Airport Biometrics: A Primer (2021)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

162 Case Study: Curb-to-Gate Program by CBP and Delta Air Lines at Hartsfield–Jackson Atlanta International Airport Summary CBP’s Curb-to-Gate program is an application of facial recognition with the intent of reducing the number of times passengers must present their form of identification and boarding pass and of increasing the reliability and efficiency of airport border and security operations. The Curb-to-Gate program at ATL as led by CBP and Delta Air Lines allows passengers to verify their identity in a reliable and more efficient manner through leveraging CBP’s TVS: • At check-in/bag-drop, a real-time photo is sent securely and encrypted to TVS. • The incoming photo is matched to a biometric template in a pre-compiled library based on the airline’s passenger manifests. • In case of a positive match, the passenger’s ID is verified, and the use of facial recognition for the rest of the journey is enabled. • At bag drop, security, and boarding, the passenger’s identity and right to entry/passage is verified using facial recognition. • For border crossings, an entry/exit record is made in the ADIS. The benefits of using the Curb-to-Gate program are time savings for passengers and airport personnel, lower operational expenditures for airports, optimization of the use of space through- out the airport, and an opportunity for airports to revolutionize the passenger travel experience. Additionally, Curb-to-Gate significantly reduces the number of physical interactions among airport stakeholders, thereby lowering the probability of transmitting diseases and hazardous pathogens (e.g., COVID-19). Furthermore, this represents a significant milestone in terms of the power of end-to-end facial recognition and demonstrates the capabilities of biometric software (A. W. 2020). See Table E-1 for more information. Introduction In the journey through an airport to an international flight, a passenger has to present pass- port and boarding pass multiple times before getting on the plane. Burdened with carrying cabin luggage, worrying about making their flight, and navigating the airport, this requirement has passengers fumbling with important documents and only adds to the often stressful experience. This application of biometrics aims to take away the need to repeatedly present IDs and boarding passes, limiting it to one time at the start of the journey at the airport (Harper 2018). It also aims to greatly increase the security and efficiency of border and security operations. More recently, this application has also provided for a largely touchless journey, which is safer for all stakeholders traveling through and working at the airport. A P P E N D I X E

Case Study: Curb-to-Gate Program by CBP and Delta Air Lines at Hartsfield–Jackson Atlanta International Airport 163   What? ● Facial biometric template matching ● 1:few biometric matching ● Pilot project led by CBP Where? ● Maynard H. Jackson Jr. International Terminal and Concourse F at ATL Atlanta ● Leased by Delta Passenger process steps ● Curb-to-Gate program (to be expanded later) ● Departures ● Check-in ● Bag drop ● Security (TSA) ● 15 departure gates ● Arrivals ● CBP immigration checkpoint Who? ● CBP led the trials in partnership with ATL, Delta Air Lines, and TSA. The DHS was involved since it manages and oversees access to the biometric information used in CBP’s system. NEC was selected as technology hardware and software provider when it was the first vendor to meet specific technology requirements. NEC products include the NeoFace Express and NEC Enhanced Video Analytics (Beroukhim and Exum 2018). Why? ● CBP’s initial goal was to speed up processing using facial data of passengers who had been previously vetted by various systems. It was important to not re-vet everyone but to use an accurate and reliable system as a verification process for passenger identification and boarding. Stakeholder goals included being able to use the biometrics verification process for non-CBP passenger processing steps (e.g., check-in and replacement of paper boarding passes). The main goals of CBP were to: – Secure – Provide increased certainty as to the identity of travelers at multiple points in the travel continuum, – Simple – Eliminate the need for physical document and boarding-pass checks as well as the collection of fingerprints, – Facilitative – Establish a clear and easily understood process to reduce the potential