DHS Audited TSA Facial Recognition Privacy Weaknesses
The TSA lacked clear data controls for passenger biometric information during system troubleshooting by vendors.
Updated on Oct. 14, 2026 in Cybersecurity
Live Poll
Do you trust the government to properly secure your biometric data?
The Department of Homeland Security Office of Inspector General audited the TSA's Credential Authentication Technology 2, finding that vendors extracted passenger data without oversight. The TSA failed to track these extractions or verify the deletion of biometric images.
Why it matters
The audit highlights critical gaps in the privacy protection and data management of biometric systems deployed in national transportation hubs. These findings expose the risks inherent in using third-party vendors for sensitive passenger identification processes.
The TSA uses cameras to compare live passenger photos against provided identification documents, but vendors accessed and extracted these images during troubleshooting. The TSA currently lacks verified confirmation that all extracted passenger data has been deleted.
The players
Department of Homeland Security Office of Inspector General
An independent oversight body responsible for auditing and investigating the programs and operations of the DHS.
Transportation Security Administration
The federal agency tasked with securing the transit systems of the United States.
The details
The Credential Authentication Technology 2 system functions by capturing live images to cross-reference against physical passports or driver's licenses. Auditors found that system vendors circumvented established privacy protocols by accessing these images during enhancement processes. The TSA currently lacks technical policies to track these external data extractions or notify passengers when their biometric information is stored.
Timeline
October 14, 2026: The DHS OIG published the summary of audit findings.
The Tech Race
This audit highlights a recurring tension between biometric system performance and compliance with the Privacy Act of 1974. The findings mark a shift toward stricter oversight of federal vendor access to passenger biometric data.
Passengers traveling through airports should be aware that the TSA is currently refining its data handling policies for the Credential Authentication Technology 2 system. These changes aim to ensure better notification and deletion standards for biometric images.
The takeaway
The TSA has concurred with the OIG findings and is working to rectify its oversight of vendor-accessed data. Readers should monitor future DHS OIG reports to confirm if the final recommendation is successfully resolved by the agency.
Further reading
For broader context on federal security standards, see our Cybersecurity section.
Source note: This article includes information reported by Electronic Frontier Foundation.
Live Poll
Do you trust the government to properly secure your biometric data?
