Facial recognition: Security at RDU, other airports now means having your photo taken
When Micah Kordsmeier of Durham arrived at the U.S. Customs and Border Protection booth at Raleigh-Durham International Airport after a trip to Mexico, the officer didn’t ask for his passport.
Instead, she told Kordsmeier to look into a camera.
His photo was taken, and he went on his way, “no explanation given whatsoever,” he said.
This was Kordsmeier’s first encounter with facial recognition technology at RDU that federal agencies increasingly use to verify a traveler’s identity. Customs and Border Protection began using it for arriving international passengers at RDU in 2021. Now the Transportation Security Administration is introducing facial recognition technology at checkpoints for all passengers departing the airport.
The photos are optional, except for foreign nationals entering the country. But that’s not always made clear. Kordsmeier said he wasn’t asked whether he wanted his photo taken and didn’t see any signs informing him of his right to opt out.
“I don’t really know what the technology is, so I am curious about the security level,” he said. “I’m not really familiar with it.”
Many travelers aren’t. But facial recognition technology is fast becoming standard in airport security and starting to crop up in other places, often in the name of convenience. Some airlines are experimenting with facial recognition systems for baggage drop, while Major League Baseball teams are beginning to use apps that allow fans with tickets to enter the park based on scans of their faces.
Not everyone is bullish on the technology. A bipartisan group of U.S. senators introduced a bill last fall that would prohibit the TSA from using facial recognition, primarily because of privacy concerns.
“The TSA program is a precursor to a full-blown national surveillance state,” Sen. Jeff Merkley, a Democrat from Oregon, said in a statement. “Nothing could be more damaging to our national values of privacy and freedom. No government should be trusted with this power.”
The bill has not advanced. But the TSA has posted signs at each security checkpoint letting passengers know that having their photo taken is optional.
Here’s how the technology works at RDU.
Transportation Security Administration
Facial recognition is a component of what the TSA calls Credential Authentication Technology or CAT. The first generation of CAT machines scan a traveler’s driver’s license or passport to confirm that it’s authentic. The machines also automatically tap into a database of people scheduled to fly that day, so passengers no longer need to show a boarding pass to the TSA officer.
But officers still need to verify that the person standing in front of them is the one whose ID they just scanned. With the early CAT machines, they do that manually, looking from the photo to the person and back again.
The newer machines, known as CAT-2, have a camera and software that takes the passenger’s photo and compares it with the photo on the ID to verify it’s the same person. If CAT-2 determines an ID is invalid or the photos don’t match, the TSA officer will call airport police, said Dan Velez, regional spokesperson for the agency.
“I don’t have statistics on how often that happens,” Velez wrote in an email, “but it’s very infrequently.”
If a person declines to have a photo taken, the TSA officer will check the person’s ID manually. Travelers under 18 are not photographed.
The TSA says it doesn’t store the photos it takes at the airport and that they’re not used for any other purpose.
The TSA installed its first six CAT-2 machines at RDU in late June. The remaining 19 CAT units are scheduled to be converted to CAT-2 on Aug. 26, Velez said.
Customs and Border Protection
About 1,600 passengers a day arrive at RDU from international destinations and are scanned by CBP’s facial comparison technology. If they are non-U.S. citizens, they must present a passport. U.S. citizens also may be asked to show their passport, and should have it handy, but most will only have to pose for a photo.
The use of facial recognition at customs grew out of the 9/11 Commission Congress created in the wake of the terrorist attacks in 2001. The hijackers used fake IDs to board the planes that day, prompting the commission to conclude that “a biometric entry-exit system is an essential investment in national security.”
CBP’s Traveler Verification Service uses an algorithm to compare a live photo of the traveler to images from passports, visas or photos from other documents on file with the Department of Homeland Security.
If the algorithm flags a discrepancy between the two, a CBP officer will manually scan the individual’s passport.
Miguel Garza, CBP area port director for Charlotte, said use of the technology makes travel easier on passengers, saying “it takes seconds.”
“This is a platform that ultimately allows us to be more efficient and allows us to confirm the traveler to their passport and to documents a lot faster,” Garza said in an interview.
Unlike the TSA, which does not store photos, CBP holds images of U.S. citizens for up to 12 hours. Non-U.S. citizens’ photos can be held by the Department of Homeland Security for up to 14 days.
RDU is one of 32 airports that use biometric facial comparison technology to identify passengers for entry into the United States, according to the agency. As of April, it also uses the technology for travelers exiting the country.
Privacy versus security
Kordsmeier, the Durham resident who came through customs at RDU recently, said he didn’t have any privacy concerns about having his photo taken.
“I know traveling internationally, you give up certain kinds of privacy,” he said.
Indeed, many airline travelers have already willingly given up biometric information in return for security and convenience.
The TSA’s PreCheck program provides expedited treatment at security checkpoints to passengers who provide identity documents and have their photo and fingerprints taken in advance. And passengers can bypass a step at checkpoints by enrolling in CLEAR, a private program that uses eye scans and fingerprints to verify people’s identity.
The conversation about facial recognition is “privacy versus security,” said Cynthia Rudin, a Duke University computer science professor and member of the National Academies of Sciences, Engineering and Medicine’s research committee on facial recognition.
Rudin said concerns about the privacy of CBP’s technology in particular may be misplaced. The agency already has a database with each traveler’s photo from passports and other travel documents — and it has clear rules about how long photos taken at an airport remain in the system, she said.
While she understands how people might be uneasy about somebody taking their picture and analyzing it in a computer, Rudin says CBP and TSA follow clear policies about data storage and privacy.
She’s more concerned about the use of facial recognition technology in the private sphere.
“The guy on the street using facial recognition on their phone doesn’t follow those policies,” she said. “So the people you should be afraid of are not necessarily the people you think.”