Rule2025-19655
Collection of Biometric Data From Aliens Upon Entry to and Departure From the United States
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
October 27, 2025
Effective
December 26, 2025
Issuing agencies
Homeland Security Department
Abstract
This final rule amends Department of Homeland Security (DHS) regulations to provide that DHS may require all aliens to be photographed when entering or exiting the United States, and may require non-exempt aliens to provide other biometrics. The final rule also amends the regulations to remove the references to pilot programs and the port limitation to permit collection of biometrics from aliens departing from airports, land ports, seaports, or any other authorized point of departure. In addition, DHS is requesting comments on the specific collection process as well as costs and benefits for new transportation modalities.
Full Text
<html>
<head>
<title>Federal Register, Volume 90 Issue 205 (Monday, October 27, 2025)</title>
</head>
<body><pre>
[Federal Register Volume 90, Number 205 (Monday, October 27, 2025)]
[Rules and Regulations]
[Pages 48604-48645]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2025-19655]
Vol. 90
Monday,
No. 205
October 27, 2025
Part II
Department of Homeland Security
-----------------------------------------------------------------------
8 CFR Parts 215 and 235
-----------------------------------------------------------------------
Collection of Biometric Data From Aliens Upon Entry to and Departure
From the United States; Final Rule
Federal Register / Vol. 90 , No. 205 / Monday, October 27, 2025 /
Rules and Regulations
[[Page 48604]]
-----------------------------------------------------------------------
DEPARTMENT OF HOMELAND SECURITY
8 CFR Parts 215 and 235
[Docket No. USCBP-2025-0033; CBP Dec. 25-06]
RIN 1651-AB12
Collection of Biometric Data From Aliens Upon Entry to and
Departure From the United States
AGENCY: U.S. Customs and Border Protection, DHS.
ACTION: Final rule with request for comments.
-----------------------------------------------------------------------
SUMMARY: This final rule amends Department of Homeland Security (DHS)
regulations to provide that DHS may require all aliens to be
photographed when entering or exiting the United States, and may
require non-exempt aliens to provide other biometrics. The final rule
also amends the regulations to remove the references to pilot programs
and the port limitation to permit collection of biometrics from aliens
departing from airports, land ports, seaports, or any other authorized
point of departure. In addition, DHS is requesting comments on the
specific collection process as well as costs and benefits for new
transportation modalities.
DATES:
Effective Date: This rule is effective on December 26, 2025.
Submission of public comments: Comments must be submitted on or
before November 26, 2025.
ADDRESSES: You may submit comments regarding the specific collection
process as well as costs and benefits for the newly implemented
transportation modalities (the Simplified Arrival process at air entry,
sea entry processes, and the process for entry for pedestrians at land)
to the Federal eRulemaking Portal: <a href="https://www.regulations.gov">https://www.regulations.gov</a>. Follow
the instructions for sending comments.
Instructions: All submissions received must include the agency name
and docket number USCBP-2020-0062 or RIN number 1651-AB12. All comments
received will be posted without change to <a href="http://www.regulations.gov">http://www.regulations.gov</a>,
including any personal information provided. For detailed instructions
on submitting comments, see the ``Public Participation'' heading of the
SUPPLEMENTARY INFORMATION section of this document.
Docket: For access to the docket to read background documents or
comments received, go to <a href="http://www.regulations.gov">http://www.regulations.gov</a>.
FOR FURTHER INFORMATION CONTACT: Larry Panetta, Director, Biometrics
Program Office, Office of Field Operations, U.S. Customs and Border
Protection, by phone at (202) 344-1253 or via email at
<a href="/cdn-cgi/l/email-protection#24484556565d0a450a54454a41505045644746540a404c570a434b52"><span class="__cf_email__" data-cfemail="45292437373c6b246b35242b20313124052627356b212d366b222a33">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Public Participation
II. Executive Summary
A. Notice of Proposed Rulemaking
B. Background and Purpose of the Rule
C. Costs, Cost Savings, and Benefits
III. Background
A. National Security and Immigration Benefits of a Biometric
Entry-Exit Program
B. Facial Comparison-Based Entry-Exit Process Pursuant to This
Final Rule
1. Benefits of a Facial Comparison-Based Process
2. Facial Comparison Technology Gallery Building
3. General Collection Process
4. Facial Comparison-Based Entry Process
5. Facial Comparison-Based Exit Process
6. Alternative Procedures and Public Notice
7. No Match Procedures
8. U.S. Nationals, Dual Nationals and Lawful Permanent Residents
9. Business Requirements for Public-Private Partnerships
IV. Summary of Changes to the Biometric Entry and Exit Regulations
A. General Biometric Exit Requirement for Aliens
B. Collection of Photographs From Aliens Upon Entry and
Departure
C. Collection of Biometrics When Departing the United States and
Other Minor Conforming and Editorial Changes
V. Discussion of Comments Submitted in Response to the NPRM
A. Overview
B. Discussion of Comments
1. Comments Expressing General Support
2. Comments Expressing General Support With Recommendations
3. Comments Expressing General Inquiries
4. Comments Expressing General Opposition
VI. Statutory and Regulatory Requirements
A. Executive Orders 12866, 13563, and 14192
B. Regulatory Flexibility Act
C. Unfunded Mandates Reform Act of 1995
D. Paperwork Reduction Act
E. Privacy
F. National Environmental Policy Act
Table of Abbreviations and Acronyms
ADIS--Arrival and Departure Information System
APA--Administrative Procedure Act
APIS--Advance Passenger Information System
CBP--U.S. Customs and Border Protection
DHS--Department of Homeland Security
DHS DPIAC--DHS Data Privacy and Integrity Advisory Committee
DHS TRIP--DHS Traveler Redress Inquiry Program
DHS FIPPS--DHS Fair Information Practice Principles
DOT--Department of Transportation
FBD--Facial Biometric Debarkation
FIS area--Federal Inspection Service area
FOIA--Freedom of Information Act
FY--Fiscal Year
GAO--Government Accountability Office
HART--Homeland Advanced Recognition Technology
IDENT--Automated Biometric Identification System
INA--Immigration and Nationality Act
LPR--lawful permanent resident
NARA--National Archives and Records Administration
NIST--National Institute of Standards and Technology
NPRM--Notice of Proposed Rulemaking
OBIM--Office of Biometric Identity Management
OMB--Office of Management and Budget
PIA--Privacy Impact Assessment
PII--personally identifiable information
PCLOB--Privacy and Civil Liberties Oversight Board
RFA--Regulatory Flexibility Analysis
SORN--System of Records Notice
S&T--Science and Technology
TSA--Transportation Security Administration
TVS--Traveler Verification Service
USCIS--United States Citizenship and Immigration Services
VWP--Visa Waiver Program
I. Public Participation
Interested persons are invited to participate in this rulemaking by
submitting written data, views, or arguments on the specific collection
process, as well as costs and benefits regarding the newly implemented
transportation modalities for facial biometric collection, namely, the
Simplified Arrival process at air entry, the sea entry processes, and
the process for entry for pedestrians at land ports. Comments that will
provide the most assistance will reference a specific portion of the
final rule, explain the reason for any recommended change, and include
data, information, or authority that supports such recommended change.
All submissions received must include the agency name and docket number
for this rulemaking. All comments received will be posted without
change to <a href="http://www.regulations.gov">http://www.regulations.gov</a>, including any personal
information provided.
Comments submitted regarding any topic other than the specific
collection process and costs and benefits on these newly implemented
transportation modalities are out of scope for this final rule and will
not be considered.
II. Executive Summary
A. Notice of Proposed Rulemaking
On November 18, 2020, the Department of Homeland Security
[[Page 48605]]
(DHS) published a Notice of Proposed Rulemaking in the Federal Register
(85 FR 74162) (hereinafter referenced as ``the NPRM'') proposing to
amend the DHS regulations with regard to collection of biometrics from
aliens entering and exiting the United States.\1\ On February 10, 2021,
DHS published a notice in the Federal Register (86 FR 8878) stating
that it was reopening the comment period for an additional 30 days
based on comments received during the initial comment period.
---------------------------------------------------------------------------
\1\ The NPRM referred to ``aliens'' as ``noncitizens.'' This
final rule uses the statutory term ``alien'' as appropriate.
---------------------------------------------------------------------------
DHS received a total of 320 comments in response to the NPRM. The
submissions included comments supporting the rule, requesting
clarification, providing suggestions for changes, and voicing concerns.
After review of the comments, through this final rule, DHS is
finalizing the proposed changes in the NPRM without substantive
modification.
B. Background and Purpose of the Rule
DHS is mandated by statute to develop and implement an integrated,
automated entry and exit data system to match records, including
biographic data and biometrics,\2\ of aliens entering and departing the
United States.\3\ DHS also has broad authority to control alien travel
and to inspect aliens under various provisions of the Immigration and
Nationality Act of 1952, Public Law 82-414, 66 Stat. 163, as amended
(INA), which may include requiring aliens to provide biometrics and
other relevant identifying information upon entry to, or departure
from, the United States.\4\ DHS, through U.S. Customs and Border
Protection (CBP), has been collecting biometric data from certain
aliens arriving in the United States since 2004.\5\ However, currently
there is no comprehensive system in place to collect biometrics from
aliens departing the country.
---------------------------------------------------------------------------
\2\ Biographic data includes information specific to an
individual traveler such as name, date of birth, and travel document
number, which are data elements stored in that traveler's passport,
visa, or lawful permanent resident card. Biometrics refers to forms
of identification based on anatomical, physiological, and behavioral
characteristics or other physical attributes unique to a person that
can be collected, stored, and used to verify the identity of a
person, e.g., fingerprints, photographs, iris, DNA, and voice print.
See Executive Office of the President, National Science and
Technology Council, Subcommittee on Biometrics, ``The National
Biometrics Challenge,'' September 2011, available at <a href="https://www.bing.com/ck/a?!&&p=e3dc11c7c1aa323eJmltdHM9MTcyOTIwOTYwMCZpZ3VpZD0zYmYzOTY1ZS01ZjU1LTY0YmItMTUzMC04MjJhNWUxYTY1MDQmaW5zaWQ9NTE5OA&ptn=3&ver=2&hsh=3&fclid=3bf3965e-5f55-64bb-1530-822a5e1a6504&psq=the+national+biometrics+challenge+2011&u=a1aHR0cHM6Ly9vYmFtYXdoaXRlaG91c2UuYXJjaGl2ZXMuZ292L3NpdGVzL2RlZmF1bHQvZmlsZXMvbWljcm9zaXRlcy9vc3RwL2Jpb21ldHJpY3NjaGFsbGVuZ2UyMDExLnBkZg&ntb=1">https://www.bing.com/ck/a?!&&p=e3dc11c7c1aa323eJmltdHM9MTcyOTIwOTYwMCZpZ3VpZD0zYmYzOTY1ZS01ZjU1LTY0YmItMTUzMC04MjJhNWUxYTY1MDQmaW5zaWQ9NTE5OA&ptn=3&ver=2&hsh=3&fclid=3bf3965e-5f55-64bb-1530-822a5e1a6504&psq=the+national+biometrics+challenge+2011&u=a1aHR0cHM6Ly9vYmFtYXdoaXRlaG91c2UuYXJjaGl2ZXMuZ292L3NpdGVzL2RlZmF1bHQvZmlsZXMvbWljcm9zaXRlcy9vc3RwL2Jpb21ldHJpY3NjaGFsbGVuZ2UyMDExLnBkZg&ntb=1</a>.
(Last visited May 15, 2025.)
\3\ Numerous federal statutes require DHS to create an
integrated, automated biometric entry and exit system that records
the arrival and departure of aliens, compares the biometric data of
aliens to verify their identity, and authenticates travel documents
presented by such aliens through the comparison of biometrics. These
include: section 110 of the Illegal Immigration Reform and Immigrant
Responsibility Act of 1996 (IIRIRA), Public Law 104-828, 110 Stat.
3009-546, 3009-558; section 2(a) of the Immigration and
Naturalization Service Data Management Improvement Act of 2000
(DMIA), Public Law 106-215, 114 Stat. 337, 338; section 205 of the
Visa Waiver Permanent Program Act of 2000, Public Law 106-396, 114
Stat. 1637, 1641; section 414 of the Uniting and Strengthening
America by Providing Appropriate Tools Required to Intercept and
Obstruct Terrorism Act of 2001 (USA PATRIOT Act), Public Law 107-56,
115 Stat. 272, 353; section 302 of the Enhanced Border Security and
Visa Entry Reform Act of 2002 (Border Security Act), Public Law 107-
173, 116 Stat. 543, 552; section 7208 of the Intelligence Reform and
Terrorism Prevention Act of 2004 (IRTPA), Public Law 108-458, 118
Stat. 3638, 3817; section 711 of the Implementing Recommendations of
the 9/11 Commission Act of 2007 (Implementing Recommendations of the
9/11 Commission Act), Public Law 110-53, 121 Stat. 266, 338; and
section 802 of the Trade Facilitation and Trade Enforcement Act of
2015, Public Law 114-125, 130 Stat. 122, 199 (6 U.S.C. 211(c)(10)).
\4\ See INA 214, 215(a), 235(a), 262(a), 263(a), 264(c), 287(b)
(8 U.S.C. 1184, 1185(a), 1225(a), 1302(a), 1303(a), 1304(c)),
1357(b)).
\5\ See the NPRM, 85 FR at 74169 for more information.
---------------------------------------------------------------------------
Implementing an integrated biometric entry-exit system that
compares biometric data of aliens collected upon arrival with biometric
data collected upon departure helps address the national security
concerns arising from the threat of terrorism, the fraudulent use of
legitimate travel documentation, aliens who remain in the United States
beyond their period of authorized stay (overstays) or are present in
the United States without being admitted or paroled, as well as
incorrect or incomplete biographic data for travelers. As recognized by
the National Commission on Terrorist Attacks Upon the United States
(also known as the 9/11 Commission), combatting terrorism requires a
screening system that examines individuals at multiple points within
the travel continuum.\6\ An integrated biometric entry-exit system
provides an accurate way to verify an individual's identity, and,
consequently, can improve security and effectively combat attempts by
terrorists who use false travel documents to circumvent border
checkpoints. An integrated biometric entry-exit system can also be used
to biometrically verify that a person who presents a travel document is
the true bearer of that document, which will help prevent visa fraud
and the fraudulent use of legitimate travel documentation.
---------------------------------------------------------------------------
\6\ The 9/11 Commission Report 384-386 (2004), available at
<a href="https://9-11commission.gov/report/">https://9-11commission.gov/report/</a> (last visited May 15, 2025). See
also the NPRM, 85 FR at 74107.
---------------------------------------------------------------------------
Such a system will also allow DHS to confirm more concretely the
identity of aliens seeking entry or admission to the United States and
to verify their departure from the United States. By having more
accurate border crossing records of aliens, DHS can more effectively
identify overstays and aliens who are, or were, present in the United
States without being admitted or paroled and prevent their potential
unlawful reentry into the United States. It will also make it more
difficult for imposters to utilize other travelers' credentials. In
addition, performing biometric identity verification can help DHS
reconcile any errors or incomplete data in a traveler's biographic
data.\7\ Ultimately, this provides DHS with more reliable information
to verify identities and to strengthen its ability to identify
criminals and known or suspected terrorists.
---------------------------------------------------------------------------
\7\ See the NPRM, 85 FR at 74107 for more information on how
biometric identity verification mitigates risks including overstays,
unlawful reentry, and other risks.
---------------------------------------------------------------------------
DHS has faced a number of logistical and operational challenges in
developing and deploying a biometric exit capability. This is, in part,
because U.S. ports generally do not have designated and secure exit
areas for conducting outbound inspections, recording travelers'
departures, or comparing biometric information against arrival data.
As stated in the NPRM, CBP has been testing various options to
collect biometrics at entry and departure.\8\ The results of these
tests and the recent advancement of new technologies, including facial
comparison technology, have provided CBP with a model to implement a
comprehensive biometric entry-exit solution. Based on these tests, CBP
determined that facial comparison technology is currently the best
available method for biometric verification, as it is accurate,
unobtrusive, and efficient.\9\ This technology uses existing advance
passenger information along with photographs, which have already been
provided by travelers to the U.S. government for the purpose of
facilitating international travel, to create galleries of facial image
templates to correspond with who is expected to be
[[Page 48606]]
arriving in or departing from the United States on a particular flight,
voyage, etc. These photographs may be derived from passport
applications, visa applications, immigration applications, or
interactions with CBP at a prior border inspection. Once the gallery is
created based on the advance information, the facial comparison
technology compares a template of a live photograph of the traveler to
the gallery of facial image templates. Live photographs are taken where
there is clear expectation that travelers will need to provide
documentary evidence of their identity. If there is a facial image
match, the traveler's identity has been verified. In select cases,
fingerprints may also need to be collected, but only as required to
better establish links to previously collected traveler biometric
records.
---------------------------------------------------------------------------
\8\ See the NPRM, 85 FR at 74171-74173 for a discussion of these
tests.
\9\ See the NPRM, 85 FR at 74173-74178 for a discussion of the
benefits of a biometric entry-exit system based on facial
recognition.
---------------------------------------------------------------------------
CBP has fully implemented its facial comparison system in the
commercial air environment at entry through a process known as
Simplified Arrival. CBP has implemented exit in the air environment
primarily through partnerships with airlines at select locations. CBP
has also fully implemented facial comparison biometrics at entry in the
sea environment through processes known as Facial Biometric Debarkation
(FBD), Mobile Primary Face, and Simplified Arrival Sea, and at entry in
the pedestrian land environment through a process known as Pedestrian
Entry. CBP plans to eventually establish a biometric entry-exit system
at all air, sea, and land ports of entry. See CBP, Biometrics, <a href="https://www.cbp.gov/travel/biometrics">https://www.cbp.gov/travel/biometrics</a> (last modified April 24, 2025) (last
visited May 12, 2025).
As noted above, in this final rule, CBP is seeking comments
regarding the specific collection process as well as costs and benefits
for these newly implemented transportation modalities (the Simplified
Arrival process at air entry, sea entry processes, and the process for
entry for pedestrians at land).
