DHS Inspector General Finds That TSA Is Not Safeguarding Facial Recognition Data

A DHS Office of Inspector General audit found significant weaknesses in TSA’s facial recognition identity-verification system (Credential Authentication Technology 2). The OIG reported a vendor could access and extract sensitive passenger data - including driver’s license and passport images - during troubleshooting and system enhancements without TSA’s knowledge. TSA lacked clear policies and vendor oversight: it did not track when data extractions occurred, could not verify that extracted information was deleted, and failed to notify travelers that their biometric or biographic information may have been stored. The OIG issued one finding and three recommendations; TSA concurred, with two recommendations marked resolved and one still open.

The Electronic Frontier Foundation frames the audit as further evidence that government facial recognition programs threaten privacy and civil liberties: insecure handling and lax oversight create risks of unauthorized retention or exposure, the systems enable mass surveillance and creation of biometric records without consent, and misidentifications have led to wrongful arrests. TSA uses a camera to compare a live passenger photo to ID data, but travelers can opt out without delay. Advocacy will continue to press for stronger controls, transparency, and limits on routine biometric collection.