The Transportation Security Administration, unconstitutionally formed after the 9/11 attacks, has, once again, come under scrutiny for its handling of the People’s biometric data. No surprise here, right?
A report from the Department of Homeland Security has now demonstrated this fact.
Pleasure to Burn reports on the unclassified summary.
A recent Department of Homeland Security (DHS) Inspector General audit found that the TSA has been mishandling sensitive biometric data collected at airports.
An unclassified summary of the report explains the Office of the Inspector General (OIG) audit, which was intended “to determine the extent to which the Transportation Security Administration’s (TSA) facial recognition and identification technologies enhance security screening to identify persons of interest and authenticate flight traveler information while protecting passenger privacy.”
“Significant weakness”
To the TSA’s credit, the audit determined that TSA personnel delete photos of passengers moving through airport checkpoints in a timely fashion and in accordance with federal regulations. However, the audit also identified a “significant weakness” in their operations. The issue concerns Credential Authentication Technology (CAT-2), which the TSA uses in its biometric facial recognition system. That system is apparently insecure. According to the OIG, CAT-2 allows the TSA contractor providing it to access passenger data, including driver’s licenses and passport photos. This sensitive information was available to the contractor during “system troubleshooting and enhancements” without the TSA’s knowledge. According to the audit summary:
“TSA lacked clear policies, did not track when this data was extracted, could not verify that extracted information was properly deleted, and did not notify passengers when their biometric and biographic information may have been stored. As a result, although passenger information was generally protected during routine operations, weaknesses in vendor oversight created a risk that sensitive personal information could be retained or exposed.”
The vendors in question appear to be two firms: Idemia Identity and Security USA, LLC. According to a 2023 TSA announcement, the agency awarded $128 million to these two contractors to develop the CAT-2 system. In that release, the TSA touted CAT-2, noting that this second-generation technology would “allow for automated identity verification with an integrated camera for biometric and self-service capabilities.” The agency noted the system’s scale, adding that their “new contract with Idemia [would] enable TSA to test, manufacture, procure and deploy over 1,500 new CAT-2 systems to airport security checkpoints nationwide.”
This is the system the OIG audit singled out for compromising passenger privacy. While Security USA LLC has a limited paper trail online, Idemia has a well-documented and problematic record (Idemia Identity is one wing of the Idemia corporation).
Idemia intrusions
For example, one of Idemia’s predecessor companies, Safran (which was partially owned by the French government), was caught bribing Nigerian government officials in the early 2000s to win a national ID contract worth over $200 million. None of the company’s senior management faced charges. Another Idemia predecessor, Oberthur, faced a World Bank investigation and subsequent sanctions for “corrupt and collusive practices” regarding a national ID project in Bangladesh (Oberthur enjoyed many contracts with the US government prior to its absorption into Idemia).
This history of corruption accompanies Idemia’s apparent disregard for civil liberties or privacy. In 2019, the ACLU of Massachusetts raised concerns about Idemia’s work with the Massachusetts Registry of Motor Vehicles. The ACLU noted that the company was helping the state agency deploy facial surveillance technology in the name of fighting fraudulent license applicants. The 2019 ACLU statement also pointed out that the company had “released a new video analytics product called Augmented Vision that allows cameras to analyze people and their movements in real-time.” That system “includes multiple algorithms with the ability to recognize not only faces but silhouettes, vehicles, number plates, and an unspecified number of objects.”
The ACLU highlighted serious concerns:
“In the absence of strong privacy rules, there are no requirements that police disclose on what basis they are tracking people, where they are being tracked, what information police are storing about people, or how that information may be used for stops, searches, surveillance, and arrests.”
In promoting this Augmented Vision tool, Idemia advertises that it can “identify and track high-risk and vulnerable persons of interest across multiple cameras” as well as “extract and capture faces of pedestrians and motorists, license plates, vehicles, and other video data” and “trigger live alerts for awareness across the entire area of operation.” The same brochure touts “biometric access control.”
The ACLU pointed out problems with such “access control” in 2019:
“While the company’s marketing materials make it sound like Augmented Vision is primarily useful for controlling something like employee access to a corporate building, IDEMIA sees no such restriction on the uses of its product. According to the materials, the company envisions its software in cameras in public and private spaces, including airports, stadiums, retail spaces, and commercial buildings.”
Idemia seems to have no concerns about the ever-encroaching surveillance state. Rather, it is happy to help build its infrastructure. A 2021 Idemia brochure for “Augmented Vision Investigate,” which appears to focus the Augmented Vision product on investigative work, touts its applicability to police investigations. The Idemia brochure notes that their system seamlessly “process[es] content from CCTV cameras, mobile phone images, videos, and body-worn cameras alike.” The brochure also notes the tool’s ability to integrate drone and webcam images. Such footage is “processed into easily navigable categories such as faces, pedestrians, luggages [sic], vehicles, and license plates.”
Additionally, Idemia produces biometric data collection tools for the mobile collection of biometric facial and fingerprint data. The company also provides “enrollment services” for TSA’s PreCheck program and has entire webpages dedicated to showcasing its federal, state, and local government contracts.
The Electronic Frontier Foundation highlighted the company’s desire to expand its operations regardless of privacy concerns. In a 2017 press release, the privacy-oriented foundation pointed out that Idemia had access to private information collected by federal agencies:
“For example, TSA’s PreCheck program has already expanded outside the airport context. The vendor for PreCheck, a company called Idemia (formerly MorphoTrust), now offers expedited entry for PreCheck-approved travelers at concerts and stadiums across the country. Idemia says it will equip stadiums with biometric-based technology, not just for security, but also ‘to assist in fan experience.’ Adding face recognition would allow Idemia to track fans as they move throughout the stadium…”
A lesser-known evil
Idemia is far less notorious than Flock and Palantir, which have elicited widespread scorn for their roles in expanding the surveillance state. But Idemia and its predecessors have also spent years helping build intricate and extensive biometric surveillance systems.
The extent of the biometric surveillance tools Idemia is willing to provide to the US government is alarming on its own. It is even more concerning given the types of regimes the company services. Idemia provides biometric identification and border control services at Singapore’s Changi Airport; Singapore is known for its repressive government and human rights violations. Idemia has also faced accusations of helping the Egyptian government surveil dissidents. One of its predecessor companies, Morpho, won a contract to provide facial recognition tools to Shanghai’s Public Security Bureau in China, where the government operates a severely intrusive surveillance state.
From the increasingly authoritarian US government to oppressive regimes abroad, the company appears to have few—if any—lines in the sand about the severity of surveillance they are willing to help paying governments impose.
This, on its own, is bad enough. But the apparent lack of security identified in the recent OIG report indicates not only a public-private lack of commitment to civil liberties and privacy but also an inability to live up to the ‘security’ they promise to provide.
It’s worth noting that biometric scanning at airport checkpoints is not currently mandatory. Anyone concerned about the growing panopticon and the mishandling of sensitive personal data may want to opt out of this ‘service’ while they still can.
