Airport Biometrics: A Primer (2021)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

131   Glossary Specific Terms Explained in Relation to One Another For the definitions and differences between the terms Authentication, Detection, Identifica- tion, Matching, Validation, and Verification, see the Fundamentals of Biometrics section of Chapter 1. Relating to sensitive and personal information, the following classifications exist: Personally identifiable information (PII) – Information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual, regardless of whether the individual is a U.S. citizen, legal permanent resident, visitor to the United States, or employee or contractor of the Depart- ment of Homeland Security. Sensitive personally identifiable information (SPII) – Personally identifiable information that, if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Sensitive personal information (SPI) – Information that does not identify an individual, but is related to an individual, and communicates information that is private or could potentially harm an individual should it be made public. General Terms Artificial intelligence – A branch of computer science dealing with the simulation of intel- ligent behavior in computers. Bias – Systematic error introduced into sampling or testing by selecting or encouraging one outcome or answer over others. Biographic data – Information describing non-physical characteristics of a person (e.g., name, date of birth, and place of birth). Biometric data – Information describing physical characteristics of a person (e.g., height, color of eyes, fingerprints, or a photo). Biometrics – The measurement and analysis of unique physical or behavioral characteristics (such as fingerprint or voice patterns), especially as a means of verifying personal identity. Biometric template – A record of data that is created by encrypting biometric information through cryptography, creating a random sequence of numbers and letters. A biometric template cannot be reverted to its original form; it is a one-way method of encoding data.

132 Airport Biometrics: A Primer Biometric touchpoint – A dedicated area where a person can get his/her identity verified by showing a biometric credential (e.g., face) to a camera and, after identification, perform opera- tions in or interact with a specific airport system. Blockchain technology – A digital database containing information (such as records of financial transactions) that can be simultaneously used and shared within a large decentralized, publicly accessible network. Border search exception – A Supreme Court–recognized exception to the Fourth Amendment in U.S. law that allows searches and seizures at international borders without a warrant or probable cause. Bypass – When biometric data are tampered with post-capture, or when the camera is bypassed altogether. Cashierless – The use of a self-service checkout kiosk (as in a store) to handle monetary transactions. Central processing unit (CPU) – The component of a computer system that performs the basic operations (such as processing data) of the system, that exchanges data with the system’s memory or peripherals, and that manages the system’s other components. Credential – An object or data structure that authoritatively binds an identity—via an identifier or multiple identifiers—to at least one authenticator possessed and controlled by a subscriber (passenger or airport staff). Credential Authentication Technology – A TSA technology that ensures ID authentication, reservation verification, and Secure Flight pre-screening status at airport security checkpoints. Cybercrime – Criminal activity (such as fraud, theft, or distribution of child pornography) committed using a computer, especially to illegally access, transmit, or manipulate data. Cybersecurity – Measures taken to protect a computer or computer system (as on the Internet) against unauthorized access or attacks. Dactyloscopic identification – Identification by comparison of fingerprints. Database – A large collection of data organized especially for rapid search and retrieval (as by a computer). Data packet switching – A method of transmitting data over a digital network by grouping it into smaller packets of data. Designated aviation channeling (DAC) – A service in the aviation industry that supports conducting required background checks of employees in the sector, thereby ensuring safety and security. Digital identity – A digital version of one’s identity and the distinguishing character or person- ality of an individual. Digital Trust in Places and Routines (DTPR) – Formerly Digital Transparency in the Public Realm, DTPR is an open-source initiative by Helpful Places that aims to promote an open- source communication standard to enable transparency, accountability, and control for people. Distributed ledger (blockchain technology) – A mechanism for storing data, replicated numer- ous times and in a synchronized manner, geographically spread across multiple computers in different locations. A consensus of all the computers is kept current, making unwarranted mutations (e.g., a cyberattack) of the data generally impossible.

