Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
JetBlue explains to a passenger how it got a photo of her face (boingboing.net)
409 points by wizeman on May 2, 2019 | hide | past | favorite | 229 comments


This essentially gives the government much tighter control of a process that, while decent, has some loose ends in it. For instance, document forging is something that is less effective than it used to be given digital chips and facial recognition.

It is of course legitimate for a democracy to check things like which plants are coming across the border and to deny access or apprehend war criminals and the like. However, the USG does not have a current record of using its powers for good recently. Example: the muslim ban. Anyone who managed to get around that is a hero even if it was illegal because it's an immoral policy.

Tighter control means tighter control of dissent. Want to find that soldier with those leaked documents? Want to locate that journalist with news of unseemly interventions in central America? Want to find those people of the wrong race or religion that are the convenient scapegoat of the moment? Sure, let's make border control more precise. Most people are actually decent and should have default global freedom to move and work by birthright. US border control is about denying people entry, but the main effect is denying ordinary people with a minor effect of deterring crime.


Sadly, fear was the strongest motivator for policies of this kind. If you get rid of increased controls on airports, flying would still be the safest form of travel and terrorism is a negligible danger exaggerated by media reporting. It is ridiculous what latest generation of politicians will leave behind. How can we get rid of this madness?


> How can we get rid of this madness?

Hold politicians accountable for what they are doing, from the local community to the President. Defend the freedom of the press, especially when Trump goes on a rampage again. Vote for someone better than him, vote for someone actually progressive. Convince family, friends and co-workers. Organize yourself and head on to the streets.

For those willing to practice with arms, join Redneck Revolt. Protest against Nazis taking the streets, protest them wherever they appear and want to spread their propaganda.

Oh, and a look towards France and the Yellow Vests is never wrong. The willingness of the French to go on mass strikes and the occasional riot has proven to be very effective against the worst of neoliberal politics over the last decades.


Trump cannot be the problem, since these controls were already implemented. Blaming dickhead absolves the people responsible.


They don’t appear to be blaming him for the controls. They are saying you should protest his attempts to intimidate and build distrust towards journalists.


Fair enough. I just think it is counterproductive to frame that as a bipartisan issue. You would only get disappointed again if these kind of policies are implemented by whoever is responsible.


We have yet to see another Stalin with all this new tech. Something I hope we never see. I wish Gulag Archipelago was history 101 at university.


Xi Jinping is trying pretty hard.


Our politicians are more than happy to let the Chinese beta test authoritarian technology on their citizenry before we can deploy the same in what remains of Western democracies.

We criticize them just a little, by principle, but as soon as the tech proves effective at controlling population, we adopt the tech "because it works".

"But at what?", one may ask...


Stalin is 10M deads in the lead.


I thought most of those deaths were indirectly, resulting from agricultural and economic policies and forced relocations and only a relatively (10%) small number of executions?

If you include economic causes, you might need to include the excess mortality of systematically impoverished communities in western nations — and I don’t just mean “PoC in the USA”, as I can point to a UK study claiming the government’s austerity policies since 2010 have caused 120,000 excess deaths: https://www.bmj.com/company/newsroom/health-and-social-care-...

Also, if those deaths were related to economic policies, you probably have to weigh them by population size.

Obviously that’s still a million executions more than most; I am not defending him, this is just about making it an apples-to-apples comparison.


It looks like something of ~7M from the famines, ~2M from Gulags, ~1M from executions, uncertain number from torture.

Numbers from

https://en.wikipedia.org/wiki/Excess_mortality_in_the_Soviet...

I'd say if famines are the cheapest way, many dictators with a genocide mind set would do that if possible.


There's some evidence it was not accidental: https://en.wikipedia.org/wiki/Holodomor#Genocide_question


New Stalin style dictatorships are unlikely to arise in developed countries. A gradual descend into modern-Russia style governance is much more likely.

We have learned a lot about building stable power structures in the last 50 years. You don't need to have a death grip on everything in the country. A much softer touch is the technique of choice of modern oppressive regimes.

Why disallow other parties when you can just make sure the right party always wins?

Why get rid of capitalism if you can just pick the winners?

Why censor information when you can drown the airwaves in fake news?

Why purge dissidents if they have no power to change things?

Why control what people do when you can control what people want to do?


that feels more theoretical. Looks like they are close to failing in Venezuela, for example.


Eh, I don't really think we're about to see a stable government in Venezuela, let alone a stable Stalin-grade dictatorship.


Most relevant details, from the last link [1]:

> It took her photo, comparing her picture to a preloaded photo databased of all the passengers with tickets on this flight, and then she got a check mark, indicating she was cleared to board. The whole process took about five to six seconds.

> The Aruba experiment is expected to last somewhere between 45 and 90 days.

> "We're basically capturing that picture at the boarding gate, providing it to U.S. Customs and Border Protection. They're identifying the traveler," Farrell said. "It's actually the U.S. government that's implementing the biometric matching system that does all the hard analysis and crunching of the data."

> A biometric exit system to track non-U.S. citizens using their faces or fingerprints has long been a congressional mandate, particularly after 9/11, to improve border security and identify people who've overstayed their visas.

> Crockford says people don't know how CBP might share that data with local police. CBP insists it'll discard photos taken of citizens, and only keep a database of non-citizens.

> Customs and Border Protection has been piloting similar biometric tests at airports in Atlanta, New York and the D.C. area. And, according to a customs official, the goal is to deploy facial recognition tech widely by early next year.

I guess it must be comparing with their passport photo? (Or visa photo, for foreigners?) It doesn't seem much different from the way you're already required to show your physical passport and they check your photo manually. It's also always been pretty normal to have your photo taken by countries when passing through passport control. So I don't really see what the problem would be here?

[1] https://www.wbur.org/bostonomix/2017/06/21/jetblue-facial-re...


Is it really that useful to identify someone who has overstayed their visa when they are leaving the country? Sure, you then know not to let them in next time. But it seems like a lot of effort when there are so many people overstaying their visa and not leaving out of the airports.

That said, even as a libertarian, privacy-conscious person, I'm not sure I have a problem with exit controls like this. It's important to know who is crossing the border, in both directions.

But why do they even need the photo? Presumably the name is already on the ticket... surely they can detect overstays from names + address alone, not just photos?


> It's important to know who is crossing the border, in both directions.

Why?

And if there exists an important reason to know that someone is exiting the country does that same criterion not also apply to exiting a state or city or neighborhood?

I am not being sarcastic; I am genuinely unable to come up with a reason it's important to track who leaves almost any place, except in highly unusual cases (e.g. "OK guys, chatmasta has gone; let's get to work planning the surprise party for when he gets back")


Its worth pointing out that the US is literally the only country in the world that I have visited, in my recollection, that does not have passport control upon exiting the country.


you would have passport control if you exited the country through some other non conventional ways.

