DHS Watchdog Finds TSA Facial Recognition System Vulnerable to Data Exposure

• A Department of Homeland Security (DHS) Inspector General audit revealed significant privacy weaknesses in the Transportation Security Administration's (TSA) facial recognition technology.
• The TSA's Credential Authentication Technology 2 (CAT-2) system failed to prevent third-party vendors from accessing sensitive passenger data without authorization.
• The Electronic Frontier Foundation (EFF) continues to oppose government use of biometric surveillance, highlighting risks of data breaches and warrantless information collection.

Audit Findings

• The TSA vendor was able to access and extract sensitive information, such as passport and driver’s license images, during system maintenance without agency knowledge.
• The TSA lacked sufficient policies to track data extraction or verify its secure deletion.
• The agency failed to notify passengers when their biometric and biographical information might have been stored or accessed.

Recommendations and Agency Response

• The Office of Inspector General issued three recommendations to enhance oversight, transparency, and data handling procedures.
• The TSA has agreed to all recommendations; currently, two are resolved, while one remains open and unresolved.

Passenger Options

• Travelers maintain the right to opt out of the TSA’s facial recognition process at security checkpoints.
• According to the TSA, opting out does not result in travel delays or additional security consequences.