Glossary 133   E-passport – A formal document issued by an authorized official of a country to one of its citizens that is usually necessary for exit from and reentry to the country, allows the citizen to travel to a foreign country in accordance with visa requirements, and requests protection for the citizen while abroad. EU-U.S. Privacy Shield program – A framework designed by the U.S. Department of Com- merce and the European Commission to provide companies on both sides of the Atlantic with a mechanism to comply with data protection requirements when transferring personal data from the European Union to the United States in support of transatlantic commerce. Fair Information Practice Principles (FIPPs) – FIPPs are five main guidelines published by the FTC that represent widely accepted concepts concerning fair information practice for privacy protection in the electronic marketplace. Global Entry – A CBP program that, on arrival in the United States, allows expedited clearance for enrolled members who are pre-approved, low-risk travelers. Health passport – Similar to a passport, a health passport contains biographic (and biometric) data as well as important health information such as the results of certain tests, vaccinations, and specific medical conditions. Interoperability – The ability of a system (such as a biometric system) to work with or use the parts or equipment of another system. Known Traveler Number – A number issued by the TSA, DHS, or DoD that indicates that a passenger has undergone a pre-flight background check or other screening before checking in for a flight. Machine learning – The use and development of computer systems that are able to learn and adapt without following explicit instructions by using algorithms and statistical models to analyze and draw inferences from patterns in data. Mass surveillance – A form of indiscriminate surveillance that uses systems that collect and analyze surveillance footage with the intent of identifying people for a specific purpose or range of purposes. NEXUS – A voluntary program designed to speed up border crossings for low-risk, pre-approved Canadian travelers into the United States. OneID – A concept by IATA that aims to promote robust, integrated identity management across the end-to-end passenger process and allows individuals to assert their identity online or in person. Opt in – To voluntarily choose to participate. Passenger journey – In this primer, the trip from an origin to a final destination. PreCheck – A TSA program that lets eligible, low-risk travelers enjoy expedited security screening. Preclearance – A program that allows passengers and their bags to be inspected and cleared at a foreign airport by U.S. CBP officers prior to travel to the United States. Privacy by design – A set of seven principles in system or process design that advance the view that privacy assurance should ideally become an organization’s default mode of operation and be incorporated from the start of the project. Rap back (FBI) – Refers to the notification returned to an organization when an employee who has undergone a fingerprint-based state or federal criminal history record information check has a subsequent state or federal criminal history event.

134 Airport Biometrics: A Primer REAL ID – Pursuant to the REAL ID Act, Pub. L. 109-13, Congress mandated minimum security standards for drivers’ licenses and identity documents and prohibits federal agencies from accepting “for any official purpose” state driver’s licenses or identification cards unless those documents meet the standards set forth therein. Pub. L. 109-13 Title II Sec. 201 (3); REAL ID Act, Pub. L. 109-13, Sec. 202(a)(1). Reasonable expectation of privacy – A person’s reasonable expectation of privacy generally implies that someone who unreasonably and seriously compromises another’s interest in keeping his or her affairs from being known can be held liable for that exposure or intrusion. Risk profiling – In the aviation world, the screening of passengers within a specific framework and aiming to address security risks. Seamless – Having no awkward transitions, interruptions, or indications of disparity. Self-sovereign identity (SSI)– Recognition of the requirement that individuals own and control their identity without the intervention of an administrative authority. Special needs exception – An exception to the Fourth Amendment requirement that govern- ment searches be supported by a warrant and probable cause that allows government searches that are primarily aimed at advancing some special need other than criminal law enforcement (e.g., security checkpoint searches) if the search program is reasonable given the balance of public and private interests. Single sign on – An authentication scheme that allows a user to log in with a single set of login credentials, such as a username and password, to access multiple independent applications. Spoof – A nonliving object that exhibits human traits (an artifact) that is presented to a camera or biometric sensor. Supremacy Clause – A provision in the U.S. Constitution that establishes that the Constitution and federal laws take priority over any conflicting state laws. Touchpoints – Points of contact or engagement between a passenger and a business (e.g., airline, TSA, concessionaire) that can occur at any time throughout a passenger’s journey. Transportation network companies – Businesses that provide prearranged transportation for compensation using an online-enabled application or platform (such as smartphone apps) to connect drivers using their personal vehicles with passengers. Trusted traveler – A passenger who is a member of a risk-based program (e.g., Global Entry, TSA PreCheck, SENTRI, NEXUS, and FAST) to facilitate the entry of pre-approved travelers. VeriFLY – Allows a passenger to verify the required credentials necessary to obtain a valid pass that will enable access to a service where a person must be physically present.