CBP estimates that a biometric entry-exit system can be fully
implemented at all commercial airports and sea ports for both entry and
exit within the next three to five years. CBP plans to continue to work
to determine the best option for implementing a comprehensive biometric
entry-exit system nationwide, which may include pilot programs to test
various options for travelers at exit in the sea and pedestrian land
environment as well as for travelers entering and exiting in vehicles
at land ports and on private aircraft.\10\ The regulatory changes
adopted in this rule are necessary to enable CBP to continue its
refinements, and implement facial comparison efficiently once the best
solution is identified. As explained in the NPRM, prior to
implementation of this rule, CBP could only conduct pilot programs at a
limited number of air and sea ports of entry and could only collect
biometrics from a limited population.
---------------------------------------------------------------------------
\10\ Private aircraft are those engaged in non-commercial
flights, sometimes referred to as general aviation. See section
122.1(h) of title 19 of the Code of Federal Regulations (CFR) (19
CFR 122.1(h)).
---------------------------------------------------------------------------
This final rule advances the legal framework for DHS collection and
use of biometrics from aliens through a comprehensive biometric entry-
exit system by removing the references to pilot programs and the port
limitations and requiring facial comparison biometrics from all aliens
on entry and exit. See 8 CFR 215.8(a) and 235.1(f). Because CBP is
still determining the best way to implement biometric entry-exit in
certain environments, as listed above, CBP has not included in this
rule an analysis of the costs and benefits for those environments that
are not yet operational. When CBP moves forward with a large-scale
implementation of biometric entry-exit for vehicles at land ports and
private aircraft or biometric exit at pedestrian land or sea ports, CBP
will publish a notice in the Federal Register with information
regarding details of implementation and request comments on the newly
implemented transportation modalities.
This final rule provides that all aliens may be required to be
photographed upon entry and/or departure. Facial comparison technology
upon entry and departure makes the process for verifying aliens'
identities more efficient and accurate. It enables CBP to match the
travelers' biometric photographs with their biographic information. The
ability to biometrically verify the identity to confirm the departure
of aliens will improve security, comply with federal statutory
requirements, and help DHS detect overstays and aliens who are or were
present in the United States without being admitted or paroled and
prevent their illegal reentry. Having accurate entry and exit records
is a fundamental piece of the U.S. immigration system and detecting
overstays supports that system. Remaining in the United States beyond
the period of authorized stay is unlawful and carries consequences for
future visits to the United States. See INA 212(a)(9)(B) (8 U.S.C.
1182(a)(9)(B)). Ensuring the travelers' photographs match with their
vetted biographic and biometric information also helps CBP prevent
document fraud and the use of fraudulent travel documents, or the use
of legitimate travel documents by imposters (thereby also assisting in
combatting identity theft), and to identify criminals and known or
suspected terrorists.
CBP will comply with all legal requirements (e.g., the Privacy Act
of 1974, 5 U.S.C. 552a (Privacy Act), section 208 of the E-Government
Act of 2002, Public Law 107-347, 116 Stat. 2899, 2921 (44 U.S.C. 3501
note) (E-Government Act), and section 222 of the Homeland Security Act
of 2002, Public Law 107-296, 116 Stat. 2135, as amended (Homeland
Security Act) (6 U.S.C. 142)) and departmental and government-wide
policies that govern the collection, use, maintenance, and disposition
of personally identifiable information (PII), including biometrics. As
discussed in section III.B.6 of this final rule, U.S. citizens \11\ may
voluntarily participate in the biometric verification process. To
minimize the data collected on U.S. citizens, CBP will not retain
photographs of U.S. citizens collected as part of CBP's biometric
verification program in CBP databases once CBP verifies that a traveler
is a U.S. citizen. Encounter photos of U.S. citizens will be used
exclusively for identity verification purposes and any photos of U.S.
citizens will be discarded within 12 hours of verification of the
individual's identity and citizenship.
---------------------------------------------------------------------------
\11\ For the purposes of opt out and photo retention policies,
U.S. non-citizen nationals are treated the same as U.S. citizens.
---------------------------------------------------------------------------
C. Costs, Cost Savings, and Benefits
CBP anticipates that during the time period of analysis (2017-2029)
this final rule will result in costs, cost savings, and benefits to
CBP, approved partners, and travelers. CBP estimates total costs to
CBP, outbound air travelers, inbound pedestrian travelers, and approved
partners will range between $1.3 billion (in discounted 2024 U.S.
dollars) using a three percent discount rate and $993 million (in
discounted 2024 U.S. dollars) using a seven percent discount rate.
Annualized costs are estimated to be between $122 million using a three
percent discount rate and $119 million using a seven percent discount
rate. Meanwhile, total cost savings to inbound air and sea travelers,
and CBP, will be between $578 million (in discounted 2024 U.S. dollars)
using a three percent discount rate and $406 million (in discounted
2024 U.S. dollars) using a seven percent discount rate. Annualized
total cost savings are estimated to range between $54 million using a
three percent discount rate, to $49 million using a seven percent
discount rate. Total net costs from the
[[Page 48607]]
implementation of this final rule are expected to range between $722
million (in discounted 2024 U.S. dollars) using a three percent
discount rate to $587 million (in discounted 2024 U.S. dollars) using a
seven percent discount rate. Annualized net costs are estimated to
range between $68 million using a three percent discount rate and $70
million using a seven percent discount rate.\12\
---------------------------------------------------------------------------
\12\ In the economic analysis for this final rule, CBP used a 3%
and 7% discount rate showing values in discounted 2024 U.S. dollars,
for estimated future quantified and monetized costs, costs savings
and benefits.
---------------------------------------------------------------------------
Additionally, some travelers may perceive having their photographs
taken for facial comparison as a loss of privacy; however, CBP could
not quantify these costs. Other cost savings that CBP was unable to
monetize were an estimated time savings to vessel carriers from a
swifter debarkation process when using Facial Biometric Debarkation,
approximately 1.25 hours per vessel arrival. Improving national and
homeland security efforts through the application of facial comparison
technology during biometric identification of individuals entering and
leaving the United States is the primary benefit of this final rule.
CBP was unable to quantify these enhanced security benefits. Table 1
below shows CBP's estimates for future annualized costs, costs savings,
benefits, and net costs from this final rule using three and seven
percent discount rates over the period of analysis (2017-2029).
Table 1--Estimated Annualized Cost, Cost Savings, Benefits (2017-2029)
[Discounted thousands of 2024 U.S. dollars]
------------------------------------------------------------------------
3% Discount rate 7% Discount rate
------------------------------------------------------------------------
Costs
------------------------------------------------------------------------
Annualized monetized costs...... $122,259.......... $118,870.
Annualized quantified, but not None.............. None.
monetized costs.
Qualitative (non-quantified) Perceived privacy Perceived privacy
costs. loss. loss.
------------------------------------------------------------------------
Cost Savings
------------------------------------------------------------------------
Annualized monetized cost $54,355........... $48,599.
savings.
Annualized quantified, but not None.............. None.
monetized cost savings.
Qualitative (non-quantified) None.............. None.
cost savings.
------------------------------------------------------------------------
Benefits
------------------------------------------------------------------------
Annualized monetized benefits... None.............. None.
Annualized quantified, but not None.............. None.
monetized benefits.
Qualitative (non-quantified) Enhanced National Enhanced National
benefits. Security and Security and
identification of identification of
visa overstays. visa overstays.
Once fully Once fully
implemented implemented
possible shorter possible shorter
plane turnaround plane turnaround
times. times.
Net Costs Annualized............ $67,904........... $70,271.
------------------------------------------------------------------------
III. Background
As discussed above, CBP is responsible for implementing an
integrated, automated entry-exit system that matches the biographic
data and biometrics of aliens entering and departing the United States.
Furthermore, to carry out its mission responsibilities to control the
border and to regulate the arrival and departure of both U.S. citizens
and aliens, CBP has the authority to confirm the identity of all
travelers and verify that they are the authorized bearers of their
travel documents. See INA 287(b) (8 U.S.C. 1357(b)).
A. National Security, Public Safety, and Immigration Benefits of a
Biometric Entry-Exit Program
The primary benefit of a biometric entry-exit system is the
enhanced security provided by having biometric confirmation of the
identification of alien travelers entering and leaving the United
States. CBP has a comprehensive automated biographic information-based
system that vets and checks aliens entering and departing the United
States. Although this information is extremely valuable to CBP in
completing its mission, no biographic information-based system, by
itself, can definitively verify the identity of persons presenting
travel and identity documents. Modern e-passports can make passport
fraud more difficult. However, the best tool to combat passport fraud
is to utilize the digital photos contained in e-passports to
biometrically verify that a person who presents a travel document is
the true bearer of that document. CBP's biometric tests using facial
comparison technology support this conclusion.\13\ DHS expects that the
implementation of this rule will greatly enhance DHS's ability to
identify more of these imposters.
---------------------------------------------------------------------------
\13\ See the NPRM, 85 FR at 74167-74169 for more discussion on
how e-passports mitigate fraud.
---------------------------------------------------------------------------
In addition to the benefits this technology can provide on entry,
an integrated system, including biometric exit, is also essential for
maintaining the integrity of the U.S. immigration system. Under current
statutes and regulations, entering or staying in the United States
without official permission from the U.S. government can cause a person
to be legally barred from reentry to the United States for a number of
years following that person's departure or
[[Page 48608]]
removal.\14\ The absence of an effective biometric exit process has
enabled aliens who are present in the United States without being
admitted or paroled or who overstayed their authorized period of
admission (overstays) to evade immigration laws and avoid the time bars
associated with unlawful presence. For Fiscal Year (FY) 2022, DHS
estimates that about 853,955 aliens who entered by air or sea and were
expected to depart that year overstayed their lawful period of
admission, or 3.67 percent of aliens arriving by air and sea.\15\
Through its deployment of biometric exit pilots, CBP has been able to
process and document hundreds of aliens who were present in the United
States without being admitted or paroled.\16\ Additionally, biometric
exit verification can allow CBP to address errors that sometimes appear
in an alien's biographic data.
---------------------------------------------------------------------------
\14\ See INA 212(a)(9)(B) and 217(a)(7) (8 U.S.C. 1182(a)(9)(B)
and 8 U.S.C. 1187(a)(7)); see also 8 CFR 217.4(a).
\15\ DHS, FY 2023 Entry/Exit Overstay Report (2024), <a href="https://www.dhs.gov/sites/default/files/2024-10/24_1011_CBP-Entry-Exit-Overstay-Report-FY23-Data.pdf">https://www.dhs.gov/sites/default/files/2024-10/24_1011_CBP-Entry-Exit-Overstay-Report-FY23-Data.pdf</a> (last visited May 15, 2025).
\16\ See generally Enterprise Management Information System-
Enterprise Data Warehouse (internal CBP reporting system); and CBP,
DHS/CBP/PIA-034, Privacy Impact Assessment for the Enterprise
Management Information System-Enterprise Data Warehouse (EMIS-EDW)
Appendix A (2016 and subsequent updates), available at <a href="https://www.dhs.gov/sites/default/files/publications/privacy-pia-cbp_emis_edw-appendixd-january2021.pdf">https://www.dhs.gov/sites/default/files/publications/privacy-pia-cbp_emis_edw-appendixd-january2021.pdf</a> (last visited May 15, 2025).
---------------------------------------------------------------------------
Finally, a comprehensive and integrated biometric entry-exit system
serves as an important tool in the fight against global terrorism.
Since the 9/11 attacks, the United States remains vulnerable to the
threat of global terrorism. Recognizing terrorism as one of the most
serious threats to international peace and security and the need to
take immediate action to address the evolving threat environment, the
United Nations Security Council adopted a resolution on December 21,
2017, calling on member nations to increase aviation security and to
develop and implement systems to collect biometric data to properly
identify terrorists.\17\ The resolution was co-sponsored by 66
countries, including the United States, and passed the Security Council
with unanimous support. CBP's biometric exit program will provide
another layer of identity verification and another opportunity to stop
these individuals from departing without opportunity for further
investigation.
---------------------------------------------------------------------------
\17\ S.C. Res. 2396 (Dec. 21, 2017), available at https://
www.un.org/securitycouncil/content/
sres23962017#:~:text=Decides%20that%20Member%20States%20shall,and%20s
uspected%20terrorists%2C%20including%20FTFs (last visited May 15,
2025).
---------------------------------------------------------------------------
CBP has conducted extensive tests of the biometric comparison
technology prior to implementation of this final rule. All of those
tests support CBP's statements above regarding the efficacy of the
congressionally mandated biometric entry-exit process.\18\
---------------------------------------------------------------------------
\18\ See the NPRM, 85 FR at 74171-74173 for more discussion
regarding CBP's prior biometric comparison tests and the results of
those tests; see also CBP, Biometrics, <a href="https://www.cbp.gov/travel/biometrics">https://www.cbp.gov/travel/biometrics</a> (last modified Apr. 16, 2025) (last visited May 1, 2025).
---------------------------------------------------------------------------
B. Facial Comparison-Based Entry-Exit Process Pursuant to This Final
Rule
In this final rule, DHS is amending the regulations to provide that
all aliens may be required to be photographed upon entry and departure
from the United States. See 8 CFR 215.8(a), and 235.1(f). Failure to
comply with a requirement to be photographed may result in a
determination of inadmissibility or a violation of the terms of the
alien's status where CBP requires this information to determine
identity or other immigration information.\19\
---------------------------------------------------------------------------
\19\ See 8 CFR 215.8(b) and 8 CFR 235.1(f)(1)(iv). In the event
of technical failures preventing the capture and matching of
photographs of travelers at entry or exit, air carriers and CBP
officers will be directed to use manual boarding processes until the
systems are functional. In this scenario, a biographic travel record
will be created for the traveler but a biometric confirmation will
not exist. A missing biometric confirmation record based on
technology or operational failures is not considered non-compliance
with the regulatory requirements.
---------------------------------------------------------------------------
Facial comparison technology will provide DHS a successful
foundation for a biometric exit solution, as well as an improved and
more streamlined biometric entry process. The following sections
discuss CBP's facial comparison-based entry-exit process pursuant to
this final rule. This process has been implemented for entry and exit
at commercial airports and for entry at sea ports and pedestrian land
ports. In this final rule, CBP seeks comments on these newly
implemented transportation modalities. CBP will proceed with full
implementation of an entry-exit process at all land modalities and for
private aircraft, as well as on exit at sea ports, after refining its
biometric exit strategies in those environments. Additionally, when CBP
moves forward with a large-scale implementation for entry-exit at land
ports or for private aircraft or for exit at sea ports, CBP will
publish a notice in the Federal Register providing information
regarding details of implementation in each new environment and request
comments on the newly implemented transportation modalities.
Some of the facial comparison-based entry and exit processes
described below may already be implemented in limited form at entry or
under biometric exit pilot programs. For such existing processes, CBP
adheres to all applicable laws and regulations that govern its
collection of biometrics. Pursuant to this final rule, CBP may collect
and compare facial images under the processes described here from all
aliens arriving in and departing from the United States.
1. Benefits of a Facial Comparison-Based Process
CBP has developed a model for implementing a biometric entry-exit
solution using facial comparison technology, currently implemented at
commercial air entry and exit, pedestrian entry, and sea entry. As
fingerprint scans have proven to be an effective law enforcement tool,
CBP will continue to capture fingerprints as one of the initial
identification biometrics at entry to the United States.\20\ However,
CBP has determined that facial comparison technology is currently the
best available method for biometric verification at entry and exit as
it is efficient, accurate, and unobtrusive. CBP may elect not to
collect fingerprints for subsequent identity verification (after
collecting them during the initial encounter) where CBP has implemented
facial comparison.\21\ Fingerprint scans can be used for most aliens
should facial comparison fail to properly identify the traveler.
---------------------------------------------------------------------------
\20\ Note that the U.S. Department of State also collects
biometrics from visa applicants and U.S. Citizenship and Immigration
Services (USCIS) collects biometrics at other times that may be
accessed by CBP as well.
\21\ CBP may collect facial images from all aliens entering or
exiting pursuant to this rule, and, when requested, aliens must
comply with CBP requirements to submit facial biometrics. CBP also
has discretion not to collect facial images in certain cases where
CBP determines that is appropriate.
---------------------------------------------------------------------------
The key benefit of using facial comparison for biometric identity
verification (as opposed to fingerprints) is its efficiency. The facial
comparison process leverages information that all travelers provide to
the U.S. government as a condition for international travel. In
general, photographs of travelers are readily available to DHS through
sources such as previous encounter photos and visa databases,
eliminating the need to collect new information and add another layer
to the travel process. In addition, a system that matches a traveler's
facial biometrics against a limited number of stored photographs,
rather than an entire government database of photographs, significantly
reduces the amount of time necessary to verify a traveler's identity.
As a result,
[[Page 48609]]
CBP is able to verify the identity of arriving or departing travelers
with a high degree of efficiency while facilitating travel for the
public.
Biometric verification using facial comparison is highly accurate.
The National Institute of Standards and Technology (NIST) Face
Recognition Vendor Test (FRVT) Demographic Effects Report (NIST FRVT
Demographic Effects Report) shows that facial comparison technology is
able to match travelers at a rate of greater than 98 percent.\22\ If
the system fails to match a traveler, then a manual review of the
traveler's document is performed. Although CBP does not intend to cause
delay or adverse consequences for the traveler in these situations, CBP
is aware that in rare cases, travelers who fail to match are referred
to secondary inspection or to a CBP officer for additional inspection,
which may delay or hinder travel.
---------------------------------------------------------------------------
\22\ See NIST, NISTIR 8280, FRVT Part 3: Demographic Effects 8,
26 (2019) (NIST FRVT Demographic Effects Report), available at
<a href="https://nvlpubs.nist.gov/nistpubs/ir/2019/nist.ir.8280.pdf">https://nvlpubs.nist.gov/nistpubs/ir/2019/nist.ir.8280.pdf</a> (last
visited May 15, 2025).
---------------------------------------------------------------------------
As an added benefit, a biometric entry-exit system based on facial
comparison is relatively unobtrusive. It relies on current traveler
behaviors and expectations; most travelers are familiar with cameras
and do not need to learn how to have a photograph taken. Finally, the
biometric capture device can be installed at an airline departure gate
without any necessary changes to existing airport infrastructure.
