What Does TSA's Facial Scan Actually Do?

Dealing with the Transportation Security Administration (TSA) at an airport can feel overwhelming. There are so many rules to remember and security processes to go through. You often wonder if you accidentally packed something you are not allowed to bring, or if those body scanners can actually see you naked. Now, facial scans at most major airports present a new issue about whether this new technology poses a privacy threat.

The TSA's facial scan technology is fairly new. Deloitte published a report in 2020 advocating for the use of biometric scanning for airport security, citing the need for contactless screening in the time of COVID-19. The report states, "More recently, governments have shown a strong preference for the use of facial biometrics in the implementation of biometric screening solutions. ... The promise of a seamless travel experience powered by facial biometrics and a partnership between airports, airlines, and government seemed to be in the near future."

That future is here, and the facial scan is working at over 250 airports across the nation. The TSA is positive about this technology, promising data security and a more efficient and safer travel experience for everyone. However, concerns still remain among travelers about the safety of this technology.

Just as the TSA has electronics rules to verify your computer is what you say it is, the facial scan's purpose is to verify you are the same person as on your ID. It is to stop fraudulent activity such as people sneaking aboard airplanes using an ID that is not their own. It's referred to as Credential Authentication Technology (CAT-2) screening. There is no special line just for facial screening, as it can be present at any checkpoint including TSA PreCheck and enhanced screening.

How does this technology match your face with your ID? The TSA uses algorithms that it developed in tandem with Customs and Border Patrol. These face-matching algorithms account for variables such as the change of lighting or a busy or static background to ensure there is no misidentification. When you get your ID checked, you have the option to consent to a facial scan. You're supposed to be able to say no without losing your place in line or receiving any negative treatment. The TSA officer you are working with is supposed to simply do a standard ID verification check rather than using a biometric camera. Twelve hours after the verification, Customs and Border Patrol states, photos of U.S. citizens are deleted from the database.

The TSA says it ensures privacy in this practice, emphasizing that this process is entirely voluntary and that there shouldn't be retaliation if a traveler chooses to opt out. The facial scan is not used for surveillance, and signs are kept at all security checkpoints to ensure travelers know their rights. The TSA says it takes passenger privacy seriously, like its rules for laptop and phone inspections.

However, concerns still remain. Not only have travelers routinely pointed out that refusal to get their faces scanned was met with pushback from TSA agents — including threats that it would delay their travel or lead to longer wait times — but critics of the program have pushed back too, cautioning travelers to not consent to the facial recognition scans and warning that it sets a dangerous precedent for surveillance. The Electronic Privacy Information Center has pointed out that there are no restrictions on how the TSA is using the technology, and the agency's own reports about its system are inconsistent and, in some cases, incorrect. Arguing that using people's faces for identity verification infringes on individuals' right to privacy, the organization urged Congress to suspend the use of facial recognition by the TSA.

India McKinney is the director of federal affairs at the Electronic Frontier Foundation, which focuses on digital privacy. McKinney also has a background as a Capitol Hill legislative staffer. She stated to USA Today, "It's not about the integrity of your face or driver's license, it's about the database where you have no control."

Vahid Behzadan is an assistant professor of computer science and data science at the University of New Haven. He's also the founder of the university's Secure and Assured Intelligent Learning research group. He told USA Today, "No cyber system is 100% secure, even if the images aren't used for a long period of time." He went on to say, "The fact that they're being imposed on a large group of travelers presents a vulnerability ... if an adversary manages to compromise the end points, then the adversary has access to all the facial images and details, assuming the IDs are also scanned."