Papers, Please!

The Identity Project

Category Archives: Papers, Please

Mar 30 2020

“Known Traveler Digital Identity” (KTDI)

On March 26, 2020, the World Economic Forum published specifications  and launched a new website for a project it has christened “Known Travel Digital Identity” (KTDI):

KTDI is a “surveillance-by-design” vision for tracking and control of travelers more dystopian than anything we have seen before.

KTDI would use a blockchain-based distributed ledger to bind together, through an app on a traveler’s mobile device, all of the following data:

  • Biometrics (initially facial images, possibly also fingerprints, etc.)
  • Government-issued ID credentials (passport number, etc.)
  • Travel history including logs of border crossings, hotel stays, and possibly also car rentals and/or other events
  • Purchase logs and possibly bank account information and/or other financial and transaction records
  • Pre-crime predictive “risk assessment” and profiling scores generated at each “intervention” point before and during each trip or transaction

Read More →

Mar 24 2020

How drivers license photos are aggregated and shared

During a press conference yesterday, President Trump announced a postponement of the “deadline” previously announced by the Department of Homeland Security for “enforcement” of the REAL-ID Act of 2005 at TSA checkpoints:

I’m also announcing that we’re postponing the deadline for compliance with REAL ID requirements…. We will be announcing the new deadline very soon. It’s going to be announced in a very short moment.

The REAL-ID Act “deadline” was set by DHS press release, not by law or regulation. It’s unclear if a new date will be announced by decree of the Secretary of Homeland Security, or by promulgation of regulations. There has been no further announcement by the DHS, and there is no notice of rulemaking in the Federal Register today.

As we noted yesterday, neither a postponement nor any of the other proposed amendments to the REAL-ID Act would address the central problems in this law: the requirement for states that want to be deemed “compliant” to share their drivers’ license and state-ID databases with all other states.

Read More →

Mar 23 2020

In a pandemic, freedom is the first casualty

We’ve seen before — notably after September 11, 2001 — how a crisis can result in damage to rights and freedoms that persists long after the initial cause of public panic.

Some advocates for restrictions on individuals and our movements and activities will exploit any crisis to ratchet the mechanisms of surveillance and control tighter.

Other officials, including many who mean well but are too traumatized to recognize the long-term consequences of their short-term actions, will advocate “temporary” restrictions on individual rights and freedoms that almost inevitably become permanent.

We don’t yet know what the cost in lost lives of the coronavirus pandemic will be. But we can already see the outlines of some of its potential cost in lost civil liberties.

Earlier in the pandemic, we reminded our readers of the risks of abuse of overbroad quarantine powers. But that’s only one aspect of the problem.

The basic methodology of control of travel and movement is that compulsory identification of travelers enables surveillance (tracking and logging) of travel and movement histories, and control of future movements based on individuals’ identities and the histories and other databases of personal information linked to those identities.

Already, changes to policies and practices related to (1) identification, (2) surveillance, and (3) control of travelers have all been proposed in response to the coronavirus pandemic: Read More →

Feb 13 2020

REAL-ID Act amendments don’t address the real ID problem

In response to fears by the travel industry (fueled by government lies) that businesses dependent on air travel will lose money if their would-be customers are prevented by the Transportation Security Administration (TSA) from flying because they don’t have ID credentials that the Department of Homeland Security (DHS) deems sufficiently “compliant”, a proposal was introduced in Congress this week by Rep. Debbie Lesko of Arizona to amend the REAL-ID Act of 2005.

What’s really called for, though, is repeal, not revision, of the REAL-ID Act, and explicit Congressional recognition that travel by common carrier is a right that cannot be conditioned on government-issued credentials or other permission. The amendments proposed in H.R. 5827 would only exacerbate the Constitutional flaws in the REAL-ID Act, and would do nothing to rein in the TSA and other DHS components in their violations of travelers’ rights.