By collecting photographs from all aliens departing the United
States, DHS can more effectively verify their identity and confirm
their departure. It also helps DHS identify known or suspected
terrorists or criminals traveling using someone else's documents before
they depart the country. This collection also helps identify visa
overstays and aliens who are present in the United States without
having been admitted or paroled, and prevent their illegal reentry into
the United States, as well as prevent visa fraud and the use of
fraudulent travel documents. After confirmation that the traveler is
not the true bearer of a presented travel document, the traveler would
then be subject to further inspection, first by the airline and also in
some circumstances by CBP officers, which may include fingerprinting
and/or an interview. Through this additional inspection, CBP will be
better able to identify known criminals and other threats to border
security.
The collection of photographs from all aliens avoids the need to
have different processes at the point of departure for different alien
travelers depending on whether they are exempt or not (such as the
exemption based on age provided by the regulations prior to the
effective date of this final rule). Collecting photographs from all
alien travelers aligns with international passport standards, which
require a photograph of the traveler on the document regardless of age
or visa classification.
DHS has also determined that the collection of photographs from all
aliens at entry is necessary, without regard to age, visa
classification, or immigration status. Establishing a requirement that
all aliens may be photographed without exemption enables DHS to
biometrically verify the identity of all alien travelers traveling to
and from the United States, thereby helping prevent visa fraud and the
fraudulent use of legitimate travel documentation.
Collecting photographs from all aliens at entry also enables CBP to
implement a streamlined entry process using facial comparison for all
such aliens. For example, under the Simplified Arrival process, CBP
primarily uses photographs rather than fingerprints to verify the
traveler's identity and retrieve the traveler's biographic information
for inspection.\23\ Facial comparison technology can perform the
function of biometrically verifying an alien traveler's identity much
more efficiently than collecting and comparing an individual's
fingerprints each time a person enters and exits the United States.\24\
The Simplified Arrival process (which applies only to certain in-scope
aliens prior to the effective date of this final rule and will
thereafter apply to all aliens) utilizes integrated biometric identity
verification with the retrieval of a traveler's biographic data from a
single capture of a photograph. In doing so, the Simplified Arrival
process eliminates the need for CBP to scan a passport or travel
document to pull up the traveler's biographic data for inspection
because a facial comparison scan performs this same function more
quickly. Using facial comparison at entry can eliminate several
administrative processes that will ultimately increase the speed at
which CBP can inspect travelers arriving in the United States. By
eliminating the administrative tasks involved in scanning a travel
document or collecting fingerprints, CBP can devote more resources to
interviewing an alien traveler to determine the person's admissibility.
The increased efficiency benefits travelers by allowing them more time
to make airline connections and spend less time waiting in lines to be
processed by CBP. The increased efficiency also benefits the travel
industry by allowing faster processing of customers which decreases
resources required to process customers as well as increasing customer
satisfaction.
---------------------------------------------------------------------------
\23\ See the NPRM, 85 FR at 74173 for more discussion on the
Simplified Arrival process.
\24\ Note that CBP will continue to collect fingerprints during
initial encounters with aliens entering the United States.
---------------------------------------------------------------------------
Pursuant to this rule, DHS may collect photographs from all aliens
seeking to enter or exit the United States regardless of their age for
the purposes of identity verification. This enables DHS to associate
the immigration records created for children to their adult records
later, which will help combat the trafficking of children, and screen
for criminal history or associations with terrorist or other
organizations seeking to violate applicable law throughout a person's
lifetime. The exemptions in the current regulations for biometric
collection based on the age of the individual (i.e., under 14 and over
79) were based on technological limitations on collecting fingerprints
from children and elderly persons, as well as traditional law
enforcement policies and other policies, such as not running criminal
history background checks on children. These exemptions are not
applicable to CBP's facial comparison-based biometric entry-exit
program, as the use of biometrics has expanded beyond criminal history
background checks and now plays a vital role in identity verification
and management, and combatting the trafficking of children.
Furthermore, internal CBP studies of biometric facial match accuracy,
historical matching data, examination of biometric matching of ages
under 14 and over 79, and CBP standard operating procedures associated
with these ages no longer support exempting facial biometric collection
from these populations. Exemptions based on age will continue to apply
to biometrics other than facial images.
Certain privacy advocates have expressed concern over the accuracy
of facial matching technology especially as it relates to demographics
such as age, race and sex. CBP has conducted extensive testing of
facial matching technology and CBP's internal analysis shows that
facial comparison technology as used in international traveler
screening operations is able to match travelers at a rate of greater
than 98 percent. By expanding the scope of individuals subject to
facial image collection, more travelers can be successfully matched.
This will improve the experience for all segments of the population,
including children and the
[[Page 48610]]
elderly.\25\ Additionally, removing biometric exemptions for aliens
alleviates the need to have multiple processing procedures for aliens,
which would be a resource-intensive process. For entry and exit at land
ports and for private aircraft as well as for exit at sea ports, CBP
plans to continue to refine biometric exit strategies with the ultimate
goal of implementing a comprehensive biometric entry-exit system
nationwide. The regulatory changes in this final rule support CBP's
efforts to regularly conduct a variety of statistical tests to bolster
performance thresholds and minimize any possible bias impact on
travelers of a certain race, gender, or nationality.
---------------------------------------------------------------------------
\25\ See Nat'l Inst. Standards & Tech. (NIST), NISTIR 8271, Face
Recognition Vendor Test (FRVT) Part 2: Identification 9 (2019),
available at <a href="https://doi.org/10.6028/NIST.IR.8271">https://doi.org/10.6028/NIST.IR.8271</a> (last visited May
25, 2025).
---------------------------------------------------------------------------
In this final rule, CBP has not analyzed the costs and benefits for
implementing a facial comparison-based biometric entry-exit program for
vehicles at land ports and private aircraft, or for exit at sea ports
and pedestrians at land ports because CBP is still in the process of
determining the best way to implement biometric entry-exit within each
of these unique environments.
2. Facial Comparison Technology Gallery Building
CBP has developed a matching service for all biometric entry and
exit operations that use facial comparison, regardless of the method of
entry or exit (i.e., air, land, and sea) known as Traveler Verification
Service (TVS). For all biometric matching deployments, TVS relies on
biometric templates generated from pre-existing photographs that CBP
already maintains, known as a ``gallery.'' These images may include
photographs captured by CBP during previous entry inspection,
photographs from U.S. passports and U.S. visas, immigration
applications, and photographs from other U.S. government encounters.
CBP builds galleries of photographs based on where and when a traveler
will enter or exit. If CBP has access to Advance Passenger Information
System (APIS) manifest information, CBP will build galleries of
photographs based on upcoming flight, vessel, or, in some cases, bus
arrivals or departures. If CBP does not have access to APIS manifest
information, such as for pedestrians or privately owned vehicles at
land ports of entry, CBP may build galleries using photographs of
aliens that frequently cross for that specific port of entry, taken at
that specific port, that become part of a localized photographic
gallery. CBP's TVS facial matching service then generates a biometric
template for each gallery photograph that is stored in the TVS virtual
private cloud for matching when the traveler arrives or departs.
3. General Collection Process
Due to the complexities in logistics and variety of air, land, and
sea port designs across the entry and exit environments, CBP will
collect photographs of the arriving or departing traveler via several
different methods depending on the local port of entry and mode of
travel. Generally, when travelers present themselves for entry or exit,
they will encounter a camera connected to CBP's cloud-based TVS facial
matching service via a secure, encrypted connection. This camera
matches live images with existing photo templates from previously
submitted passenger travel documents or other photos that CBP possesses
(e.g., CBP encounter photos). The camera may be owned by CBP, the
airport or air or vessel carrier, another U.S. government agency such
as the Transportation Security Administration (TSA), or a foreign
commercial partner. Once the camera captures a quality image and the
system successfully finds a match among the historical photo templates
of all travelers from the gallery associated with that particular
manifest or port, the traveler proceeds to inspection for an
admissibility determination by a CBP officer or is permitted to depart
the United States. When a no match occurs, CBP or the carrier may use
an alternative means to verify the traveler's identity, such as use of
an alternate biometric modality like fingerprints, or a manual review
of the travel document as has been done historically.
4. Facial Comparison-Based Entry Process
Historically, prior to admission of a person to the United States,
CBP used a manual process to inspect travel documents, such as
passports or visas, to initiate system checks and verify a traveler's
identity, travel history, and any law or border enforcement concerns
that may require attention. The new primary entry solutions, including
Simplified Arrival, FBD, Mobile Primary Face, and Pedestrian Entry, use
biometrics to initiate the transaction and system checks, using facial
comparison as the primary biometric verification modality. This shift
from a biographic, document-based system to a biometric-initiated
transaction requires travelers to provide facial photos for identity
verification purposes. This enables CBP to more accurately verify
identity and citizenship by matching the traveler's photograph with
vetted and validated biographic information that is associated with a
validated photo. Studies show that humans can benefit in face
comparison tasks when assisted by a machine, and vice versa.\26\
---------------------------------------------------------------------------
\26\ See P. Jonathon Phillips, et al., Face recognition accuracy
of forensic examiners, superrecognizers, and face recognition
algorithms, 115 PNAS 6171 (2018), <a href="https://www.pnas.org/content/pnas/115/24/6171.full.pdf">https://www.pnas.org/content/pnas/115/24/6171.full.pdf</a> (last visited May 15, 2025). See also Hamood M.
Alenezi & Markus Bindemann, The Effect of Feedback on Face-Matching
Accuracy, 27 Applied Cognitive Psych. 735 (2013), <a href="https://onlinelibrary.wiley.com/doi/abs/10.1002/acp.2968">https://onlinelibrary.wiley.com/doi/abs/10.1002/acp.2968</a> (last visited May
15, 2025); and Matthew C. Fysh & Markus Bindemann, Effects of time
pressure and time passage on face-matching accuracy, 4 Royal Soc'y
Open Sci. 170249 (2017), <a href="https://royalsocietypublishing.org/doi/full/10.1098/rsos.170249#RSOS170249C16">https://royalsocietypublishing.org/doi/full/10.1098/rsos.170249#RSOS170249C16</a> (last visited May 15, 2025).
---------------------------------------------------------------------------
At entry, CBP uses CBP-owned cameras, CBP's primary arrival
subsystem of TECS (not an acronym), and the TVS facial matching service
to capture facial biometric data from travelers seeking to enter the
United States. TVS automatically creates a template from the image and
uses the template to query against a gallery of known identities, based
on the manifests for entering flights and vessels that day. At this
time, CBP is not actively using galleries of known travelers in the
land vehicle environment. CBP uses gallery matching in some instances
at land borders, such as bus manifest processing. The process works the
same as in the air and sea environments, but APIS submission is
currently voluntary for commercial bus and rail operators. CBP does not
receive a manifest for pedestrians crossing the land border on foot or
for persons traveling in private vehicles. CBP is conducting technical
demonstrations to determine the feasibility of gallery matching in the
personal vehicle environment at entry. CBP uses one-to-one matching in
environments where no manifest exists, such as pedestrian entry. In
those cases, CBP will use facial comparison technology to compare the
live image captured at the time of application for entry with the
traveler's travel document (e.g., passport) when possible.
5. Facial Comparison-Based Exit Process
CBP is using biometric technologies in voluntary partnerships with
other federal agencies and commercial stakeholders. These partnerships
enable CBP to more effectively verify the identities of individuals
entering and exiting the United States, identify aliens who are
violating the terms of their admission, and expedite immediate action
when such violations are identified. In some partnership
[[Page 48611]]
arrangements, an airline or airport authority partner uses its own
technology and staff to incorporate TVS biometric facial comparison
during the boarding process. These stakeholders have to adhere to
strict business requirements and the cameras must meet CBP's technical
specifications to capture facial images of travelers, prior to use.
Each camera is connected to the TVS via a secure, encrypted connection.
During the boarding process, CBP's facial comparison matching
service allows CBP to biometrically verify the identity of travelers
departing the United States with the assistance of airline or airport
partnerships. Once the traveler's photo is captured via a camera at the
departure gate, TVS generates a template from the departure photo and
uses that template to search the gallery of historical photo templates
in the cloud-based gallery. Some airlines now accept CBP's biometric
identity verification in lieu of boarding passes as part of a new
paperless, self-boarding process. Carriers, pursuant to the APIS
regulations, are responsible for comparing the travel document to
validate the information provided and ensure that the person presenting
the document ``is the person to whom the travel document was issued.''
19 CFR 122.49a, 122.49b, 122.75a, and 122.75b. The use of TVS provides
a more efficient and accurate way to meet this requirement.
Typically, on air exit, CBP is not permanently stationed at the
gate. Therefore, CBP currently relies on the review of biographic data
(provided via APIS) to determine whether further inspection on
departure is warranted and whether an outbound enforcement team should
be sent to the gate. With the use of facial comparison technology,
outbound enforcement teams are informed immediately when a no match
occurs (via notification on a mobile device) and may, in some cases,
determine that additional inspection is warranted. The carrier may also
notify CBP if additional CBP inspection is needed.
Outbound processing for travelers on commercial sea vessels (e.g.,
cruise ships) will resemble the air exit process. It is expected that
this process will also be based on an APIS traveler manifest, although
CBP is still determining the best way to implement this process. CBP
may collect biometrics from travelers leaving the United States at land
borders, when staffing permits. CBP may consider and examine partnering
opportunities in the future in the land environment to enable more
complete collection of biometrics at exit at land borders. When CBP
moves forward with a large-scale implementation for entry-exit at land
ports or for private aircraft or for exit at sea ports, CBP will
publish a notice in the Federal Register providing information
regarding details of implementation in each new environment and request
comments on the newly implemented transportation modalities.
6. Alternative Procedures and Public Notices
All U.S. citizens and nationals are subject to inspection upon
arrival into and departure from the United States to confirm their
identity and citizenship. See INA 287(b) (8 U.S.C. 1357(b)). However,
where CBP has implemented a biometric verification program,
participation by U.S. citizens in the biometric verification process is
voluntary. A U.S. citizen traveler who does not wish to have a
photograph taken may request an alternative inspection process. U.S.
citizens may notify the airline or vessel boarding agent or a CBP
officer if they would like to opt out of the facial comparison-based
process at the time of boarding or during the entry process and request
that an alternative method of validation be employed. The citizen's
identity will then be verified manually by CBP or the gate agent
examining the travel document. For example, in the event a U.S. citizen
elects not to be photographed at airports where CBP is conducting
biometric exit verification, an airline gate agent should perform a
manual review of the U.S. citizen's passport. Although CBP and carriers
make every effort to ensure no delays or adverse consequences result
when a U.S. citizen opts out of the biometric collection, CBP is aware
that in some cases, U.S. citizens have alleged that they have been
referred to secondary inspection or told they would not be able to
board because they declined biometrics. Individuals who feel they were
unduly delayed and would like further information regarding their
travel record may request information about records contained in the
CBP systems through procedures provided by the Freedom of Information
Act (FOIA) (5 U.S.C. 552) and the access provisions of the Privacy Act
of 1974 (5 U.S.C. 552a(d)) online at <a href="https://www.dhs.gov/foia-contactinformation">https://www.dhs.gov/foia-contactinformation</a>.
CBP strives to be transparent and provide notice to individuals
regarding its collection, use, dissemination, and maintenance of PII,
as set forth in this rulemaking, the CBP biometrics website regarding
CBP's Biometric Privacy Policy, <a href="https://www.cbp.gov/travel/biometrics/biometric-privacy-policy">https://www.cbp.gov/travel/biometrics/biometric-privacy-policy</a>, the TVS Privacy Impact Assessment (PIA),\27\
and the CBP Privacy Office report entitled ``CBP Privacy Evaluation
(CPE) of the TVS in support of the CBP Biometric Entry-Exit Program''
(CPE TVS Report).\28\ As detailed in the CPE TVS Report, when airlines
or airports are partnering with CBP on biometric air exit, the public
is informed that the partner is collecting the biometric data in
coordination with CBP.\29\ CBP provides notice to travelers at the
designated ports of entry through both physical and either electronic
message boards or electronic signs, as well as verbal announcements in
some cases, to inform the public that CBP will be taking photos for
identity verification purposes. CBP also provides notice to the public
that a U.S. citizen may opt out of having a photo taken and request an
alternative procedure. CBP works with carriers, airports, and other
port facilities to incorporate appropriate notices and processes into
their current business models. Examples of such notices are available
on CBP's Biometrics Resources website, <a href="https://www.cbp.gov/travel/biometrics/resources">https://www.cbp.gov/travel/biometrics/resources</a>. CBP is aware that, in some cases, adequate
signage and notice may not have been installed or provided. CBP seeks
to ensure that all locations place signs and notice regarding biometric
collection where appropriate.\30\
---------------------------------------------------------------------------
\27\ See DHS/CBP/PIA-056, Privacy Impact Assessment for the
Traveler Verification Service (Nov. 14, 2018, as amended) (TVS PIA),
available at <a href="https://www.dhs.gov/sites/default/files/publications/privacy-pia-cbp056-tvs-february2021.pdf">https://www.dhs.gov/sites/default/files/publications/privacy-pia-cbp056-tvs-february2021.pdf</a> (last visited May 15, 2025).
\28\ See CBP Privacy Evaluation (CPE) of the Traveler
Verification Service (TVS) in support of the CBP Biometric Entry-
Exit Program (Aug. 15, 2022), (CPE TVS Report), available at <a href="https://www.cbp.gov/document/foia-record/cpe-traveler-verification-service-final-report">https://www.cbp.gov/document/foia-record/cpe-traveler-verification-service-final-report</a> (last visited May 15, 2025); see also TVS PIA at 1.
\29\ See CPE TVS Report at 6.
\30\ See CPE TVS Report at 6.
