them.

Read More →

Aug 10 2016

DEA recruits airline & travel industry staff to inform on travelers

Brad Heath reports in USA Today that the Drug Enforcement Administration (DEA) has been recruiting airline and other travel industry staff to inform on travelers. The DEA has been using these tips from industry insider informers with access to travel reservations as the basis for searches, seizures, and “civil forfeiture” proceedings to confiscate cash from travelers on the basis of allegations that it was somehow associated with illegal drugs:

USA TODAY identified 87 cases in recent years in which the Justice Department went to federal court to seize cash from travelers after agents said they had been tipped off to a suspicious itinerary. Those cases likely represent only a small fraction of the instances in which agents have stopped travelers or seized cash based on their travel patterns, because few such encounters ever make it to court.

Those cases nonetheless offer evidence of the program’s sweep. Filings show agents were able to profile passengers on Amtrak and nearly every major U.S. airline, often without the companies’ consent. “We won’t release that information without a subpoena,” American Airlines spokesman Ross Feinstein said.

In almost none of these cases has the DEA actually brought any criminal charges against the travelers whose cash has been confiscated:

A DEA group assigned to Los Angeles’ airports made more than 1,600 cash seizures over the past decade, totaling more than $52 million, according to records the Justice Department uses to track asset seizures. Only one of the Los Angeles seizure records included an indication that it was related to a criminal indictment…. Of the 87 cases USA TODAY identified in which the DEA seized cash after flagging a suspicious itinerary, only two resulted in the alleged courier being charged with a crime. One involved a woman who was already a target of a federal money-laundering investigation; another alleged courier was arrested a month later on an apparently unrelated drug charge.

According to USA Today, “The DEA would not comment on how it obtains records of Americans’ domestic travel, or on what scale.” USA Today wasn’t able to identify any of the travel industry informers who have been tipping off the DEA about customers they thought might be carrying cash. But DEA spokesman Russ Baer said DEA agents “receive information from employees at ‘airlines, bus terminals, car rental agencies, … or other businesses.'”

Because airlines and computerized reservation systems don’t keep any access logs, it’s impossible for anyone to tell, after the fact, which travel industry personnel looked at a reservation and might have been DEA informers (or any other sort of attacker or threat: identity thief, stalker, industrial spy, etc.).

Some of the examples reported in USA Today relate to DEA access to Amtrak reservations. In court filings quoted in the USA Today story, DEA agents described their review of reservations for domestic Amtrak travel within the US as “routine”. From one of Amtrak’s responses to our FOIA requests, we know that Amtrak has a special “police GUI” for police to use in mining and reviewing data from Amtrak’s “Arrow” reservation system. We’ve asked Amtrak for all records pertaining to access to reservations by law enforcement agencies. After more than a year and a half, Amtrak is still continuing to process responsive records, as discussed in our previous articles about Amtrak. But Amtrak hasn’t yet disclosed anything to us about DEA access to Arrow or other Amtrak data.

The story in USA Today notes that the DEA isn’t supposed to have access to the information about travelers on domestic flights that airlines are required to transmit to the TSA before they can get permission to issue boarding passes. The TSA has defended the Secure Flight passenger surveillance and control scheme as an administrative search for the limited purpose of aviation safety. But we’ve heard rumors that the TSA is under pressure from other law enforcement agencies to open up the Secure Flight database of domestic air travel itineraries for general law enforcement uses. Those uses would likely include both arrest warrants and lookouts derived from NCIC, and profiling for forfeiture targeting by the DEA.

Mar 23 2015

Smile for the camera, citizen!

The Department of Homeland Security is extending its photography of travelers at US border crossings, ports, and international airports from foreign nationals to US citizens entering and leaving our own country.

On January 5, 2004, under an “interim final rule” for the “US-VISIT” program effective the same day it was published in the Federal Register, agents of US Customs and Border Protection (CBP) began fingerprinting and photographing foreign visitors on their arrival and again on their departure from the US.

At first, only those foreign citizens who required visas to enter the US were given this treatment. A few countries. starting with Brazil, took this as a sign of their “least favored nation” status with the US government, and reciprocated by photographing and fingerprinting US citizens arriving in and departing from their countries. Many other countries didn’t take things quite so far, but partially reciprocated to the extent of increasing their visa or entry fees for US visitors, or imposing new fees where entry for US tourists had been free, to match the US$135 minimum fee for a tourist or transit visa to the US for citizens of most other countries.

On August 31, 2004, under yet another “interim” rule effective the same day it was published, fingerprinting and photography at US airports and borders was extended to citizens of countries in the US “visa waiver program”.

For the third phase of expansion of US-VISIT fingerprinting and photography of border crossers, the DHS published a notice of proposed rulemaking in 2006, giving organizations and individuals a chance to object before the rules were finalized. But the numerous objections, including ours, were ignored. In December 2008, the DHS promulgated a final rule extending the fingerprinting and photography of visitors to all non-US citizens, including permanent US residents (green-card holders).

Now, without bothering to propose or finalize any new regulations, DHS has announced through a non-binding “Privacy Impact Assessment” (PIA) posted on its website that CBP is already conducting a “Facial Recognition Air Entry Pilot” program under which some unspecified fraction of US citizens entering the US by air are being required to submit to facial photography by CBP agents:

U.S. citizens with U.S. e-passports arriving at air ports of entry testing the technology may be selected to participate in the pilot at port discretion. Individuals that are selected do not have the option to opt out of this process.

