Hey readers,
It's Sigal Samuel. Here's something I'm embarrassed to admit: Even though I've been reporting on the problems with facial recognition for half a dozen years, I have allowed my face to be scanned at airports. Not once. Not twice. Many times.
There are lots of reasons for that. For one thing, traveling is stressful. I feel time pressure to make it to my gate quickly and social pressure not to hold up long lines. (This alone makes it feel like I'm not truly consenting to the face scans so much as being coerced into them.) Plus, I'm always getting "randomly selected" for additional screenings, maybe because of my Middle Eastern background. So I get nervous about doing anything that might lead to extra delays or interrogations.
But the main reason I haven't declined airport face scans is actually very simple: I had no idea I could opt out.
It turns out that saying no is not only doable, but surprisingly easy — at least in theory. Everyone, regardless of citizenship, can opt out when it comes to domestic flights in the US. (For international flights, US citizens can opt out but foreign nationals have to participate in face scanning, with some exceptions.) Simply stand away from the camera or keep your face covered with a mask, present your ID, and say, "I opt out of biometrics. I want the standard verification process."
In theory, an officer is then supposed to manually look over your ID and compare it to your face, as they used to do before facial recognition. But in practice, there have been reports of passengers — even a senator — facing resistance or intimidation when they try to go this route.
The Transportation Security Administration (TSA) and Customs and Border Protection (CBP) are also supposed to have clear signs informing passengers of the right to opt out. But at many airports, you have to look really, really hard to spot that message. Be prepared to crane your neck at an unnatural angle or squint at a very small font!
This is why the Algorithmic Justice League, a nonprofit that sheds light on AI harms, launched a campaign this month called "Freedom Flyers" to raise awareness of your right to opt out. The timing is perfect: The TSA recorded an all-time record day for air travel on June 23, with nearly 3 million people screened at the country's airports as summer vacation season picked up.
Now is the ideal time to make sure you know your rights when you pass through airport security — and understand exactly what's at stake. The implications go way beyond air travel.
How facial recognition works at the airport
In the US, over 80 airports are currently piloting facial recognition technology. The TSA's goal is to roll out the tech in all of the more than 430 airports that it covers, arguing that this kind of automation would reduce "friction" at airports — meaning, presumably, how long it takes passengers to move through security.
That should raise some eyebrows, because there are known risks with this AI technology, from the possibility that your face data will be stolen due to breaches to the chance that you'll be misidentified as a criminal suspect — and jailed. Neither of these are hypothetical scenarios; the former has happened due to CBP system vulnerabilities and the latter has happened at the hands of police. And then, of course, there's AI bias; facial recognition tech is known to disproportionately misidentify people of color.
But as dangerous as face recognition can be if it goes wrong, a greater concern could be what happens if it's seen to work as intended. When I asked Joy Buolamwini, the founder of the Algorithmic Justice League, what worries her about the use of this tech in airports, she said, "The big one for me is normalizing surveillance."
Buolamwini argued that airport face recognition is a way of acclimating the public to having more and more sensitive information taken. "I see this on a longer trajectory," she said. "And they've shown you the trajectory."
She was referring to a roadmap released in 2018 by the TSA. It distinguishes between two types of facial recognition: There's one-to-one matching, where the TSA compares the photo in your passport with the photo they take of you at the airport, to make sure that the photos match. (If you ever use your face to unlock your iPhone, this is the kind of facial recognition you're using.)
Then there's one-to-many matching, where your image is compared with images of others. One-to-many matching is already in use by CBP and airline partners in that they compare a passenger's photo to a database of government documents (like US passports) for verification, TSA press secretary Robert Carter Langston told me by email.
A particularly worrisome form of one-to-many matching is live biometrics. "Live biometrics is the Minority Report kind of thing — where you're just walking around and they can identify you," Buolamwini said. The TSA's own roadmap says that's what they aim to use in the future. And if everyone's face becomes fair game for live biometrics, your likeness could one day be checked against a criminal database any time you walk through a drug store or show up at a protest, which may create a dangerous chilling effect across society.
In the context of airports, "you might hear people say 'Oh, we're only doing one-to-one matching. You show us your ID, you show us your face, and we delete the data,' Buolamwini told me. But, she stressed, the full story is more complicated.
Do airports really delete your photo after taking it?
The first thing to know is that if you're not a US citizen, you have no guarantee that your photo will be deleted.
In fact, according to CBP documents, "Facial images for in-scope [noncitizen] travelers are also transmitted to the Department's Automated Biometric Identification System (IDENT) and Homeland Advanced Recognition Technology System (HART). All biometrics of in-scope travelers are transmitted to IDENT/HART as encounters and are retained for 75 years in support of immigration, border management, and law enforcement activities."
That means your photo could end up in the database for the rest of your life. What's more, CBP notes that "CBP may share information with federal, state, and local authorities, which may be authorized to use the information for purposes beyond the scope of CBP's mission."
If you're a US citizen, you might breathe a bit easier upon reading on the CBP website, "CBP retains U.S. citizen photos for no more than 12 hours after identity verification, and only for continuity of operations purposes." But even so, there's reason to wonder whether all your data is really deleted after those 12 hours.
When you submit to facial recognition, the tech analyzes a photo of your face and creates what's called a "face print" or "face template." This is not an image — it comes in the form of a series of numbers. You can think of it as your face's metadata.
The problem is, even if airports do delete your photo, that does not necessarily mean they're deleting your face print. And that face print is the real informational gold. Researchers have shown that they can reconstruct an image of your actual face as long as they've got the face print.
I asked CBP what happens to that precious series of numbers — is it ever retained? — but did not receive an answer in time for publication.
If you've already let airports scan your face, is there a point in saying no next time?
Maybe you're in the same situation as me. Maybe you've already let airports scan your face. And maybe you're wondering whether saying no in the future will make any difference, given that your face data is probably already in a database — or two — or three. (Separate from TSA, your individual airline may also scan your face instead of your boarding pass before letting you on the plane, though airlines say you can opt out for domestic flights.)
Buolamwini's opinion? It's definitely still worth declining the face scan next time you fly. "Every opt-out opportunity is a way to vote for your biometric rights," she said.
We've already seen that when there's enough of a public outcry, it can lead to deletion of face data. After Facebook's facial recognition system sparked a class-action lawsuit, government investigations, and public furor, the company ended up deleting the face prints of more than a billion users in 2021.
"Face purges can and do happen," Buolamwini said.
Remember, the TSA's stated reason for rolling out facial recognition in airports is to minimize friction. If you're unhappy about the use of the tech, you can consider generating more friction next time you fly.
—Sigal Samuel, senior reporter
Questions? Comments? Tell us what you think! Email us at futureperfect@vox.com.
And if you want to recommend this newsletter to your friends or colleagues, tell them to sign up at vox.com/future-perfect-newsletter.
