February 15, 2022
At the nexus of technology and security: Biometrics at the border
This page provides an excerpt from Forward Defense’s latest issue brief, sponsored by SAIC, which provides an overview of the opportunities and challenges to employing biometric technology at US ports of entry. To read the full paper, please visit here.
Introduction
Under the traditional [travel] system, travelers boarding a plane departing the United States show their passports to airline personnel, who then look at them and electronically scan the documents before allowing the travelers onboard. TVS [Traveler Verification Service] automates that process by, instead, taking a digital photo of the traveler before boarding and using a high-performing facial-recognition algorithm to instantaneously compare it to a database of existing passport or visa photos of all travelers on that flight’s manifest. In some airports (those where airlines employ an “e-gate”), if a traveler’s photo matches, the boarding gate opens automatically. In others, the traveler gets the green light from a totem camera, which signals the traveler to walk onto the plane. Either way, the identity comparison and verification are automated and instantaneous—and some airlines have chosen to expedite things even further by using the TVS process not only to obviate the need for manual passport checks, but to do the same for boarding passes. If the photo does not match, however, things revert to the old system, with CBP or airline personnel performing a manual identity check of the traveler’s passport. For US citizens, the TVS process is entirely voluntary; they can always choose to have their passports reviewed manually, in the old-school style
For travelers entering the United States, CBP [Customs and Border Protection] utilizes “Simplified Arrival,” a primary processing application that leverages the TVS facial-comparison system.
Concerns Raised about the Use of Biometrics at the Border
In November 2020, CBP published a proposed rule to expand biometric processing to all non-US citizens and remove port limitations on the use of biometrics in the exit environment.[1] The proposal has drawn a flurry of comments, both pro and con, and the Joseph Biden administration—after extending the comment period to March 2021—is still considering whether to issue a final rule.[2] A number of privacy and immigrant-advocacy organizations—including the Electronic Privacy Information Center (EPIC), the Center for Democracy and Technology (CDT), the American Civil Liberties Union (ACLU), and others—have raised objections to the continuation of CBP’s use of facial biometrics. [3]
1. Fear of a Surveillance State
The broadest objection is that facial recognition is an “inherently dangerous technology,” and that CBP’s use of it could be the beginning of a slippery slope that could lead to more generalized tracking of both Americans and non-US persons, not only at the borders, but also within the United States—raising the specter of a Minority Report-style surveillance state.[4] Some also say that the use of such technology at the border dangerously singles out immigrants, given that most non-US persons cannot opt out of CBP using it to process their entry.[5] Photos of in-scope non-US travelers are enrolled and retained in IDENT for up to seventy-five years. (CBP deletes its copies of all photos, within twelve hours for US citizens and fourteen days for all others.) Objectors express the fear that such images might be shared with US or foreign law enforcement.
These are serious concerns, but CBP is utilizing this technology in relation to crossings of the US border, where the US Supreme Court has consistently recognized that “the Government’s interest in preventing the entry of unwanted persons and effects is at its zenith,” that the government has “plenary power to make rules for the admission of aliens,” and that CBP has broad authority under the Fourth Amendment to search and question all seeking admission or return to the United States.[6] Moreover, DHS has been collecting biometrics—both fingerprints and photographs—from non-US persons for many years through the US-VISIT system. The State Department already issues passports to US citizens and machine-readable visas for non-US citizens, both of which now include biometric photographs. And, all federal law-enforcement agencies, including CBP, regularly cooperate with foreign, state, local, and tribal authorities by sharing biographic and biometric data on individuals—including photos—where there is good cause and it is permitted by law. Fundamentally, the use of TVS does not change or add much to the information already possessed by the government. It takes one additional photo and compares it to information that already exists in government databases, all pursuant to a long-standing congressional mandate and consistent with broad border authorities recognized by the Supreme Court for more than a century.
The question of whether facial comparison is an “inherently dangerous” technology is a debatable one—especially given its ubiquity (look at your iPhone or Android). But, its use by repressive, authoritarian regimes demonstrates the risks, so careful safeguards governing how CBP uses facial-comparison technology or shares images are clearly appropriate—and many already exist. As required by law, CBP has published a Privacy Impact Assessment discussing the program in great detail, and it has provided notice of how it shares data in the various System of Records Notices (SORNs) it also publishes, as well as in the proposed rule.[7] Additionally, CBP provides notice to travelers through message boards or signs, as well as verbal announcements in some cases, to inform the public that CBP or a stakeholder will be taking photos for identity-verification purposes. In addition to CBP’s own internal oversight and officer-training protocols, DHS also provides oversight through its Offices of Civil Rights and Civil Liberties (CRCL) and Privacy, as does the Privacy and Civil Liberties Oversight Board (PCLOB). That said, more safeguards could and should be put in place. In 2020, the Biometrics Subcommittee of the Homeland Security Advisory Council (HSAC) issued a report analyzing DHS biometrics programs and recommending the creation of a DHS Biometrics Oversight and Coordination Council (BOCC), chaired by the DHS deputy secretary, as well as empowering the DHS Office of Strategy, Policy and Plans to lead the development of DHS-wide policies on biometrics, including on such issues as retention and sharing.[8] The HSAC’s recommendations regarding additional oversight structures are sensible, and should be implemented.