The airlines are giving out all the information, that's why there is no need to do an exit passport control.


> you would have passport control if you exited the country through some other non conventional ways.

From the US? I can't think of any outgoing passport control at all; not by land in a private vehicle, nor by boat.


The UK does not check passports outbound at airports either


Canada also doesn't have any sort of outgoing passport control that I've seen. Leaving on a flight, it's possible that the airlines pass your info on to CBSA but there are no controls when leaving by car (you literally drive into the US, then see the CBP) or by boat (you have to report on your way in, but not out, see https://www.cbsa-asfc.gc.ca/travel-voyage/pb-pp-eng.html ).


There's no exit passport control in Canada either, at least when going to the US (ground or air).


I never really considered this, but I believe you are right. I have travelled to dozens of different countries and the USA is the only one out of those to not have exit customs checks.


I know it's not quite the same thing, but most countries in the EU have no passport control upon exiting or entering the country as long as it's within the Schengen zone.

So France has basically no idea who shows up from Germany or leaves via Belgium. The countries on the external borders are supposed to handle all that.

Now I suppose it's possible there is a lot of data exchanged in real time and so on, but it's also possible that is a complete mess and nobody really knows anything, especially about citizens (GDPR).


It's far from the same thing. For all intents and purposes the Schengen Area works like a big country, regarding border control. That's like being surprised that Iowa doesn't check your passport when you head over into the neighboring US state :)


To the parent's point, though, passports ARE checked at the point you exit the Schengen area, whereas they're generally not when you leave the US.


They are checked by the foreign country though, not by the country you're leaving.

I have not crossed that many non-Schengen land borders, but as far as I remember it was the same every time, when going from France to England through the channel, Belgium to England by train, France to Switzerland (before Switzerland joined Schengen) and Canada to the US.


When flying from a Schengen area country to the US, border patrol on the departing side is entirely managed by that country. Often e.g. United-operated flights from larger European airports will have their own passport check, but that always happens after you pass through the departing country's passport control. At least, this is my personal experience flying between Germany and the US ~once a month.

I have been to a few airports where you explicitly clear US customs at the departing airport before leaving for the US — Vancouver, BC and Dublin Shannon come to mind.

If you've overstayed your automatic 90-day Schengen area travel visa, a common hack for backpackers and such is to intentionally leave the Schengen area from someplace like France that's generally less strict about counting exact days than many other EU countries.

To be fair, I don't have much experience flying from the Schengen area to non-Schengen area non-US countries. It's totally possible this is all rigamarole that the US government pressures other countries to do.


Over the past few years, I've flown in and out of the EU dozens of times. Every EU international airport I've flown out of has outbound passport control, operated by the local country, before you enter the international part of the terminal.


I fly between Germany and UK pretty frequently, and whilst the UK doesn't check the passport on the way out, Germany do check it on the way out (you get checked again when entering into UK).

I have heard of friends of friends who overstayed a visa and get found out on the exit gate (usually bringing a lawyer/embassy official to talk through things). This can lead to a (temporary?) travel ban to Germany and a fine.


Neither does Canada.


Most countries of the world have maximum visit lengths as part of a visitor visa.

And those maximum visit lengths are counted on an annual basis. So you can only visit the US 179 days out of 365.

So they need to know when you came in and when you left. It's not good enough to just leave and not tell anyone.


They don’t “need to know” for reasons which are of significant practical benefit to citizens/residents.

But institutions like governments only “see” via data collection, and in general are happy to collect whatever is technically and socially feasible, and people involved in setting up databases seldom stop to think about the risks or trade-offs involved in collecting various types of data, or whether that data is meaningful or useful. https://www.ribbonfarm.com/2010/07/26/a-big-little-idea-call...


> They don’t “need to know” for reasons which are of significant practical benefit to citizens/residents.

Staying for more than six months is usually one of the main measures to determine if one is resident and should pay taxes in the country, so there is at least a very good reason (although I don't know how much this applies to the USA specifically).


Anyone who earns income working in the USA has to pay US income and payroll taxes.


you pay income tax in the country you live, not where you work (i.e. if you were employed by a US company, but working remotely in the UK, you'd pay income tax in the UK)


Any country can try to extract any tax from anyone it likes, and in general the US does.


Except if you are working for a company that is sending you to the US (your company makes the income). It's easy to argue for 2-3 weeks, harder to argue for over 2 months.


It seems to me that being opposed to someone breaking the law is not equivalent to being a sadistic xenophobe.

Finding people who rob banks at some point and punishing them is of great interest to people fearful of robbers who like disrupting robbers’ lives for no practical purpose because they gain sadistic satisfaction from cruelly exercising power over other people.


I think the robbers argument isn't directly applicable because mere physical presence without committing a crime doesn't hurt anyone -- does it? I think Congress for all its flaws agrees, as simply being present and out of status in the US isn't a criminal matter, it's civil, and congress has repeatedly, and even recently, refused to change that classification.

You punish a robber ostensibly to stop them from robbing again, lest you end up the victim of a robbery. What does being the victim of someone's unlawful presence even mean?


Their "mere physical presence" after their visa has expired is the crime.

There is nothing unique about the US in that regard. Most countries have a limit on how long you can visit.


No, it's not a criminal matter, it's a civil matter. It's illegal in the same way as parking somewhere you're not supposed to. Not everything that's illegal is a crime. "It is generally accurate that the simple act of being in the United States illegally is not, by itself, a crime. Rather, it’s a civil violation that puts the individual at risk for deportation, but not for criminal prosecution." [1]

This isn't always a good thing, of course, as there's less due process involved in handling such situations. Unlawful entry is a misdemeanor, lying to a border guard is a crime, and unlawful re-entry after deportation can be, also.

[1] https://www.politifact.com/florida/statements/2017/mar/15/fl...


Ok, point withdrawn. Overstaying a visa is not a criminal offense. That's a new one for me. Thanks.

I think your "who is hurt" approach is weak though.

If a country can't enforce its own laws - or worse selectively enforces them - no one is obviously "hurt" but it erodes trust in the systems and process itself. It leaves everything up to the judgement of the people on the ground and damages the concept of equality under the law. It's a dangerous game to play.


Yeah, I agree with you about law enforcement, particularly selective law enforcement. It is indeed a dangerous game to play, and while definitely a left-leaning individual I just can't get behind the whole "abolish ICE" thing. I do think that immigration laws in the US are absurdly strict and I have a hard time buying the "America's Full" argument. That said, while laws exist on the books they should be enforced.

I was suggesting one has a clear victim and the other doesn't so it may not be directly comparable. The "who's hurt" question was something I'm curious the consensus answer to rather than an excuse for not enforcing the law.


> I just can't get behind the whole "abolish ICE" thing.

