Papers, Please! – Page 14 – The Identity Project

Sep 01 2020

TSA tries out another (illegal) biometric “ID verification” system

Today the Transportation Security Administration (TSA) announced that it has launched a “pilot” at Washington National Airport (DCA) of yet another scheme for biometric identification and tracking of domestic air travelers.

[Screen capture from TSA video]

The new “touchless ID verification” stations at DCA include a webcam (at top center of photo above) a magnetic-stripe reader (lower left) for drivers licenses and other ID cards, and a photographic scanner for passports (lower right).

Travelers who volunteer to use the new system are directed to insert their drivers license, ID card, or passport into the appropriate reader, stand on a marked spot in front of the webcam, and remove their face mask, so that the image from the ID (or, more likely, from some back-end image database linked to the ID, although that hasn’t been disclosed) and the image from the webcam can be compared by some undisclosed algorithm.

[Traveler being directed by TSA staff to remove her face mask for digital mug shot.]

As we’ve noted previously, it appears to us that (1) the TSA has no general authority to require travelers to show their faces or remove face masks, and (2) in many jurisdictions, orders issued by state or local health authorities currently require all people in public places such as airports to wear masks.

The TSA describes this system as “touchless”. But while TSA staff don’t have to touch travelers’ IDs, each traveler has to touch the same ID card or passport scanner. Then, immediately after touching the scanner, they have to touch their face again to put their mask back on.

Aug 31 2020

8th Circuit finds TSA agents can be liable for assault

A panel of the 8th Circuit Court of Appeals decided today, over a dissent, that TSA checkpoint staff at airports (“Transportation Security Officers”) are “officer[s] of the United States … empowered by law to execute searches… for violations of Federal law”, making TSOs liable for damages if they commit assault, battery, or certain other torts against travelers.

With today’s decision in Iverson v. TSA the 8th Circuit joins the 3rd Circuit (en banc) in what is now a 2-1 split with the 11th Circuit, which ruled in 2014 that TSOs, despite their title and the fact that their primary job is to carry out searches, are not “officer[s] of the United States … empowered by law to execute searches… for violations of Federal law” and thus are completely immune from liability for even intentional assaults on travelers.

Most people unfamiliar with the law assume that the government is generally liable for damages if its agents attack innocent citizens. While the law is complex, the general principle is just the reverse: The US government generally enjoys “sovereign immunity” — a despicably undemocratic vestige of the idea that the king is above the law — and private individuals can sue the government only with the government’s permission.

There are exceptions to this principle, in the form of laws that “waive sovereign immunity” for certain offenses, as well as exceptions to the exceptions. The dispute with respect to liability or impunity for violent or negligent TSOs revolves around the interpretation of the language in Federal law defining one of those exceptions to an exception.

Aug 11 2020

TSA considers new system for flyers without ID

According to a solicitation to potential contractors published last week, the Transportation Security Administration (TSA) wants to outsource its current questioning of airline passengers without ID, and its decisions about which travelers without ID to allow to travel and which to prevent from flying, to a fee-based system operated through a cellphone app provided by a private contractor and based on (secret) commercial databases.

There’s some good news and some bad news in the TSA’s posting of this Request for Information.

First, the good news:

1. The TSA admits that people can and do fly without ID.

According to the TSA’s Request for Information:

Prior to the COVID-19 National Emergency, TSA encountered over 2.5 million passengers a day and, on average, 600 instances of passengers without acceptable ID. These individuals are able to verify their identity via telephone through our National Transportation Vetting Center (NTVC).

That’s almost three times the average daily number of airline travelers without ID disclosed in the most recent of the TSA’s belated and still-incomplete responses to our Freedom of Information Act (FOIA) requests for records of travelers without ID.

2. You will still be able to fly without ID, even after the TSA “implements” and “enforces” the REAL-ID Act.

In their most recent notice of postponement of their REAL-ID threats, the TSA and the Department of Homeland Security (DHS) have said that they plan to fully implement and enforce the REAL-ID Act, with respect to airline travel, beginning October 1, 2021.

The TSA and DHS have repeatedly claimed that after that date, all air travelers will “need” to show ID that the DHS deems compliant with the REAL-ID Act in order to fly. And the TSA has previously indicated — in 2016 and again in May of 2020 — that it intended to modify its current ID verification procedures to (illegally) deny passage through TSA checkpoints to would-be travelers who don’t present REAL-ID Act compliant ID cards.

But the TSA is now soliciting information preparatory to soliciting bids for a contract to provide outsourced “identity verification” services for air travelers without ID.

