A recent audit by the Department of Homeland Security’s Office of Inspector General exposed major flaws in the Transportation Security Administration’s handling of passenger facial recognition data, highlighting privacy risks and oversight gaps in the agency’s biometric verification program.
- Vendor accessed and extracted sensitive passenger biometric data without TSA’s knowledge
- TSA failed to track, verify deletion, or notify passengers about data handling practices
- DHS OIG made three recommendations; one remains unresolved
What happened
The Department of Homeland Security’s Office of Inspector General conducted an audit of the Transportation Security Administration's facial recognition program, specifically examining the Credential Authentication Technology 2 (CAT-2) system used for verifying passenger identities at airports. The audit summary, though classified in detail, revealed significant vulnerabilities in how TSA safeguards passenger biometric and biographic data collected during the facial comparison process.
The audit found that the vendor responsible for CAT-2 accessed and extracted sensitive passenger information—including images from driver’s licenses and passports—during system troubleshooting and upgrades without TSA’s awareness or authorization. Moreover, TSA lacked comprehensive policies to log these data extractions, verify subsequent deletion, or notify affected travelers about their data being accessed and potentially stored.
Why it matters
These findings have profound implications for the privacy rights of millions of air travelers, many of whom do not opt out of the TSA’s biometric verification process. The exposure and potential retention of sensitive personal information raise the risk of data breaches, unauthorized surveillance, and misuse of biometric records. Despite TSA’s public commitment to protecting traveler privacy, this audit reveals failures in oversight and data control that could undermine public trust.
Beyond privacy concerns, facial recognition technology is prone to errors, including mistaken identity incidents by law enforcement. The DHS Inspector General’s findings underscore the urgent need for stricter controls and transparency to prevent the creation of warrantless biometric databases and to protect individuals’ rights in an era of expanding government surveillance.
What to watch next
The DHS Inspector General issued three recommendations to TSA aimed at strengthening security controls, enhancing vendor oversight, and ensuring transparent handling of passenger data. While TSA has accepted these recommendations, only two have been marked as resolved, leaving one critical recommendation still open. Stakeholders should monitor TSA’s progress in fully addressing these issues.
Travelers are reminded that opting out of TSA’s facial recognition process is permitted and can be done without delaying security screening. Privacy advocates, including the Electronic Frontier Foundation, remain vigilant against mass biometric surveillance programs and will continue raising awareness about the dangers posed by inadequate data protections within government facial recognition systems.