---------------------------------------------------------------------------
Upon request, CBP officers provide individuals with a handout
(i.e., ``tear sheet'') with Frequently Asked Questions (FAQ), opt-out
procedures, and additional information on the particular collection
method, including the legal authority and purpose for inspection, the
routine uses, and the consequences for failing to provide
information.\31\ CBP is aware that some locations may not have had
adequate information informing travelers of the availability of a tear
sheet for more information. CBP is working to make sure all locations
collecting biometrics provide this information and have available tear
sheets for travelers. Additionally, in the Federal Inspection
[[Page 48612]]
Service area (FIS area), CBP posts signs informing individuals of
possible searches, and the purpose for those searches, upon arrival or
departure from the United States.\32\ Privacy information on the
program, such as applicable System of Records Notices (SORNs) and
Privacy Impact Assessments (PIAs), are published on the DHS Privacy
website, <a href="https://www.dhs.gov/privacy">https://www.dhs.gov/privacy</a>. CBP will also continue to make
program information, such as FAQs, available for the public on CBP's
biometrics website at <a href="https://www.cbp.gov/travel/biometrics">https://www.cbp.gov/travel/biometrics</a>.
---------------------------------------------------------------------------
\31\ See CPE TVS Report at 6.
\32\ See CPE TVS Report at 6-7.
---------------------------------------------------------------------------
7. No Match Procedures
CBP has designed the entry and exit inspection process such that,
in the event of a mismatch, false match, or no match, CBP or the
carrier may use alternative means to verify the traveler's identity and
ensure that the traveler is not unduly delayed. If the system fails to
match a traveler, then a manual review of the traveler's document
should be performed. On entry, the CBP officer may continue to conduct
additional screening or request fingerprints (if appropriate) to verify
identity. Each inspection booth at entry is equipped with a fingerprint
reader. At departure, after the manual review of the travel document
(i.e., scanning a boarding pass and checking a traveler's passport),
the airline or cruise line may notify CBP's outbound enforcement teams
should additional inspection be required.\33\ If the CBP inspection
yields no derogatory information, the CBP officer allows the traveler
to board/continue travel. If CBP finds actionable derogatory
information on the traveler during the additional inspection, the CBP
officer may escort the traveler to the FIS area to conduct further
questioning and take the appropriate actions under CBP's law
enforcement authorities. CBP is aware that in some cases, travelers
have been improperly delayed or experienced other adverse consequences
due to a mismatch. In the event that an individual does experience a
delay or issue as an outcome of these processes, travelers may contact
the CBP Information Center and/or DHS Traveler Redress Inquiry Program
(TRIP).\34\ Signage and tear sheets at select ports of entry where the
TVS is employed provide information on how to contact the CBP
Information Center and/or DHS TRIP. In addition, travelers may request
information from the on-site CBP officer or gate agent.
---------------------------------------------------------------------------
\33\ Communication between CBP's outbound enforcement team and
airlines/cruise lines is not unique to locations where facial
comparison is implemented. During the outbound inspection, CBP may
interview the traveler as well as use Biometric Exit-Mobile (BE-
Mobile) devices. CBP conducts outbound enforcement operations using
BE-Mobile devices in all modes of transportation and also at
locations where facial comparison technology (i.e., biometric exit
boarding) is unavailable. Neither the operations nor the technology
is exclusive to locations where facial comparison-based biometric
exit is implemented.
\34\ See CBP, CBP Information Center, <a href="https://help.cbp.gov/s/?language=en_US">https://help.cbp.gov/s/?language=en_US</a> (last visited May 15, 2025); DHS, DHS Traveler
Redress Inquiry Program (DHS TRIP), <a href="https://www.dhs.gov/dhs-trip">https://www.dhs.gov/dhs-trip</a>
(last visited May 15, 2025).
---------------------------------------------------------------------------
8. U.S. Nationals, Dual Nationals and Lawful Permanent Residents
Under the INA, a U.S. national is either a citizen of the United
States, or a person who, though not a U.S. citizen, owes permanent
allegiance to the United States. See INA 101(a)(22) (8 U.S.C.
1101(a)(22)). Alien U.S. national status applies only to individuals
who were born either in American Samoa or on Swains Island to parents
who are not citizens of the United States.\35\ Dual nationals are
individuals who owe allegiance to both the United States and a foreign
country. They are required to obey the laws of both countries, and
either country has the right to enforce its laws. For purposes of
international travel, U.S. nationals, including dual nationals, must
use a U.S. passport (or alternative documentation as required by 22 CFR
part 53) to enter and leave the United States. See INA 215(b) (8 U.S.C.
1185(b)); 22 CFR 53.1. In cases where dual nationals fail to present
the proper travel documents, biometrics may be used to identify that
the same individual has traveled using documents issued by different
countries.
---------------------------------------------------------------------------
\35\ See U.S. Department of State, Dual Nationality, <a href="https://travel.state.gov/content/travel/en/legal/travel-legal-considerations/Relinquishing-US-Nationality/Dual-Nationality.html">https://travel.state.gov/content/travel/en/legal/travel-legal-considerations/Relinquishing-US-Nationality/Dual-Nationality.html</a>
(last visited May 15, 2025).
---------------------------------------------------------------------------
For purposes of this rule, a U.S. national or dual national who
presents as a citizen of another country will be processed as a foreign
national and the individual's photo will be retained accordingly,
unless the individual is able to present evidence of U.S. citizenship
or nationality.\36\ Under immigration law, lawful permanent residents
(LPRs) are aliens authorized to live permanently within the United
States.\37\ As such, for purposes of this rule, LPRs will be processed
as aliens.
---------------------------------------------------------------------------
\36\ A person claiming U.S. citizenship or nationality must
establish that fact to the examining officer's satisfaction and must
present a U.S. passport or alternative documentation as required by
22 CFR part 53. If such person fails to satisfy the examining
immigration officer that the traveler is a U.S. citizen, the person
shall thereafter be inspected as an alien applicant for admission. 8
CFR 235.1(b).
\37\ Under section 101(a) of the INA (8 U.S.C. 1101(a)), the
term ``alien'' means any person who is not a citizen or national of
the United States. See also 8 CFR 215.1(a). Therefore, a lawful
permanent resident is an alien under the INA.
---------------------------------------------------------------------------
9. Business Requirements for Public-Private Partnerships
The business requirements implemented by CBP with its partners
govern the retention and use of the facial images collected using CBP's
facial comparison technology. The Business Requirements Documents are
available on CBP's biometrics website at <a href="https://www.cbp.gov/travel/biometrics/biometric-privacy-policy">https://www.cbp.gov/travel/biometrics/biometric-privacy-policy</a> and are also discussed in the TVS
PIA.\38\ The CBP Business Requirements prohibit CBP's approved partners
such as airlines, airport authorities, or cruise lines and
participating organizations (e.g., vendors, systems integrators, or
other third parties) from retaining the photos they collect under this
process for their own business purposes.\39\ The partners must
immediately purge the images following transmittal to CBP, and the
partner must allow CBP to audit compliance with this requirement. To
use TVS, private sector partners must agree to these Business
Requirements.\40\
---------------------------------------------------------------------------
\38\ TVS PIA at 10, 17-18, 21-22.
\39\ CBP, Biometric Air Exit Business Requirements, v3.0 at 10
(2023), <a href="https://www.cbp.gov/sites/default/files/assets/documents/2023-Oct/Biometric%20Air%20Exit%20Business%20Requirements5.pdf">https://www.cbp.gov/sites/default/files/assets/documents/2023-Oct/Biometric%20Air%20Exit%20Business%20Requirements5.pdf</a> (CBP
Biometric Air Exit Business Requirements); and CBP, Biometric Sea
Entry-Exit Business Requirements, v2.0 at 10 (2023), <a href="https://www.cbp.gov/sites/default/files/assets/documents/2023-Oct/Sea%20Business%20Requirements%20Document10_0.pdf">https://www.cbp.gov/sites/default/files/assets/documents/2023-Oct/Sea%20Business%20Requirements%20Document10_0.pdf</a> (CBP Biometric Sea
Entry-Exit Business Requirements).
\40\ CBP Biometric Air Exit Business Requirements 8; CBP
Biometric Sea Entry-Exit Business Requirements 8.
---------------------------------------------------------------------------
IV. Summary of Changes to the Biometric Entry and Exit Regulations
To advance the legal framework for the full implementation of a
biometric exit capability as described above, DHS is amending the
regulations in parts 215 and 235 of title 8 of the Code of Federal
Regulations (8 CFR parts 215 and 235) that set forth the requirements
for providing biometrics upon entry and departure as described below.
A. General Biometric Exit Requirement for Aliens
Prior to the effective date of this final rule, the regulations at
8 CFR 215.8(a)(1) authorize DHS to collect biometric exit information
from certain aliens on departure from the United States pursuant to
pilot programs at air, land, or sea ports of entry and places a limit
of 15 air or sea ports of entry at which
[[Page 48613]]
such biometric exit pilots may be established. The reference to pilot
programs and the 15 air or sea port limitation hinder DHS's ability to
expand and fully implement a comprehensive biometric exit solution.
Therefore, DHS is amending 8 CFR 215.8 by removing the reference to
pilot programs and the reference to 15 air or sea port limit, allowing
DHS to establish a general biometric exit requirement for aliens.
B. Collection of Photographs From Aliens Upon Entry and Departure
To implement a biometric entry-exit system based on facial
comparison, DHS is amending the regulations to provide that all aliens
may be required to be photographed upon departure from the United
States. Specifically, DHS is amending 8 CFR 215.8 to add a new
paragraph (a)(1), which provides that an alien may be required to be
photographed when departing the United States to determine identity or
for other lawful purposes. The collection of photographs from an alien
upon departure will assist DHS in determining the alien's identity and
whether immigration status in the United States has been properly
maintained. The exemptions of certain aliens from the collection of
biometrics provided in 8 CFR 215.8(a)(1) and (2), redesignated as 8 CFR
215.8(a)(2) and (3) and revised by this final rule, will no longer
pertain to the collection of photographs from aliens upon departure and
will only apply to the collection of other biometrics.
In addition, DHS is amending 8 CFR 235.1(f) to add new paragraph
(f)(1)(ii), which provides that an alien seeking admission may be
required to be photographed to determine the alien's identity,
admissibility, and whether immigration status in the United States has
been properly maintained. Like the collection of photographs upon
departure, the exemptions provided in 8 CFR 235.1(f)(1)(ii),
redesignated as 8 CFR 235.1(f)(1)(iii) and revised by this final rule,
will no longer pertain to the collection of photographs from aliens
seeking admission and will only apply to the collection of other
biometrics.
As noted above, DHS is retaining the exemptions in 8 CFR 215.8 and
235.1(f) \41\ for the collection of biometrics other than photographs
(e.g., fingerprints and other biometrics) from aliens upon entry to and
departure from the United States. This is set forth in redesignated 8
CFR 215.8(a)(2) and (3) and 235.1(f)(1)(iii) and (vi) as amended by
this final rule. Notwithstanding these exemptions, DHS is authorized to
collect biometrics from aliens, regardless of age, citizenship, or visa
status, for law enforcement purposes or in other contexts not addressed
by these regulations, such as from aliens attempting to enter the
United States illegally between U.S. ports of entry.
---------------------------------------------------------------------------
\41\ The following categories of aliens will remain exempt from
the requirements under 8 CFR 215.8 and 235.1 to provide other (non-
photograph) biometrics upon arrival to, and departure from, the
United States at a U.S. port of entry: Canadian citizens under
section 101(a)(15)(B) of the INA who are not otherwise required to
present a visa or be issued a form I-94 or Form I-95; aliens younger
than 14 or older than 79 on the date of admission; aliens admitted
on A-1, A-2, C-3 (except for attendants, servants, or personal
employees of accredited officials), G-1, G-2, G-3, G-4, NATO-1,
NATO-2, NATO-3, NATO-4, NATO-5, or NATO-6 visas, and certain Taiwan
officials who hold E-1 visas and members of their immediate families
who hold E-1 visas unless the Secretary of State and the Secretary
of Homeland Security jointly determine that a class of such aliens
should be subject to these requirements; classes of aliens to whom
the Secretary of Homeland Security and the Secretary of State
jointly determine it shall not apply; or an individual alien to whom
the Secretary of Homeland Security, the Secretary of State, or the
Director of Central Intelligence determines it shall not apply. See
8 CFR 215.8(a)(1) and (2); and 8 CFR 235.1(f)(1)(ii) and (iv).
---------------------------------------------------------------------------
C. Collection of Biometrics When Departing the United States and Other
Minor Conforming and Editorial Changes
DHS is amending 8 CFR 215.8(a) to expand where the collection of
biometrics may be required. Prior to the effective date of this final
rule, 8 CFR 215.8(a)(1) provided that biometrics may be collected from
aliens only when departing ``the United States from a designated port
of entry.'' As described above, this final rule adds new paragraph 8
CFR 215.8(a)(1) and redesignates 8 CFR 215.8(a)(1) as 8 CFR
215.8(a)(2). Both new paragraph 8 CFR 215.8(a)(1) and redesignated
paragraph 8 CFR 215.8(a)(2) now provide that biometrics may be
collected from aliens ``when departing the United States'' from any
location. This amendment is necessary to allow for the collection of
biometrics from individuals upon departure at locations other than from
a designated port of entry.\42\ Although the majority of travelers
depart the United States from a designated port of entry, a few
travelers depart the country from locations that are not designated as
ports of entry, including airports such as Ronald Reagan Washington
National Airport \43\ as well as other locations such as pleasure boat
docks that are not designated ports of entry. To ensure the
implementation of a biometric entry-exit system that tracks all
individuals departing the United States, DHS may require aliens to
provide biometrics upon departure from designated ports of entry or
from any other location.
---------------------------------------------------------------------------
\42\ Designated ports of entry are listed in 8 CFR 100.4(a) for
aliens arriving by vessel or by land transportation and in 8 CFR
100.4(b) for aliens arriving by aircraft.
\43\ This airport is not a port of entry pursuant to 8 CFR
100.4(b) and does not have federal inspection processes or
facilities, but it still has a few flights that depart to
international locations, mostly those that have CBP preclearance
facilities (typically in Canada or the Caribbean).
---------------------------------------------------------------------------
In addition, DHS is making certain minor conforming and editorial
changes in 8 CFR 215.8 and 235.1(f). In 8 CFR 215.8, DHS is
redesignating paragraphs (a)(1) and (2) as paragraphs (a)(2) and (3),
and revising cross-references and adding paragraph headings as
necessary. In Sec. 235.1(f), DHS is redesignating paragraphs
(f)(1)(ii), (iii), and (iv) as paragraphs (f)(1)(iii), (v), and (vi),
respectively; adding new paragraphs (f)(1)(ii) and (iv); and revising
cross-references and adding paragraph headings as necessary. In both
Sec. Sec. 215.8 and 235.1(f), DHS is removing the phrase ``[t]he
Secretary of Homeland Security or his or her designee'' and adding in
its place ``DHS'', and removing the phrase ``biometric identifiers''
and adding in its place ``biometrics.''
Finally, DHS is amending 8 CFR 215.8(a) and 235.1(f) to remove the
specific references to fingerprints and photographs. Prior to the
effective date of this final rule, 8 CFR 215.8(a)(1) and
235.1(f)(1)(ii) provided that any alien may be required ``to provide
fingerprints, photograph(s) or other specified biometric identifiers''
upon arrival into or departure from the United States. Because this
final rule adds new paragraphs relating to the provision of
photographs, the word ``photograph(s)'' in these provisions is no
longer appropriate. Furthermore, to allow the flexibility for DHS to
employ different methods of biometric collection in the future as
biometric technology advances, DHS is amending 8 CFR 215.8(a) and
235.1(f) to provide instead that any alien, other than those exempt by
regulation, may be required ``to provide other biometrics'' upon
arrival into and departure from the United States. See 8 CFR
215.8(a)(2) and 235.1(f)(1)(iii). For example, CBP has tested iris
technology, and there may be other biometric options that may have
potential for implementation in the future.
V. Discussion of Comments Submitted in Response to the NPRM
A. Overview
In response to the NPRM, DHS received 320 comments during the two
[[Page 48614]]
30 day public comment periods. Commenters consisted of individuals,
advocacy groups, legal service providers, professional associations,
State and local governments, and social organizations. The comments and
responses are grouped by subject area. Some commenters expressed
support for the rule and/or offered suggestions for improvement. The
majority of commenters expressed general opposition to the rule,
mentioning immigration policy concerns, general privacy concerns, and
economic concerns.
B. Discussion of Comments
1. Comments Expressing General Support
Comment: Several commenters generally supported the proposed rule,
providing various rationales or supporting data. Commenters noted that
biometrics will streamline the travel process, address national
security concerns, provide U.S. citizens with the opportunity to
request alternative screening procedures and protect children from
being exploited by human traffickers.
Response: DHS appreciates the support for the rule and agrees that
the rule will streamline the travel process and address various
national security concerns to include terrorism and nonimmigrants who
overstay their authorized period of admission. Furthermore, DHS agrees
that the rule preserves the ability for U.S. citizens to request
alternative procedures for identity verification. DHS also agrees that
this rule will protect youth and children from being exploited by human
traffickers; please see the response in Section V.B.4.l., Under 14
Children: Privacy, Authority and Accuracy Concerns, below for
additional details regarding the benefits of collecting biometrics from
children under the age of 14.
2. Comments Expressing General Support With Recommendations
Comment: Some commenters expressed support for the rule and offered
suggestions for improvement. Commenters supported CBP's efforts to
maintain the ability for U.S. citizens to request alternative screening
procedures and applauded CBP's efforts to institute privacy protections
for all travelers. Commenters noted that an expanded system-wide
biometric implementation will not only facilitate travel to include a
more hygienic user experience, but also address national security
concerns arising from fraudulent documents and those individuals that
overstay their authorized period of admission. Several commenters
supported DHS's decision to withdraw the 2008 NPRM \44\ which proposed
to require commercial air and vessel carriers to collect biometric
information from certain aliens departing the United States and submit
this information to DHS within a certain timeframe.
---------------------------------------------------------------------------
\44\ 73 FR 22065 (Apr. 24, 2008).
---------------------------------------------------------------------------
Response: DHS appreciates the support for the rule that provides
for continued implementation of the statutorily mandated biometric
entry-exit system. DHS also appreciates support for the withdrawal of
the 2008 NPRM. DHS agrees that this final rule will streamline the
travel process and address various national security concerns to
include fraudulent documents and aliens who overstay their authorized
period of admission. Furthermore, DHS agrees that the rule preserves
the ability for U.S. citizens to request alternative procedures.
a. Recommendation: Provide additional information for both the
traveling public and stakeholders regarding U.S. citizens' voluntary
participation in the program.
