Don’t Take It at Face Value: Why TSA’s Implementation of Facial Recognition is More Dangerous Than You Think

Facial recognition is an invasive and dangerous surveillance technology. When the government moves forward with pilot programs that will, if fully implemented, subject millions of people on a daily basis to the technology that should give us all pause. Currently the Transportation Security Administration (TSA) is running two different pilots that use of facial recognition technology to confirm travelers’ identity. As explained below, this is a mistake—not only because of the ongoing privacy and bias issues but because of the long term implications of using our face as our ID. That is why EPIC has previously urged Congress to suspend TSA’s use of facial recognition technology and supports the call by several Senators earlier this year for TSA to halt the technology’s use.

TSA Facial Recognition Pilot Programs

TSA’s 1:1 pilot uses a real-time photo taken at a security checkpoint and compares that image to the image on the traveler’s government-issued ID (e.g., a driver’s license or passport). Instead of handing over your ID to a TSA agent, travelers will place their ID into a machine that will then take a picture of them and compare it to the image on the ID to verify their identity. In theory, travelers can opt out of the pilot at the security checkpoint to avoid having their picture taken and their identity verified by facial recognition. In those instances where a traveler opts out, a TSA agent is supposed to check the ID manually to verify identity. This 1:1 pilot has currently expanded to at least 25 airports.

There is also a more limited 1:many pilot currently focused on “trusted travelers” (e.g., TSA PreCheck enrollees) that uses a real-time photo taken at the security checkpoint and compares that image to a database of images the government controls. Currently, these travelers may opt into the 1:many pilot and, if they do so, do not need to present a government issued ID at the security checkpoints where the pilot has been implemented. Instead, their identity is verified with a real-time photo taken at the security checkpoint that is sent to Customs and Border Protection’s (CBP) Traveler Verification Service (TVS) for identity verification. TVS is CBP’s cloud-based facial recognition identity verification service. TVS leverages photos from government databases containing passport photos and/or visa photos, among other sources, to perform the identity verification against the photo taken in real-time.

Both pilots raise the possibility of bias issues that could disproportionately impact certain groups of people (e.g., women and people with darker skin). According to TSA, they are testing the facial recognition algorithm for accuracy and to ensure it is free from bias. But it appears the TSA is not using an independent third party to perform the tests, and the agency apparently has no plans to release the results publicly, which calls into question how they are testing the algorithm and any results of that testing.

The Risks of Facial Recognition—Even for Identity Verification

Regardless of the test results, though, TSA should not be implementing the use of facial recognition. Unfortunately, despite the potential privacy and bias risks, TSA’s Biometric Roadmap makes clear that TSA has every intention of implementing the use of facial recognition at airports across the country. This is a problem because any current claims by TSA about how they are protecting privacy and the voluntariness of the program ring hollow in light of the fact that there are no meaningful restrictions on how TSA implements the use of facial recognition technology. This is because the United States lacks an overarching law to regulate the use of facial recognition to ensure the necessary transparency, accountability, and oversight to protect our privacy, civil liberties, and civil rights. 

For example, although currently travelers are not required to participate in the 1:1 or the 1:many face verification pilots, there is no guarantee that will remain the case. Indeed, the head of TSA, David Pekoske, stated at SXSW this year while talking about the use of facial recognition at airports that “eventually we will get to the point we will require biometrics across the board.” This statement by TSA Administrator Pekoske highlights one of the main risks of TSA using facial recognition in any capacity—there is no guarantee that how TSA initially uses facial recognition will not change or expand beyond the current stated purpose. Even if TSA begins with the less privacy-invasive and “voluntary” 1:1 implementation, the agency could easily change the implementation and expand the use of facial recognition. This includes moving from a 1:1 implementation to a 1:many, making face verification a requirement, and granting unfettered access to law enforcement. The extent of TSA’s facial recognition program, how TSA decides to use facial recognition, and what protections are or are not in place are largely up to TSA. 

Another risk that is set in motion by TSA’s use of face verification is the very real possibility that our face eventually becomes our default ID and creates a de facto national ID controlled by the government. TSA subjecting millions of travelers to face verification will act as an endorsement of face verification moving forward, regardless if the agency intends it that way or not. Consequently, it will accelerate the use of our faces as our IDs. No longer will we control our identification as that control will be ceded to the government, which will have the ability to easily identify us without our consent and even without our knowledge. And using our faces as our ID means the infrastructure for facial recognition will become ubiquitous and centralized and the temptation to expand the use of such an infrastructure will likely be too great to resist, resulting in mission creep. A national ID based on face verification will be disastrous for our privacy, civil liberties, and civil rights. It would destroy anonymity and put the control of identification in the hands of the government and further exacerbate the imbalance of power between the government and the people.

Given the power of facial recognition technology, we, as a society, must consider its risks and how, if at all, the technology should be used. This is particularly true before a government agency starts implementing a program that would subject millions of travelers to it. As it stands, the government (and the private sector) are free to implement facial recognition technology pretty much however they would like, but the fact is facial recognition technology poses too great a threat to our democracy to allow its unfettered expansion. There is a reason facial recognition has become ubiquitous in less democratic countries—facial recognition is an ideal tool for oppression by an authoritarian or would-be authoritarian government. TSA’s use of facial recognition normalizes the use of our face as our ID and the dangerous implications are far too great to ignore. The TSA should immediately halt its implementation of facial recognition.