Not saying one way or another, but the argument is that ICE was only formed 16 years ago and that the U.S. was not 'overrun' before then. The Border Patrol etc. would still remain, just the Stasi-like tactics of removing people from their homes in the middle of the night and holding people in cages would disappear.

At least that's how I've heard the argument.


ICE was the merger of numerous things, including the INS which pre-dates WW2 making it older than the Air Force, Department of Ed, and dozens of other government agencies.

Saying "only formed 16 years ago" is only right among the "well, actually" crowd.


The problem is that a merge increases the centralization of power and the ability to abuse that power with impunity. ICE was only formed 16 years ago as this sort of centralized organization. That is different than going via multiple separate entities, each of which have their own checks and balances, oversight and even internal politics that make it less likely widespread abuse would pass all the links in the chain untamed. That is gone.

The difference in 'effectiveness' is sort of like the difference between the reach of the LAPD intelligence arm vs the CIA.


So that next time chatmasta comes back, you know when he left. Otherwise how do you know how long he stayed in the country, and therefore how many days he should be allowed on this next visit? Currently, I assume the countries without exit controls have access to the entry databases of the destination countries, so they forego exit controls as redundant.


> Currently, I assume the countries without exit controls have access to the entry databases of the destination countries

I believe the US exit controls are currently based on airline passenger manifests (not entry databases of other countries).


Borders are different. There is a right to free movement within a country. Not so across borders.


There are numerous countries without unlimited right of free movement. China, Burma, and (to a much lesser extent) India come to mind.

Also de facto limitations in highly violent places like Syria, parts of Iraq, Somalia et al, but I assume you were referring to a de jure right


I don't know if they still do it, but in the 90s if you drove between provinces in Egypt there were police checkpoints reviewing ID, reason for travel and levying a fee although I don't know how official that last part was.


There is a right to free movement in the country because it would be impractical to check movements of people at this level of granularity.

With this development of technology, it becomes possible to even check who is crossing your neighborhood, and you may lose your freedom inside your own country, if a government decided to go in that direction


I can. If someone commits a crime in the country and then they leave, then it's important to stop them. In Australia, a number of men have kidnapped their children and so knowing they were leaving would have prevented them from leaving with the children illegally.


North Korea has an exit visa, and the associated processes.

Obviously a great country to emulate.


> Is it really that useful to identify someone who has overstayed their visa when they are leaving the country? Sure, you then know not to let them in next time.

This happened to me leaving London and it was a lot of fuss over nothing. I (American) had given my forwarding travel plans to the border agent upon arrival and I didn't notice but she marked my passport with a visa for an exact stay (just the weekend). Except she mistakenly wrote my exit date a day early. It took quite a bit of explaining to convince them not to put a giant "DEPORTED" stamp in my passport and even though they eventually believed me that it was a clerical mistake they definitely kept track in their system because I was questioned about it several months later when I went to the Falkland Islands.


It’s not about catching visa overstays on their way out. It’s about identifying who’s still here. Take the set of people who entered, subtract the set who exited, and anyone who remains who entered too long ago is an overstay.


[flagged]


Could you please stop posting unsubstantive comments to Hacker News?

https://news.ycombinator.com/newsguidelines.html


nobody has ever died in the united states, or crossed the border to Mexico or Canada without alerting the proper authorities. The Math will work out. I'm also quite sure everyone overstaying Visas will be very easy to find and in no way go by another identity.


Address isn't on the ticket or on the visa/passport. As many people on the "no-fly list" can attest, very many people have the same name.


That's true. But the article is talking about international flights. So in fact they have way more information in this case, as a passport is required. Granted it might not be the same passport the person arrived with. But it's a passport.

Anyway, I think facial recognition makes sense from a security perspective, as an additional layer of defense. You can make assumptions about what faces you expect to see from the passports that are scheduled to fly. If you see an unknown face in the boarding area, it's reasonable to flag that person for further review.


It might be just a convenient way to collect photos for the database.


Also, you need photo ID to fly and pass customs.


You don’t need photo ID to fly. TSA will ask you questions from your credit report and allow you to board.

*US citizens flying within the states.


From TSA press release April 4, 2019 (https://www.tsa.gov/news/releases/2019/04/04/tsa-reminds-tra...): "Travelers will begin seeing new signs at airports nationwide in the coming weeks to remind people that REAL ID-compliant licenses or other acceptable forms of ID, such as a valid passport, federal government PIV card or U.S. military ID, will be mandatory for air travel beginning on October 1, 2020. Critically important, on October 1, 2020, individuals who are unable to verify their identity will not be permitted to enter the TSA checkpoint and will not be allowed to fly."


Oh, sorry, you don’t have ID? Oh… I hate to tell you, but… I guess you live in Dallas now. I think you need to start a new life here in Dallas, and work hard until you get a new ID. And then you could use that ID to fly back to your old life and get your old ID.

- Hannibal Buress


You are required by regulation to have it. There is, as you describe, a convenience procedure intended to help people who forget their ID. You could still be turned away if you do this frequently or they otherwise have reason to doubt the legitimacy of it. And they don't have time for everyone in line to do it--if they did, this exception would go away completely.


For sure. A coworker lost his wallet while hiking after a sales visit prior to his flight.


You are correct; sad that most people don't know this.


I'm not sure that's true everywhere, but not for long many places (eg California, Washington).

Casual article on it: https://www.king5.com/article/news/local/how-to-get-on-a-pla...


The real id rules only address what documents count as id, no the cases of no id


Why should they? The only time it would be relevant is if you forgot your ID, and if you want to rent a car or hotel at your destination that might be a problem there as well. Knowing the TSA, I bet this adds at least an hour to the trip as you are begrudgingly walked to some back room and sit there for 20 minutes while someone is pulling up your file.


My one experience with losing an ID was that there was no real issue although it took 15 minutes or so to do a more thorough check. It was very professional. The Travelodge at the other end was a bigger deal though I was eventually able to check in there.

ADDED: It appears that as of Oct 1 2020, this sort of exception will no longer be possible.


Do you have a ref? I haven’t seen any notice of change, though of course the actual law is classified.


https://www.dhs.gov/real-id-public-faqs

It doesn't explicitly say "no exceptions" but the plain text is certainly that you will need appropriate ID (Real ID/passport/etc.) to go through TSA when Real ID requirement fully kicks in.


The barrage of propaganda since the Gore match-if-to-traveler policy was enacted has been that ID is required but in practice it has not been enforced. As I mentioned, the actual law is classified so cannot be consulted not litigated in court so we’ll simply have to see


I typically don’t carry any id in the us, and since Apple Pay came out just a little cash in my pocket.

The inspection is not a big deal and they are prepared for this situation. It’s a shame that the laws that control this are classified (cf Gilmore v Gonzalez) so we can’t know what the actual rules are.


Is REAL ID dead?


