The Legal Questions Surrounding the TSA’s Facial Recognition Program
By Robert Lowell
The Transportation Security Administration (TSA) has been rapidly expanding a pilot program implementing facial recognition technology (FRT) into its security screening checkpoints at airports across the country.[1] The program’s rollout began just a couple of years ago, in 2020.[2] In mid-2023, FRT had already been implemented at 25 major US airports and the agency indicated that it would continue this expansion at rapid pace—to over 400 airports within the next “several years.”[3] Additionally, while US citizens can currently opt-out, the TSA’s Chief Administrator has said that the program will likely become a mandatory element of airport screening in the future.[4] The TSA’s program raises serious privacy concerns and significant legal questions. In particular, it raises questions about the agency’s statutory authority to adopt this technology and about Congress’s willingness to intervene.
First, one might reasonably ask whether the TSA has the requisite statutory authority to implement its FRT program. The agency points to Section 109(a)(7) of the Aviation and Transportation Security Act.[5] This provision allows the agency to use “voice stress analysis, biometric, or other technologies to prevent a person who might pose a danger to air safety or security from boarding the aircraft of an air carrier.”[6] Under the Supreme Court’s current Chevron jurisprudence, the TSA’s broad interpretation of this provision to allow it to use biometrics to screen all airline travelers would likely be deferred to by the courts, since there is a good argument that the precise scope of the passage is textually ambiguous.[7] However, it appears likely that Chevron will soon be replaced by a potentially less deferential standard at the end of the Supreme Court’s current term.[8] If so, the courts may consider the TSA’s interpretation more closely were it to be challenged, and they could potentially find that the agency has not been authorized by the statute to use such invasive technology as a part of its standard screening protocols.
Second, even if the TSA’s program is statutorily legitimate, Congress should still step in. Indeed, despite the serious privacy risks posed by FRT, Congress has passed no laws that explicitly regulate the adoption of the technology by federal agencies.[9] Without such regulation, executive agencies have asserted broad authority to determine if, how, and when to use FRT.[10] At a minimum, Congress needs to establish standards and guiderails to prevent the government from abusing the civil liberties and privacy interests of US citizens. Some legislative proposals have already been made to outright ban federal agencies from using FRT,[11] and one proposal would specifically ban the TSA from using the technology.[12] To gain greater political traction, those in Congress who support such efforts may want to consider proposing regulating the technology as a first step. Regardless, Congressional oversight of some kind is needed, as it would help ensure that the adoption of FRT by the TSA, and other agencies, is properly subjected to democratic accountability.
Robert Lowell is currently a 2L at Vanderbilt Law School. He is from Tucson, Arizona and graduated from the University of Arizona in 2022 with a double major in Philosophy, Politics, Economics, and Law (PPEL) and History.
[1] See Facial Recognition Technology, Trans. Sec. Admin., https://www.tsa.gov/news/press/factsheets/facial-recognition-technology (last visited Feb. 3, 2024); Kris Van Cleave, TSA expands controversial facial recognition program, CBS News (June 5, 2023, 10:45 AM), https://www.cbsnews.com/news/tsa-facial-recognition-program-airports-expands/.
[2] Van Cleave, supra note 1.
[3] Wilfred Chan, Exclusive: TSA to expand its facial recognition program to over 400 airports, Fast Co. (Jun. 30, 2023), https://www.fastcompany.com/90918235/tsa-facial-recognition-program-privacy?partner=rss.
[4] Bonnie Kristian, TSA’s Biometric Screening May Not Be Optional for Long, Reason, (Mar. 31, 2023, 12:45 PM), https://reason.com/2023/03/31/tsas-biometric-screening-may-not-be-optional-for-long/.
[5] See TSA Biometrics Strategy For Aviation Security & the Passenger Experience, Transp. Sec. Admin. (July 2018), https://www.tsa.gov/sites/default/files/tsa_biometrics_roadmap.pdf (“this initial release of the TSA Biometrics Strategy is focused on verifying aviation passenger identity using biometrics per TSA’s authorities under applicable laws and regulations including the Aviation and Transportation Security Act (Section 109 (a)(7))”).
[6] Aviation and Transportation Security Act § 109(7), 49 U.S.C. § 114.
[7] See id.; Chevron, U.S.A., Inc. v. Nat. Res. Def. Council, Inc., 467 U.S. 837 (1984).
[8] See Amy Howe, Supreme Court likely to discard Chevron, SCOTUSBlog (Jan. 17, 2024, 6:58 PM), https://www.scotusblog.com/2024/01/supreme-court-likely-to-discard-chevron/.
[9] See Kristin Finklea, Laurie A. Harris, Abigail F. Kolker, John F. Sargent Jr., Cong. Rsch Serv., R46586, Federal Law Enforcement Use of Facial Recognition Technology (2020) (“There are currently no federal laws specifically governing law enforcement agencies’ use of FRT.”).
[10] U.S. Gov’t Accountability Off., GAO-21-518, Facial Recognition Technology:
Federal Law Enforcement Agencies Should Better Assess Privacy and Other Risks (2021); U.S. Gov’t Accountability Off., GAO-23-105607, Facial Recognition Services:
Federal Law Enforcement Agencies Should Take Actions to Implement Training, and Policies for Civil Liberties (2023).
[11] See Facial Recognition and Biometric Technology Moratorium Act, S. 681, 118th Cong. (2023).
[12] See Traveler Privacy Protection Act of 2023, S. 3361, 118th Cong. (2023).