H.R. 5827 appears to have been drafted by travel industry lobbyists. Its provisions exactly match the recommendations of the U.S. Travel Association, the umbrella trade association for the travel industry in the USA. Rep. Lesko’s press release announcing the filing of H.R. 5827 quotes endorsements for the bill from spokespeople for U.S. Travel and its constituent trade associations of airlines, airports (which in the US are almost all publicly operated, but tend to act like self-interested businesses rather than operating in the public interest), and travel agents. No advocates for travelers , civil liberties, or freedom to travel are quoted — nor are they likely to endorse H.R. 5827 or the REAL-ID Act it would amend.

H.R. 5827 is styled as the “Trusted Traveler REAL ID Relief Act of 2020”, and is described as a bill “To exempt certain travelers from certain requirements of the REAL ID Act of 2005 for purposes of boarding a federally regulated commercial aircraft, and for other purposes.”

But what would H.R. 5827 actually do, and would that make things better or worse?

Read More →

Feb 07 2020

The nightmare of airport facial recognition

[TSA Biometrics Roadmap, September 2018. Note that face ID will be used for all air travelers and that all use of physical ID credentials is “phasing out” in favor of facial recognition and digital tokens on mobile devices.]

[IATA airline vision for shared use of facial recognition by governments, airlines, and airports]

The ACLU has released an important white paper on airport facial recognition by ACLU senior policy analyst Jay Stanley. Citing some of our previous reporting and analysis, the ACLU white paper focuses, appropriately, not so much on the details of current use of facial recognition at airports, but on where governments and the aviation industry — who share a an explicitly-recognized interest in common use of facial recognition — say it will lead if we don’t stop them.

Driving the dystopian trend called out in the ACLU white paper is the malign convergence of interest between governments that want to use facial recognition and other techniques of compelled and automated identification for surveillance and control of travelers’ movements, and airlines, airports, and other businesses that want to share use of the same identification systems and data for business process automation and commercial tracking and profiling of travel customers.

Below are some key excerpts, but we encourage you to read the full ACLU white paper:

Customs and Border Protection’s new airport face recognition system has attracted a lot of attention and criticism, most recently last month when the agency backed away from suggestions that it would make the program mandatory for American citizens….

CBP officials argue that this program doesn’t involve mass surveillance. But CBP’s program still involves the mass collection of photographs of the general public….

The biggest harm from this program, however, is likely to come from the investment that it represents, the precedent it sets, and the path it puts us on as a society.

And where that path leads is a nightmare. It hardly takes a paranoid flight of fancy to foresee this program morphing into something far more comprehensive and dystopian — a world where face recognition is used throughout our public spaces to scrutinize our identity, record our movements, and create a world where everyone is constantly watched….

DHS and the aviation industry as a whole have a sweeping vision of expanded use of face recognition in the air travel context, and the government itself has already laid out — and begun following — a very specific, clear, and well-defined pathway for how the current program leads to a much broader implementations of face surveillance at the airport. And from there, it will be poised to expand far beyond the airport.

Here is what that pathway looks like:…

Read More →

Jan 02 2020

Drivers’ license data sold to businesses, given to Feds

As we start the year of the once-a-decade US Census, it’s an appropriate time to start looking at some of the ways and the purposes for which data — including drivers license data — is used and shared by the Bureau of the Census.

State agencies that issue drivers’ licenses want us not to object to their demands for more and more personal information about matters unrelated to driving — digital photos, scans of birth certificates and social security cards, etc. — in order to obtain drivers’ licenses that comply with the Federal REAL-ID Act.

State driver licensing agencies say we shouldn’t worry — notwithstanding the requirement of the REAL-ID Act that drivers’ license and state ID data be made available electronically to all other states — because this data will only be shared “as permitted by law”.

But what does that mean? What sharing of this data does the law permit?