for major bottlenecks within the air travel process, and – Compliant – Employ a high-integrity biometric entry and exit system that not only increases CBP’s certainty as to the identity of travelers, but also more ably holds accountable those violating terms of admittance (U.S. Department of Homeland Security 2019). How? ● Cameras: tablets, mounted, on-a-stick ● Matching live pictures taken at the checkpoint with preloaded biometric templates ● No collection of biographic data through TVS; pictures kept up to 12 hours ● Systems, databases, and so forth used: – TVS on virtual private cloud (VPC) – APIS – ADIS – DHS Office of Biometric Identity Management – DHS IDENT – ATS-UPAX Enrollment/digital identity creation and verification ● No formal enrollment; TVS already has access to a large database of foreign nationals’ pictures who have traveled to the United States or applied for visa or other permits. ● DHS Office of Biometric Identity Management Table E-1. Key facts of case study on the Curb-to-Gate program by Delta. (continued on next page)

164 Airport Biometrics: A Primer This is achieved by CBP, which leverages its TVS to provide secure, efficient, automated bio- metric identity verification at the checkpoints for Delta (Future Travel Experience 2019a) and the airport as well as for PreCheck-eligible passengers at the TSA checkpoint (TSA 2020a). ATL also hosted one of the earlier versions of TSA’s biometric authentication technology trials, but this is not covered in this specific use case review. Note that an actual passport is still necessary for international travel for identification at the destination countries. TVS is a cloud-based facial biometric matching service that uses U.S. government databases of pictures on file of U.S. citizens as well as foreign nationals who have in the past traveled to the United States. For new travelers, enrollment for Delta’s service is done at the check-in kiosk or airline counter. Storage and retention of pictures sent to the TVS system are minimal, although the TVS system builds on pre-existing U.S. government databases, which keep records of foreigners for longer periods of time. For U.S. citizens, pictures are retained for no more than 12 hours in the TVS system before being purged. CBP temporarily retains facial images of non-immigrant aliens and lawful permanent residents for no more than 14 days. For certain other foreign nationals, pictures after matching are sent to CBP’s IDENT database to update pictures on file and kept there for a maximum of 75 years. For both U.S. citizens and foreign nationals, an entry or exit record is stored, but it contains only the biographic information found in a passport; no pictures are in those records. Furthermore, no pictures are stored on the local camera devices themselves by NEC. Airlines and airports are prohibited from keeping pictures of their passengers. The accuracy of the match- ing is high (99%), and the sending of data is regarded protected due to the secured connection between the NEC systems and TVS and due to the encryption of the pictures before they are sent. The main benefits are significant time savings for passengers, and space and resource savings for airports and airlines. The system architecture is technology agnostic and, thus, allows for multiple hardware suppliers to develop specific solutions for airports. How Does It Work? Before the Passenger Journey Several U.S. government databases are essential elements of the system behind the Curb-to- Gate program at ATL by CBP. CBP’s TVS and its API are the systems that interact with private third parties’ devices. The most important databases are briefly introduced here: • HART (follow-up system for IDENT): The HART system is a centralized, DHS-wide bio- metric database that contains limited biographic and encounter-history information. The system will replace IDENT for the storage and processing of biometric and associated biographic information for national security, law enforcement, immigration and border Verification of identity how? ● Facial biometric is collected when applying for a passport/visa or during entry/exit of United States; verification matches biometric template of unique IDs of the pictures on file with a picture taken at the passenger checkpoint, which is sent encrypted to TVS. For? ● International flights with Delta or partners Air France-KLM, Aeromexico, and Virgin Atlantic ● To be expanded to U.S. domestic flights in subsequent steps in the program Table E-1. (Continued).