The TSA wouldn’t be preparing to solicit bids for a system to deal with air travelers without ID if the TSA planned, in a little more than a year, to stop allowing those people to fly at all.

And the TSA says that the contractor’s ID verification system for flyers without ID must “be able to process thousands of transactions per hour per day [sic] distributed across the TSA enterprise of airports.” Whether the TSA means “thousands per hour” or “thousands per day”, that’s several times more than the current number of travelers without acceptable ID.

The only plausible explanation for the expected many-fold increase in the number of travelers without acceptable ID is that the TSA’s implementation of the REAL-ACT will result in many more air travelers’ ID’s being deemed unacceptable, and that the outsourced system is the one the TSA plans to use for travelers without REAL-ID compliant ID.

The TSA is looking for a new system for dealing with travelers without ID only because it has been forced to abandon its original plan to prevent all such people from flying.

The most important takeaway from the TSA’s latest notice is that the TSA is (still) lying about what REAL-ID Act enforcement and implementation will mean. You will not need a compliant ID to fly. The procedures may change, but you will still be able to fly without ID.

This is a major victory for our legal objections and for the potential of popular resistance.

The TSA has implicitly acknowledged that — either because it lacks legal authority to prevent everyone without “acceptable” or REAL-ID Act compliant ID from flying, or because doing so would cause riots at airports or other forms of popular resistance, or both — it won’t be able to stop travelers without ID or without compliant ID from flying.

The bad news is the nature of the TSA’s contemplated new procedures for flyers without ID (or without “acceptable” ID).

Currently, the TSA leaves the final decision on whether or not to allow airline passengers without ID to pass through TSA or contractor-operated checkpoints to the discretion of the Federal Security Director (FSD) or their designee on duty at the individual airport.

That decision can be based on what the FSD thinks of the traveler’s looks, the nature of any “unacceptable” ID they present, whether they are willing to complete and sign the illegal TSA Form 415, and their responses to questions relayed via the TSA’s Identity Verification Call Center (IVCC) from the TSA National Transportation Vetting Center (NTVC) based on information in records about the traveler held by the commercial data broker Accurint.

The new process apparently being considered by the TSA would outsource the questioning of travelers without ID or with unacceptable ID to a private for-profit contractor, with that questioning to be administered through a smartphone app. The questions would be based on some aggregation of government and commercial data, and the answers would be assessed according to some secret algorithm to generate a binary pass or fail result.

An identity thief (or ‘bot) with access to the commercial database used as the basis for “pass/fail” determinations would be better able to answer questions about the information in that database than would a real person who is unprepared for this questioning and who has no way to know (or to correct) what misinformation is contained in the database.

A traveler who shows up at a TSA checkpoint would, it appears, be told they have to install the mobile app, pay a fee through the app (which presumably would require a credit or debit card or bank account), complete the in-app questioning, and show a “pass” result from the app to the TSA staff or contractors in order to “complete screening” and proceed through the checkpoint.

No cellphone? No fly. (We’ve seen this already in Hawaii.)
Your cellphone isn’t a smartphone? No fly.
Your smartphone has a different OS that can’t run the contractor’s app? No fly.
No charge in your cellphone battery? No fly.
No signal in the airport? No fly.
No credit or debit card? No fly.
Don’t know what misinformation is in data brokers’ records about you? No fly.
Your record fits a “fail” profile in the contractor’s secret algorithms? No fly.

Jul 28 2020

Senate bill would exempt REAL-ID from due process and oversight

Rather than responding to our comments on the latest proposal by the Department of Homeland Security to require ID for airline travel, the DHS has quietly gone to Congress to try to get the law changed so that it doesn’t have to answer us, and to preclude potential litigation to challenge an ID requirement or defend people who try to fly without ID.

A bill introduced earlier this month in the Senate, and already approved in committee, would exempt the implementation and administration of the REAL-ID Act from normal administrative requirements for due process in rulemaking and oversight and transparency in demands by Federal agencies for information.

Included in S. 4133, both as introduced and as amended and reported by the committee, are provisions that would allow the Secretary of Homeland Security, at his or her “discretion”, to issue regulations and administer the REAL-ID Act without regard for the Paperwork Reduction Act (PRA) or the notice-and-comment requirements of the Administrative Procedure Act (APA).

