DHS's New Airport Face-Scanning Program Is Expensive, Flawed, And Illegal

We, the people, are going to shell out $1 billion for the DHS to scan our faces into possibly illegal biometric systems. Those are the conclusions reached by the Georgetown Law Center on Privacy and Technology. A close examination the face scanning system the DHS plans to shove in front of passengers of international flights shows it to be a waste of money with limited utility.

DHS' biometric exit program" stands on shaky legal ground. Congress has repeatedly ordered the collection of biometrics from foreign nationals at the border, but has never clearly authorized the border collection of biometrics from American citizens using face recognition technology. Without explicit authorization, DHS should not be scanning the faces of Americans as they depart on international flights-but DHS is doing it anyway. DHS also is failing to comply with a federal law requiring it to conduct a rulemaking process to implement the airport face scanning program-a process that DHS has not even started.

But American citizens will be included, according to the DHS. Its response to US travelers' wondering why they're being treated like terrorism suspects is that they're welcome to opt out of the collection. All they have to do is not fly. The DHS insists it's only targeting foreign visitors, but the system will scan everyone. The agency also promises not to retain face scans of US citizens, but it's highly doubtful it will keep that promise. The government has rolled out a variety of biometric collections, each one intermingled with existing law enforcement and terrorism databases. Collect it all and let the courts sort it out: that's the government's motto.

On top of the illegality and lack of proper deployment paperwork, there's the fact the program really just doesn't do anything useful. As the Center points out in its thorough report, there was originally a point to scanning incoming foreign visitors and comparing them to government databases: catching incoming criminals and members of terrorism watchlists. But there's no solid rationale behind the push to scan faces of foreigners as they leave the country.

The DHS has a theory, but it's not a good one.

DHS, for its part, has never studied whether there is a problem that necessitates a change in its approach to tracking travelers' departures. DHS claims that the aim of the program is to detect visa overstay travel fraud and to improve DHS' data on the departure of foreign nationals by "biometrically verifying" the exit records it already creates for those leaving the country.

Visa overstay travel fraud could-in theory-be a problem worth solving. Foreign nationals who wish to remain in the country undetected past the expiration of their visas could be arranging to have others leave the country in their place using fraudulent credentials. But DHS has only ever published limited and anecdotal evidence of this.

The DHS -- despite rolling this out -- still has no idea if it will do anything more than stock its database of human faces. Five years after being asked to demonstrate how biometric exit scans would be an improvement over the status quo, the DHS has yet to provide answers. In fact, it's hasn't even been able to deliver an estimate as to when its report answering these questions will be delivered.

This dovetails right into the DHS's lackadaisical roll out of its biometric program. So far, the tech has only been installed in a few airports, but even in this limited trial run, the agency seems uninterested in ensuring the system's accuracy. The DHS claims the program is doing great because it's not returning a lot of false positives. But that's the wrong metric if you're hoping to catch people on the way out of the country.

DHS currently measures performance based on how often the system correctly accepts travelers who are using true credentials. But if the aim of this system is to detect and stop visa overstay travel fraud-as DHS suggests-it is critical and perhaps more important to assess how well it performs at correctly rejecting travelers who are using fraudulent credentials. Yet DHS is not measuring that.

The Center recommends DHS suspend the program indefinitely. It should not be put back into place until the DHS has clear legal authorization to do so and with all of the required privacy impact paperwork filed. It should spend some more time studying the tech to see if it can actually perform the job the DHS wants it to. The end goal for the tech -- overstay travel fraud -- seems like a spurious reason for expanded surveillance in US airports, especially when isn't interested in limiting this biometric collection to foreign citizens only. But chances are none of these recommendations will be followed by the DHS -- not while answering to a presidential administration that has done its best to portray most foreigners as inherent threats to the US way of life.