I hope so. The gosh-darn-no-exceptions deadline has been extended several times and I presume will be again.

It’s a “solution” in search of a problem.


You need more than a photo ID for international travel. You need a passport and any required visas to clear into the destination. Airlines care very much about this, because they are responsible for repatriating you if you are denied entry at your destination.


Didn't read the article, did it specify international flights? It makes sense if they're doing this for intranational flights too


I am not sure if passport photo is good enough for this. The mimimum requirement for face recognition is about 50 pixels between the eyes, and for reliable recognition it probably should be more. So the photo must come from somewhere else. For example, it could be taken when she passed the gates previous time.


In Europe there’s automated passport control gates with face recognition in several airports. These are based on the photo stored on passport. Not sure how automatic these are - would be of course possible to have a human there looking at the photos.

According to quick search there’s no specific resolution requirement for the image in biometric passport, but size should be min 12kB to have recognizable image.

https://readid.com/blog/face-images-in-ePassports


There is a human looking at the photos. When you take the Eurostar you can see them sitting in a booth after the gates. If you look into the booth as you pass, you'll see a grid of photos on screen. I'm assuming they're overseeing it all rather than checking everything manually.

I noticed that these gates were quite slow ID'ing me the first couple of times I went through them but now I hardly have the time to see my face flash on the screen before the gates open. Maybe there's a human check on initial passes. Either that or their code has gotten way better or they store data that helps matching after a few uses.


The human is only a second-level control in case the confidence level is too low, or the system can't match the face with the passport photo. Also, the face is matched against the photo stored in the electronic passport, not against a central database. With respect to resolution etc., there are specifications in place about the quality of the passport photo. If your photo doesn't meet them, you will be asked to submit another photo for your passport application.


I've had a beard and not, a shaved head and not, and mine feel slower than others. Tough to verify with an N=1, but that wouldn't really surprise me if they were.

I'm also flying to Kenya and other E. African countries so it wouldn't be surprising if they flagged me.


I always assumed they are storing every photo to help recognition because it definitely seems to get better the more you use it. You're right there is a human there though monitoring it, I assume they only step in when the system cant identify you.


I'm not sure what the resolution is (I tried it out a few years back), but you can actually pull your digital passport photo out of your passport using NFC. There's an Android app for it.


Not to mention some portion of photos would have to be out-of-date or otherwise unusable.

My guess is the app probably just approved anyone or nearly anyone. It's unlikely someone without a boarding pass would try to get on and it's likely that anyone with a boarding pass who got disapproved would be pissed.

Or who knows, maybe homeland security did a mechanical Turk and had someone at the other end looking at faces and checking off names.


>It's also always been pretty normal to have your photo taken by countries when passing through passport control.

No not always, only recently.

> I don't really see what the problem would be here?

You’re kidding right? There’s multiple privacy problems. Sounds like you either benefit from mass surveillance or have been conditioned to it.


> You’re kidding right? There’s multiple privacy problems.

No, not kidding.

There's a legitimate government interest in identifying people entering and leaving a country. This isn't Facebook, or even cameras on street corners -- this is a government responsible for enforcing legitimate immigration policies at a legitimate location (the border) for a wide variety of reasons (safety, economic, etc.), which absolutely requires knowing who is who.

I don't know any serious thinkers who claim otherwise.

And I don't see a particularly big difference between getting my photo taken for official ID's every few years (passport, driver's license, visas, etc.) and having it taken when I need to prove my identity with one of those.

The government already has photos of me. They already know my flight. How could it possibly affect my privacy that they also have a photo of me when I get on the plane?

I'm just not seeing it.

(Unless you're opposed to the whole concept of passports and photo ID's in general, but that would be a pretty radical position.)


You're correct—it is reasonable for governments to require a photo of yourself to associate with your passport. But it is not necessary to take a new photo every time you interact with the government. That's overreach, or at minimum wasting taxpayer money on unneeded photo storage.

And I'd wager the reason they're doing this is because while a human can make a decent determination of whether the photo matches the person in front of them, computers need a larger sample to get the error rate low enough for broad use. That's great for CBP and airlines that can employ fewer personnel, and great for travelers who can breeze throughª boarding and customs. But imagine how it will go when you are one of those 0.1% errors and the system refuses to let you in.

ªassuming companies/govts decide to increase throughput instead of decreasing cost, or that it's such an improvement that it can do both.


What is the problem with a new photo being taken? You say it like it is obvious but you haven’t actually made your thinking known.

Wasting taxpayer money in photo storage is a laugh. That isn’t the same category of argument as the idea that is is “overreach.”


I think the issue here is not where we are at but the risks inherent.

It would be entirely possible to have a benevolent dictator, he might think he is doing everything for the benefit of the people - and he might even be right. This situation is fine, the issue is what happens when that dictator dies.

Similarly with mass surveillance, if used with restraint and for the right reasons it could be completely fine. The problem is what happens if the situation changes, there is now a massively powerful tool available with little recourse for change.

I think the issue is not the situation as it is _now_, it's the risk potential it inherently has that is terrifying.


>It would be entirely possible to have a benevolent dictator

You lost me at this straw man. You are tossing around nebulous and vague concerns. Would it be fair to say your concern is potential abuse of your photos by a government entity?


I'd call it an analogy rather than a straw man. The formula is [now thing] is safe in [now context] but [future context] != [now context] so is [future thing] safe?

It's fair to say my concern is potential abuse of any system in a fluctuating context.


Not the person you are asking, but as someone who shares a similar feeling of distrust to authority, I'll provide you with my point of view:

It's not just the picture, it's the databases and the veracity of mass data base mining that can come from it.

To better explain:

Right now powerful entities have files on me. My actives. And yours. The collection, use and sharing of these files between these powerful entities violate our rights, even if only in intent (though arguably more)

Right now these files are mostly loosely created, probabilistic based associations.

If you've ever used any ID verification systems, you'd understand this (think lexisnexis)

So, they sort of know, but don't fully. Good. Even if these entities have shown the desire to violate my rights, they can't do it well because of issues related to data collection. I like that.

So the way I see these advancements is... great, now these entities are getting mass fed pictures that are 99.999% a correct association. This could be used for facial recognition software tie ins to say, CCTV systems. As stated, you need more than one picture to increase accuracy.

I don't want them to have it.

Right now, their interest (in violating my rights for profit and power) and my interest (in staking claim to the rights my forebearers fought for) are oposite.


They aren’t violating your rights. At least not in an obvious way. The government’s use of your photo ID is not controllable with the non-existent privacy law the US has not enacted.

However your concern about building a face database is valid. Note that China somehow can do it with only your Wechat profile. Maybe they are better at ML than the US. They are already automatically fining jaywalkers by face ID. And I assume worse.


> They aren’t violating your rights. At least not in an obvious way.

