International airports that serve nine U.S. cities could be in jeopardy of legal action after screening passengers with facial recognition software.
The Georgetown Law Center on Privacy & Technology reports that airports for Atlanta, Boston, Chicago, Las Vegas, Houston, Miami, New York and Washington, D.C., have begun using the technology to identify accused criminals of attempting to exit the U.S. on fake identities. The Department of Homeland Security (DHS) is the federal agency deploying the technology.
The software was funded with more than a billion dollars in congressional appropriations for fighting crime and terrorism, but the report called the technology’s use on American citizens legally questionable.
In the nine cities, passengers are told to stand in front of security cameras that compare facial features with a biometric database from DHS. The report’s authors, Harrison Rudolph, Laura Moy and Alvaro Bedoya said this activity could set off legal challenges, like class action lawsuits.
“Congress has repeatedly ordered the collection of biometrics from foreign nationals at the border, but has never clearly authorized the border collection of biometrics from American citizens using face recognition technology,” the report says. “Without explicit authorization, DHS should not be scanning the faces of Americans as they depart on international flights — but DHS is doing it anyway.”
In a statement to StateScoop, DHS said that the technology is still under evaluation and "for purposes of these initial technical demonstrations, U.S. citizen participation is not required and alternative procedures are available." It added that it has conducted public outreach in August with privacy groups, and as a result of these discussions, has produced signage to alert Americans they have a right to decline.
"If a U.S. citizen is concerned about participating in the technical demonstrations, a traveler need only let a CBP officer or airline gate agent know and their documents will be reviewed to ensure they are the true bearer of the passport that is being presented," DHS said.
Even so, the agency acknowledged that in the future Americans could be required to participate in the process if it is officially adopted nationwide.
As another criticism to use of facial recognition, the report says that federal law requires DHS to start a rulemaking process that would include the opportunity for greater public feedback. DHS acknowledged it had not completed this process, but said it was "working to meet the Congressional mandate."
“The law requires DHS to solicit and consider comments from the public before adopting big-impact new programs like mandatory biometric scans,” the researchers said.
The report urges DHS to suspend all facial scanning until it can provide evidence that the technology is effective. A 2016 report from the Government Accountability Office highlighted a lack of research into whether biometric scanning can achieve the desired security benefits.
The Georgetown report mentions skepticism expressed in a 2012 analysis from DHS’s own Science and Technology Directorate (S&T) that there was doubt that the service would provide significant improvements over current measures and whether the benefit of a national deployment of biometric cameras would justify the costs, estimated at more than a $1 billion. Since the 2012 analysis, the S&T has not updated its findings.
Looking at error rates, S&T was also concerned. It found that face scanning technology used by DHS makes frequent mistakes, rejecting as many as one in 25 travelers with valid credentials — a rate that would cause more than 1,600 passengers at New York’s John F. Kennedy International Airport to be delayed or denied entry to their flights.
In its statement, DHS said Georgetown's claims were not entirely accurate.
"As a note, CBP has a rigorous process in place to review data and metrics associated with biometric exit matching performance and the demonstrations have a matching rate in the high 90 percentile," DHS said. "Travelers are not prevented from boarding as a result of facial recognition mismatch for purposes of these technical demonstrations."
Still, the Georgetown report also weighs in on the broader issues of privacy expectations and excessive government surveillance. Researchers questioned how the biometric data collected from law abiding residents would be used afterward. Would it be used to identify protestors, be aggregated in a national biometric database, or allow tech vendors contracted by the government to gain access? The researchers said all of these issues were potentially problematic.
“As currently envisioned, the program represents a serious escalation of biometric scanning of Americans, and there are no codified rules that constrain it,” researchers said. “It may also lead to an even greater and more privacy-invasive government surveillance system… DHS’ airport face scans raise important questions about the expansion of government tracking tools in public spaces.”