DHS Inspector General finds TSA facial recognition data security weaknesses

An audit by the Department of Homeland Security Office of Inspector General (DHS OIG) has identified significant privacy and oversight weaknesses in the TSA's facial recognition processes. The report found that the vendor for Credential Authentication Technology 2 (CAT-2) was able to extract sensitive information, such as passport and driver's license images, during system maintenance without TSA's knowledge. The agency currently lacks sufficient policies to track data extraction or verify the deletion of such information.

Audit findings on CAT-2 oversight

• The vendor for CAT-2 accessed and extracted sensitive passenger data, including driver's license and passport images.
• TSA lacked mechanisms to track when data was extracted by the vendor.
• There was no way to verify if extracted information was properly deleted after troubleshooting.
• The agency failed to notify passengers when biometric and biographic information might have been stored.

Why it matters

The findings highlight the privacy risks inherent in government-managed biometric surveillance systems and the dangers of insufficient vendor oversight.