<div class="field field--name-body field--type-text-with-summary field--label-hidden"><div class="field__items"><div class="field__item even"><p><i><span data-contrast="auto">EFF legal intern Gabrielle Ladun was the principal author of this post.</span></i><span data-ccp-props="240}"> </span></p>
<p><span data-ccp-props="240}">The Department of Homeland Security Office of Inspector General (DHS OIG) has </span><a href="https://www.oig.dhs.gov/sites/default/files/assets/2026-09/OIG-26-27-Sep26.pdf"><span data-contrast="none">published a summary of findings</span></a><span data-contrast="auto"> from its audit of the Transportation Security Administration’s (TSA) facial recognition technology. While the detailed findings are classified, the summary states that the OIG’s audit uncovered a “significant weakness” in the technology’s ability to protect the privacy of passenger data. This has massive privacy implications for the millions of passengers who travel and don’t opt out of the TSA’s biometric surveillance technology verification process. </span></p>
<p><span data-contrast="auto">TSA uses facial comparison technology for identity verification of airline passengers. A camera takes a photo of passengers to verify that their provided identification matches their live photo. Although TSA states that it is “<a href="https://www.tsa.gov/news/press/factsheets/facial-comparison-technology">committed to protecting traveler privacy</a>,”</span> <span data-contrast="auto">the audit highlights that this has not been the case. </span><span data-ccp-props="240}"> </span></p>
<p><span data-contrast="auto">The OIG found that TSA’s Credential Authentication Technology 2’s (CAT-2) vendor “was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and enhancements, without TSA’s knowledge.” </span><span data-ccp-props="240}"> </span></p>
<p><span data-ccp-props="240}">The OIG further admonished the agency: </span><span data-ccp-props="240}"> </span></p>
<blockquote><p><span data-contrast="auto">TSA lacked clear policies, did not track when this data was extracted, could not verify that extracted information was properly deleted, and did not notify passengers when their biometric and biographic information may have been stored. As a result, although passenger information was generally protected during routine operations, weaknesses in vendor oversight created a risk that sensitive personal information could be retained or exposed.</span><span data-ccp-props="240}"> </span></p>
</blockquote>
<p><span data-contrast="auto">We hope the TSA will fix these issues. The OIG summary states:</span><span data-ccp-props="240}"> </span></p>
<blockquote><p><span data-contrast="auto">We issued one finding and three recommendations to strengthen controls, improve oversight, and ensure transparency and the proper handling of passenger data. TSA concurred with all three recommendations. Two recommendations are open and resolved, and one remains open and unresolved.</span><span data-ccp-props="240}"> </span></p>
</blockquote>
<h3><b><span data-contrast="auto">Why EFF Opposes the Government’s Use of Facial Recognition Technology</span></b><span data-ccp-props="240}"> </span></h3>
<p><span data-ccp-props="240}"></span><span data-ccp-props="240}">EFF </span><a href="https://www.eff.org/document/ban-government-use-facial-recognition"><span data-contrast="none">has a long history</span></a><span data-contrast="auto"> of opposing governmental use of facial recognition technology. As the OIG’s audit underscores, this technology presents privacy risks associated with unsecured data, unauthorized access, and data breaches. The government’s use of this technology also creates a mass surveillance system and facilitates the creation of warrantless biometric records for unconsenting parties. </span><span data-ccp-props="240}"> </span></p>
<p><span data-contrast="auto">The biometric data captured by this technology is not without errors. There have been multiple instances of law enforcement agencies using facial recognition technology to misidentify and arrest innocent individuals. </span><span data-ccp-props="240}"> </span></p>
<h3><b><span data-contrast="auto">Reminder: Opting Out of TSA Photos Is Possible</span></b><span data-ccp-props="240}"> </span></h3>
<p><span data-contrast="auto"></span><span data-contrast="auto">Given that facial recognition technology is prone to mistakes, combined with the OIG’s audit revealing significant privacy weaknesses, it is imperative that travelers remember that opting out is possible. </span><a href="https://www.tsa.gov/news/press/factsheets/facial-comparison-technology"><span data-contrast="none">TSA’s own website</span></a><span data-contrast="auto"> emphasizes that travelers who wish to decline to have their photo taken for facial comparison can do so without any delay, disruption, or recourse. </span><span data-ccp-props="240}"> </span></p>
<p><span data-contrast="auto">Considering the data protection weaknesses exposed by the OIG’s audit, EFF will continue to oppose this governmental system of mass surveillance and spread awareness to ensure that no one is forced to relinquish their biometric data without consent. </span></p>

</div></div></div>