Recent reports show that drivers’ license data can be, and is, widely shared with both commercial entities and Federal agencies — including the Bureau of the Census, which will be conducting the decennial census in 2020 — for purposes unrelated to motor vehicle operation or drivers’ licenses. Both Federal and state agencies say that all of this is permitted by the Drivers Privacy Protection Act (DPPA).

Read More →

Dec 12 2019

Port of Seattle to develop policies on use of biometrics to identify travelers

This week the Port of Seattle Commission — a special-purpose government body elected by the voters of King County, Washington, to administer both the Seattle-Tacoma International Airport and the maritime Port of Seattle — became the first airport operating or oversight body in the US to publicly discuss any policy for use of facial recognition and other biometrics to identify and track travelers.

Dozens of community members, technical experts, and members and representatives of local, national, and international civil liberties and human rights organizations including the Identity Project, the World Privacy Forum, the ACLU of Washington, the Japanese American Citizens League (JACL), Puget Sound Sage, the Seattle Privacy Coalition, cyber-security experts, and many others submitted written statements to the Port Commission or testified in person at the Port Commission meeting on December 10th in opposition to biometric tracking of travelers at Sea-Tac Airport and the Seattle cruise ship terminal.

The only testimony to the Port Commission in support of biometrics to identify travelers came from a representative of Alaska Airlines, who asked the airport to make available “common-use” biometric passenger identification infrastructure and systems that could be used by all airline tenants at Sea-Tac.

Contrary to some reports, the Port of Seattle Commission adopted neither a moratorium on current or additional deployments of biometric traveler identification systems at Sea-Tac and the Seattle cruise ship port, nor any binding rules for the continued or expanded use of biometrics.

Port Commissioners made explicit during this week’s public meeting that they have not yet made any decision on which current and/or proposed new or expanded biometric systems or uses, if any, or what regulations or contractual terms of airport leases to airline tenants related to biometrics the Port Commission will eventually approve.

The motion adopted by the Port Commission is a directive to Port staff who have approved years of biometrics deployments at Sea-Tac (including Automated Passport Control kiosks for biometric entry tracking of arriving international passengers) and the Seattle cruise ship port without, to date, any formal standards or meaningful assessment of their purpose,  justification, or impact. The Port Commission has now ordered what amounts to a “do over” by Port staff:

Through this motion, a port working group is established to develop further recommendations governing port policy related to use of public-facing biometric technology.

This working group is to be composed of Port staff and operate in line with general principles, procedural guidelines, and a schedule included in the Port Commission motion.

Port staff are to “engage active participation from an advisory group [to be named later by Port staff] composed of community partners, travelers, maritime and aviation industry partners, and other impacted stakeholders”. The Port Commission will only then decide whether, and if so on what terms, the Port will allow continued and/or expanded use of biometric systems to identify travelers on Port premises. “Policy recommendations shall be delivered to the commission by the end of the first quarter of 2020…. The commission … expects a policy governing the use of public-facing biometric technology to be delivered to the commission by the end of the second quarter of 2020.”

As we explained in our written testimony to the Port Commission, and in person near the start of the public comment period at the Port Commission meeting on December 10th, there’s a malign convergence of interest between airlines’ desire to use facial recognition for business process automation and personalization, and government agencies’ desire to use the same systems for profiling, surveillance, and control of travelers.

The unfortunate result has been the development of integrated common-use systems of commercial and government biometric tracking.

Read More →

Dec 03 2019

Seattle Port Commission to consider rules for airport facial recognition

We’ll be in Seattle on December 10, 2019, to give public comments (see our detailed written testimony submitted in advance) at a meeting of the Port of Seattle Commission concerning a proposed resolution on use of facial recognition by airlines at the Seattle-Tacoma International Airport (SEA).

This will be the first time that any operator of a US airport has publicly considered any policies to govern use of facial recognition by airlines or on airport property.

The public authorities that operate almost all major US airports have a key role to play in oversight of traveler surveillance systems deployed on their premises by their tenants.