As of now, no comparable bill has been introduced in the House. (Several bills to amend the REAL ID Act are pending in the House, but none of them contain PRA or APA exemptions.) It’s unclear what effect these provisions would have if enacted. All Federal agencies are, of course, still subject to Constitutional requirements for due process. But these provisions of S. 4133 appear to be a direct response to the objections we raised in May 2020 to the latest DHS proposal to impose an ID requirement for airline travel without complying with the PRA or the APA.

Jul 23 2020

CBP to buy license-plate reader data to track vehicles away from borders

Are parking garages and toll roads spying on innocent motorists for Federal police?

Reversing a decision made in response to public pressure in 2014, US Customs and “Border” Protection (CBP) plans to pay a commercial aggregator of license-plate reader data to track vehicles that aren’t near any US border or in the “border zone” within 100 miles of coasts and borders where CBP has its own license plate readers, according to a Privacy Impact Assessment (PIA) published this month.

According to the new PIA, the aggregated commercial database that CBP is paying to query includes “nationwide… license plate image information from private businesses (e.g., parking garages), local governments (e.g., toll booth cameras), law enforcement agencies, and financial institutions via their contracted repossession companies.”

The PIA is worded in the future tense (“CBP plans to…”), but the contract is describes may already have gone into effect, or could do so at any time.

Jul 17 2020

FBI enlists reservation services to spy on travelers

[The role of CRSs in the travel data ecosystem and government access to airline data. Slide from Identity Project presentation on C-SPAN, April 2, 2013.]

A report by Thomas Brewster published yesterday by Forbes discloses that the FBI has used court orders issued under the “All Writs Act” (AWA) to order operators of computerized reservation systems (CRSs) to provide weekly reports on any new reservations made by specified persons of interest, for periods of as long as six months at a time.

The article in Forbes includes a copy of one of these orders issued to Sabre, which mentions, by way of legal precedents, some other such orders issued to Sabre:

Forbes also describes a similar All-Writs Act order issued to Travelport, another of the three major CRS operators.

Who are these CRSs? What are we to make of these court orders? And is there anything really surprising about the newly-revealed All Writs Act orders to Sabre and Travelport?

This report in Forbes and these orders aren’t a surprise, but they do provide positive confirmation of (previously suspected) facts about US government activities and US law that may be of considerable significance to challenges to travel surveillance under the laws of other countries including the European Union, Canada, and possibly others.

Jul 16 2020

European court (again) finds US data protection inadequate

Today the highest court in the European Union ruled (summary, full decision) for the second time, that US law does not provide an “adequate” level of protection for personal information transferred from the EU to companies or servers in the US.

What does this mean for Passenger Name Records (PNRs) or other records of our travels?

Understanding the implications of today’s decision — especially with respect to airline reservations and other information about when, where, how, and with whom we have traveled — requires some review of the background:

Jul 03 2020

Two courts deny injunctions against state restrictions on interstate travel

Following separate hearings yesterday, two Federal District Court judges in New York and Hawaii denied applications for temporary restraining orders against state health orders mandating quarantine of some or all people arriving from out of state.

A ruling in Corbett v. Cuomo was issued orally, immediately following argument by phone, by Judge Lorna Schofield in New York. A written ruling in Carmichael v. Ige was issued late last night by Judge Jill Otake in Hawaii, following an afternoon hearing by videoconferencing.

Neither of yesterday’s rulings is a final decision in either of these cases, even at the District Court level. Both cases are continuing, and motions for temporary restraining orders can be renewed if conditions change and/or new evidence becomes available. The standard that must be met to persuade a court to issue a temporary restraining order or preliminary injunction, especially against government action, is always high, and is generally higher than what must be shown to support a favorable decision on the merits.

The judges issuing yesterday’s rulings indicated a disturbing willingness to accept conclusionary hand-waving, by anyone designated by the state as an expert, as sufficient to justify restrictions on the right to travel. During the oral arguments, both judges paid lip service to the idea that there might be some limits on what state authorities could do once they invoked the magic words, “because pandemic“. But neither Assistant New York Attorney General Matthew Lawson nor Hawaii Attorney General Clare Connors was prepared to say where those limits might be, and neither of the judges’ rulings spelled out meaningful criteria or limits to state officials’ discretion.

We are concerned, and the public should be concerned, if Federal courts wash their hands of oversight over state officials, and leave it to “discretion” of those state officials to decide for themselves to what extent they can infringe on people’s fundamental right in the name of whatever they consider to be the exigency of the moment, whether that be defense against Communism, anarchism, terrorism, pandemic, or tomorrow’s demon of the day.

