Documents Show Agreements Between CBP and JetBlue for Facial Recognition Boarding

Newly released documents show the agreement between U.S. Customs and Border Protection (CBP) and the airline JetBlue on scanning the faces of passengers, in order to "build a biometric gallery of facial images, obtained through various DHS databases" of travelers flying from certain airports.

The documents provide more insight into the dynamics between DHS and airlines, which are increasingly deploying biometric boarding at their gates.

"The purpose of this MOU for the Parties is to collaborate on JetBlue's proposed pilot program to utilize facial biometrics to verify the identity of travelers prior to their departure on JetBlue international flights from Boston Logan Airport and John F. Kennedy Airport in the United States, to international destinations serviced by JetBlue, as mutually identified by the Parties," an amendment to the memorandum of understanding, obtained by Motherboard through a Freedom of Information Act (FOIA) request, reads.

"JetBlue, working with SITA, its technology partner, intends to capture each traveler's photo, in accordance with CBP's specifications, during the boarding process for certain mutually identified JetBlue international flights," the MOU continues.

Since 2017, JetBlue has rolled out biometric boarding at different airports. In a November 2018 press release announcing the expansion of the program to JFK airport, JetBlue said that "There is no pre-registration required. Customers can simply step up to the camera for a photo match and make their way onto the aircraft."

The MOU obtained by Motherboard also includes SITA. In a 2018 NPR piece, SITA America's head of technology strategy Sherry Stein said "So as a person approaches the gate, they step onto the designated footprints, which triggers the camera. We collect a photo, send that to CBP, who checks to make sure that that person's booked on the manifest and matches the photo that they already have on file. If everything matches, we open the doors and give them the OK to board. All of that happens in three to five seconds."

Derek Dombrowski, manager of corporate communications at JetBlue, told Motherboard in an email that JetBlue has temporarily paused the majority of its biometric boarding due to "additional complexity at the gate as a result of COVID entry/exit requirements." JetBlue expects to resume the program for all international departures from JFK by the summer, and the expansion to other airports later this year and into 2022, he added.

Dombrowski said "We have seen more than 90% of our customers participate in biometric boarding when available." The program is opt-out; travelers who do opt-out instead have to show their travel documents as normal at the gate.

"Biometric boarding improves security by securely ensuring the identity of the customer with a direct link to the CBP, and also reduces boarding complexity by avoiding customers attempting to locate and scan their boarding passes with crewmembers there to assist. In the end, this frees up more crewmembers to provide one-on-one customer support with issues for customers who cannot self-serve," Dombrowski added.

A CBP spokesperson told Motherboard in an email that "CBP has partnered with several airlines to implement biometric facial comparison technology at departure gates in U.S. airports. As of February 2021, CBP has implemented biometric facial comparison technology fully or partially at 38 entry locations, and fully or partially at 28 exit locations (biometric boarding)."

The CBP spokesperson added that since September 2018 "CBP has used biometric facial comparison technology to identify more than 84,000 individuals who overstayed their lawful term of admission in the United States. During the same period of time, CBP has used biometric facial comparison technology to apprehend more than 400 imposters at U.S. ports of entry, 115 of whom were carrying U.S. passports or passport cards. An imposter is an individual who attempts to enter the United States using a genuine travel document that belongs to another person. Often, the imposter bears a close physical resemblance to the legitimate owner of the travel document."

A report last year from the Canadian Internet Policy and Public Interest Clinic (CIPPIC) argued that facial recognition systems at borders can enable more invasive forms of surveillance by feeding biometric data from travelers to other agencies and companies without their knowledge. The CBP spokesperson said the agency has "reduced the data retention period for new biometric photos of U.S. citizens who participate in the biometric entry-exit process from 14 days to 12 hours."

Subscribe to our cybersecurity podcast CYBER, here.