Case Study: Curb-to-Gate Program by CBP and Delta Air Lines at Hartsfield–Jackson Atlanta International Airport 165   management, intelligence, background investigations for national security positions, and other administrative uses. • IDENT: The DHS database for the Automated Biometric Identification System that has, since 2003, collected pictures, fingerprints, and basic biographic data (e.g., passport information) of non–U.S. citizens who have traveled to the United States (Thales 2021). • DOS database of passport photos and visa applications. • APIS: A collection information, supplied by the airlines, of all passengers flying from U.S. airports. • ADIS: CBP’s system that keeps track of all entries/exits of U.S. citizens as well as foreign nationals; relating to visas. • FBI NGI: The FBI’s system for fingerprints, formerly known as the Integrated Automated Fingerprint Identification System. • ATS-UPAX: This module system is a decision-support tool that is operated by DHS CBP; it combines data from numerous U.S. databases for passenger vetting. • VPC: The firewalled virtual network on which the TVS system runs. The TVS database and software are hosted in the United States on Amazon Web Services (dubbed the Gov Cloud), a version of Amazon Web Services that is designed to be able to host sensitive data and regulated workloads, and to address the most stringent U.S. government security and compliance requirements. Prior to the passenger’s journey, CBP’s TVS system uses information from passenger booking information in the APIS database to create manifests (lists) of passengers that are expected to travel that day in its VPC. The TVS system preloads verified biometric templates of the passengers’ pictures into the traveler manifests. A biometric template is a digital representation of a biometric trait of an individual generated from a picture and processed by an algorithm. The template is usually represented as a sequence of characters and numbers comparable to a long string of letters and numbers. The source for the biometric templates is DHS’s decision-support tool called the ATS-UPAX, from which existing pictures are downloaded and converted into biometric templates. The pictures downloaded from ATS-UPAX are not stored in the TVS system. ATS-UPAX sources pictures from multiple databases, such as the DHS’s database IDENT and the Department of State’s database of passport and photos of U.S. citizens and foreign nationals, but potentially from several other intelligence databases. The Passenger Journey 1. At check-in/bag-drop, a real-time photo is made by NEC hardware (NEC 2020) with integrated cameras and sent securely and encrypted to the TVS matching service through the API. 2. In the TVS cloud service (VPC), the incoming encrypted photo is matched to the biometric templates in the relevant traveler manifest. 3. If a positive match is made, the passenger is verified, and the use of facial recognition for the remainder of the passenger journey is enabled (Today.com 2020). With a positive bio- metric match within the right manifest, the passenger record in the manifest is updated from “reported” to “confirmed.” 4. At subsequent passenger process touchpoints (bag drop, security, and boarding), the passenger’s identity and right to entry/passage are verified using facial recognition and matched with the corresponding specific traveler manifest (Baran 2020). 5. In the case of a border crossing, an entry or exit record consisting of only the biographic infor- mation from the passenger’s passport is created or added to the pre-existing record and retained in the ADIS.

166 Airport Biometrics: A Primer 6. In case of no match or if the passenger wishes to opt out of this process, a manual verification of the identity is done at each checkpoint. Pursuant to CBP inspection, the manual ID check is followed by a check of eligibility to enter/exit the United States (Murph 2018). Retention and Storage Storage and retention of pictures sent to the TVS system is minimal: • No pictures are stored on any of the airports’ or airlines’ devices supplied by NEC. These only take the picture, encrypt the file, and immediately send it to the TVS through the API over a secured connection. Airlines and airports are prohibited from keeping pictures of passengers. • For U.S. citizens, pictures are kept up to 12 hours in the TVS system (Patterson and Russell 2018). • During the initial trial period, pictures of U.S. citizens and foreign nationals were kept in the ATS-UPAX for up to 14 days for the evaluation of the technology. This is no longer the case. • For foreign nationals, pictures are sent to CBP’s IDENT database after matching to keep the records’ pictures up-to-date and current. These records are kept for a maximum of 75 years. • For U.S. citizens and foreign nationals, an entry or exit record is stored in ADIS. This record contains only the biographic information found in a passport; no pictures are in this record. System Architecture Flow Diagram The flow diagram of this case study can be found in the Curb-to-Gate Program by CBP and Delta Air Lines at Hartsfield–Jackson Atlanta International Airport case study in Chapter 2. Stakeholders and Responsibilities CBP took leadership of the (pilot) project, partnering with Delta, ATL, TSA (TSA 2020b), and NEC to trial the TVS system on broader application use over multiple passenger check- points. This curb-to-gate trial followed several earlier pilot programs and built on CBP’s earlier Departure Information System Test pilot and Departure Verification System (both in 2016). Stakeholders The main stakeholders of the Curb-to-Gate program are Delta Air Lines, ATL, TSA, NEC, and other SkyTeam partner airlines (AF-KLM, Aeromexico, Virgin Atlantic) (Mutzabaugh 2018). In an interview, CBP reiterated the importance of carrier buy-in from the onset and throughout the development and entire period of the program (personal communication). Responsibilities and Governance CBP was the main driver of the program, and the main requirements of the pilot were dic- tated by the CBP. After various collaborative discussions with several organizations, CBP took the lead on moving the project forward to establish a strategic pilot project. As the task and goals were outlined and agreed on, subject-matter work groups were formed (e.g., in data systems and information technology) and decided on protocols. For CBP, Delta Air Lines, and ATL, officials were designated and provided guidelines and project goals. Timeline and Planning Interviews with CBP revealed that multiple timelines were based on individual workgroup task capabilities. Weekly updates were established as the working groups progressed with the pilot projects, implementations, evaluations, and next steps.