Comment: Commenters suggested that to instill greater public
confidence in the program, CBP should further clarify the option for
U.S. citizens to opt out of the program and establish a rule dictating
that U.S. citizens' photos may only be kept for up to 12 hours.
Response: DHS agrees that U.S. citizens should have proper
notification of their option to opt-out of facial comparison. This
issue is further discussed in Section V.B.4.e., U.S. Citizen Opt-Out,
below, including a discussion regarding CBP's authorities, signage/
notification, alternative procedures, and training efforts. CBP agrees
that the appropriate retention period for U.S. citizen photos should be
no more than 12 hours. The National Archives and Records Administration
(NARA)-approved records schedule requires destruction of U.S. citizen
photos upon confirmation of U.S. citizenship and no later than 12 hours
after confirmation of U.S, citizenship CBP worked closely with the NARA
to approve the retention period for U.S. citizen photos.\45\
---------------------------------------------------------------------------
\45\ See DHS, CBP, U.S. Citizen Encounter Photos (DAA-0568-2019-
0002), available at: <a href="https://www.archives.gov/files/records-mgmt/rcs/schedules/departments/department-of-homeland-security/rg-0568/daa-0568-2019-0002_sf115.pdf">https://www.archives.gov/files/records-mgmt/rcs/schedules/departments/department-of-homeland-security/rg-0568/daa-0568-2019-0002_sf115.pdf</a> (last visited May 15, 2025).
---------------------------------------------------------------------------
Comment: One commenter suggested that both U.S. citizens and aliens
should be required to have their photo taken upon arrival/departure.
Response: CBP initially considered including U.S. citizens in its
biometric entry-exit program because having separate processes for
aliens and U.S. citizens at ports of entry creates logistical and
operational challenges that affect security, wait times, and the
traveler experience. However, CBP determined that the best course of
action at this time is to continue to allow U.S. citizens to
voluntarily participate in the biometric entry-exit program. CBP does
not have plans at this time to require U.S. citizens to be photographed
when entering or exiting the United States, as evidenced by DHS's
withdrawal of the 2008 NPRM proposing to require biometric collection
from U.S. citizens. See Withdrawal Notice (85 FR 73644).
Nevertheless, to carry out its responsibilities effectively under
the INA, for both arrivals and departures from the United States, CBP
must be able to determine conclusively whether a traveler is a U.S.
citizen or national or an alien by verifying that the traveler is the
true bearer of the presented travel documentation. CBP is authorized to
take and consider evidence concerning the privilege of any person to
enter, reenter, pass through, or reside in the United States, or
concerning any matter material or relevant to the enforcement or
administration of the INA. See INA 287(b) (8 U.S.C. 1357(b)). A person
claiming U.S. citizenship must establish that fact to the examining
officer's satisfaction and must present a U.S. passport or alternative
documentation. See INA 215(b) (8 U.S.C. 1185(b)), 8 CFR 235.1(b), and
22 CFR 53.1.
b. Recommendation: Increase program transparency to address
concerns from privacy advocates and members of Congress.
Comment: Commenters suggested that CBP should provide the public
with additional information about the biometric entry-exit program such
as data usage, retention, protection, and dissemination, as well as
continually update Privacy Impact Assessments and SORNs as biometric
technology capabilities and methodologies continue to evolve.
Response: CBP endeavors to provide notice to the public
continuously regarding the biometric entry-exit program including
through regular updates of its PIAs and SORNs as well as the CBP
biometric website at <a href="https://www.cbp.gov/travel/biometrics">https://www.cbp.gov/travel/biometrics</a>. See Section
V.B.4.d., Public Notification and Information, below, for more
information on CBP's transparency and communication efforts. See
Section V.B.3.c., Data Security, Retention, and Dissemination Concerns,
below, for
[[Page 48615]]
more information regarding CBP's data usage, storage, and protection.
Additional information is also available in various places on the CBP
and DHS websites including <a href="https://www.cbp.gov/travel/biometrics">https://www.cbp.gov/travel/biometrics</a> and
<a href="https://www.dhs.gov/privacy">https://www.dhs.gov/privacy</a>, which provide the relevant PIA and SORN,
and which are all updated regularly as capabilities and technologies
evolve; and <a href="https://www.dhs.gov/compliance">https://www.dhs.gov/compliance</a>, which includes information
on compliance including periodic reviews of Privacy Threshold Analyses
(PTAs), PIAs, and SORNs.
Comment: One commenter suggested that CBP work to make sure
travelers understand and adjust to the new system in advance of making
biometric collection fully mandatory.
Response: As mentioned in the NPRM,\46\ through the CBP biometrics
website at <a href="https://www.cbp.gov/travel/biometrics">https://www.cbp.gov/travel/biometrics</a>, and the TVS PIA,\47\
CBP strives to be transparent and provide notice to individuals
regarding its collection, use, dissemination, and maintenance of PII.
CBP has also gradually rolled out the biometric entry-exit program with
various voluntary pilots over the past several years giving the public
the opportunity to adjust to this new process. As discussed throughout
this final rule, CBP is still in the process of determining the best
way to fully implement biometric collection at all entry and exit
modalities. CBP has maintained a proactive approach to stakeholder
engagement and outreach through participation in speaking engagements,
conferences, and stakeholder meetings. This outreach has kept CBP on
the forefront of domestic and international engagement by allowing CBP
the opportunity to partner with airlines, airport authorities, travel
associations and agents, embassies, attach[eacute]s, and privacy
advocacy groups to share programmatic updates on CBP's use of biometric
facial comparison technology in the air, land, and sea environments.
---------------------------------------------------------------------------
\46\ See the NPRM, 85 FR at 74177 for more information on CBP's
protection of PII.
\47\ See TVS PIA at 19.
---------------------------------------------------------------------------
CBP also participates regularly in events sponsored by travel
industry partners to provide updates which highlight the benefits of
biometric facial comparison technology. Some of these partners have
included but are not limited to the U.S. Travel Association (USTA),
Global Business Travel Association (GBTA), Cruise Line Industry
Association (CLIA), American Association of Airport Executives (AAAE),
and Airlines for America (A4A), to name just a few. Moreover, to
maximize messaging efforts, CBP has often participated in these events
in collaboration with its government partners, like TSA or the Science
and Technology Directorate (S&T) of DHS.
Comment: Commenters also suggested that CBP set a minimum
acceptable accuracy rate consistent across demographics, which, along
with system improvements, should then be studied and publicized
regularly. One commenter encouraged CBP to expedite the implementation
of the 2020 U.S. Government Accountability Office (GAO) audit.\48\
---------------------------------------------------------------------------
\48\ See GAO, GAO-20-568, Facial Recognition: CBP and TSA are
Taking Steps to Implement Programs, but CBP Should Address Privacy
and System Performance Issues (2020), available at <a href="https://www.gao.gov/products/gao-20-568">https://www.gao.gov/products/gao-20-568</a> (last visited May 15, 2025).
---------------------------------------------------------------------------
Response: CBP appreciates the commenters' suggestions regarding
tracking accuracy rates and effectiveness of improvements to the
matching algorithm. CBP does have a minimum acceptable accuracy rate
for the program and does regularly track it to ensure program success.
CBP's Biometric Air Exit Key Performance Parameters (KPPs) mandate that
the system's True Acceptance Rate (TAR) must equal or exceed 97 percent
of all in-scope travelers (as previously defined by 8 CFR 215.8 and
235.1) and that the system's False Acceptance Rate (FAR) must not
exceed 0.1 percent of all in-scope travelers. Through congressionally
mandated reports, such as the annual DHS Entry/Exit Overstay Report
\49\ the TSA and CBP: Deployment of Biometric Technologies Report to
Congress,\50\ and other public reports, such as the annual CBP Trade
and Travel Report,\51\ CBP discusses the accuracy rates of the
Biometric Entry-Exit program as well as system improvements.
Additionally, CBP continues to collaborate with DHS S&T, DHS Office of
Biometric Identity Management (OBIM), and the National Institute of
Standards and Technology (NIST) on technical standards and evaluation
to ensure optimal system performance.
---------------------------------------------------------------------------
\49\ This report is available for FY22 at <a href="https://www.dhs.gov/sites/default/files/2023-07/23_0707_FY22_FY23_CBP_Integrated_Entry_Exit_Overstay_Report.pdf">https://www.dhs.gov/sites/default/files/2023-07/23_0707_FY22_FY23_CBP_Integrated_Entry_Exit_Overstay_Report.pdf</a> and
available for previous FYs at <a href="https://www.dhs.gov/publication/entryexit-overstay-report">https://www.dhs.gov/publication/entryexit-overstay-report</a> (last visited May 15, 2025).
\50\ This 2019 DHS report is posted in the docket for this
rulemaking.
\51\ This report is available for FY22 and earlier at <a href="https://www.cbp.gov/document/annual-report/cbp-trade-and-travel-fiscal-year-2022-report">https://www.cbp.gov/document/annual-report/cbp-trade-and-travel-fiscal-year-2022-report</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
CBP concurred with the 2020 GAO audit recommendations and has
addressed each recommendation, as indicated in the Recommendations for
Executive Action Table on the applicable GAO website.\52\
---------------------------------------------------------------------------
\52\ See GAO, GAO-20-568, Facial Recognition: CBP and TSA are
Taking Steps to Implement Programs, but CBP Should Address Privacy
and System Performance Issues, Recommendations, Recommendations for
Executive Action Table, <a href="https://www.gao.gov/products/gao-20-568">https://www.gao.gov/products/gao-20-568</a>
(last visited May 15, 2025).
---------------------------------------------------------------------------
c. Recommendation: Provide additional information regarding no
match and opt-out procedures.
Comment: Several commenters requested that CBP clarify its process
for when a traveler screening yields a no-match result, to include when
CBP assistance should be requested. One commenter also requested the
number of Biometric Exit-Mobile devices CBP currently has in use today,
as they will likely be used for both no-match and opt-out procedures.
Additionally, one commenter indicated that CBP should be responsible
for the implications of a no-match result.
Response: As discussed in the NPRM, in the event of no match at
departure, the carrier or CBP officer will perform a manual review of
the travel document (i.e., scanning a boarding pass and checking a
traveler's passport).\53\ If additional inspection is required by a
carrier, the carrier line may notify CBP's outbound enforcement teams,
but the carrier is not required to do so. Carrier partners should
follow internal business rules and policy to manually verify identity
and determine boarding status of a traveler. Air carrier and airport
partners may contact CBP, in accordance with existing guidelines
outlined by the Carrier Liaison Program, when there are issues or
concerns with U.S. entry requirements, human trafficking, traveler
assessment, fraudulent document detection and imposter
identification.\54\
---------------------------------------------------------------------------
\53\ See the NPRM, 85 FR at 74177, for further discussion of no
match procedures.
\54\ CBP, Carrier Information Guide: United States Document
Requirements for Travel (2023), available at <a href="https://www.cbp.gov/sites/default/files/assets/documents/2023-Nov/Carrier%20Information%20Guide%20ENGLISH.pdf">https://www.cbp.gov/sites/default/files/assets/documents/2023-Nov/Carrier%20Information%20Guide%20ENGLISH.pdf</a> (last visited May 15,
2025).
---------------------------------------------------------------------------
CBP may use mobile devices with the relevant CBP-built mobile
applications to support its multilayered enforcement approach. These
CBP applications include the Biometric Exit Mobile application.
Additional information about the Biometric Exit Mobile application can
be found in the Biometric Exit Mobile Program PIA.\55\ CBP officers can
use the application on any CBP smartphone. CBP does not
[[Page 48616]]
dedicate phones to a single mobile application or operation. Rather,
officers use these phones to perform various job responsibilities
across multiple environments. Ports are provided with enough phones to
meet their mobile mission including biometric exit operations. The port
will make a determination on how officers will use their phones on a
day-by-day basis based on staffing and other law enforcement-related
factors.
---------------------------------------------------------------------------
\55\ The updated 2018 PIA for DHS/CBP/PIA-026 Biometric Exit
Mobile Program, and all prior versions, are available at <a href="https://www.dhs.gov/publication/biometric-exit-mobile-air-test">https://www.dhs.gov/publication/biometric-exit-mobile-air-test</a> (last visited
May 15, 2025).
---------------------------------------------------------------------------
Comment: One commenter expressed concern that CBP will not have the
staffing resources to conduct outbound enforcement operations
efficiently.
Response: CBP has partnered with multiple stakeholders, including
airports and airlines, who are assisting with facilitating the
collection at departure through the use of CBP's TVS. TVS provides an
automated mechanism to verify the identities of travelers. CBP has also
partnered with cruise operators in the entry environment and CBP
expects these partnerships will also aid in developing a strategy for
biometric exit in the sea environment as well. CBP is still determining
the best method for using facial biometrics at land exit.
Comment: One commenter requested further clarification on the
process for families traveling with children, and persons with reduced
mobility as experience during the trials has shown that collecting
biometric information from these travelers can be difficult and time
consuming.
Response: Air carriers may use discretion when processing travelers
with disabilities and families with children, including conducting
manual identity verification using the individual's travel document
(document review), as is performed for all flights where biometric
processing is not available. Additionally, carriers must abide by
existing local, state, and federal laws and regulations regarding
processing persons with disabilities.
CBP's biometric entry-exit program does not contradict existing
accessibility regulations and processes. In many cases, biometric
collection equipment accommodates disabilities; furthermore, it is
CBP's policy to afford persons with disabilities an equal opportunity
to participate in, or benefit from, CBP-conducted services, programs,
and activities and to provide reasonable modifications to its services,
programs, and activities to qualified individuals with a disability
when necessary to avoid discrimination on the basis of disability.
d. Recommendation: Clarify the impact that a biometric exit system
would have on airport operations and infrastructure requirements for
airports and airlines.
Comment: Commenters requested that CBP explain whether the
program's implementation would require separate screening lines,
separate processes, or notifications for passengers. Additionally, one
commenter requested clarification on whether non-U.S. citizens could
opt out of the biometric exit process to avoid additional burdens on
CBP and/or the carriers during boarding such as separate boarding
queues (i.e., one for U.S. citizens and one for aliens).
Response: As noted throughout this rule, on the effective date of
this final rule, collection of facial biometrics may be required from
all aliens entering or exiting the United States, regardless of age,
sex, race and nationality. As indicated on privacy signage, also
available on CBP's biometrics website, <a href="https://www.cbp.gov/travel/biometrics/resources">https://www.cbp.gov/travel/biometrics/resources</a>, if a traveler is a U.S. citizen and does not wish
to have a photograph taken, the traveler may see a gate agent or CBP
officer to request alternative procedures for identity verification.
The alternative procedures are intended to be similar to the existing
processes at entry and exit. See Section V.B.4.e., U.S. Citizen Opt-
Out, below, for more information regarding CBP's authorities, signage/
notification, alternative procedures, and training efforts. CBP will
continue its transparency and communication efforts, discussed in
detail in Section V.B.4.d., Public Notification and Information, below,
as it rolls out full implementation of the biometric entry-exit
program.
e. Recommendation: Provide details should airlines/airports choose
not to participate in the Biometric Entry-Exit Program.
Comment: Several commenters requested that CBP provide procedures
that airlines should follow if they decide not to participate in this
voluntary program and that CBP should commit to continue working with
those airports that do not participate in the program.
Response: Participation in CBP's biometric entry-exit program will
remain voluntary for carriers under this final rule. If air carriers or
airports do not participate, they will continue conducting manual
identity verification. However, CBP may supplement this verification
with CBP officers conducting periodic biometric exit operations. CBP
uses its Workload Staffing Model to determine the staffing requirements
and help make allocation decisions for CBP officers at ports of entry,
including airports. CBP will continue to use this data-driven
methodology to identify staffing requirements by considering all the
activities performed by CBP officers at ports of entry, the volume of
those activities, and the levels of effort required to carry them out.
f. Recommendation: Provide carrier protections through the SAFETY
Act.
Comment: Some commenters recommended that DHS provide SAFETY Act
\56\ legal liability protections for air carriers that participate as
partners in CBP's biometric entry-exit program. The commenters stressed
the importance of these protections against claims of discrimination in
facial comparison technology, as well against any breach of traveler
privacy.
---------------------------------------------------------------------------
\56\ Support Anti-Terrorism by Fostering Effective Technologies
Act of 2002, Public Law 107-296, 116 Stat. 2135, 2238 (6 U.S.C. 441
et seq.).
---------------------------------------------------------------------------
Response: DHS will not issue a blanket liability protection.
Carriers need to work with their technology providers on seeking SAFETY
Act certification for biometric technology devices. The SAFETY Act also
is designed for anti-terrorism technology certification, not for
general privacy or other areas of discrimination concerns. The SAFETY
Act offers liability protection to sellers of qualified anti-terrorism
technologies to incentivize the development and deployment of anti-
terrorism technology solutions. Additional information is available on
the DHS S&T SAFETY Act website at <a href="https://www.safetyact.gov/">https://www.safetyact.gov/</a>.
g. Recommendation: Establish an oversight body on DHS biometric
programs.
Comment: One commenter supports the findings and recommendations in
the Homeland Security Advisory Council Biometrics Subcommittee 2020
Report,\57\ including the establishment of a DHS Biometrics Oversight
and Coordination Council.
---------------------------------------------------------------------------
\57\ Homeland Security Advisory Council, Final Report of the
Biometrics Subcommittee (2020) (HSAC Biometrics Report), available
at <a href="https://www.dhs.gov/sites/default/files/publications/final_hsac_biometrics_subcommittee_report_11-12-2020.pdf">https://www.dhs.gov/sites/default/files/publications/final_hsac_biometrics_subcommittee_report_11-12-2020.pdf</a> (last
visited May 15, 2025).
---------------------------------------------------------------------------
Response: While DHS has not created the specific oversight council
as suggested in the 2020 report, numerous oversight processes exist to
ensure DHS compliance with civil rights and civil liberties. These
processes included congressional hearings, congressionally mandated
status update reports and responses to formal congressional inquiries.