Easy to say. How about evidence. I offer all the evidence from Snowden and other whistle blowers to beg the contrary.

To me, it's very obvious unless you are intentionally not wanting to see it.

Notice I said if only in intent, I'm not here to split hairs on legalese. Intent in things like the Fourth Amendment to me is very clear.

I live in an area where when I go for weekend drives, I have to stop at border patrol check points where I am forced to stop and answer officer's questions. I'm not even traveling between states and I'm over 50 miles from the boarder in those points.

Trust me, I understand the legalese they use to justify it. They define a border zone that I think goes a hundred or two miles in land, which means it covers something like 70% of major American metro areas and allows the gov to basically conduct illegal searches by creating a loop hole.

But that is the point. My rights are routinely violated with impunity. People who have stood up to this get literally crushed. Clear whistle blowers are declared spies. It's them working to undermine my rights. Rights that people literally died so I could have. I think it's wrong to let those rights go. It's why I support things like the Electronic Frontier Foundation.


They say they're not storing the new photos. Just matching them and discarding.


They say but they could store photos by mistake. Especially if those are high-quality photos suitable for face recognition.


After Snowden you trust this?


I have to agree with crazygringo. In my home state there are cameras set up at border patrol stations near the Mexican border already filming video of my car and the occupants within everytime you come in from Mexico, and this has been the case for years.

This is nothing new, only new for people that don’t live near a physical border in the US.

The government clearly has missed a few people coming in and out on Visas. What is a way better than the current border protection method that also protects everyone’s privacy?


Isn’t a passport good enough? Why do I need to help train their ML model if a manual check works?


Out of interest, how would you argue against someone using your justifications for facial recognition on street corners, which you seem to think is a step too far?

Would your argument against street corner recognition systems have been different before and after facial recognition was required at the border?

You mention that having your photo taken at passport control is “pretty normal”. Do you remember when it was not? Would you be more concerned if we had gone straight from a situation where no pictures were taken, to rolling out a facial recognition system at the border?


Parent's argument is that the government already has photos of all international travelers and the government already has a written record of each international arrival and departure. So, the delta between a written record of border crossing and a photo record of border cross is the government having additional photos of somebody they already have at least one photo of. For many people, the difference between a single photo and many photos is minor.

Government does not already have photos of all individuals who cross street corners (there is no legal requirement to have ID) and government does not record a list of names of each person who crosses the street. So, cameras at street corners have a much larger delta - between no photos and photos and between no internal location records and having internal location records.


Was this an international flight?


Yes, according to the first tweet.


I think being conditioned to it is inevitable to some degree. I think the only reasonable choice is to focus on punishment for misuse, not prevention.

This reeks to me of another situation where we're trying to put the cat back in the bag, and that has basically never worked (except maybe nuclear disarmament, and even then... barely, and largely because the capital costs are so extreme).

Surveillance tech is cheap and widely available and will only continue to move in that direction. Attempting to make sure no one has a photo of you without your consent seems hilariously impossible to me. Focus on the outcomes instead.


Make it symmetric, use it to watch the watchers, then we might be talking about something socially viable. Without that, it's about control.


There is a fundamental trade-off between transparency and privacy, but also a very real risk that we will end up with neither.


Privacy is not hiding, it's about controlling visibility. Most of the data we wish would be treated differently are not strictly private, we just don't assume they would be easily accessible (specifically by a private company). We are currently transparent to big actors but cannot see through the window ourselves.


Effective surveillance is extremely expensive. But, it’s an easy way for contractors and suppliers to make money so many industries lobby for it.

For example road side license plate readers sound cheap, but unless a cop is next to it it’s really hard to catch the car that tripped one.


Exactly we keep hearing about privacy violations from Google and Facebook. Time and time again. Except those ... never seem to have any victims. There's just a bit of outrage.

But the London cops have been caught falsely accusing, arresting and holding people for weeks based on facial recognition (based on both wrongly made identifications, and wrong input pictures).

People have had their own medical files used against them in court by youth services and mental health services departments of their own governments.

People have been convicted based on factually incorrect information entered into police databases, then corrected in one place, but not the other.

The government keeps getting caught using privacy laws in ways not intended: for instance, to hide the identity of cops that beat up someone for racist reasons, preventing them from getting sued.

IRS has access to almost all databases. From medical files to bank statements. What they use it for ...

We all know WHO needs to be prevented from merging databases to increase people's safety. And it's not Facebook, it's the police, health and government departments. We need a right to delete any information about yourself AND ALL LINKED AND COPIED VERSIONS in all government database, and all information sharing needs to be "default deny". No government department has any business whatsoever in your medical files. All information provided by the government in court needs to be subject to invalidation by counter-experts. And it should be default practice to have all government information and copies of it that involves any person directly or indirectly "time-out". And to prevent government abuse of privacy laws, anyone working for government needs to be identified on request in any record that involves that person acting in any official capacity.


In my opinion it's a really bad idea to foster an attitude of, "if you're not with us then you're against us."

Some people don't mind these kinds of surveillance. You might staunchly disagree but you have to accept that it's a valid position.


> you have to accept that it's a valid position.

What if I don't accept it?


I think I agree with you but I can't help asking "valid in what sense?"


Valid in the sense of considering the tradeoff of privacy and airline security worth it.


Some people don't believe vaccines work and cause autism. Some people believe the earth is flat. Some people seriously believe we are ruled by lizard people.

Is it valid?

At some point we have to determine what is a minimum acceptable level of cohesiveness in though to take someone seriously.

I'm not saying anti-privacy people are in such extreme, but I don't like the 'everything a valid position in the post-modern relativist world'. The line has to be drawn somewhere, and some people might draw it further in or further out. But we all do it.


Children don't like getting vaccines either. But guess what? You have to protect stupid people from themselves.


No, children don't like shots in general. Vaccines are generally delivered via needle, which means that they don't like those.

I don't know of anyone who likes sticking needles in themselves (aside from addicts, but that's another story), only those who understand the value of what's in them (I suppose that addicts would fall into that category, too.)

I distinctly remember my mom explaining why I was about to get stabbed with needles when I was four. I didn't mind.


Why do you think that?


I have a Green Card and I get my photo taken each time I enter the country. I assume the same process exists for non-citizens, and that CPB is using these photos for this process.


Everyone on an ESTA has their photo taken when they enter the US (at least first time you enter on an ESTA. I don't always have it taken on subsequent visits). I would assume that is enough for them to match you.


> It doesn't seem much different from the way you're already required to show your physical passport and they check your photo manually.

Well, now they can check your identity anywhere with a camera removing all agency. Yay!


> CBP insists it'll discard photos taken of citizens, and only keep a database of non-citizens.

So only non-citizens would be able to "use" the face-as-boarding-pass "feature"?


