Will biometric tracking systems at U.S. exits improve border security?

WASHINGTON — Facial recognition software, iris scanners and fingerprint matching are spy-movie staples but they also are part of a national security debate over whether they should be installed at U.S. borders to ensure all foreign travelers who come to the U.S. also leave the country.

Even before the 9/11 terror attacks, biometric entry and exit tracking systems were mandated to ensure border security. Since President Bill Clinton signed the 1996 Illegal Immigration Reform and Immigration Responsibility Act, Congress has mandated that the Department of Homeland Security build a biometric entry-exit system.

Now, DHS gathers biographic information from passports and other travel documents, such as visas, at entry and exit points. Biometric data from a person’s physical features such as fingerprinting, photos and iris scans is collected only at entry points. Nonetheless, federal agencies have yet to use biometrics for foreigners leaving the U.S. Critics say the technology is expensive, unnecessary and can pose possible cybersecurity threats.

US-VISIT requires biometrics at entry but not exit

For more than a decade, foreign travelers have been required to provide both biographic and biometric information to enter the United States as a result of a terrorism prevention law. However no biometric tracking systems have been installed at exits, despite pressure from Congress, said Sen. Jeff Sessions, R-Ala., during a Senate Judiciary subcommittee hearing in January on why these systems have not yet been implemented.

It’s very frustrating,” Sessions said. “We’re aware of the excuses. We’ve been hearing them for more than a decade. The time of excuses is over.”

The U.S. Visitor and Immigrant Status Indication Technology system was established in 2004 to create an electronic check-in/check-out system for most foreign visitors — from students to tourists to businessmen. This process requires visitors to present photo and fingerprint identification, but only at entry points. The data is stored in the Arrival and Departure Information System, an electronic interagency database. At exit points, only the visitor’s passport is checked against airline passenger lists. This has some national security experts worried.

Before US-VISIT, only visitors who required a visa to enter the U.S. had to go through the photo and fingerprint scan. Visitors with visa waivers, from countries with high-income economies like Japan, Switzerland or the United Kingdom, could enter the U.S. without having biometric information recorded if their stays lasted less than 90 days.

Most foreigners are required to go through the US-VISIT security check when entering the nation. Some Mexican and Canadian citizens, as well as foreign diplomats, children under the age of 14 and people over the age of 79, are exempt from having to supply biometrics.

Does exit tracking protect the U.S. from terrorists?

By not collecting visa information from all foreign visitors, the system is at risk of failing to protect the country from terrorists and unwanted aliens, according to the Federation for American Immigration Reform, an anti-immigration organization.

The system also does not track whether visitors actually leave because U.S. Customs and Border Protection does not do a complete collection of departure forms that visitors must turn in when leaving the country. There is no way to be sure visitors are not staying in America on expired visas unless someone personally tracks their individual biographic information, said Sessions.

“If somebody comes here and keeps their nose clean and doesn’t have a criminal record, nobody is ever going to come look for them under the policies of this government,” Sessions said. It’s a wide-open method by which millions of people can enter our country unlawfully.”

A government report for fiscal 2015 said the U.S. received 45 million nonimmigrant visitors. About 416,500 visitors – a little less than 1 percent – stayed longer than the departure dates on their travel documents. The report does not account for foreigners using student or work visas. Not having accurate exit data to keep track of overstays poses a potential threat to American citizens, said Sessions.

“We need to remove alien overstays before they hurt innocent Americans, before they engage in terrorism and not wait until it’s too late,” he said.
The challenges of implementing a biometric exit tracking system include cost and finding an efficient way to combine the new technology with the existing immigration system, said John Wagner, deputy assistant commission of field operations with U.S. Customs and Border Protection.

“We’ve got to figure out a biometric you can take without creating gridlock and taking two hours to board a plane,” he said.
Putting exit systems into practice would cost an estimated $3.5 billion, according to a 2008 DHS report. The government agency was given $2 billion from Congress and is expected to use it toward implementing a biometric exit tracking system, said Sen. Al Franken, D-Minn. But it is unclear if the funds will be adequate, said Rebecca Gambler, a director in the Government Accountability Office.