See Section V.B.4.j., Government Accountability and Oversight, below
for more information on the various biometric oversight and
accountability mechanisms.
[[Page 48617]]
h. Recommendation: Provide more information on the implications of
state/local laws and implementation of biometric capabilities in the
land and sea environments.
Comment: One commenter requested that CBP provide additional
guidance and clarification on the role of the biometric entry-exit
program when local laws conflict with CBP's biometric entry-exit
strategy. One commenter indicated that further details on process,
timing, cost, etc., in the land and sea environments are necessary to
ensure traveler confidence and comprehension.
Response: CBP is congressionally mandated to implement a Biometric
Entry-Exit System and is issuing this regulation to implement such
system. The Supremacy Clause of the U.S. Constitution provides that
federal laws and treaties are the supreme laws of the land, and it is
well established that the power to regulate immigration is exclusively
with the federal government. In instances where a state law conflicts
with federal immigration laws, the state law must yield. See Section
V.4.B.s, Land and Sea Implementation, below, for more information on
CBP's implementation plan in the land and sea environments.
i. Recommendation: Further coordinate with NIST to examine existing
standards that may unintentionally inhibit CBP's ability to consider
other biometric modalities.
Comment: One commenter requested that CBP coordinate with NIST to
ascertain gaps that could limit consideration of other biometric
modalities--e.g., edge computing platforms, mobile platforms, and
cloud-based systems.
Response: CBP works closely with DHS S&T, OBIM and NIST on
technical standards and system performance regarding facial comparison
capabilities as well as remaining informed on the development and
evolution of other biometric modalities, especially as it relates to
the border security mission.\58\
---------------------------------------------------------------------------
\58\ See, e.g., DHS/OBIM/PIA-005 Office of Biometric Identity
Management (OBIM)-National Institute of Standards of Technology
(NIST) Data Transfer 3-5 (2022), available at <a href="https://www.dhs.gov/publication/dhsobimpia-005-office-biometric-identity-management-obim-national-institute-standards">https://www.dhs.gov/publication/dhsobimpia-005-office-biometric-identity-management-obim-national-institute-standards</a> (last visited May 15, 2025).
---------------------------------------------------------------------------
j. Recommendation: Implement additional changes to the rule to
ensure all aliens arriving to and departing from the United States are
thoroughly screened and vetted.
Comment: One commenter requested that CBP remove all age
restrictions in 8 CFR 215.8 and 235.1 for all biometric collection
regardless of biometric modality and expand biometric collection to
include additional biometric modalities (e.g., iris, DNA, voice).
Additionally, the commenter requested that DHS finalize both the USCIS
and CBP biometrics rules.
Response: The NPRM published on September 11, 2020, entitled
``Collection and Use of Biometrics by U.S. Citizenship and Immigration
Services,'' 85 FR 56338 (USCIS NPRM), would have implemented the
suggested changes if finalized.\59\ On May 10, 2021, DHS withdrew the
USCIS NPRM. 86 FR 24750. However, since the withdrawal of the NPRM, the
President has issued Executive Order No. 14161, Protecting the United
States From Foreign Terrorists and Other National Security and Public
Safety Threats, 90 FR 8451, (Jan. 30, 2025) (E.O. 14161). E.O. 14161
mandates that DHS protect the American public from ``aliens who intend
to commit terrorist attacks, threaten our national security, espouse
hateful ideology, or otherwise exploit the immigration laws for
malevolent purposes'' and to ``vet and screen to the maximum degree
possible all aliens who intend to be admitted, enter, or are already
inside the United States.'' Therefore, DHS will consider future efforts
to enhance biometric submission to further the goals of this Executive
Order.
Through this rulemaking, DHS is removing the age restrictions for
photograph collection under 8 CFR 235.1 for aliens seeking admission to
the United States, as well as under 8 CFR 215.8 for aliens departing
the United States. See Section V.B.4.l, Under 14 Children: Privacy,
Authorities and Accuracy Concerns, below, for more details.
3. Comments Expressing General Inquiries
a. Rule Impact
Comment: Commenters raised questions regarding to whom the rule
applies, as well as the purpose and need for the biometric information
collected.
Response: As stated throughout this rule, on the effective date of
this final rule, collection of facial biometrics may be required from
all aliens entering or exiting the United States, regardless of age,
sex, race and nationality. DHS is mandated by numerous statutes as
discussed above \60\ to develop and implement an integrated, automated
entry and exit data system to match records, including biographic data
and biometrics, of aliens entering and departing the United States. CBP
has determined that facial comparison technology is currently the best
available method for biometric verification, as it is accurate,
unobtrusive, and efficient.
---------------------------------------------------------------------------
\60\ Two of the relevant statutes are section 110 of the DMIA (8
U.S.C. 1365a) and section 7208 of the IRTPA (8 U.S.C. 1365b). For a
more complete list, please refer to Section II.B. of this final
rule.
---------------------------------------------------------------------------
This final rule improves DHS's ability to meaningfully implement a
comprehensive biometric entry-exit system and make the process for
verifying the identity of aliens more efficient, accurate, and secure
by using facial comparison technology. Implementing an integrated
biometric entry-exit system that verifies the identity of aliens at
arrival and on exit and then uses that information to confirm that the
alien has exited as required is essential for addressing the national
security concerns arising from the threat of terrorism, combatting the
fraudulent use of legitimate travel documentation, and identifying
aliens who overstay their authorized period of admission or are present
in the United States without being admitted or paroled. An integrated
biometric entry-exit system can also fill the gaps left by incorrect or
incomplete biographic data for travelers.
b. Technology Usage and Techniques Accuracy and Misidentification
Comment: Several commenters raised questions on the training
dataset and machine learning models used for facial comparison.
Response: The information requested regarding the training dataset
and machine learning models CBP uses for facial comparison is
proprietary information. CBP works closely with DHS S&T, OBIM and NIST
on technical standards and system performance regarding facial
comparison capabilities. NIST has conducted in-depth analysis on facial
comparison algorithms, which showed that the vendor selected by CBP is
capable of delivering algorithms with a high accuracy rate.\61\ For
more information on NIST's analysis, see Section V.B.4.k, Accuracy,
General Bias, and Misidentification Concerns, below.
---------------------------------------------------------------------------
\61\ See NIST, NISTIR 8280, FRVT Part 3: Demographic Effects 8,
26 (2019) (NIST FRVT Demographic Effects Report), available at
<a href="https://nvlpubs.nist.gov/nistpubs/ir/2019/nist.ir.8280.pdf">https://nvlpubs.nist.gov/nistpubs/ir/2019/nist.ir.8280.pdf</a> (last
visited May 15, 2025).
---------------------------------------------------------------------------
CBP has issued PIAs for many pilots that were testing/developing
facial comparison technology. These PIAs include information about how
the algorithms are tested to assure accuracy of the facial comparison
technology.\62\
---------------------------------------------------------------------------
\62\ See, e.g., DHS/CBP/PIA-025 1:1 Facial Comparison Project,
DHS/CBP/PIA-026 Biometric Exit Mobile Air Test, DHS/CBP/PIA-027
Southwest Border Pedestrian Exit Field Test, DHS/CBP/PIA-030
Departure Information Systems Test, and the TVS PIA. These PIAs are
available at <a href="https://www.dhs.gov/privacy">https://www.dhs.gov/privacy</a>-documents-us-customs-and-
border-protection (last visited May 16, 2025).
---------------------------------------------------------------------------
[[Page 48618]]
For more information on how CBP ensures high accuracy rates across
all demographics see Section V.B.4.k., Accuracy, General Bias, and
Misidentification Concerns, below.
c. Data Security, Retention, and Dissemination Concerns
Comment: Many commenters had questions regarding the safety and
protection of sensitive information with use of this technology and
linkage to interagency databases. Additionally, one commenter asked
whether protection would be provided to the individuals should a breach
or cybersecurity incident occur. One commenter asked if CBP could
delete the biometric information but retain the record of the entry or
exit.
Response: Because numerous federal statutes require DHS to create
an integrated, automated biometric entry and exit system that records
the arrival and departure of aliens, compares the biometric data to
verify their identities, and authenticates travel documents, DHS cannot
delete personally identifiable data and only retain a record of entry-
exit. Furthermore, DHS retains certain records for up to 75 years,
which is necessary to support the holding of biometrics of subjects of
interest in immigration and border management or law enforcement
activities.\63\
---------------------------------------------------------------------------
\63\ See DHS/NPPD/PIA-002, Privacy Impact Assessment for the
Automated Biometric Identification System (IDENT) 25 (2012) (IDENT
PIA), available at <a href="https://www.dhs.gov/publication/dhsnppdpia-002-automated-biometric-identification-system">https://www.dhs.gov/publication/dhsnppdpia-002-automated-biometric-identification-system</a> (last visited May 16,
2025) (note that this website refers to this PIA as ``DHS/OBIM/PIA-
001'' due to OBIM renumbering after the DHS National Protection and
Programs Directorate (NPPD) became the Cybersecurity and
Infrastructure Security Agency within DHS); and DHS/OBIM/PIA-004,
Privacy Impact Assessment for the Homeland Advanced Recognition
Technology System (HART) Increment 1 PIA (2020) (HART PIA),
available at <a href="https://www.dhs.gov/publication/dhsobimpia-004-homeland-advanced-recognition-technology-system-hart-increment-1">https://www.dhs.gov/publication/dhsobimpia-004-homeland-advanced-recognition-technology-system-hart-increment-1</a>
(last visited May 16, 2025).
---------------------------------------------------------------------------
When DHS personnel discover a suspected or confirmed privacy
incident, there are a series of actions and activities that must occur
to appropriately report, investigate, respond, and mitigate the privacy
incident. DHS's policy for responding to privacy incidents is
established in the DHS Privacy Office, DHS Instruction Guide 047-01-
008, Privacy Incident Handling Guidance (2017).\64\ Additionally, DHS
Privacy Policy Instruction 047-01-006, Privacy Incident
Responsibilities and Breach Response Team (2017),\65\ provides
additional instruction on how DHS and CBP employees should handle and
respond to privacy incidents. The Breach Response Team determines the
appropriate course of action with respect to any privacy incident
investigation, remedy options, resource allocations, risk mitigation,
and interagency engagement. DHS and CBP also follow OMB's breach
response guidance, including OMB M-17-12 and M-25-04.\66\
---------------------------------------------------------------------------
\64\ Available at <a href="https://www.dhs.gov/sites/default/files/publications/047-01-008%20PIHG%20FINAL%2012-4-2017_0.pdf">https://www.dhs.gov/sites/default/files/publications/047-01-008%20PIHG%20FINAL%2012-4-2017_0.pdf</a> (last
visited May 16, 2025).
\65\ Available at <a href="https://www.dhs.gov/sites/default/files/publications/047-01-006%20Privacy%20Incident%20Responsibilities%20and%20Breach%20Response%20Team%20FINAL%2012-04-17.pdf">https://www.dhs.gov/sites/default/files/publications/047-01-006%20Privacy%20Incident%20Responsibilities%20and%20Breach%20Response%20Team%20FINAL%2012-04-17.pdf</a> (last visited May 16, 2025).
\66\ See OMB M-17-12, available at <a href="https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf">https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf</a> (last visited July 31, 2025) and OMB 25-04, available at
<a href="https://www.whitehouse.gov/wp-content/uploads/2025/01/M-25-04-Fiscal-Year-2025-Guidance-on-Federal-Information-Security-and-Privacy-Management-Requirements.pdf">https://www.whitehouse.gov/wp-content/uploads/2025/01/M-25-04-Fiscal-Year-2025-Guidance-on-Federal-Information-Security-and-Privacy-Management-Requirements.pdf</a> (last visited July 31, 2025).
---------------------------------------------------------------------------
For more information on how CBP safeguards sensitive information,
see Section V.B.4.g., Data Security, Retention, and Dissemination
Concerns, below.
4. Comments Expressing General Opposition
a. General Opposition
Comment: Some commenters provided general opposition for the
proposed rule, with little, non-specific reasoning or justification
provided.
Response: DHS appreciates the time these commenters took to read
the rule, but DHS respectfully disagrees. DHS's intent for this rule is
explained in detail in the rule's preamble and throughout the NPRM. DHS
is mandated by numerous statutes to develop and implement an
integrated, automated entry and exit data system to match records,
including biographic data and biometrics, of aliens entering and
departing the United States. Additionally, DHS gave careful
consideration to the costs and benefits associated with this regulatory
change, as well as considered all of the comments submitted by the
public. DHS concludes that after the careful weighing of equities, this
rulemaking is necessary as biometrics are simply a more efficient and
reliable means of identifying an individual, compared to biographic
identifiers.
Comment: Some commenters requested that DHS not use the term
``alien'' in the rule.
Response: DHS used the term ``noncitizen'' in the NPRM except where
quoting directly from statutory or regulatory text that uses the term
``alien.'' However, DHS uses the term ``alien'' in this final rule
consistent with the statutory and regulatory text.
Comment: Two commenters suggested that DHS should be abolished.
Response: Comments suggesting DHS be abolished are outside the
scope of this rulemaking. DHS and its homeland security mission are
born from the commitment and resolve of Americans across the United
States in the wake of the September 11, 2001, attacks. With the
enactment of the Homeland Security Act in November 2002, DHS formally
came into being as a stand-alone, Cabinet-level department to further
coordinate and unify national homeland security efforts, opening its
doors on March 1, 2003. As the complex threat environment continues to
evolve, DHS will embody the relentless resilience of the American
people and continue to ensure a safe, secure, and prosperous homeland.
Comment: One commenter expressed concern that the use of technology
would cause officers to distance them physically from the subject and/
or distance them from personal responsibility for tasks done.
Response: CBP's mission is to protect the American people,
safeguard our borders, and enhance the nation's economic prosperity.
Technology will never replace the skills and capabilities that can only
be exhibited by CBP's personnel in identifying and mitigating threats
to the nation. In fact, studies \67\ have shown that it is the
combination of humans, with technology at their disposal, that best
serve the CBP mission while simultaneously respecting the rights of all
persons. Humans, balanced with technology, are essential to successful
execution of these biometric programs.
---------------------------------------------------------------------------
\67\ See P. Jonathon Phillips, et al., Face recognition accuracy
of forensic examiners, superrecognizers, and face recognition
algorithms, 115 PNAS 6171 (2018), <a href="https://www.pnas.org/content/pnas/115/24/6171.full.pdf">https://www.pnas.org/content/pnas/115/24/6171.full.pdf</a> (last visited May 16, 2025). See also Hamood M.
Alenezi & Markus Bindemann, The Effect of Feedback on Face-Matching
Accuracy, 27 Applied Cognitive Psych. 735 (2013), <a href="https://onlinelibrary.wiley.com/doi/abs/10.1002/acp.2968">https://onlinelibrary.wiley.com/doi/abs/10.1002/acp.2968</a> (last visited May
16, 2025); and Matthew C. Fysh & Markus Bindemann, Effects of time
pressure and time passage on face-matching accuracy, 4 Royal Soc'y
Open Sci. 170249 (2017), <a href="https://royalsocietypublishing.org/doi/full/10.1098/rsos.170249#RSOS170249C16">https://royalsocietypublishing.org/doi/full/10.1098/rsos.170249#RSOS170249C16</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
CBP's investment in technology is designed to empower officers to
execute the agency's critical law enforcement mission and alleviate the
administrative burden on officers so they are able to focus on
enforcement. The use of facial comparison technology saves frontline
officers' time in matching travelers to
[[Page 48619]]
document photos and capturing fingerprints CBP already has in its
holdings, allowing for a focus on threat detection and behavioral
indicators that technology cannot identify. CBP's workforce is critical
to accomplishing CBP's missions.
b. General Privacy Concerns
Comment: Many commenters disagreed with the rule, stating that the
proposal is unnecessary, offensive, an invasion of privacy, infringes
on freedoms, and would violate the respect, privacy rights, and civil
liberties of U.S. citizens, legal immigrants, aliens, victims of
domestic violence, other vulnerable parties, and children.
Response: DHS disagrees with these comments. DHS recognizes there
may be increased sensitivities associated with facial comparison
technology. However, DHS complies with all applicable privacy statutes,
regulations, and policies. Further, DHS currently includes information
about specific privacy protections in the relevant PIAs. The PIAs also
direct individuals to the applicable SORNs, which describe the
categories of individuals covered by the system, categories of records
in the system, legal authority for maintaining the system, purpose of
the system, and routine uses of records maintained in the system. All
PIAs and SORNs are submitted to the DHS Privacy Office for review and
approval by the DHS Chief Privacy Officer.
The privacy compliance documentation process is an iterative
process that not only provides transparency into the details of DHS
activities, but also shapes those activities by identifying privacy
risks as well as mitigations and privacy-enhancing solutions. Privacy
is a DHS-wide responsibility, and the DHS Privacy Office works with DHS
components, including CBP, to ensure privacy protections are
incorporated in the entire lifecycle of DHS projects, programs, and
activities. DHS is committed to the fair and equal treatment of all
individuals in its screening and vetting activities, ensuring the
rights of all people are protected, while taking lawful actions
necessary to secure the homeland. In addition to adhering to all
relevant statutory and regulatory privacy protections, DHS complies
with existing DHS policies, which include the DHS Fair Information
Practice Principles (FIPPS) \68\ that ensure privacy safeguards are
incorporated throughout the information lifecycle. These safeguards
also account for administrative, physical, and technical controls to
ensure appropriate collection, use, maintenance, and protection of all
information, both biometric and biographic, submitted to DHS.
Furthermore, DHS complies with protections in 8 U.S.C. 1367 regarding
disclosure of information pertaining to beneficiaries of applications
for victim-based immigration relief. DHS will continue to adhere to all
statutes, regulations, and policies regarding the privacy rights of
individuals departing or entering the United States.
---------------------------------------------------------------------------
\68\ DHS, The Fair Information Practice Principles, <a href="https://www.dhs.gov/publication/privacy-policy-guidance-memorandum-2008-01-fair-information-practice-principles">https://www.dhs.gov/publication/privacy-policy-guidance-memorandum-2008-01-fair-information-practice-principles</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
Comment: Some commenters stated the rule violates the fundamental
human rights to privacy, provided specifically in Articles 17 and 26 of
the International Covenant on Civil and Political Rights (ICCPR) \69\
and Article 12 of the Universal Declaration of Human Rights (UDHR),\70\
which the United States has ratified.