And you probably still need to have a boarding pass to get past TSA.


What is tiring me out about all this "technology improvement" in airport check-in is how confusing it is and how often it changes.

There is no one clear process anymore.

Last week I went to board a flight and checked in using the phone app. At the airport I needed to get a baggage ticket so I used the machine there for that, but it basically had me go through the whole check-in all over again. On top of that the first machine errored during the step to pay the baggage fee so I ended up doing that again with another machine.

Afterwards I went to drop off my bag and was told the tag was not "active" and I'd have to go to the desk.

What the hell is the point of any of these electronic options if at the end of it all I still have to wait in line for an agent, stand there while they "mmm-hmmm" at their computer and avoid eye-contact with me for 5 minutes just to finally scan the tag I had printed and attached myself?


Automation and self-serve makes sense even if N% of people fall through the cracks. As long as N is small enough that you can comfortably reduce headcount while not degrading customer experience.


In my case I'm pretty sure N is 100%


Its probably more about info on how they will load the aircraft ahead of time to ensure those calcs are done in time


Privacy concerns aside, I can't wait to read the "Facial Recognition let me on the wrong flight when I got in the wrong line by accident" articles that are going to come out of this. Unless these systems have some fantastic (1e-6) P_{false alarm} rate or better, people are going to be mistaken for other people and let on the wrong flight sooner or later.


I'm predicting perfectly innocent people who happen to have some algorithmic resemblance to some murderers and terrorists to be detained.


They already do this based on names. A former coworker shared his name with his grandfather, and both of them matched the name of a man on the terror watchlist. Naturally, the man was much younger than both of them and of a different nationality, but that didn't stop his grandfather (~50 years older!) from getting stopped and questioned every time he flew.


I was wondering about this. From what I hear it's basically impossible to get a name removed from this watchlist, so short of actually legally changing your name there's basically nothing you can do!?


It's something that was fought around the implementation of the Patriot act, but still needs to be fought. The lack of transparency or ability to easily ask for redress or correction of problems is a significant withholding of due process for many suspects (not convicted or charged) who basically have quasi-warrants out on them by being on the list.

Checking the list via facial recognition adds extra dimensions to the problem, but is the same core problem.


> short of actually legally changing your name

Shh! Don't let the terrorists know!


Honestly I don't care that much about such case. The system is not there to babysit you. In other transportation system if you get on the wrong car/bus, it's your problem.

So you should check your flight and gate number for your own benefit.

Not to mention the chance would be very low, you have to go the wrong flight and the system have to have false positive at you.


Accoding to https://www.faa.gov/air_traffic/by_the_numbers/ there are more than 2.6 million passengers a day. So even with 1e-6 you get a handful of falls alarms each day.

When dealing with large systems, even small probabilities regularly occur.


You need at least 2 people for this mixup to happen...


You don’t, really. Whoever is checked in first gets the seat. The second person will be questioned, and hopefully it will be cleared up. With the number of flights in and out of the US each day, it’s bound to happen unless the false positive rate is extremely low, which would only be possible through an extremely invasive cataloguing of photographs beyond those taken for DMV and Passport photos.


Well, you have to hit a no-show. Gives you maybe another two order of magnitude. And the article might be written even if the misidentification was resolved before the flight leaves.


Here in Australia we have automated passport control gates that scan a chip in our passport then takes a photo of our face (and I assume does some matching with our passport photo) before allowing reentry. It's quite quick and very convenient. Although I'm not aware of any airlines being able to use the system for boarding.


Traveling extensively the past year I have noticed the following which are probably all coming into our lives soon. (a) In many countries border entry is accompanied by a fingerprint scan which will be either a left and right index finger scan or a scan of the whole left hand. The scans are done at inbound border crossings in conjunction with the passport check. (b) In many countries both border exit and entry are paired with the taking of a photograph. In some places it appears the exit photograph is validated automatically by software. (c) In some cities, the subways have security checks at entry and in those places photographs are taken, non obviously, by the security equipment. I am not sure how effective these systems are at tracking. I guessing ideally governments would like to pair these photos with a passive probe of something carried on the body like a phone or official id, something that could link the photo to an already verified identity. (d) On country entry, purchases like SIM cards for local telephone service or public transportation pass cards can only be acquired if one presents an official id. Manual computer entry usually links the card to the presented id.

And here is a prediction, getting a record of faces and fingerprints, and tracking movement is on the agenda right now. In the future there will be a equally focused agenda to acquire records of peoples DNA. In countries where there is nationalized health service, it will eventually be required. Aquisition will begin when the cost of storing, acquiring, and searching that DNA information becomes cheap enough.


Same in Europe. You arrive at Frankfurt Airport. None EU citizens are questioned as if they are terrorists. I go to electronic doors. I put my EU passport to the gate. The camera scans my face and then computer compares it with the photo in my EU passport (there is HD photo within the passport chip). And the door opens. I'm back home in EU. No police, no border control other than that few seconds camera check.

https://en.wikipedia.org/wiki/Biometric_passport

https://play.google.com/store/apps/details?id=nl.innovalor.n...


This is only for going through customs, and controlled by the government, not a private company.


Note that is only for international travel.

In Australia, you don't need an ID for a domestic flight; and non-flyers are permitted to walk to the gate, no boarding pass is required to go through security.


There's some talk about changing this but I hope they don't. It's really convenient to just walk on and fly - you can do Sydney to Melbourne door to door in 2 hours.


I recently flew into Australia (typing this from there). I was so irritated when the scanner wouldn't read my passport for some reason, and I had to stand in the hour-long line at 6 am because of it.

Not sure if my passport chip is broken or the system isn't full proof?


This new system does not require you to present your passport or ticket. It just takes a photo.


Even better, many foreign visitors can use the same system to enter Australia. Lots of countries have fully automated entry for citizens but by doing it for foreigners, Oz is ahead of the game.


I guess now we all know what the REAL ID act was about.

https://www.dhs.gov/real-id


This was somewhat explicitly what REAL ID was about. Provide name age, address and photo to the feds along with any related state ID info (which often correlates easily with fed info). I would not be surprised if airport cameras already put "citizen ids" on photos for the right folks...


IDK enough about this to know who's right, but the DHS denies this:

> Is DHS trying to build a national database with all of our information?

> No. REAL ID is a national set of standards, not a national identification card. REAL ID does not create a federal database of driver license information. Each jurisdiction continues to issue its own unique license, maintains its own records, and controls who gets access to those records and under what circumstances. The purpose of REAL ID is to make our identity documents more consistent and secure.


Exactly... my only real issue with this is that you are restricted from travel by other conventional means (bus), and are also restricted from being able to leave the country without it (of course being up to other countries to let you enter without it).


> Was my image, in the space of those seconds, sent to CBP, run through a database, matched to a name, and then sent back to @JetBlue?