Jun 30 2020

Freedom to travel across state lines

Oral arguments have been scheduled by two different Federal District Court judges for this Thursday, July 2, 2020, on motions for temporary restraining orders against enforcement of separate state health orders mandating 14-day quarantine of all people arriving in New York or Hawaii from out of state.

Corbett v. Cuomo will be argued at 2 p.m. EDT by telephone in New York; Carmichael v. Ige will be argued in person (and not available for remote auditing) at 11 a.m. HST in Hawaii.

The Hawaii quarantine order, as we’ve discussed previously, applies to anyone arriving from out of state. The New York order only applies to people who have visited certain states designated by New York authorities, but those states include almost half the US population. The blacklisted states include Georgia and Texas, so anyone who changes planes in Atlanta, Houston, or Dallas-Ft. Worth — all major airline hubs — en route to New York is affected, even if they are coming from some other, less-infected state.

As the complaint in the New York case notes, it’s unclear whether those involuntarily quarantined in New York will be held in jails, hospitals, or some other locations, but according to a public statements by New York Governor Cuomo cited in the complaint, they are to be detained at their own expense.

On its face, the New York order applies to anyone arriving in New York who has recently been in any of the blacklisted states, even if they don’t intend to stay in New York. This would include people changing planes in New York, or passing through on the short New York section of Interstate 95 or on the Northeast Corridor between New England and New Jersey, Pennsylvania, and points south and west. All routes between New England and the rest of the US pass through either New York or Canada. With the US-Canada border mostly closed, enforcement of the New York travel restrictions would render New England an isolted island accessible only by air.

In addition to the 14-day quarantine, New York state has also begun demanding that each interstate traveler arriving by air (regardless of their state of residence or whether they have visited any of the blacklisted states) complete and sign a written declaration (Exhibit B to the complaint) about themselves, their business affairs, and their travels.

The Hawaii and New York quarantines and the New York questionnaire for interstate air travelers are all backed with threats of arrest and fines for noncompliance.

The New York quarantine order and travel declaration are being challenged by Jonathan Corbett, who has his primary residence and business interests in Brooklyn, New York, but is also a member of the California bar who practices law in California. Before his admission to the bar, Mr. Corbett had brought multiple pro se lawsuits challenging restrictions on air travel and searches of travelers, including the TSA’s use of “virtual strip-search” imaging machines.

Significantly, in light of the written declaration that the state of New York is now ordering arriving air travelers to fill out and sign, Mr. Corbett has also previously challenged administrative interrogations of air travelers (who aren’t suspected of any crime) by, or at the behest of, the TSA. That case was dismissed without the court reaching the Constitutionality of administrative interrogation of travelers. So far as we know, Corbett v. Cuomo is the first time this issue has arisen in a COVID-19 quarantine case.

There’s extensive case law on administrative searches, but very little on administrative interrogations. Mr. Corbett argues, and we concur, that he has an absolute right to stand mute in response to interrogatories by state authorities at state borders or airports.

In the current circumstances, it’s tempting to give health authorities a free pass for whatever they do, “because pandemic”. But that would be a mistake. We’ve already seen what happened when authorities were given free rein to impose new restrictions on travelers after September 11, 2001, “because terrorism”. Many of those measures had no rational relationship to the prevention of terrorism, were implemented without regard for Constitutional rights, and have become permanent, or effectively so.

How long will the current health emergency last? And will Federal, state, and local government agencies return to their prior practices at airports and borders if and when the emergency is declared to have ended, or will restrictions imposed during the pandemic become the permanent “new normal”?

If our Constitution is to have meaning, and if there is a sufficient justification for restrictions on travel, it should be possible to defend those restrictions on the basis of the Constitution. It should not be necessary to argue for suspending the Constitution.

Jun 26 2020

Federal bills would restrict airport facial recognition

A bill introduced yesterday in both houses of Congress would, at least initially, prohibit all or most current and planned use of facial recognition or other biometric identification at US airports and borders by the Transportation Security Administration (TSA) and US Customs and Border Protection (CBP).

The Facial Recognition and Biometric Technology Moratorium Act of 2020 was introduced by Sen. Edward Markey (D-MA) as S. 4084 and by Rep. Pramila Jayapal (D-WA) as H.R. 7356. The new bill has already been endorsed by a broad coalition of civil liberties organizations. Sen. Markey has been a leading Congressional critic of facial recognition at airports.

This Federal proposal, if enacted as introduced, would fill a significant gap in ongoing efforts to rein in facial recognition through state laws and local ordinances.