DHS had planned to conduct analyses and submit information to Congress on the costs and benefits of various options for a biometric exit system in time for the fiscal year 2016 budget planning cycle,” said Gambler, who specializes in border security and immigration. “In the absence of that information, it’s unclear how much various options for biometric exit may cost.”

Pilot programs if overstay represents threat

Two pilot programs have been launched to test biometric exit systems in airports. Facial comparison software is being used at Washington Dulles International Airport and John F. Kennedy International Airport in New York. Mobile fingerprint scanners have also been deployed at the nation’s top 10 airports, which include Chicago’s O’Hare International Airport, Los Angeles International Airport and Hartsfield-Jackson Atlanta International Airport.

In a third pilot program at Otay Mesa — a point of entry on the U.S.-Mexico border in California — U.S. Customs and Border Protection agents are collecting biometric and biographic information from pedestrian travelers departing the U.S. through the land border. Data gathered from these trials will help DHS officials determine the most efficient way to phase in a biometric exit tracking system, said Wagner.

Exit biometric systems could prove that someone is still in the country, but the systems would not help in knowing why people overstayed or where they are, said David Inserra, a cybersecurity expert at the Heritage Foundation, a conservative think tank.

If there’s someone who overstayed a visa, you don’t know if they did it because they’re a threat to the U.S.,” Inserra said. “Maybe they’re here like any other illegal immigrant, or economic reasons, or maybe they forgot.” It might not be worth the cost of a biometric exit system to only know that people have overstayed their visas, Inserra said.

It’s often touted as an immigration tool to stop terrorism too, but when I think about that, I fail to see how it can actually prevent it,” Inserra said. “You can have a system that is straight up Star Wars level, but if you don’t exit, you’re not going to be to using that system you spent so much money on.” He suggested implementing a more secure biographic system requiring more layers, such as adding more security questions and additional personnel at borders.
If biometric exit systems are installed, the issue of data security also arises, said Jennifer Lynch, senior staff attorney with the Electronic Frontier Foundation, a digital freedom advocacy group.

This is the first time now that data’s being collected on people exiting the country,” Lynch said. ”It’s very concerning that this data is being collected on U.S. citizens, especially if it’s face recognition data, because it allows the government to build out its gigantic database of face recognition information.”

The gigantic database is the Arrival and Departure Information System, composed of multiple local databases funneling information into a central source. The data provides information for national security purposes, such as monitoring terrorist activities, according to a Homeland Security ADIS update report. Information from ADIS can only be shared when there is approval from the data’s owner, the report said.

However, it is “certainly possible” for hackers to break in to the database and steal data because it has been done in the past, said Dr. James Wayman, a biometrics professor with San Jose State University.

“The ADIS system is a system of systems,” Wayman said. “It has lots of entry points. There are lots of ways a person could get data.”

An example is the Office of Personnel Management breach last year, which compromised 5.6 million people’s fingerprint data. However, tech security wasn’t to blame in that situation because the OPM hack was most likely a social engineering plot, said Scott Schober, CEO of Berkeley Varitronics Systems, a cybersecurity company. Social engineering plots involve manipulating insiders and tricking them to give up credentials without their knowledge.

Biometric systems can also be tricked by research and design methods, such as using fake fingerprint molds to fool the scanners.

“(Working normally), these biometric machines could incorrectly indicate false positives due to programming errors, but that error rate is infinitesimal,” Schober said.

A data breach of biometric information is worse than losing a Social Security number or credit card information, said Lynch.

The problem with biometrics that makes them different from other types of information is that it’s impossible to change one’s biometrics,” she said. “A person can’t easily change their face, fingerprints or iris, like they could with a social security number.”

A person’s right to privacy is also compromised, said Lynch. The technology could become advanced enough to make it possible to keep track of everyone’s location if the government decided to use surveillance cameras with biometric face recognition, she said.

Despite these concerns, Congress is still pushing for swift implementation because improving the current immigration system and solving the overstay issue is a necessity, said Sessions.

If we do not track and enforce departures then we have open borders, especially the way it’s being carried out today,” he said. “It’s as simple as that.”