HOW DOES THIS WORK?

Just before departure, international travelers’ photos are taken, by either CBP-owned cameras or equipment provided by the airlines or airport authority. CBP compares these photos with existing images from passports, visas and other travel documents in a secure environment using the Traveler Verification Service (TVS). See the TVS Privacy Impact Assessments (PIA) [1]for more information.

ARE U.S. CITIZENS REQUIRED TO PROVIDE BIOMETRICS FOR THE ENTRY-EXIT SYSTEM?

U.S. Citizens who are entering or exiting the country are generally required to be in possession of a valid U.S. passport.[2] At this time, however, CBP does not require U.S. Citizens to have their photos captured when entering or exiting the country. U.S. Citizens who request not to participate in this biometric collection may notify a CBP Officer or an airline or airport representative in order to seek an alternative means of verifying their identity and documents. CBP discards all photos of U.S. citizens once their identities have been verified, unless the photos are associated with a law enforcement action. (Alternative language: Photos of U.S. citizens collected as a result of participating in this program will be discarded after the individual’s identity is verified)

WHAT ARE THE LEGAL AUTHORITIES THAT ALLOW CBP TO COLLECT BIOMETRICS ON TRAVELERS EXITING THE U.S.?

The 1996 Illegal Immigration Reform and Immigrant Responsibility Act[3] called for the creation of an automated system to record arrivals and departures of non-U.S. citizens at all air, sea, and land ports of entry. The 2002 Enhanced Border Security and Visa Entry Reform Act,[4] the Intelligence Reform and Terrorism Prevention Act of 2004,[5] and the Implementing Recommendations of the 9/11 Commission Act of 2007[6] all called for the creation of a nationwide biometric entry-exit system, including the creation of exit records for individuals departing the United States. In addition, the Consolidated Appropriations Act of 2016 [7] authorized CBP to expend up to $1 billion in certain visa fee surcharges collected and deposited into the recently created 9-11 Response and Biometric Exit Account for biometric entry and exit implementation. Executive Order 13780, “Protecting the Nation from Foreign Terrorist Entry into the United States,” required U.S. Department of Homeland Security (DHS) to “expedite the completion and implementation of a biometric entry-exit tracking system for in-scope travelers to the United States.”[8]

ARE THERE ALTERNATIVE PROCEDURES FOR THOSE WHO DO NOT WISH TO HAVE A PHOTO TAKEN?

If a U.S. citizen requests not to participate in the biometric entry or exit technical demonstration, he or she may be processed using alternate procedures, such as presenting travel credentials to an available CBP Officer or airline personnel, before proceeding to the flight.

HOW DOES CBP SECURE TRAVELER PHOTOS?
‍
CBP is committed to protecting the privacy of all travelers. Toward this end, CBP employs four primary safeguards to secure the data:‍

• Secure Encryption: CBP IT systems use HTTPS/SSL encryption during the storage of personally identifiable information and during the data transfer between the camera and the Virtual Private Cloud
• Biometric Templates: CBP creates biometric templates of each of the (1) historical photos and (2) newly-captured photos for matching and storage. What are biometric templates?
  - Strings of multiple numbers representing images  
  - Can be matched against other templates that represent facial images
  -Irreversible—cannot be reverse-engineered to reconstruct the photo by anyone outside of CBP   
• Brief Retention Periods: CBP discards the photos of U.S. citizens after their identities have been verified and deletes the photos of non-U.S citizens within 14 days.
• Secure Storage: Facial images are stored in secure CBP systems and, for a brief period of time, in a secure cloud environment, thus mitigating potential privacy risks.
  - The Cloud Service Provider (CSP) adheres to the security and privacy controls required by National Institute of Standards and Technology (NIST) Special Publication 800-144, “Guidelines on Security and Privacy in Public Cloud Computing,” and the DHS Chief Information Officer. 
  

________________
[1] See CBP Traveler Verification Service (TVS) PIAs.
[2] 8 U.S.C. §§ 1185(b)
[3] Pub. L. 104-208
[4] Pub. L. 107-173
[5] Pub. L. 108-458
[6] Pub. L. 110-53
[7] Div. O, Title IV, § 402(g), Pub. L. 114-113
[8] Executive Order 13780, Protecting the Nation from Foreign Terrorist Entry into the United States, 82 FR 13209 (March 9, 2017), available at https://www.whitehouse.gov/the-press-office/2017/03/06/executive-order-protecting-nation-foreign-terrorist-entry-united-states
‍