Actually, it was probably done in a fraction of a second.


Yes, that was a funny thing she tweeted. So surprised that a few KB of data was transmitted on a high speed network in under a second. :)


It is annoying that the title of the article is inaccurate. They use an API that calls external government servers to compare the photos.


To be fair, it's not clear how these devices work. It sounds like they are taking a photo, submittiting it to an API and waiting for a result. However FTA linked in the Twitter exchange "preloaded photo databased of all the passengers".

It implies that the devices that JetBlue are using for boarding, already have all the photos in them. If this hardware belongs to JetBlue (rather than CBP/DHS/etc), then one would be correct in saying that JetBlue has the passengers photos. So we really don't know either way how this works.

I'll also add my personal anecdote: Recently I flew internationally out of SFO (I live in the Bay Area) and CBP was there to take "exit photos" of everyone with similar style devices. This was not part of the boarding pass process as we still had to do scan tickets afterwards.


The same article later states

> "We're basically capturing that picture at the boarding gate, providing it to U.S. Customs and Border Protection. They're identifying the traveler," Farrell said. "It's actually the U.S. government that's implementing the biometric matching system that does all the hard analysis and crunching of the data."

So I'd say it's more likely that it is CBP who has the database (and not JetBlue).


I am curious to how this would work if 2 twins travel together. If it would mismatch or demand both to verify with a manual check?


Given the new Travel ID requirements coming up, I'm not surprised in the slightest by this.


Can biometric data be hashed like a password would be? Or is the signal too noisy?


if you regard hashing as dimensionality reduction, there's certainly hashing involved -- some machine learning pipeline will consume high dimensional raw image data and map it into a lower dimensional feature space

on the other hand, for cryptographic hashing we want very similar but inequal inputs to be hashed to wildly different outputs, so a useful hash function should be highly nonlinear / discontinuous, small changes in the input leading to huge changes in the output.

if we're hashing in machine learning, we probably want the hash function to be (crudely) continuous functions -- with "similar" inputs hashed to similar values, so we can operate on the hashed values to cluster or classify things. we dont want a bit of "noise" in the input to produce a massive difference in the lower dimensional feature space.


I would guess they encrypt whatever they send to DHS. Hashing would destroy all the information required to make a match.



I sense there's a business opportunity for "finding another person's data that looks very similar to you according to facial recognition models"...

If there is such a person, you could sign up with their name / birthdate and walk through the control points without having to show your ID (which you didn't bring "because you thought the face ID was sufficient").


Yet another example that if something profitable is both technically possible and legal, it IS being done whether you know about it or not.


Delta too -- though they've been less responsive:

https://twitter.com/RealPressSecBot/status/11232845870635130...


I can bet that they have a copy of all photos on their servers. No company will be foolish enough to build a business/service that relies on another entity, much so a government organization that is not known for building highly scalable services. This is a crucial part of their process and any delays will impact their bottom line. So they have all faces with them and so does every other company. Also, just the face is not enough, they need all the other identifying info associated with it. So they got everything.

Also, the government organization is not foolish enough to build such a service they get to be blamed for. They gave/sold that data away.

Just the face is of no use, the identifying information that goes along with it is also given. So at this point any company in the US can just query your entire info from your photo. Privacy is dead and it is provided as a service by the government. Wonderful.

Question is can anyone get this data?


This is foolish. It would be very dumb for a company to take the liability if they did not have to.


They can say that the photos were stored by mistake and were supposed to be deleted.


They say that the photos are discarded after being compared by the government on government servers with the original.

So you're saying, they're lying. Which might be true. But you'd need to prove that.


> So you're saying, they're lying. Which might be true. But you'd need to prove that.

I've read repeatedly on HN over the past couple of months (re: Boeing and Facebook) that these corporations are required to lie about the naughty things they do. The shareholders' interest must be protected at all cost.


If a company is caught taking on additional risk that they explicitly said they weren't then that is a very good case for shareholders to sue.


While I’m totally onboard with the privacy concerns, this is ridiculous FUD to just assume that every company just took on the security and storage risk of holding that data. Find me an enterprise department/exec that would willingly take that on to support a trial.

The corporate bogeyman is a great story but I think you’re being a little unrealistic here. These systems typically allow the picture to be sent in with a name, and the system returns a success or fail response.


I don’t think so. I am being completely reasonable and rational here. Let me ask this, what is special about JetBlue? If JetBlue doesn’t host the service on their data centers would they be willing to offer such a service? If a government agency can reasonably be expected to not play favorites and offer the service to anyone within reason, do you think they will be able to scale it up and offer the kind of SLAa expected by money making businesses? Why would an agency want to get in to that endeavor?

Please, offer me alternative view points rather than calling my theory FUD.


Presumably the airline could always fall back on traditional paper/mobile boarding passes if the system goes down. It’d mean a bit of a delay, but it’s not like the whole operation would grind to a halt.

It’s true that we have no guarantee that the airlines won’t save our photos along with our ID information, but they _could_ already have been doing that for years. There just doesn’t seem to be that much reason why they would.


JetBlue doesnt need to do this. Why would they take the risk? You are being a bit ridiculous.


I don’t disagree with your overarching point, but it can’t be quite that simple, if it works as advertised. In order for it to send a name with the photo, the passenger would have to scan some sort of documentation to provide their name, which would defeat the purpose of “your face is your boarding pass”.

It seems more likely that the CBP system compares against passenger manifests of upcoming flights. Which isn’t necessarily more intrusive, but it is a bit less straightforward than a simple yes/no query.


>No company will be foolish enough to build a business/service that relies on another entity,

It's an airline operating at an airport. That operation is already inseparably interwoven with number of other organizations - including the government - just to move a tube full of people from point A to B.

>much so a government organization that is not known for building highly scalable services

In that case, it's good for them that they have such a highly predictable load target. Airports have a fixed number of gates and a maximum number of planes ATC can smoothly get into the air in an hour. There's your upper bound. Flight plans and ticket sales set the normal band and refine the performance target. Load can be well understood, and they have lots of visibility into future demand changes.

>This is a crucial part of their process

It's a pilot program. As much as I doubt they'd let this system ever be a single point of failure under normal operation, an experimental system certainly has a fallback plan for boarding.


>This is a crucial part of their process and any delays will impact their bottom line.

If the government servers go down, JetBlue can fall back to checking paper boarding passes.


Probably it's all stored in plain text on an unsecured S3 bucket.


I work for a large company that uses genomics data for health care related research. The GDPR is a huge pain in our butts. But man do I love the "people over companies" attitude of this law as a citizen.


It's kind of surprising that we're still surprised by this.


It's good that we are surprised. The total surveillance system is being normalized far too quickly.

At this rate, in 10 years we will see even more "conveniences" like for example automatic face id in shops and on websites that pull your payment information and can authorize payments from your card/account - with no setup.

