Biometrics at the border

Editor's note: The following text is a transcript of a podcast story. To listen to the story, click on the arrow beneath the headline above.

NICK EICHER, HOST: Coming up next on The World and Everything in It: Biometrics and borders.

Europe is launching a new security system that scans faces and fingerprints from non-citizens at all of its border crossings.

MARY REICHARD, HOST: The US is close to completing a similar program. The US Customs and Border Protection says it’s finalizing its biometric exit program, in the works for nearly 25 years.

Why are governments updating their systems now, and do travelers have a reason to worry about how their data is used? WORLD’s Mary Muncy reports.

MARY MUNCY: On October 12th, the first EU airports started using their new biometric data collection kiosks.

EU COUNCIL: New rules are coming for non-EU citizens traveling to the EU.

The EU Council shared this informational video on Instagram.

EU COUNCIL: It replaces the old passport stamping with a fast and safe digital check-in. The new system will help police and border guards track who comes in and out of the Schengen area and spot overstays.

The Schengen area includes most European countries plus Iceland, Liechtenstein, Norway, and Switzerland, and allows passport-free travel within the zone.

The kiosks collect a traveler’s photo and fingerprints and ask a few questions, border agents still stamp passports for now, but the government is planning on phasing that out by April.

The EU has been working towards implementing this system since 2017, when the bloc recorded the most terrorist attacks in the last 15 years. About half of those arrested on suspicion of planning an attack were non-citizens.

VAUGHAN: The governments of Europe very much want to bring their system into the 21st Century.

Jessica Vaughan is the Director of Policy Studies at the Center for Immigration Studies.

VAUGHAN: There have been too many bad actors who have been able to exploit weak immigration controls and carry out terrorist attacks, organized crime, or even simply abuse immigration laws.

The EU is not the only one leveraging the technology. The U.S. started collecting biometric data upon entry after 9/11, and last month, the Department of Homeland Security issued an order to implement exit tracking at every crossing by December 26.

Now, as a traveler boards an airplane out of the U.S. or approaches a land border, they’ll find a camera or a border agent taking photos of every person leaving the country. Citizens’ data is supposed to be deleted within 12 hours.

Vaughan says the biometric data collection changes are happening now because the technology has progressed.

But critics say these systems don’t do enough to protect non-citizens' privacy.

NIOVI VAVOULA: This system essentially entails mass surveillance of huge numbers of travelers.

Niovi Vavoula is an associate professor of cybersecurity at the University of Luxembourg.

What governments do with the data varies. The EU says it will hold it in a central database for three years, five years if a traveler overstays their visa.

VAVOULA: Overall, there are reasons to believe that there are risks to data protection, because the data can be used for various purposes, not only for immigration purposes, but also for law enforcement and police authorities or even intelligence services may have access to the data.

Vavoula worries that law-abiding travelers or asylum seekers are being surveilled without due cause.

The system and rules are similar to the biometric border regulations that the U.S. and Australia have had in place for years, with one big exception: the U.S. keeps non-citizens' data for much longer, up to 75 years.

BROWN: We don't always know if somebody's a person of concern when they enter the United States, and we may find out information later.

Theresa Brown is a senior advisor at the Bipartisan Policy Center, and was the Director of Immigration Policy at the US Chamber of Commerce from 2001 to 2005.

THERESA BROWN: Our privacy laws are first and foremost for protection of U.S. citizens' privacy data.

In contrast, Europe’s privacy protections extend to non-citizens, though they’re not as strong.

GIANCLAUDIO MALGIERI: Europe starts from forbidden unless justified, while the U.S. starts from allowed unless restricted.

Gianclaudio Malgieri is an associate professor of law and technology at Leiden University. He says the difference in values is especially apparent in the private sector.

MALGIERI: The protection in the U.S. is a bit of a patchwork. I would say that the most advanced protection is the Illinois BIPA, which is the toughest law, but applies just to Illinois.

The Biometric Information Privacy Act, requires companies to gain consent before collecting or storing biometric data. Some other states, like California and Texas, have similar laws, but as of March, only 13 states have proposed or implemented privacy protections.

And this leaves the door open for abuse.

For example, within the past five years, Meta has settled lawsuits in Texas and Illinois over their use of biometric data—costing the company more than $2 billion dollars combined. The lawsuits allege that Meta didn’t get consent to collect users’ data for a now-discontinued feature that used AI to find photos a user might be in.

The Texas suit claimed that Meta then sold that biometric data to third parties and didn’t destroy it within a “reasonable time.”

Malgieri says biometric data in the hands of an unconstrained government could be worse than data going to a third party company.

MALGIERI: The general problem with biometrics is that we don't we usually don't choose our biometrics. We cannot change them. They follow us everywhere.

If your data is connected to something the government deems a concern, it would be hard to correct the issue.

Malgieri says that this should add an extra layer of pressure on governments and companies to use that data properly and keep it secure.

Cybersecurity professor Niovi Vavoula says she’s going to be watching the EU rollout over the next few months. She wants to see exactly how the EU’s plans to balance privacy and security take shape in actuality.

NIOVI VAVOULA: We will have to wait and see how it plays out in terms of data, in terms of how individuals interact with the system, and what problems they may have in the future in entering and exiting.

Reporting for WORLD, I’m Mary Muncy.

WORLD Radio transcripts are created on a rush deadline. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of WORLD Radio programming is the audio record.