Ideally, current limits on CBP broadening use of the technology or sharing facial-biometric data should not be waivable by executive action alone. This is an area in which congressional action can provide additional checks against the misuse of data or technology.
2. Data Protection
Others have argued that CBP’s use of facial biometrics should be terminated because CBP will be unable to protect the biometric data from cyber hacks—citing the 2015 example of the Office of Personnel Management being unable to protect its information from Chinese exfiltration.[9] But, for the most part, this argument is not specific to CBP. Instead, it argues that the federal government should not collect personal data at all because it cannot protect it with certainty. Protecting databases from cyber hacks requires adequate resources, oversight, accountability, and expertise, but it is not an impossible task—and restricting government agencies (or private-sector entities) from collecting personal data required to perform their functions is an obvious non-starter. Strong governance and oversight are a more sensible position, and the HSAC report’s recommendation of a DHS BOCC providing strong, senior-level oversight for TVS and other DHS biometrics programs is a good one, as is the HSAC’s additional recommendation that the Cybersecurity and Infrastructure Security Agency (CISA) play a key role in the protection of data. Furthermore, nothing comes for free, so Congress needs to ensure that federal agencies have the cybersecurity resources, personnel, and authorities to do the job.
3. Accuracy and Bias
Finally, some assert that the 98–99-percent accuracy rate for CBP’s Biometric Facial Comparison Technology is not good enough, and that—given the huge volume of travelers—many people will suffer from erroneous “no-match” determinations. But, the obvious answer to this is that, at an airport, the consequence of a no-match decision is simply that a CBP officer or airline official will need to perform an old-school manual check of the traveler’s passport or visa. This may cause a minute’s inconvenience, but automated checks that work 98 to 99 percent of the time will significantly reduce the number of travelers whose documents need a manual check. Moreover, CBP has processed more than one hundred and thirty million people through the system since 2017 and, thus far, mistaken “no-match” incidents have not arisen as a major issue. On the contrary, facial-comparison technology has proven more accurate than manual document checks, as evidenced by the more than two thousand imposters the system has enabled CBP to catch.
A related objection is that the use of some facial-recognition technology algorithms has resulted in bias against persons of color. But, the National Institute of Standards and Technology (NIST), which performed the much-reported study indicating that some facial-recognition algorithms can produce biased results, actually found that the facial-recognition algorithm specifically used by CBP for facial comparison in TVS—NEC-3 (developed by NEC Corporation)—is highly accurate.[10] As noted in the NIST study, some facial-recognition algorithms are better than others, and the bad ones are indeed more likely to produce demographically biased results.[11] But, the best ones—like the NEC-3 algorithm used by CBP—are highly accurate and do not “display a significant demographic bias.”[12] CBP officials have also told Congress that “CBP’s operational data demonstrates that there is virtually no measurable differential performance in matching based on demographic factors.”[13] CBP continues to conduct analysis, as well as monitor algorithm performance and technology enhancements, to ensure a high biometric performance.
Nevertheless, CBP is focused on this issue, as it must be, and careful oversight by existing bodies like the Office of Civil Rights and Civil Liberties, and by the new DHS BOCC recommended by the HSAC Biometrics Subcommittee, is vital here, as is full transparency to these institutions, Congress, and the general public.[14] This should provide a measure of confidence that CBP’s algorithms will continue to improve, avoid any appearance of unfair bias, and will become even more accurate over time.
Excerpt of Recommendations:
Recommendation #3: DHS should carefully consider and adopt most of the recommendations of the HSAC Biometrics Subcommittee, particularly the creation of the DHS BOCC, which should be chaired by the DHS deputy secretary. DHS should empower the DHS Office of Strategy, Policy, and Plans to lead the development of DHS-wide policies on biometrics, including on such issues as retention, sharing, and—in conjunction with the DHS Office of Civil Rights and Civil Liberties—the avoidance of unfair bias against communities of color and others.
This page provides an excerpt from Forward Defense’s latest issue brief, sponsored by SAIC, which provides an overview of the opportunities and challenges to employing biometric technology at US ports of entry. To read the full paper, please visit here.
Image: Photo by George Prentzas via Unsplash