Case Study: Curb-to-Gate Program by CBP and Delta Air Lines at Hartsfield–Jackson Atlanta International Airport 167   Procurement and Vendor Selection: NEC NEC was the first vendor to demonstrate the capability to meet the biometric facial technical requirements for all the vested partners. Delta volunteered to pilot the biometric process at its ATL operational hub. Case Study Review Benefits For passengers, an average reduction of 7 to 9 minutes was accomplished when adding up all the time savings at the passenger checkpoints that used the facial-recognition technology (Burt 2020; Linder 2020). Passengers also do not have to reach for and hand over their passports and boarding passes on several occasions, making the passenger checkpoints much less of a hassle and preventing possible transmission of communicable diseases through closer contact and interaction. For the airport, airline, TSA, and CBP, the faster processing times through checkpoints mean a possible reduction of staffing, space, and other resources required for a similar throughput. This allows for expansion of throughput in the current assigned areas or freeing up of space for other uses. More specifically, CBP reported the benefits shown in Table E-2 in its August Report of 2019 (U.S. Department of Homeland Security 2019). TVS is technology agnostic and comes with a range of tools (the API) for integration with stakeholder/partner technology for capturing facial biometrics. This means that other suppliers of the hardware and software (NEC) can be chosen, or the software can be developed in parallel. The 1:few matching greatly improves matching speed and accuracy over the use of other large U.S. databases. With respect to privacy, the pictures are encrypted before uploading to the cloud, where they are transformed to a biometric template: only the unique IDs are stored, and only for a short period of time. Pictures uploaded by the airline/airport are compared to the biometric tem- plates, and only a positive/negative match is returned. This means no actual pictures are stored in the TVS database. The process and flow of information are well defined for sharing of pictures for traveler verification as well as other information flows, because they have been analyzed by the Office of Improved business process ● An enhanced entry/exit business process that integrates within existing government and stakeholder business models Stronger relationships ● An environment that allows CBP and stakeholders to work together and that allows for further airline modernization A positive impact on inbound security and throughput ● Enhanced inbound security and more efficient throughput Improved traveler experience ● An overall enhanced traveler experience Improved data integrity ● Use DHS enterprise biometric repositories provided to ensure accurate biometric identity records Enhanced Visa overstay enforcement ● Support the ID and tracking of Visa overstays by closing information gaps associated with current exit reporting capabilities, allowing for improved enforcement action Table E-2. CBP strategic benefits.

168 Airport Biometrics: A Primer Biometric Identity Management in its PIA. These PIA reports are available to the general public to read, greatly benefiting the digital transparency of the system. For the CBP, the automated process lets the CBP officers focus on high-risk travelers, or even undocumented travelers, which aids the CBP with its border protection mandate. Responses from Passengers Feedback from passengers has been positive; according to passenger surveys performed during the pilot project, only 2% opted out of the process; 93% of customers had no issue using the technology at boarding (Steele 2019), and 72% found it more preferential than previous processes (Yamanouchi 2019a; Yamanouchi 2019b). System Performance and Specifications Review According to a CBP report of August 2019, attained online (U.S. Department of Homeland Security 2020), the accuracy of the facial-recognition matching was in the high 90s, and improvements in the technology have led to much lower false positives and false negatives. The matching rate was running at 97% to 99% according to CBP, as can be seen in the results from the August 2019 Report (U.S. Department of Homeland Security 2019) shown in Table E-3. The estimated false positive rate based on the internal CBP analysis is 0.0103%, which is within the established key performance indicator (KPI) target of less than 0.1%. Fall-Back Options For those passengers who do not wish to take part in the Curb-to-Gate program [at the time of writing about 2% (Pitrelli 2020)], there are opt-out possibilities. This will mean having staff do manual verifications of identity as well as boarding-pass/passport checks. Power cuts or system integrity failures can seriously hamper the operation of the passenger identity vetting system, as is the case with any computer system. Luckily, with the main system running in the cloud, this process can be hosted in a multitude of physical locations, thus protecting it from interruption. Similarly, mobile devices in the airport used at the passenger checkpoints can run software independently and on battery power, maintaining an encrypted connection, so that in the event of a loss of power, these devices can continue operation. The latest update from the traveler manifest should allow for continued operation, at least for those who are positively matched in the TVS system. Manual ID verification in the case of a negative match is more difficult at CBP since this requires connection to DHS/DOS for formal ID query. Modality Number of Locations Flight Count Number of Travelers Technical Match Rate Air entry 11 446 34,716 99.2% Air exit 16 92 11,545 97.6% Air preclearance 4 45 6,559 99.4% Table E-3. Facial-recognition performance report, August 2019 (U.S. Department of Homeland Security 2019).