Read More →

Nov 21 2019

What will the REAL-ID Act mean for Californians?

Steve Gordon, Director of the California Department of Motor Vehicles

The director of a $9 million state publicity campaign to persuade Californians that they will be “turned away at the TSA checkpoint” if they try to fly without ID and that “you will need to show federally-compliant identification in order to board a domestic flight within the U.S.” admits that he knows you can fly without any ID, and he’s flown without ID himself.

That admission by Steve Gordon, Director of the California Department of Motor Vehicles (DMV), came following a hearing in Los Angeles yesterday at which we also testified (written testimony, video starting at 1:10:23) before the California Assembly Budget Subcommittee responsible for oversight of the DMV.

California DMV Director Gordon said the DMV has an “overall budget north of $9 million” for an “awareness and motivational campaign” in all media — billboards, online keyword advertising buys , etc. — to “drive people to action” to apply for REAL-ID cards.

Gordon said that the DMV had changed its message from “You can apply for either a REAL-ID ‘compliant’ or ‘noncompliant’ drivers license or ID card” to, “You should get a REAL-ID card,” because it was “too confusing” to tell people they have a choice.

Read More →

Oct 02 2019

Do I need ID to ride a train?

We’ve been trying for years to find out what the real story is with respect to ID requirements for travel by train, especially on Amtrak.

Amtrak and Greyhound ID policies and practices are of paramount importance to the mobility of undocumented people and people who, whether or not they are eligible for or have chosen to obtain government-issued ID credentials, don’t want to show their papers to government agents as a condition of exercising their right to freedom of movement.

Amtrak and Greyhound policies and practices will become even more important if the government and/or airlines further restrict air travel by people who don’t have, or don’t show, ID credentials that comply with the REAL-ID Act.

The latest responses to our requests for Federal and state public records reveal more about passenger railroad policies and practices, but still don’t give a clear answer.

What we can say at this point, based on the records disclosed to us to date, is that:

  1. There are substantial discrepancies and contradictions between what the TSA has told Amtrak to do, what Amtrak tells its own staff about what is required, what Amtrak tells travelers about what is required and the basis for those requirements, and what Amtrak staff actually do. Those variations make it impossible to determine unambiguously what “the rules” are for Amtrak travel, or what is “required”.
  2. Some of Amtrak’s claims, including its claim that passengers are required by the TSA to have and to show ID to travel by Amtrak, are blatant lies.
  3. TSA Security Directive RAILPAX-04-02, cited by Amtrak in its employee manual as the basis for demanding that passengers show ID, requires Amtrak to “request” (not demand) that passengers show ID, but does not purport to require passengers to respond to such requests and does not prescribe any sanctions on passengers for failure, refusal, or inabiity to show ID.
  4. Amtrak has instructed its staff that “If the customer responds they are 18 or older and do not have valid identification, … the Amtrak police must be notified by the quickest available means away from the customer,” but also that, “Failure to possess the proper photo identification is not, by itself, sufficient reason to have the customer removed from the train.” Amtrak has not yet responded to our FOIA request for Amtrak Police policies and staff directives for what to do in such cases.
  5. Although Amtrak is unquestionably an instrumentality of the Federal government, and transportation by Amtrak is unquestionably a Federal government activity, the list of ID credentials deemed acceptable by Amtrak does not correspond to the list of forms of ID deemed by the DHS to be acceptable for “Federal purposes” pursuant to the REAL-ID Act of 2005.  Amtrak says it accepts several forms of ID that do not comply with the REAL-ID Act. None of Amtrak’s ID policies, procedures, or staff directives disclosed to date mention the REAL-ID Act or when or how it might be implemented by Amtrak, although records of such policies or of discussions related to them would be responsive to soem of our pending FOIA requests.

Where does this leave undocumented long-distance travelers, including those who turn to Amtrak as a government-operated common carrier of last resort?

Read More →