---------------------------------------------------------------------------
\69\ The text of the ICCPR is available on the United Nations
Office of the High Commissioner for Human Rights website, <a href="https://www.ohchr.org/en/instruments-mechanisms/instruments/international-covenant-civil-and-political-rights">https://www.ohchr.org/en/instruments-mechanisms/instruments/international-covenant-civil-and-political-rights</a> (last visited May 16, 2025).
\70\ The text of the Universal Declaration of Human Rights is
available on the United Nations website, <a href="https://www.un.org/en/about-us/universal-declaration-of-human-rights">https://www.un.org/en/about-us/universal-declaration-of-human-rights</a> (last visited May 16,
2025).
---------------------------------------------------------------------------
Response: DHS disagrees with commenters that this rule violates any
provisions of international law that are applicable within the United
States. The tenets of the rights to privacy expressed under the ICCPR
and UDHR are already incorporated into U.S. domestic law via the
Privacy Act and through DHS regulations and policy guidance. DHS is
committed to fair equal treatment of all individuals and the rule
complies with all applicable privacy statutes, regulations, and
policies.
Comment: Two commenters mentioned the 2020 DHS Office of the
Inspector General (OIG) Report on DHS Privacy oversight inefficiencies.
Response: CBP is aware of the DHS OIG report on its November 2020
audit, entitled ``DHS Privacy Office Needs to Improve Oversight of
Department-wide Activities, Programs, and Initiatives'' \71\ (Nov. 2020
DHS OIG Report). CBP takes privacy very seriously and is dedicated to
protecting the privacy of all travelers. DHS OIG identified three
recommendations for the DHS Privacy Office to improve privacy
compliance, information sharing access agreements, and privacy
training.\72\ Two of the recommendations apply to internal record
keeping (compliance and training) and the third applies to oversight of
information sharing and access agreements.\73\ None of those
recommendations was specific to this rulemaking. CBP reviews all
programs and changes to programs to determine any privacy concerns and
mitigate any privacy risks.
---------------------------------------------------------------------------
\71\ DHS OIG, OIG-21-06, DHS Privacy Office Needs to Improve
Oversight of Department-wide Activities, Programs, and Initiatives
(2020), available at <a href="https://www.oig.dhs.gov/sites/default/files/assets/2020-12/OIG-21-06-Nov20.pdf">https://www.oig.dhs.gov/sites/default/files/assets/2020-12/OIG-21-06-Nov20.pdf</a> (last visited May 16, 2025).
\72\ Nov. 2020 DHS OIG Report at 17.
\73\ Nov. 2020 DHS OIG Report at 17.
---------------------------------------------------------------------------
c. Privacy Act and Paperwork Reduction Act
Comment: Some commenters stated that the proposed rule fails to
justify its claimed authority to collect biometrics from U.S. citizens
or lawful permanent residents (LPRs) protected by the Privacy Act (5
U.S.C. 552a).
Response: DHS respectfully disagrees with the commenters. In the
NPRM, DHS explains in great detail its authority to collect biometrics
from all aliens, including LPRs.\74\ Moreover, DHS is authorized to
take and consider evidence concerning the privilege of any person,
including U.S. citizens, to enter, reenter, pass through, or reside in
the United States, or concerning any matter which is material or
relevant to the enforcement of the INA and DHS regulations. See INA
287(b) (8 U.S.C. 1357(b)). The Privacy Act does not prevent government
agencies from collecting information about U.S. citizens and LPRs when
needed for the agency to execute its statutory and regulatory
responsibilities, but rather requires that the government follow a
process for appropriately protecting information and informing the
public about collection and retention of the information. Additionally,
as noted here and elsewhere throughout this final rule, U.S. citizens
are not required to but can voluntarily participate in the facial
biometric process.
---------------------------------------------------------------------------
\74\ See the NPRM, 85 FR at 74164, for more information on DHS'
authority to collect biometrics from all aliens.
---------------------------------------------------------------------------
DHS acknowledges that the Privacy Act requires that ``each agency
that maintains a system of records shall . . . collect information to
the greatest extent practicable directly from the subject.'' 5 U.S.C.
552a(e)(2) (emphasis added), subject to any exemptions from this
provision contained in 5 U.S.C. 552(j) and (k). Nevertheless, as
explained in the NPRM, CBP considered and piloted many types of
biometrics collections.\75\ Using information gleaned from the pilots
as well as public feedback, CBP
[[Page 48620]]
has concluded that partnering with carriers and airports to capture
facial images is the most viable large-scale solution as it is highly
effective, cost effective, and less disruptive than other possible
methods.
---------------------------------------------------------------------------
\75\ See the NPRM, 85 FR at 74171, for more information about
CBP's biometrics pilots.
---------------------------------------------------------------------------
Comment: One commenter stated that CBP should require airlines and
airports to display the Office of Management and Budget (OMB) control
number regarding this information collection.
Response: The OMB control number, 1651-0138, is listed in the TVS
PIA. Furthermore, pursuant to the Paperwork Reduction Act of 1995
(``Paperwork Reduction Act''), CBP displays the OMB control number on
signage. See 44 U.S.C. 3507. CBP also provides language for signs that
are printed and displayed by airlines, airports and other carriers at
each location where biometric collection takes place. Additionally, for
the convenience of the public, CBP updated its biometrics website
regarding CBP's Biometric Privacy Policy, <a href="https://www.cbp.gov/travel/biometrics/biometric-privacy-policy">https://www.cbp.gov/travel/biometrics/biometric-privacy-policy</a>, to include the OMB control number.
d. Public Notification and Information
Comment: Several commenters raised concerns regarding a perceived
lack of public information, notification, and awareness for all
travelers, including U.S. citizens, with regard to biometric collection
pursuant to this rule.
Response: CBP strives to be transparent and provide notice to
individuals regarding its collection, use, dissemination, and
maintenance of PII. Besides this rule, additional information can be
found on CBP's website, in the TVS PIA, and in the CPE TVS Report.\76\
Where airlines or airports are partnering with CBP on biometric air
exit, the public is informed that the partner is collecting the
biometric data in coordination with CBP.\77\ CBP provides notice to
departing travelers at airport departure gates and travelers arriving
at ports of entry through message boards or electronic signs, as well
as verbal announcements in some cases, to inform the public that CBP or
a stakeholder will be taking photos for identity verification
purposes.\78\ CBP also provides notice to the public regarding opt-out
procedures for U.S. citizens.\79\ CBP works with airlines, cruise line
operators, airports, and other port facilities to incorporate
appropriate notices and processes into their current business
models.\80\ Additionally, signage posted at CBP's FIS area provides
information to travelers on search procedures and the purpose for those
searches.\81\ Upon request, CBP officers provide individuals with a
tear sheet with Frequently Asked Questions (FAQ), opt-out procedures,
and additional information on CBP's biometric matching process,
including the legal authority and purpose for inspection, the routine
uses, and the consequences for failing to provide information.\82\
Current text for signs and tear sheets are also available on CBP's
Biometrics Resources website, <a href="https://www.cbp.gov/travel/biometrics/resources">https://www.cbp.gov/travel/biometrics/resources</a>.
---------------------------------------------------------------------------
\76\ See <a href="https://www.cbp.gov/travel/biometrics/biometric-privacy-policy">https://www.cbp.gov/travel/biometrics/biometric-privacy-policy</a>; TVS PIA at 1; and CPE TVS Report at 1, 5-7.
\77\ See CPE TVS Report at 6.
\78\ See CPE TVS Report at 6.
\79\ See CPE TVS Report at 6.
\80\ See CPE TVS Report at 6.
\81\ See CPE TVS Report at 6-7.
\82\ See CPE TVS Report at 6.
---------------------------------------------------------------------------
Privacy information on the program such as SORNs and PIAs,
including the TVS PIA and information on CBP's previous pilots during
the development and testing of facial comparison technology, are
published on the DHS Privacy website, <a href="https://www.dhs.gov/privacy">https://www.dhs.gov/privacy</a>. A
link to the TVS PIA is provided on CBP's Biometric Privacy Policy
website, <a href="https://www.cbp.gov/travel/biometrics/biometric-privacy-policy">https://www.cbp.gov/travel/biometrics/biometric-privacy-policy</a>. Also available on CBP's Biometric Privacy Policy website is the
CPE TVS Report.
In response to the 2020 GAO audit recommendations,\83\ and as noted
in the Status of Recommendation 1 in the Recommendations for Executive
Action Table on the applicable GAO website,\84\ CBP launched its
updated biometrics website on September 1, 2020 (<a href="https://www.cbp.gov/travel/biometrics">https://www.cbp.gov/travel/biometrics</a>). The purpose of the site is to deliver information
to the public and other stakeholder groups. The site provides a user-
friendly communication channel for promoting facial comparison
technology and biometrics information in a dynamic and interactive
manner. As a testament to CBP's commitment to privacy protections,
outlined in the DHS FIPPS, the CBP biometrics website includes the
current locations using facial comparison technology, as well as
information on how to request alternative screening and copies of CBP's
privacy signage on display. The information provided, including a link
to CBP's TVS PIA, is yet another tool CBP uses to ensure technology
sustains and does not erode privacy protections.
---------------------------------------------------------------------------
\83\ See GAO, GAO-20-568, Facial Recognition: CBP and TSA are
Taking Steps to Implement Programs, but CBP Should Address Privacy
and System Performance Issues (2020), available at <a href="https://www.gao.gov/products/gao-20-568">https://www.gao.gov/products/gao-20-568</a> (last visited May 16, 2025).
\84\ See GAO, GAO-20-568, Facial Recognition: CBP and TSA are
Taking Steps to Implement Programs, but CBP Should Address Privacy
and System Performance Issues, Recommendations, Recommendations for
Executive Action Table, <a href="https://www.gao.gov/assets/gao-20-568.pdf">https://www.gao.gov/assets/gao-20-568.pdf</a>
(last visited May 16, 2025).
---------------------------------------------------------------------------
Additionally, CBP has briefed the staff of the CBP Information
Center to ensure the staff has the latest information to answer
questions. CBP will continue to ensure that content is up to date on
the CBP biometrics website, as required, and when substantive updates
are made, CBP will provide new details to the CBP Information Center.
Furthermore, CBP regularly conducts periodic signage audits that
include local CBP personnel to ensure signs are accurate and placed
appropriately.\85\ It is important to note that, unlike FIS areas, the
airport departure areas are not managed by CBP personnel. However, CBP
will continue to work with its airline/airport partners to ensure that
privacy signage is available, on display, and reflective of current
privacy messaging for travelers.
---------------------------------------------------------------------------
\85\ See CPE TVS Report at 7.
---------------------------------------------------------------------------
Comment: Additionally, some commenters stated that all signage and
communication should clearly identify a contact and process for any
traveler to file a grievance should the traveler feel that the traveler
was improperly or unfairly treated during the biometric collection
process.
Response: If a traveler believes that CBP actions are the result of
the TVS maintaining incorrect or inaccurate information, (i.e., if the
TVS finds a mismatch, false match, or no match) inquiries may be
directed to CBP Information Center, Office of Public Affairs--MS1345,
U.S. Customs and Border Protection, 1300 Pennsylvania Avenue NW,
Washington, DC 20229, or online at <a href="https://help.cbp.gov/s/?language=en_US">https://help.cbp.gov/s/?language=en_US</a>. Travelers may also contact the DHS Traveler Redress
Inquiry Program (DHS TRIP), 6595 Springfield Center Drive TSA-910,
Springfield, VA 22150-6901, or online at <a href="https://www.dhs.gov/dhs-trip">https://www.dhs.gov/dhs-trip</a>,
if they have experienced a travel-related screening difficulty,
including those they believe may be related to incorrect or inaccurate
biometric information retained in their record(s). Individuals making
inquiries should provide as much identifying information as possible
regarding themselves to identify the record(s) at issue. Further, an
individual may submit a Privacy Act amendment request to have their
travel history record amended if they believe there is incorrect or
inaccurate information in their record(s). Privacy Act amendment
requests may be sent to <a href="/cdn-cgi/l/email-protection#3d4d4f544b5c5e44135e5f4d7d5e5f4d1359554e135a524b"><span class="__cf_email__" data-cfemail="10606279667173693e737260507372603e7478633e777f66">[email protected]</span></a>.
[[Page 48621]]
CBP agrees that it is important to advise the traveling public of
appropriate redress mechanisms if a traveler believes that CBP actions
are the result of the TVS maintaining incorrect or inaccurate
information. Nevertheless, CBP must be mindful of the limited space on
the sign itself. Current signage language directs travelers to the CBP
biometrics website for more information. The CBP biometrics website
includes several additional links to additional resources such as
information on the FOIA, the CBP Information Center and a link to the
DHS website, <a href="https://www.dhs.gov">https://www.dhs.gov</a>. On the DHS website, the public can
submit a DHS TRIP complaint as discussed above.
CBP will continue to keep the public informed regarding the use of
facial comparison technology as it expands to additional locations.
Comment: One commenter requested additional information on exactly
who will be targeted for this biometric collection.
Response: As discussed throughout this rule, upon the effective
date of this final rule, collection of facial biometrics may be
required from all aliens entering or exiting the United States,
regardless of age, gender, race, or nationality.
Comment: One commenter indicated this rule fails to provide
individuals with a choice or general awareness on whether travelers'
personal information will be used to develop and/or train machines or
algorithms.
Response: CBP has issued PIAs for many of the pilots that have
tested facial comparison technology.\86\ Furthermore, the relevant
SORNs are clear that DHS/CBP may use biometrics for purposes of testing
new technology and identity verification.\87\
---------------------------------------------------------------------------
\86\ See DHS/CBP/PIA-025 1:1 Facial Comparison Project, DHS/CBP/
PIA-026 Biometric Exit Mobile Air Test, DHS/CBP/PIA-027 Southwest
Border Pedestrian Exit Field Test, DHS/CBP/PIA-030 Departure
Information Systems Test, and DHS/CBP/PIA-056 Traveler Verification
Service. These PIAs are available at <a href="https://www.dhs.gov/privacy">https://www.dhs.gov/privacy</a>-
documents-us-customs-and-border-protection (last visited May 16,
2025).
\87\ See DHS/CBP-006 Automated Targeting System SORN, 77 FR
30297, 30301-02 (May 22, 2012); and DHS/CBP-007 Border Crossing
Information (BCI) SORN, 81 FR 89957, 89960-61 (Dec. 13, 2016). See
also DHS/ALL-041 External Biometric Records (EBR) SORN, 83 FR 17829,
17831-32 (Apr. 24, 2018); DHS/ALL-043 Enterprise Biometric
Administrative Records (EBAR) SORN, 85 FR 14955, 14957 (Mar. 16,
2020); DHS/CBP-011 U.S. Customs and Border Protection TECS SORN, 73
FR 77778, 77780-81 (Dec. 19, 2008); and DHS/CBP-021 Arrival and
Departure Information Systems (ADIS) SORN, 80 FR 72081, 72083 (Nov.
18, 2015). These SORNs are available at <a href="https://www.dhs.gov/system-records-notices-sorns">https://www.dhs.gov/system-records-notices-sorns</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
Comment: Two commenters noted that they had only just heard about
this rule and that the previous administration did not want input from
the public.
Response: DHS respectfully disagrees. In addition to following the
legal requirements for providing notice to specifically seek input from
the general public in accordance with the Administrative Procedure Act
(APA), 5 U.S.C. 553(b), by publishing the proposed rule in the Federal
Register on November 19, 2020, CBP also issued a press release.\88\ In
February 2021, in alignment with DHS's transparency efforts, DHS
published another notice in the Federal Register to allow the public
another opportunity to provide comments on the NPRM regarding the
expansion of facial biometrics to further secure and streamline the
international travel process. 86 FR 8878 (Feb. 10, 2021). Furthermore,
CBP issued a separate press release discussing the NPRM and reiterating
that the comment period was reopened.\89\
---------------------------------------------------------------------------
\88\ CBP, National Media Release, CBP Enhances Biometrics for
Non-U.S. Travelers Entering and Exiting the United States, Nov. 20,
2020, available at <a href="https://www.cbp.gov/newsroom/national-media-release/cbp-enhances-biometrics-non-us-travelers-entering-and-exiting-united">https://www.cbp.gov/newsroom/national-media-release/cbp-enhances-biometrics-non-us-travelers-entering-and-exiting-united</a> (last visited May 16, 2025).
\89\ CBP, National Media Release, CBP Reopens Comment Period
Regarding Enhancements to Biometrics for non-U.S. Citizens Entering,
Exiting United States, Feb. 9, 2021, available at <a href="https://www.cbp.gov/newsroom/national-media-release/cbp-reopens-comment-period-regarding-enhancements-biometrics-non-us">https://www.cbp.gov/newsroom/national-media-release/cbp-reopens-comment-period-regarding-enhancements-biometrics-non-us</a> (last visited May
16, 2025).
---------------------------------------------------------------------------
e. U.S. Citizen Opt-Out
Comment: A few commenters raised concerns about U.S. citizen
options for opting out of using this biometric technology, including
training of officers, signage and notification, alternative inspection
methods, and authority to collect data.
Response: DHS disagrees with these comments. Pursuant to section
287(b) of the INA (8 U.S.C. 1357(b)), all U.S. citizens are subject to
inspection upon arrival to and departure from the United States to
confirm their identity and citizenship. However, as noted here and
elsewhere throughout this final rule, U.S. citizens can voluntarily
participate in the facial biometric process. As mentioned on the
privacy signage, also available on <a href="https://www.cbp.gov/travel/biometrics">https://www.cbp.gov/travel/biometrics</a>, if a U.S. citizen does not wish to have a photograph taken,
the U.S. citizen may see a gate agent or CBP officer to request
alternative procedures for identity verification.