Facial recognition software is being used to compare the photos to the digital photos stored on the RFID chips in US citizens’ passports, and to assign a score indicating the robot’s “confidence” that the photo in the passport and the photo taken at the airport depict the same person. “The facial recognition system is a tool to assist CBPOs [CBP officers] in the inspection process.”

The selection is supposedly random, but there is no specified limit on how large the percentage of US citizens subjected to this requirement might be:

Supervisory CBPOs (SCBPO) will set the standard for the random selection criteria and have discretion to change the criteria as needed. For example, the SCBPO may choose to select every fifth traveler but may change to every third or every seventh traveler at his or her discretion.

DHS has a history of prolonging and expanding “tests” as cover for de facto full implementation of controversial requirements. There’s nothing in this PIA to rule out the extension of the “pilot” program to nine out of ten arriving US citizens, or 99 out of 100.

Disturbingly but characteristically, DHS suggests that US citizens returning to our own country can be required to do whatever is necessary to “satisfy” CBP officers:

A person claiming U.S. citizenship must establish that fact to the examining [CBP] officer’s satisfaction [emphasis added] and must present a U.S. passport or alternative documentation as required by 22 CFR part 53. If such applicant for admission fails to satisfy the examining immigration officer that he or she is a U.S. citizen, he or she shall thereafter be inspected as an alien.

Read More →

Aug 22 2014

Passenger tracking = “Happy Flow” at Aruba Airport

[Vendor’s vision of “Happy Flow”. Click image for larger version.]

Later this year, passengers traveling on KLM Royal Dutch Airlines between Aruba and Amsterdam will begin to be subjected to what airlines, airports, governments, and their vendors and suppliers envision as the “passenger experience” of the future: an integrated biometric panopticon in which travelers are identified and tracked at each stage of their passage through the airport by surveillance cameras and automated facial recognition.

[KLM’s vision for “Happy Flow”. Click image for larger version.]

The vendor and the airline call this touchless total tracking, “Happy Flow”. We call it Orwell’s airport.

Travelers won’t have to identify themselves: They will be identified in spite of themselves. Travelers won’t have to worry about whether they are dealing with, or providing information to, the airline or the airport or a government agency or a third party: Biometric identifiers and surveillance data will be seamlessly shared for multiple purposes between the airline, the airport operator, government agencies, and their contractors.

Aruba is part of the Kingdom of the Netherlands, and the Aruba Airport (IATA code AUA) is managed by the company that operates Amsterdam’s Schiphol Airport. That creates unusual opportunities for collaboration between the airline, both airports, and government agencies concerned with flights between AUA and AMS.

The system is scheduled to go live by the end of 2014, according to recent conference presentations and press releases. But nothing has been made public by any of the partners in the joint venture (KLM, the operator of the Aruba and Amsterdam airports, the government of the Netherlands, and their contractors) regarding the data to be collected about travelers’ movements or any technical measures or policies controlling biometric, identification, or movement data storage, transmission, access, or retention.

Don’t worry. Be happy!

Apr 30 2010

Universal fingerprinting and national ID card to be included in “immigration reform” bill

As we reported last month, members of Congress are moving ahead with an increasingly detailed road map for a bipartisan “immigration bill” that would include mandatory universal fingerprinting and a mandatory national ID card in the guise of a “biometric Social Security card”.

The Identity Project was one of the signers of a joint public letter of opposition to the national ID card component of the proposal issued earlier this month, we were one of the signatories and we share the objections to the latest draft of the bill voiced yesterday by other civil liberties organizations. In the joint letter, we and numerous allies said that:

We write today to express our opposition to a proposal by Senators Charles Schumer (D – NY) and Lindsey Graham (R – SC) to create a biometric Social Security card – one that relies on personal characteristics like fingerprints to identify individuals….

A national ID system is not the solution. Both Republicans and Democrats have opposed a National ID system. President Reagan likened a 1981 proposal to the biblical “mark of the beast,” and President Clinton dismissed a similar plan because it smacked of Big Brother. A National ID would not only violate privacy by helping to consolidate data and facilitate tracking of individuals, it would bring government into the very center of our lives by serving as a government permission slip needed by everyone in order to work. As happened with Social Security cards decades ago, use of such ID cards would quickly spread and be used for other purposes – from travel to voting to gun ownership….

A biometric ID system would be controversial and unpopular with constituencies across the ideological spectrum. It would require the fingerprinting of every American worker – not just immigrants. It would also require the creation of a bureaucracy that combines the worst elements of the Transportation Security Administration and state Motor Vehicle Departments.

All this, should of course, go without saying. What we find most disturbing is that, even as people across the country are speaking out against the badly-drafted attempt by the state of Arizona to impose an ID requirement in the guise of “immigration enforcement”, members of Congress from both parties think they can get away with this same Trojan Horse to push through a national ID scheme at the Federal level.

Clearly what’s called for is for opponents of the new Arizona law to recognize the new Federal proposal as a larger instance of the same Big Brother mentality, and redirect some of their outrage and activism from Arizona legislators to the House and Senate. If you don’t want the whole country to go the way of Arizona on this question, let your representatives know that any national ID is unacceptable, no matter what its excuse or what it is called.