Homeland Security officials continue to step back from their published plan to require use of facial recognition technology on American citizens at U.S. airports when they arrive from or depart to international destinations.

The Trump administration’s proposed mandatory use of the technology was included in the so-called unified agenda, published in late November, which sets out the regulatory changes agencies intend to pursue in coming months. The proposal sought to expand mandatory facial recognition at U.S. airports “to provide that all travelers, including U.S. citizens, may be required to be photographed upon entry and/or departure.”

U.S. Customs and Border Protection has been testing facial recognition technology in passenger lanes at four ports of entry along the southern U.S. border, and at around 20 international airports around the country in partnership with private airlines. Currently, U.S. citizens can opt out of the facial scan, but the proposed rule appeared to have eliminated that option. 

On Monday, acting CBP Commissioner Mark Morgan clarified the agency’s walk-back. 

“When it first happened, logistically, it was going be very, very difficult to separate out U.S. citizens with non-U.S. citizens. That’s why it was originally included,” Morgan told reporters, explaining the agency’s proposed rule to expand the technology to all passengers. “My understanding is there was no intent to mandate U.S. citizens. It is voluntary — it has been — and currently there are no plans to change that.” 

The CBP’s move to expand the use of facial recognition came despite significant concerns about the technology already raised by lawmakers of both parties, civil rights groups and technology companies, all of whom have called for a federal law governing the use of the technology.

A CBP official told CQ Roll Call that the regulation first appeared on the unified agenda in 2018 and reflected “earlier discussions,” but by summer 2019, after many discussions with privacy groups and members of Congress, the agency had decided to keep the scans voluntary.

Privacy advocates continue to be skeptical of the agency’s intentions despite its latest announcement. CBP intends to have the planned regulatory action regarding U.S. citizens removed from the unified agenda next time it is published in the spring of 2020, a CBP official told CQ Roll Call.

As it is currently implemented in airports, passengers pause to have their photos captured, which are then compared with ones in the network of databases CBP has access to. U.S. citizens can inform a CBP officer if they want to opt out. Even if U.S. citizens don’t opt out, their images are deleted within 12 hours anyway, a CBP official told CQ Roll Call. 

CBP says it has interdicted nearly 200 “imposters” through this technology since September 2018. (In fiscal 2018, CBP officers processed more than 413 million travelers at air, land and sea ports of entry.)  

Public outrage

But the outcry following news reports about CBP’s expansion of facial recognition reveals a deep and increasing discomfort with the ways in which this largely unregulated technology is being deployed. 

Harrison Rudolph, an associate at the Georgetown Law Center on Privacy and Technology, who has been tracking the spread of facial recognition technology, has documented in a detailed report ways DHS has been expanding the technology without safeguards. The center consults with CBP on privacy issues surrounding biometric entry and exit. 

Rudolph said he has seen language requiring mandatory facial recognition scans at the border in previous regulatory abstracts as well, but CBP has repeatedly assured privacy groups it allows U.S. citizen travelers to opt out — at least for now. While CBP has heeded some privacy concerns and agreed to audit the scanners it uses, it has put nothing in writing. 

“Those promises are not enforceable when there are no rules in place, and right now there are no rules in place,” Rudolph told CQ Roll Call. 

Advocacy groups have said signs at airports telling citizens they can opt out are neither clearly visible nor a meaningful way of informing them of their rights. 

“The airport terminal environments are extremely difficult places to provide adequate notice to what [passenger] rights are as to having their faces scanned by facial recognition technology,” Rudolph said. Passengers should be told at the time they purchase tickets that the airline would be asking for biometric information, he added, along with the airlines’ privacy policy and thorough information about their rights. 

At the southern border with Mexico, the use of this technology has become concerning after news reports revealed that the administration was keeping tabs on protesters, lawyers, journalists and humanitarian aid workers, many of whom are U.S. citizens. 

Evan Greer, deputy director of Fight for the Future, an organization that carried out facial recognition scans on members of Congress as a test, revealing several false matches, was skeptical of CBP’s clarification. She viewed it as a move to save face after senior members of Congress expressed concern about the planned expansion of the program.

“There’s no way a program like this won’t be used for authoritarian surveillance purposes,” she said in a statement. “It’s good to see that public backlash has forced them to shelve the proposal for now, but we urgently need Congress to pass legislation to ban face surveillance entirely. Until then, our basic rights are at risk.”

Origins in 9/11

The quest for a more advanced system to track travelers entering and leaving the United States stemmed from the 9/11 commission’s report, which called for a biometric-based system. The proposal was codified in law by Congress in 2004. But according to Rudolph and his colleagues, Congress did not expressly authorize the deployment of facial recognition technology, which didn’t exist in 2004. 

There’s a broad bipartisan, political and tech-industry agreement that facial recognition technologies need strictly defined boundaries before they are used widely in government decision-making and commercial settings. They have pointed out that facial recognition technology can disproportionately misidentify non-Caucasians, women and other minorities.

A handful of bills in the 116th Congress have been proposed to address the issue but haven’t made much progress.

In the absence of a federal law governing use of the technology, some U.S. cities have banned its use.

Cambridge, Massachusetts, in August became at least the fourth city in the country to ban facial recognition software, after San Francisco, Oakland and Somerville, Massachusetts.

Cambridge’s decision came days after Rep. Ayanna S. Pressley, whose district includes the city, and other House Democrats introduced legislation to ban facial recognition technology in public housing and assisted housing units funded by the federal government.

Rep. Jim Jordan, the top Republican on the House Oversight and Reform Committee, which earlier this summer held the first series of congressional hearings on facial recognition technology, agreed with then-Chairman Elijah E. Cummings that they would pursue legislation that would ban the use of the technology by government agencies.

Massachusetts Sen. Edward J. Markey, the ranking Democrat on the Commerce, Science and Transportation Security Subcommittee, and Utah GOP Sen. Mike Lee have been particularly concerned about DHS expansion of this technology, penning letters expressing concern about the accuracy of the program. They have also raised questions about whether the extent of visa overstays — which DHS says the program will prevent — really warrants this kind of expansion of unregulated technology.