CBP Proposes Eliminating Age Restrictions and Opt-Out Policies for Non-Citizen Biometric Data Collection

A new Customs and Border Protection rule would allow the agency to move ahead with the implementation of its biometric entry-exit program while eliminating age restrictions and the ability to opt-out of the agency’s facial recognition system for non-citizens, according to a proposal filed in the Federal Register. 

The proposed rule aims to “advance the legal framework” for the Homeland Security Department’s biometric entry-exit system, according to a document that will be published in the Federal Register Thursday. The main changes in the rule eliminate language preventing CBP from expanding its program beyond pilots and to more than 15 air and seaports, thereby permitting collection of biometric data from exiting non-citizens at any authorized departure location. But other regulatory adjustments in the rule leave the door open for CBP to expand its biometric collection practices. 

The notice was filed just over two months after U.S. Citizenship and Immigration Services published a controversial rule proposing the agency—and potentially CBP and Immigration and Customs Enforcement as well—should be able to collect more types of biometric data from more people. That rule garnered thousands of comments in response and a letter from five senators calling the rule an “unacceptable escalation of government surveillance.” The five senators are also co-sponsors of a bill that would ban government use of facial recognition and other biometric technologies. 

“The proposed regulatory changes are necessary to enable CBP to continue its testing of a comprehensive biometric entry and exit program and implement permanent DHS programs efficiently,” a spokesperson for CBP told Nextgov in an email. “Under the current regulations, CBP can only conduct pilot programs at a limited number of air and seaports of entry and may only collect biometrics from a limited population.” 

The new CBP rule proposal mirrors some of the changes put forth in the USCIS rule. Both seek to eliminate age restrictions for biometrics collection. Previous regulations prohibited the collection of biometric data from individuals under the age of 14 or over the age of 79. CBP attributed the prohibition to a lack of adequate technology.

“This will enable DHS to associate the immigration records created for children to their adult records later, which will help combat trafficking of children, and confirm the absence of criminal history or associations with terrorist or other organizations seeking to violate applicable law,” the CBP proposal reads. 

While the USCIS rule proposes expanding biometric modalities to include a wider range of technologies, the new CBP rule proposal appears to affirm CBP is currently only using facial recognition technology as part of its biometric entry-exit program. 

But the new rule explicitly notes CBP may expand into new modalities in the future. The rule proposes amending prior regulations to give CBP the authority to require non-citizens to “provide other biometrics” at ports. CBP told Nextgov it does not have plans to expand into new modalities at this time. 

“CBP has tested iris technology, for example, but biometric technology continues to advance and there may be other biometric options that may have potential for implementation in the future,” the proposal reads. CBP in the rule said it found fingerprint and iris scans to be more intrusive than facial recognition technologies and present more privacy concerns in addition to other difficulties relating to using these modalities for exit. 

CBP also argues giving travelers the ability to opt-out of the biometric entry-exit system mitigates privacy concerns because people who don’t want to participate can flag a CBP officer and present themselves for manual identity verification. But that option will only be available to U.S. citizens under the new rule. 

“Under the proposed rule, alien travelers would no longer be able to opt out,” the proposal reads. “Alternative procedures would only be available to U.S. citizen travelers.”

To explain the reasoning behind eliminating opt-out procedures for non-citizens, CBP referenced the statutory mandates including those born from the work of the National Commission on Terrorist Attacks Upon the United States, known as the 9/11 Commission. The mandate requires CBP to “biometrically record all foreign nationals who enter and exit the United States,” according to CBP. 

While CBP quickly stood up a biometric entry system at all ports of entry, setting up exit has been a far greater challenge, largely because of logistics and infrastructure issues. After years of testing, CBP has settled on facial recognition technology, which will be implemented for exit first at commercial airports and will be eventually incorporated in entry for a more “streamlined” process as well. CBP expects the program will be fully implemented at all commercial airports of entry within the next three to five years, according to the rule proposal. 

But pilot programs for biometric entry-exit have not gone off without a hitch. In 2019, CBP suffered a major privacy breach when a subcontractor working on a facial recognition technology pilot transferred CBP biometric data to its own network and subsequently experienced a malicious cyberattack. More than 180,000 traveler images were compromised in that incident, according to a DHS Office of Inspector General report published in September. 

The Government Accountability Office also published a DHS audit in September, which described inadequate privacy practices by CBP. According to the audit, CBP neglected to provide complete and accurate privacy notices and conduct appropriate audits to ensure the agency’s facial recognition technology used for identity checks comply with privacy standards.

The Homeland Security Advisory Council determined DHS needs to improve its process for approving new or novel uses of biometric technologies in a report the council approved last week. While the council was complimentary of DHS’s facial recognition technology solution, it found the agency doesn’t always develop and execute appropriate communications and outreach plans when it wants to implement new biometric capabilities.

The public has 30 days to respond to CBP on this latest biometrics rule proposal, according to the document that will be published in the Federal Register Thursday. 

This article was updated with comments from CBP.