People will say "Kinda spooky how they can just take my money automatically but it's convenient" and you'll be there to say "It's kind of surprising that we're still surprised by this." ;-) I hope!

That will be underpinned by even larger surveillance and data collections on people, that can do a lot of harm when/if data is leaked or the systems are breached.


This is already closer than you think, Amazon actually has a physical store exactly like this: https://www.amazon.com/b?ie=UTF8&node=16008589011


see also how Runa Sandvik got a copy of all her photos from the DHS:

https://medium.com/matter/how-i-requested-my-photographs-fro...


Honestly, if implanting a chip in my arm meant I could just walk through immigration/customs/check-in without carrying anything I'd do it. I have Global Entry so things are already pretty good but I'd give them anything to ease the process. And it's not like I'm going to lose my arm in the normal run of play so that's even better than my passport.


This is dope


[flagged]


Isn't it a bit different have a photo tied to an ostensibly anonymous internet account which you have control over, and have a photo that is legally tied to your person and leased out by the government?


The person's twitter account uses their given name with a personal photo. So replace "ostensibly" with "absolutely not."

Also, let's assume we're talking reality and not theory. Given that, what's the difference between JetBlue querying a proprietary goldmine of data (or multiple ones) vs. querying a (probably) proprietary goldmine of data that was collected through a contract with DHS?

In either instance, the short term solution would be to generate negative publicity for JetBlue until they cancel the program. Also in either instance, the only conceivable way to keep the goldmine off limits would be through federal legislation.


I think the horse has already left the barn. An individual with $500 worth of equipment could quickly create a database of facial biometrics for a good portion of his city. What kind of legislation could prevent this? Outlaw private ownerships of cameras and computers? I do not think there is any way to stop what is coming...


"I think the horse has already left the barn. An individual with $500 worth of equipment could disrupt cellphone reception along an entire corridor of an interstate. What kind of legislation could prevent this? Outlaw private ownership of SDR? I do not think there is any way to stop what is coming..."

Keep in mind that story was just about a single driver's concern over safety. There is also a huge economic incentive for hotels and other business to disrupt signals to force people to pay to use their own wifi services. Marriott tried that. Guess what the consequence was.

So if the horse has already left the barn, how do you explain the fact that cell phone towers seem to work in practice, esp. in large cities like NYC and LA? How is it that nearly every single baseband OS in existence is locked down to comply with FCC regulations?


It's the power inherent to the holder of that database that makes the difference...


CBP already has my photo and name from my passport.


This about consent and control.


Disagree. There is nothing private about your face. It's feigned outrage.


Right, anyone can take a picture of you in a public place, such as an airport, without consent. You give your picture to the government for passports and drivers licenses. You don't have to consent to them comparing the two.


That's just bizarre. This would never, ever, fly under the GDPR.


it would actually, biometric ids etc are allowed for various regulated reasons -- identifying folks who cross national boundaries is likely one of them


I’ve used similar systems recently in Europe so it would appear GDPR is cool with it...

It seems they are simply asking for identify verification by sending the photo to a remote DHS server for verification. How is this different than showing a ticket agent your passport and having them scan it? That’s the same photo in question. GDPR doesn’t get you out of having to verify your identity in person against a government photo for boarding a flight.

In fact, one could argue the method in question is actually more secure and private because you never actually have to share your passport photo directly with JetBlue.


Implying that European states would pass laws that limited their power over the cizitenry.


I believe that if you study the language of the GDPR, you'll find that "it's OK if the government does it."


In this case since the company does not store the images GDPR doesn’t apply.


Even if they don't retain the images, it's a veritable treasure trove for security agencies, who will almost certainly be hoovering them up, either with or without the company's knowledge.


It's been a few years since I traveled international - but CBP already takes pictures at passport control, don't they?


I have never had my picture taken while leaving the United States, which is what this sounds like. Arriving? Sure.


You have not had this knowingly. You have not posed for a photo.

But surely, the government has plenty of cameras in customs areas and face recognition has been a thing for a decade.


Now think about the attributes they're recording from your phone when you approach.


You don't go through customs areas to leave the US, though.

Maybe the TSA does it, of course.


Doesn't the GDPR also apply to entities that process personal data (as opposed to only those that store it)?

AFAIK it should apply to entities that share personal data with third parties, for instance.


If I am understanding this correctly this would be ok under the GDPR because the government is the one holding the data bag.

They got the images from CBP.


Are you sure? According to what the airline said, the airline doesn't have the facial recognition data; rather they are just taking photos from passengers who opt in to board via this method, and the photos only need to be stored for a few seconds so they can be sent to DHS for verification.

The airline isn't taking or storing photos of passengers who don't opt into this process, but it is presumably sending the government a list of all passengers prior to boarding so that photos of passengers who opt in can be verified. Would this violate the GDPR?


> According to what the airline said, the airline doesn't have the facial recognition data

I absolutely do not believe the tweets from a company PR representative as to how their technology actually works.


Regardless of whether this PR person knows anything or not, I think the much more likely scenario is that they are sending facial recognition requests to a CBP API vs. building their own facial recognition database with 100s of millions of identities out of thin air.


But they have your photo after they take it, and the CBP verifies for them who you are. From this information transfer, the airline can replicate the CBP database entry for each person that it takes a picture of... In the long run, they can build a facial recognition database of everyone who flies. Am I wrong about this?


No, but whether they actually are or not is another question.

They could also build the same database 10 years ago by taking your picture as you scanned your boarding pass.


I haven't done international travel (by normal means), have they always taken your picture for that? Thanks for the info!


No, but they could surreptitiously take your photo if they wanted to. I doubt there is much expectation of privacy at an airport gate


If the database of photos has a business value then they will be looking for loopholes to store them. It would be stupid to spend money on new equipment and not maximize the returns.


do you actually believe that the twitter PR person has enough technical knowledge of this process to make such bold claims as to whether they store people's data or not? And if you do believe they would have enough knowledge, do you believe they would EVER tell the truth?


I believe the PR person have the knowledge by proxy, someone is directing him. I also believe that DHS won't give them sensitive information without requiring them to conform to the relevant regulations.

I can't say I'm certain it is fail-proof, and it defiantly can feel spooky but not everybody is lying to you all the time.

From the article the PR quoted, I arrived to the relevant executive order that facilitated this, section 8: https://www.whitehouse.gov/presidential-actions/executive-or...


The government already sees all the flight manifests. Assuming that it also has a database of photos from passports, the matching process doesn't violate anyone's privacy, since they opted in to have their photo matched in the first place.


s/who opt in/who don't opt out/ according to the tweets.

But you're right, and the process is surprisingly reasonable as long as the implementation is safe


Driver's licenses surely have photos still in EU nations, right? I don't think the GDPR speaks to this.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: