A recent Department of Homeland Security (DHS) Inspector General audit found that the TSA has been mishandling sensitive biometric data collected at airports.
An unclassified summary of the report explains the Office of the Inspector General (OIG) audit, which was intended “to determine the extent to which the Transportation Security Administration’s (TSA) facial recognition and identification technologies enhance security screening to identify persons of interest and authenticate flight traveler information while protecting passenger privacy.”
“Significant weakness”
To the TSA’s credit, the audit determined that TSA personnel delete photos of passengers moving through airport checkpoints in a timely fashion and in accordance with federal regulations. However, the audit also identified a “significant weakness” in their operations. The issue concerns Credential Authentication Technology (CAT-2), which the TSA uses in its biometric facial recognition system. That system is apparently insecure. According to the OIG, CAT-2 allows the TSA contractor providing it to access passenger data, including driver’s licenses and passport photos. This sensitive information was available to the contractor during “system troubleshooting and enhancements” without the TSA’s knowledge. According to the audit summary:
“TSA lacked clear policies, did not track when this data was extracted, could not verify that extracted information was properly deleted, and did not notify passengers when their biometric and biographic information may have been stored. As a result, although passenger information was generally protected during routine operations, weaknesses in vendor oversight created a risk that sensitive personal information could be retained or exposed.”
The vendors in question appear to be two firms: Idemia Identity and Security USA, LLC. According to a 2023 TSA announcement, the agency awarded $128 million to these two contractors to develop the CAT-2 system. In that release, the TSA touted CAT-2, noting that this second-generation technology would “allow for automated identity verification with an integrated camera for biometric and self-service capabilities.” The agency noted the system’s scale, adding that their “new contract with Idemia [would] enable TSA to test, manufacture, procure and deploy over 1,500 new CAT-2 systems to airport security checkpoints nationwide.”
This is the system the OIG audit singled out for compromising passenger privacy. While Security USA LLC has a limited paper trail online, Idemia has a well-documented and problematic record (Idemia Identity is one wing of the Idemia corporation).