Case Study: Curb-to-Gate Program by CBP and Delta Air Lines at Hartsfield–Jackson Atlanta International Airport 169   Concerns Media attention has raised concerns on the implementation of biometrics in four main categories: 1. Use of technology for (mass) surveillance, 2. Privacy, 3. Transparency, and 4. Technology standards. Use of Technology for (Mass) Surveillance The fear that facial-recognition technology will allow for mass surveillance of the public has seen media attention around the world, especially as some countries have implemented just that. The goal of the Curb-to-Gate program and its (system) design prevent this capability. CBP specifically states that TSA is not evaluating the use of facial comparison for law enforcement purposes; it is assessing its use for traveler identity verification as part of its mission to protect the nation’s transportation systems to ensure freedom of movement for people and commerce. In the execution of the system, there are no means that allow, in this case, federal authorities to access the camera systems, and all the system does is generate automatic versions of the entry/ exit reporting for which CBP was already keeping records. Privacy Privacy concerns (Hautala 2019) for any system that handles biographic or biometric personal information include misuse or loss of that information when collected, used, or stored. To counter privacy concerns, in the design of the TVS, CBP has implemented a privacy-by-design approach to ensure that privacy protections are embedded into its use of facial comparison tech- nology. CBP employs four primary safeguards to secure the data: secure storage, brief retention periods, irreversible biometric templates, and strong encryption during data storage and transfer. On top of that, CBP has submitted a number of PIAs (Kaplan 2018) on related pilots and programs to the DHS Privacy Office for adjudication and publication. These use the FIPPs to assess and mitigate any impact on an individual’s privacy. These principles are rooted in the Privacy Act of 1974 and govern the use of personal information. One example of the principles of privacy by design is showcased in the case of a data breach. If the TVS database were to be hacked, only the biometric templates that are stored in the database would be susceptible to theft. These are worthless because they cannot be recreated to biometric facial pictures without the software and codes used to make the template in the first place. Transparency When interviewed, CBP stressed the need to mitigate privacy concerns with outreach and openness. CBP provides transparency and general notification to the public through program information, such as frequently asked questions, available on the CBP website and the TVS PIAs and SORNs published on the Department of Homeland Security website. The PIAs and SORNs for the TVS and its predecessor projects explain all aspects of CBP’s biometric entry/exit pro- grams, including policies and procedures for the collection, storage, analysis, use, dissemination, retention, and deletion of data. Technology Standards System performance depends highly on adequate hardware and software roll out, in which case standards for the technology can protect against malfunctioning, misinterpretation, or other issues that may arise. One issue that has gained attention in the media is the reported bias in some demographic groups, as per NIST in 2018 (Grother et al. 2018). Another worry with

170 Airport Biometrics: A Primer facial-recognition technologies is that camera images are not of high enough quality, which can have an impact on the accuracy of the match. Because data privacy, protection, and mitigation of algorithmic or operational bias are prime concerns, CBP actively makes improvements while seeking to ensure that there are no signs of bias and also engages in a robust public dialogue on appropriate standards. CBP also conducts outreach to privacy advocates, the NIST, and the DHS Science and Technology Directorate (S&T) to monitor performance and progress. Lessons Learned According to an interview with CBP, several lessons learned were important in the develop- ment of the program and its continuation to the next phases: • Initially, there was skepticism and concern from potential end-users and stakeholders about the cost of equipment, programming, and training. Through discussions and joint planning, all parties were able to establish and implement mutually beneficial goals. • Initially, there were various levels of government and private-entity scrutiny regarding government biometric and facial data collection and storage. CBP emphasized the impor- tance of not replicating the vetting process and, for privacy reasons, not storing data. This proved beneficial in further privacy assessments. • It was important to have airline and airport approval to access relevant company data and systems. • It was important to allow subject-matter working groups to leverage expertise and focus on the