U-turn on facial recognition scans

THE US government began asking international travellers for their faces a few years ago – but for a moment this week, it seemed officials were going to stop asking and just start taking.

The Post reported this past week that the Department of Homeland Security (DHS) had proposed a regulation that would make facial recognition scans mandatory not only for non-citizens entering and exiting the country, but for citizens as well.

Advocates were alarmed, and, after some outcry, officials not only appeared to reverse course: they also insisted they had never been walking in the wrong direction to start with.

There was no plan to require photographs from Americans, said Customs and Border Protection (CBP).

The agency had considered including citizens in its programme, but decided against it after consulting lawmakers and privacy experts.

This was the right place for CBP to end up. There are consequences to treating faces like any old data points.

Sensitive information collected could fall into the wrong hands if it is stored for too long with too little security, and unlike our credit card numbers, we can’t simply change our faces.

That concern is more than hypothetical after news this summer that hackers had accessed photos amassed by CBP.

The accuracy of facial recognition algorithms generally is uncertain, especially when they’re levelled on members of minority groups and women, and though CBP says its own tool has a match rate of 98% to 99%, there has been no formal review to confirm its finding. In fact, there hasn’t been much formal anything.

CBP has issued what it calls privacy impact assessments on its programme, and it rightly changed some practices after, again, consulting privacy experts – reducing images’ storage time from 14 days to 12 hours and obligating the airlines it partners with not to use the pictures they capture for commercial purposes. But the agency has not yet audited these partners to ensure they’re following through. And if CBP wants to change its own protocols, Americans will have to take on faith that they and their representatives will be told first and given the chance to weigh in.

Legislators are lagging as facial recognition technology creeps around the country.

Congress has not authorised DHS to collect Americans’ biometric information as part of its mandate to create an entry-exit system, but it also hasn’t told the agency not to.

Without action, there are few rules for DHS to follow because, contrary to the usual procedure for a project with such significant civil liberties implications, the department did not write them before rolling out its system. That process is ongoing.

In the meantime, CBP has scanned the faces of tens of millions of travellers.

The government, according to internal documents, envisions a future in which passengers’ trips from the curbside to the boarding gate are determined at every juncture by facechecks. Anonymity disappears in the service of “simplified and standardised wayfinding across airports”.

Many Americans might appreciate the convenience, but it is Congress’s job to consider the cost.