Few rules govern where your face scan data goes
WASHINGTON— The program makes boarding an international flight a breeze: Passengers step up to the gate, get their photo taken and proceed onto the plane. There is no paper ticket or airline app. Thanks to facial recognition technology, their face becomes their boarding pass.
“I would find it superconvenient if I could use my face at the gate,” said Jonathan Frankle, an artificial intelligence researcher at the Massachusetts Institute of Technology studying facial recognition technology. But “the concern is, what else could that data be used for?”
The problem confronting Frankle, as well as thousands of travelers, is that few companies participating in the program, called the Traveler Verification Service, give explicit guarantees that passengers’ facial recognition data will be protected.
And even though the program is run by the Department of Homeland Security, federal officials say they have placed no limits on how participating companies — mostly airlines but also cruise lines — can use that data or store it, opening up travelers’ most personal information to potential misuse and abuse such as being sold or used to track passengers’ whereabouts.
The data the airlines collect is used to verify the identity of passengers leaving the country, an attempt by the department to better track foreigners who overstay their visas. After passengers’ faces are scanned at the gate, the scan is sent to Customs and Border Protection and linked with other personally identifying data, such as date of birth and passport and flight information.
For its part, Customs and Border Protection has said it will retain facial scans of U.S. citizens for no longer than 14 days. But the agency has said it cannot control how the companies use the data because they “are not collecting photographs on CBP’s behalf.”
John Wagner, the deputy executive assistant commissioner for the agency’s Office of Field Operations, said he believed that commercial carriers had “no interest in keeping or retaining” the biometric data they collect, and the airlines have said they are not doing so. But if they did, he said, “that would really be up to them.”
But, Wagner added, “there are still some discussions to be had,” and federal officials are considering whether they should write in protections.
Privacy advocates have criticized the agency for allowing airlines to act as unregulated arbiters of the data.
“CBP is a federal agency. It has a responsibility to protect Americans’ data, and by encouraging airlines to collect this data, instead they are essentially abdicating their own responsibility,” said Jennifer Lynch, a senior staff attorney with the Electronic Frontier Foundation, a digital rights nonprofit.
Harrison Rudolph, an associate at Georgetown Law’s Center on Privacy and Technology, voiced similar concerns in a report he helped write in December evaluating the agency’s use of facial scans.
“Are there privacy protections in the contracts that DHS has reached with the airlines?” Rudolph said in an interview. “Do they require the disposal of any data collected? Do they require audits? Are there use limitations to ensure that travelers’ photos aren’t used in ways they don’t expect? Without any enforceable rules, it’s too easy for DHS to break those promises.”
Wagner, however, defended the program and said it “builds upon the processes that have taken place for many years.”
“Airlines are already collecting a lot of information from a traveler and providing that to CBP: the reservation data, the manifest,” he said.
But biometric data, including scans of passengers’ faces and fingerprints, is among the most sensitive, according to privacy experts, because unlike other means of identification such as a Social Security number, it cannot be changed.
The face is a particularly sensitive identifier because “if someone has a camera, they can identify you by your face,” Frankle said. “You can be recognized even if you have no idea you’re being recognized.”
The program, which currently operates through four major airlines in international airports in Los Angeles, Detroit, Orlando and Atlanta, is not mandatory for passengers. But the airlines — Delta, Lufthansa, British Airways and JetBlue — have reported that a majority of passengers participate.
It comes as facial recognition technology has become both more widespread and more closely scrutinized.
Companies such as Apple and Citibank have leveraged the technology, and still more — including casinos, music festival organizers and retailers like Walmart — have used it to track customers and shoplifters.
Amazon has recently drawn condemnation for providing facial recognition software to law enforcement agencies, whose use of the technology has caused privacy and civil liberties groups to voice concerns about overzealous surveillance.