immediate needs by not being too rigid in timelines and processes. At times, there was trouble visioning the end result among stakeholders, which resulted in some inflexibility. By including willing partners at the operational decision-making table, continued progress was possible, and a collaborative effort for a continuous focus on future enhancements was established. • It was important to ensure that acquisition groups were in sync with implementation requirements. This expectation management was key for tracking progress and updating time- lines for pilot programs. Findings and Trends Findings The development of (federal) national standards to govern the use of biometrics in facial recognition for verification/identification is considered beneficial for: • Picture quality and method of sharing, to further improve matching accuracy and speed; • Method of encryption, and secure connection, to ensure further protection from digital threats such as hacks; • Use of biometric (templates) regarding capture, use, and storage; • Synthesis of lessons learned/recommendations from PIA to further privacy commitments enacted (e.g., storage and retention durations); and • Information and transparency: Informing users and passengers of system functions and how these work in a campaign to gain trust and dispel negative media attention. Starting in 2018, DHS S&T has performed independent biometric analyses using a sample of operational TVS probe and gallery facial images. Based on these analyses, DHS S&T made specific recommendations to CBP: • Ensure that only ticketed travelers are allowed to use TVS for boarding or to increase match thresholds used for biometric exit; and

Case Study: Curb-to-Gate Program by CBP and Delta Air Lines at Hartsfield–Jackson Atlanta International Airport 171   • Carry out an exhaustive “Virtual Red Team” analysis to calculate the risk of false matches based on the demographics (age, country of origin, gender) of travelers on individual flights (U.S. Department of Homeland Security 2019). Future Situation and Broader Implementation The success of the Delta Air Lines ATL Curb-to-Gate program gave rise to implementation of TVS at numerous other airports in the United States (Steele 2020). In 2018, the entry process using facial comparison was reengineered and deployed in the air entry environment at 15 air- ports, including four preclearance locations, with plans to expand further in 2019. From recent reports by CBP regarding the next steps for further pilot programs/implementation of the TVS system, the following can be expected in the (near) future: • Expansion of the program to domestic flights in the United States. • Expansion of the trial to transferring passengers. • By 2022, deployment of biometric exit using TVS to the top 20 airports, which account for more than 97% of commercial air travelers departing the United States. • Full certification/integration with simplified arrivals and biometric entry/exit. • Mass implementation: All passenger processes, including all transfers (rescreening and CBP immigration), will have the option for use of facial recognition. • Development of standard process for CBP and TSA. • Guidance related to required opt-out possibilities for passengers. • Development of guidance on how TVS is potentially an enabler for the Flexible Facilitation Model, where mixing of, for instance, domestic and international passengers is possible without physical separation of the two passenger flows with terminal partitions (U.S. Depart- ment of Homeland Security 2019). Besides these, CBP is actively working to expand stakeholder partnerships and adoption and is prioritizing the highest volume of international airports and carriers to achieve the biometric air exit implementation goal. CBP continues efforts to find innovative ways to use TVS with mobile phones, tablets, and watches. CBP will look to expand partnerships with international airports and governments and to further expand capabilities in preclearance locations to con- tinually improve security and facilitation of traveler processes. Trends Identified This specific use case has shown the possible success of a seamless passenger journey through several checkpoints manned by different airport stakeholders (airline, customs, security). Trends identified relate to: • Touchless touchpoints reduce the risk of transmission of communicable diseases as well as increase speed and ease of travel. • There will be end-to-end integration of digital identity management throughout the passenger journey. This will continue even beyond the scope of the airport. All journey touchpoints will use biometrics, from booking to arriving at a hotel/destination, across different modes of transport, and using different suppliers of services (taxi, baggage pickup, airport, airline, security, taxi, hotels, etc.). • The system provides incentives for passengers to use it because it allows for more ease of use, faster processing, and less hassle with official documents.