TSA now wants to scan your face at security. Here are your rights.

By Geoffrey A. Fowler / The Washington Post

13:40 JST, December 3, 2022

Next time you’re at airport security, get ready to look straight into a camera. The TSA wants to analyze your face.

The Transportation Security Administration has been quietly testing controversial facial recognition technology for passenger screening at 16 major domestic airports – from Washington to Los Angeles – and hopes to expand it across the United States as soon as next year. Kiosks with cameras are doing a job that used to be completed by humans: checking the photos on travelers’ IDs to make sure they’re not impostors.

The TSA says facial recognition, which has been banned by cities such as San Francisco, helps improve security and possibly also efficiency. But it’s also bringing an unproven tech, with civil rights ramifications we still just don’t understand, to one of the most stressful parts of travel.

After hearing concerns from Washington Post readers who encountered face scans while traveling, I wanted to know how the TSA is using the tech and what our rights are. Everybody wants better safety, but is this really safer – and what are its real costs?

So I quizzed the TSA’s Jason Lim, who helps run the program formally known as Credential Authentication Technology with Camera (CAT-2). And I also called Albert Fox Cahn, the founder of the Surveillance Technology Oversight Project, or STOP, and one of the biggest critics of facial recognition.

I learned the TSA has put some important constraints on its use of facial recognition – but its current programs are just the beginning.

No, you don’t have to participate in facial recognition at the airport. Whether you’ll feel like you have a real choice is a separate question.

– – –

How TSA facial recognition works

American airports have been experimenting with so-called biometric technology for years, following the 9/11 attacks. You might have seen Customs collecting biometric information from passengers entering the United States. In 2019, I tested some of the ways airlines were using face scans to replace boarding passes for international flights. The TSA’s facial recognition pilot began at Ronald Reagan Washington National Airport (DCA) amid concerns about covid transmission through contact in August 2020.

This system is for general passenger security screening. You step up to the travel document checker kiosk and stick your ID into a machine. Then you look into a camera for up to five seconds and the machine compares your live photo to the one it sees on your ID. They call this a “one to one” verification system, comparing one face to one ID. Even though the software is judging if you’re an impostor, there’s still a human agent there to make the final call (at least for now).

So how accurate is it? The TSA says it’s been better at verifying IDs than the manual process. “This technology is definitely a security enhancement,” Lim said. “We are so far very satisfied with the performance of the machine’s ability to conduct facial recognition accurately.”

What about people who don’t exactly look like their driver’s license photo? Minor variations in appearance over time – such as changing your hairstyle – have negligible negative impact on identity verification, the TSA says.

But the TSA hasn’t actually released hard data about how often its system falsely identifies people, through incorrect positive or negative matches. Some of that might come to light next year when the TSA has to make its case to the Department of Homeland Security to convert airports all over the United States into facial recognition systems.

“I am worried that the TSA will give a green light to technology that is more likely to falsely accuse black and brown and nonbinary travelers and other groups that have historically faced more facial recognition errors,” said Cahn of STOP.

Research has shown facial recognition algorithms can be less accurate at identifying people of color. A study published by the federal National Institute of Science and Technology in 2019 found that Asian and African American people were up to 100 times more likely to be misidentified than White men, depending on the particular algorithm and type of search.

Should travelers be concerned? “No one should worry about being misidentified. That is not happening, and we work diligently to ensure the technology is performing according to the highest scientific standards,” Lim told me. “Demographic equitability is a serious issue for us, and it represents a significant element in our testing.”

That doesn’t satisfy critics such as Cahn. “I don’t trust the TSA to evaluate the efficacy of its own facial recognition systems,” he said.

– – –

What about your privacy?

When some people hear about governments using facial recognition, they rightly picture the situation in China, where broad use of the technology makes it extremely difficult for citizens to evade surveillance. Does going through airport security now mean Homeland Security has a face ID that can identify you at a protest?

The TSA says it doesn’t use facial recognition for law-enforcement purposes. It also says it minimizes holding on to our face data, so it isn’t using the scans to build out a new national database of face IDs.

“The scanning and match is made and immediately overwritten at the Travel Document Checker podium. We keep neither the live photo nor the photo of the ID,” said Lim. But the TSA did acknowledge there are cases in which it holds on to the data for up to 24 months so its science and technology office can evaluate the system’s effectiveness.

What’s more, the TSA already has a plan to expand the scope of how it’s using the tech. It’s running a pilot of a second system at a few airports where you don’t even have to present your physical ID for inspection. Your face is your ID.

In tests with Delta, machines compare passengers’ live faces to a database of photos the government already has, typically from passports. For now, this system only works for passengers with PreCheck or Global Entry and passengers also have to request it from Delta. A colleague recently tried it in Atlanta and reported it was like an extra-fast version of PreCheck that probably saved him five minutes on his trip.

Just remember: Any time data gets collected somewhere, it could also be stolen – and you only get one face. The TSA says all its databases are encrypted to reduce hacking risk. But in 2019, the Department of Homeland Security disclosed that photos of travelers were taken in a data breach, accessed through the network of one of its subcontractors.

– – –

Your rights

So do you have to participate?

“None of this facial recognition technology is mandated,” said Lim. “Those who do not feel comfortable will still have to present their ID – but they can tell the officer that they do not want their photo taken, and the officer will turn off the live camera.” There are also supposed to be signs around informing you of your rights.

But does it mean you’ll get moved to a slow line, get an extra pat down, or a mark on your record? “You should have no derogatory experience based on you exercising your right,” said Lim. If you suspect that has happened, the TSA says you should ask to speak to a manager.

“What we often see with these biometric programs is they are only optional in the introductory phases – and over time we see them becoming standardized and nationalized and eventually compulsory,” said Cahn. “There is no place more coercive to ask people for their consent than an airport.”

Even people who care a lot about privacy often find their limits when it comes to airline travel. People gravitate to options that help them get through the airport faster – and it’s not hard to imagine ending up with a bifurcated airport experience, said Cahn.

Those who have the privilege of not having to worry their face will be misread can zip right through – whereas people who don’t consent to it pay a tax with their time. At that point, how voluntary is it, really?