The frequent-flyer program "PreCheck," which allows for quick transit through airport security, soon could be used to gather biometrics, such as face recognition and iris scans, according to a privacy-rights group.
The Electronic Frontier Foundation notes PreCheck allows passengers to speed through airports by submitting their background information in advance.
EFFÂ warns, however, a new plan released by the Transportation Security Administration "reveals the Department of Homeland Security's greater underlying plan to collect face images and iris scans on a nationwide scale."
The organization charges DHS's programs "will become a massive violation of privacy that could serve as a gateway to the collection of biometric data to identify and track every traveler at every airport and border crossing in the country."
While the fingerprints collected by PreCheck so far has had been used only for the mandatory background check, the scope could expand.
"This summer, TSA ran a pilot program at Atlanta's Hartsfield-Jackson Airport and at Denver International Airport that used those prints and a contactless fingerprint reader to verify the identity of PreCheck-approved travelers at security checkpoints at both airports," EFF said.
And now the program is to roll out nationwide.
"While this latest plan is limited to the more than five million Americans who have chosen to apply for PreCheck, it appears to be part of a broader push within the Department of Homeland Security to expand its collection and use of biometrics throughout its sub-agencies," EFF warned.
"For example, in pilot programs in Georgia and Arizona last year, Customs and Border Protection used face recognition to capture pictures of travelers boarding a flight out of the country and walking across a U.S. land border and compared those pictures to previous recorded photos from passports, visas, and 'other DHS encounters.'"
Customs and Border Protection's Privacy Impact Assessments for the pilot programs said that although CBP would collect face recognition images of all travelers, it would delete any data associated with U.S. citizens.
"But what began as DHS's biometric travel screening of foreign citizens morphed,"without congressional authorization, EFF said, " into screening of U.S. citizens, too. Now the agency plans to roll out the program to other border crossings, and it says it will retain photos of U.S. citizens and lawful permanent residents for two weeks and information about their travel for 15 years. It retains data on 'non-immigrant aliens' for 75 years."
There's coordination inside Congress, too, where a proposal would require DHS to "collect biometric information from all people who exit the U.S., including U.S. and foreign citizens."
A TSA update outlines how biometrics can be used at checkpoints, screening lanes, bag drop and boarding areas.
And "other areas."
EFF said these agencies "aren't just collecting biometrics for their own use; they are also sharing them with other agencies like the FBI and with 'private partners' to be used in ways that should concern travelers."
How about facing such security at a concert or athletic event?
"We cannot overstate how big a change this will be in how the federal government regulates and tracks our movements or the huge impact this will have on privacy and on our constitutional 'right to travel' and right to anonymous association with others," EFF said.
The organization pointed out that even as late as May 2017, CBP recognized that its power to verify the identification of travelers was limited to those entering or leaving the country.
"But the TSA Modernization Act would allow CBP and TSA to collect any biometrics they want from all travelers – international and domestic – wherever they are in the airport," EFF said.
Eventually the images will find their way to FBI and DHS databases, where they will be reviewed over and over for years, posing a security risk.
"As we saw with the 2015 Office of Personnel Management data breach and the 2017 Equifax breach, no government agency or private company is capable of fully protecting your private and sensitive information. But losing your social security or credit card numbers to fraud is nothing compared to losing your biometrics. While you can change those numbers, you can't easily change your face," EFF said.