The alternative procedures implemented pursuant to this rule are
intended to be similar to the existing process at entry today, in which
a CBP officer physically examines the traveler's documentation to
ensure the bearer is the true owner and scans the document to pull up
the traveler's data for inspection. On exit, airline partners would
then conduct manual identity verification using the travel document, as
is done today with minimal impact to the boarding and exit process. If
there is some question as to the authenticity of the passport or
whether the person presenting the passport is the person to whom the
passport was lawfully issued, the airline will contact CBP for
additional inspection, and a CBP officer may perform a manual review of
the passport. A CBP officer may ask the traveler questions to validate
identity and citizenship. As mentioned above, every effort will be made
to not delay or hinder travel; however, as the alternative procedures
include a more manual process it may be slower than the automated
process using facial comparison technology.
Prior to deploying facial comparison technology to ports of entry,
CBP conducts extensive and ongoing officer training, including emphasis
on U.S. citizens being able to request to opt-out of having their photo
taken and instead proceed through the traditional inspection process
consistent with existing requirements for entry into the United States.
Additionally, CBP sends reminder memos to the field offices to ensure
compliance.
Comment: Commenters also raised concerns regarding the possibility
of an eventual biometric collection mandate for all U.S. citizens.
Response: At this time CBP does not have plans to require U.S.
citizens to be photographed when entering or exiting the United States
as evidenced by DHS's withdrawal of the 2008 NPRM which would have
proposed to require biometrics from U.S. citizens. See Withdrawal
Notice (85 FR 73644).
f. Disability, Religious and Language Accommodations
Comment: A few commenters raised concerns surrounding religious and
language accommodations, including the need for alternative processing
for travelers with religious affiliations, disabilities, or limited
English-language proficiency.
Response: CBP treats all international travelers with dignity,
respect and professionalism while keeping the highest standards of
security. For travelers with religious affiliations and/or
disabilities, CBP policy generally allows for alternative processing on
a case-by-case basis. These methods include fingerprint scans or
requesting additional documents to establish identity and citizenship.
On exit, the
[[Page 48622]]
airline gate agent may conduct manual identity verification of
travelers by using their travel documents, as is performed for flights
where biometric processing is not available, and may notify CBP to
conduct further examination, if necessary. For example, if there is
some question as to the authenticity of the passport or whether the
person presenting the passport is the person to whom the passport was
lawfully issued, airline partners will contact CBP for additional
inspection, and a CBP officer may perform a manual review of the
passport. A CBP officer may ask the traveler questions to validate
identity and citizenship.
CBP requires the full face to be viewable. As such, CBP may request
that the individual adjust or remove religious headwear to the degree
necessary for identification verification. Should religious headwear
need to be removed, CBP endeavors to provide as much privacy as
possible. During processing, if a traveler requires special
consideration due to religion, cultural, or privacy concerns, CBP
officers and managers should endeavor to reasonably accommodate the
traveler's request.
CBP has long recognized the importance of effective and accurate
communication between CBP personnel and the public they serve. Language
and communication barriers can negatively affect interactions with the
public, provision of services, and law enforcement activities. Ensuring
effective communication with all persons facilitates the CBP mission.
CBP has a protocol for the use of interpreters and translation
services, which is triggered by a request for interpreters or language
services.\90\ Air carriers and airport authorities may also provide
interpreters for travelers, typically through Airport Ambassadors. CBP
also utilizes other means of interpretation and translation, including
Agency employees certified to provide language services. Additionally,
CBP developed an internal smartphone translation application, CBP
Translate, to facilitate basic officer-traveler conversations. Privacy
information about CBP Translate is provided in DHS/CBP/PIA-069 Privacy
Impact Assessment for the CBP Translate Application (2021), available
at <a href="https://www.dhs.gov/publication/dhscbppia-069-cbp-translate-application">https://www.dhs.gov/publication/dhscbppia-069-cbp-translate-application</a> (last visited May 15, 2025).
---------------------------------------------------------------------------
\90\ See CBP, Language Access, <a href="https://www.dhs.gov/publication/language-access-plan-us-customs-and-border-protection">https://www.dhs.gov/publication/language-access-plan-us-customs-and-border-protection</a> (providing
links to the DHS and CBP Language Access Plans) (last visited May
16, 2025).
---------------------------------------------------------------------------
Comment: One commenter expressed concern over requiring travelers
to remove their face masks during the facial comparison process.
Response: The Centers for Disease Control and Prevention's Order
entitled ``Requirement for Persons To Wear Masks While on Conveyances
and at Transportation Hubs'' \91\ has expired and most travelers no
longer wear masks. However, CBP recognizes that some travelers still
choose to wear masks and understands the concerns of those travelers.
During both entry and exit, traveler identity must be verified, whether
it is by a CBP officer or by a gate agent (on departure). To verify
identity, it is necessary to see a person's face, whether it is being
viewed by a camera or by a person. An argument can be made that it
takes less time for a camera to capture a photo and do a backend
comparison than it does for a person to make the same comparison and
decide whether or not the faces match. In that case, using facial
comparison technology lessens the time a traveler has to be without
wearing a mask.
---------------------------------------------------------------------------
\91\ See 86 FR 8025 (Feb. 1, 2021).
---------------------------------------------------------------------------
As such, once at the primary inspection booth, CBP requires that
all travelers momentarily lower their masks either to conduct the
facial comparison match or to visually confirm that the traveler is the
true bearer of the travel document. Requiring travelers to briefly
remove their masks does not violate any laws. Upon departure, CBP
defers to stakeholders, but does request that travelers pull their
masks down as much as possible and ensure that no other facial
obstructions (e.g., hats or glasses) are present. If CBP officers are
present upon departure, CBP will request that travelers pull their
masks down. Nevertheless, facial comparison technology continues to
improve. For example, a 2020 DHS S&T study showed that systems are
often able to correctly identify individuals with masks.\92\ CBP will
continue to consider alternatives to mask removal using improved
technology for those rare cases where travelers are still using masks.
---------------------------------------------------------------------------
\92\ DHS S&T, News Release, Airport Screening While Wearing
Masks? Facial Recognition Tech Shows up to 96% Accuracy in Recent
Test, Jan. 4, 2021, available at <a href="https://www.dhs.gov/science-and-technology/news/2021/01/04/news-release-airport-screening-while-wearing-masks-test">https://www.dhs.gov/science-and-technology/news/2021/01/04/news-release-airport-screening-while-wearing-masks-test</a> (last visited May 16, 2025); DHS S&T, Demographic
Variation in the Performance of Biometric Systems: Insights Gained
from Large-Scale Scenario Testing (2021), available at <a href="https://www.dhs.gov/publication/demographic-variation-performance-biometric-systems">https://www.dhs.gov/publication/demographic-variation-performance-biometric-systems</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
g. Data Security, Retention, and Dissemination Concerns
Comment: Several commenters raised concerns surrounding data
security, retention, and dissemination to include protecting the
biometric data from breaches, cyberattacks, or insider threats, and
implementing appropriate safeguards and storage protocols.
Response: CBP is committed to protecting all sensitive information
in its possession, including mitigating, to the extent possible, the
risk of data breaches from information systems containing PII. Privacy
is implemented by design. It is ensured in this instance because data
protection is built into the design, architecture, and implementation
of the biometric technology, ensuring data protection through the
architecture and implementation of the biometric technology. As further
detailed below, there are four primary safeguards to secure traveler
data: secure encryption during data storage and transfer; irreversible
biometric templates; brief CBP retention periods; and secure storage.
<bullet> Encryption: CBP stores TVS information in secure CBP
systems and temporarily in a secure virtual cloud environment.\93\ CBP
uses two-factor authentication and strong encryption to transfer the
data between the camera, the TVS cloud matching service, and CBP
systems as well as for PII at rest (in storage). Moreover, just as CBP
encrypts all biometric data at rest and in transit, CBP requires its
approved partners under the TVS partner process to encrypt the data,
both at rest and in transit.
---------------------------------------------------------------------------
\93\ See TVS PIA at 26; CPE TVS Report at 15.
---------------------------------------------------------------------------
<bullet> Templates: A biometric template is a digital
representation of a biometric trait of an individual generated from a
biometric image and processed by an algorithm. The template is usually
represented as a sequence of characters and numbers.\94\ For TVS, the
secure biometric templates created from the photos cannot be reverse
engineered to recreate a biometric image. The templates generated for
the TVS are proprietary to a specific vendor's algorithm and cannot be
used with other vendors' algorithms.
---------------------------------------------------------------------------
\94\ See TVS PIA at 6, 26; CPE TVS Report at 15-16.
---------------------------------------------------------------------------
<bullet> Retention periods: The entirety of TVS is in the
cloud.\95\ For U.S. citizens, the biometric image is destroyed
immediately following confirmation of U.S. citizenship, but no later
than 12 hours only under specific
[[Page 48623]]
circumstances.\96\ If there is a system or network issue, photos will
reside in an inaccessible queue for up to 12 hours and will be
processed once the system and/or network connectivity is re-established
and proper dispositioning (confirmation of U.S. citizenship) can occur.
For all other travelers, CBP temporarily retains facial images in the
internal cloud for no more than 14 days for confirmation of travelers'
identities, evaluation of the technology, assurance of accuracy of the
algorithms, and system audits. Gallery photos of all air and sea
travelers are purged from the TVS external cloud matching service no
later than 12 hours after entry or departure. CBP's cloud service
provider, using a configurable managed service, automatically deletes
the data. Additionally, the data cache is in an encrypted form and the
cloud service provider does not have the encryption keys. CBP does not
create galleries for the land environment. Photos of aliens who are
required to provide a biometric as well as those U.S. citizens who
participate in CBP's Global Entry Program, are securely transferred
from CBP's cloud service providers to DHS IDENT, and any successor
systems.\97\ Certain other federal agencies may access IDENT with the
approval of DHS, if the purpose of their access is consistent with the
applicable SORNs, which are available on the DHS website, <a href="https://www.dhs.gov/system-records-notices-sorns">https://www.dhs.gov/system-records-notices-sorns</a>.\98\ DHS retains certain
records in IDENT for up to 75 years, which is necessary to support the
holding of biometrics of subjects of interest in immigration and border
management or law enforcement activities.\99\
---------------------------------------------------------------------------
\95\ See TVS PIA at 6; CPE TVS Report at 15.
\96\ See TVS PIA at 9-10; CPE TVS Report at 11, 16.
\97\ See TVS PIA at 8-9.
\98\ See TVS PIA at 22.
\99\ See TVS PIA at 21.
---------------------------------------------------------------------------
<bullet> Access controls: Only authorized CBP personnel and
authorized representatives of approved CBP partners have access to the
cameras, and only authorized CBP staff and cloud service provider
personnel have access to the cloud database.\100\ Although authorized
cloud personnel may access the database, they do not have keys to
decrypt the data. CBP access controls ensure only authorized access to
the facial images. Initial TVS access is not activated for an
individual without completion of the CBP Security and Privacy Awareness
course.\101\ The course presents Privacy Act responsibilities and
agency policy with regard to the security, sharing, and safeguarding of
both official information and PII. The course also provides information
regarding sharing, access, and other privacy controls. CBP updates this
training regularly, and TVS users are required to take the course
annually.\102\ Furthermore, the cloud service provider selected for
this initiative is required to adhere to the security and privacy
controls required by NIST Special Publication 800-144, Guidelines on
Security and Privacy in Public Cloud Computing (2011) \103\ and the DHS
Chief Information Officer.
---------------------------------------------------------------------------
\100\ See TVS PIA at 26; CPE TVS Report at 15.
\101\ See TVS PIA 2 at 7; CPE TVS Report at 15.
\102\ See CPE TVS Report at 15.
\103\ Available at <a href="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-144.pdf">https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-144.pdf</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
CBP experienced a cybersecurity incident during a biometric pilot
in 2019.\104\ DHS OIG reviewed the incident to determine whether CBP
ensured adequate protection of biometric data during the 2019
pilot.\105\ In response to the 2019 cybersecurity incident, CBP has
taken and continues to take robust measures to protect information
systems containing PII. CBP response actions are detailed in CBP
Comments to the Draft Report found in Appendix B to the Sept. 2020 DHS
OIG Report regarding the incident.\106\
---------------------------------------------------------------------------
\104\ See DHS OIG, OIG 20-71, Review of CBP's Major
Cybersecurity Incident during a 2019 Biometric Pilot 5 (2020) (Sept.
2020 DHS OIG Report), available at <a href="https://www.oig.dhs.gov/sites/default/files/assets/2020-09/OIG-20-71-Sep20.pdf">https://www.oig.dhs.gov/sites/default/files/assets/2020-09/OIG-20-71-Sep20.pdf</a> (last visited May
16, 2025).
\105\ Sept. 2020 DHS OIG Report at 5.
\106\ Sept. 2020 DHS OIG Report at 22-23.
---------------------------------------------------------------------------
In addition to the assessment of biometric exit stakeholders,
discussed in more detail below, CBP is working with DHS S&T, Office of
Test and Evaluation, to develop and execute a cybersecurity test plan
that will ensure all required security controls are in place on
existing hardware and software. Additionally, CBP has contracted with a
third-party vendor to perform an adversarial assessment to identify and
mitigate any cyber vulnerabilities.
Comment: Several commenters also suggested auditing stakeholders
(such as port authorities, air carriers and sea carriers) to ensure
compliance.
Response: CBP understood the need to build a system that all
stakeholders within the travel continuum could participate in without
building their own independent systems. To address these challenges and
satisfy the Congressional mandate, CBP, as outlined above, is working
closely with its partners to integrate biometrics with existing
identity verification requirements to the extent feasible. CBP agrees
that it needs to ensure that its partners comply with and adhere to DHS
and CBP privacy and security policies. To that end, CBP developed
Business Requirements Documents, available on CBP's biometrics website
at <a href="https://www.cbp.gov/travel/biometrics/biometric-privacy-policy">https://www.cbp.gov/travel/biometrics/biometric-privacy-policy</a>,
which partners sign and return to CBP as acknowledgement by the
stakeholder that it agrees to all CBP terms and technical
specifications as well as any other requirements as determined by
CBP.\107\
---------------------------------------------------------------------------
\107\ CBP Biometric Air Exit Business Requirements 8; CBP
Biometric Sea Entry-Exit Business Requirements 8.
---------------------------------------------------------------------------
These business requirements implemented by CBP with its partners
govern the retention and use of the facial images collected using CBP's
facial comparison technology. CBP prohibits all approved partners such
as airlines, airport authorities, or cruise lines and participating
organizations (e.g., vendors, systems integrators, or other third
parties) from retaining the photos they collect under this process for
their own business purposes.\108\ The partners must immediately purge
the images following transmittal to CBP, and the partner must allow CBP
to audit compliance with this requirement.\109\ In order to use TVS,
private sector partners must agree to these Business Requirements.\110\
---------------------------------------------------------------------------
\108\ CBP Biometric Air Exit Business Requirements 10; CBP
Biometric Sea Entry-Exit Business Requirements 10.
\109\ CBP Biometric Air Exit Business Requirements 10; CBP
Biometric Sea Entry-Exit Business Requirements 10.
\110\ CBP Biometric Air Exit Business Requirements 8; CBP
Biometric Sea Entry-Exit Business Requirements 8.
---------------------------------------------------------------------------
CBP comprehensively assesses compliance with DHS's security and
privacy requirements on the part of CBP and CBP's partners. This
includes security interviews with partner IT departments, security
scans of biometric processing systems, and penetration tests of those
systems. CBP has conducted 14 assessments thus far.\111\ CBP has not
found any instances of stakeholders' retaining photos in violation of
the Business Requirements Document.
---------------------------------------------------------------------------
\111\ Information provided by CBP's Biometric Entry-Exit
Strategic Transformation Admissibility and Passenger Programs office
subject matter expert on January 4, 2024.
---------------------------------------------------------------------------
CBP's cybersecurity resilience efforts, including the assessment of
biometric exit stakeholders and adversarial assessment, align with
Executive Order 14028, ``Improving the Nation's Cybersecurity,'' 86 FR
26633 (May 17, 2021), which highlights the need to strengthen
collaboration between the private sector and the Federal Government.
[[Page 48624]]
Furthermore, CBP is taking steps to promote data minimization and
privacy protections by using an airline-generated alphanumeric unique
ID (UID) to disassociate the biographic information associated with the
new facial images. As CBP verifies the identity of the traveler, either
through the automated TVS facial comparison process or manual officer
processing, the backend matching service returns the ``match'' or ``no-
match'' result, along with the associated unique identifier. There is
no additional PII shared with industry partners, which minimizes harm
to individuals should cybersecurity incidents occur. A UID is generated
by either the travel agent, travel website hosting service, or the
airline at the time of the reservation. The UID is comprised of a
sequential number (which is only valid for the particular airline and
the specific flight), plus the Record Locator, a six-digit code used to
access additional information about the traveler.
Comment: Several commenters also suggested limiting forward
dissemination.
Response: DHS discloses information sharing pursuant to the
relevant SORNs, under the Privacy Act. As discussed above, these SORNs
are available on the DHS website at <a href="https://www.dhs.gov/system-records-notices-sorns">https://www.dhs.gov/system-records-notices-sorns</a>. DHS abides by all applicable confidentiality statutes
and regulations that may limit the use and sharing of information about
vulnerable populations including those covered by IIRIRA 110 (8 U.S.C.
1367) (Violence Against Women Act, T nonimmigrant visas, and U
nonimmigrant visas); INA 244 (8 U.S.C. 1254a(c)(6)) and 8 CFR 244.16
(Temporary Protected Status); INA 245A (8 U.S.C. 1255a(c)(5)(A) and
(B), LIFE Act, Pub L. 106-553 Sec. 1104(c)(5) and 8 CFR 245a.2(t);
245a.3(n), and 8 CFR 245a.21) (Legalization under the LIFE Act); INA
210 (8 U.S.C. 1160(b)(6)(A) and (B)), 8 CFR 210.2(e) (Special
Agricultural Workers); and 8 CFR 208.6 (Asylum, credible fear, and
reasonable fear, and applicable by DHS policy to Refugee information).
Additionally, in accordance with DHS policy, CBP uses the DHS FIPPs
\112\ to assess the privacy risks and ensure appropriate measures are
taken to mitigate risks from data collection through the use of
biometrics. DHS applies FIPPS-based protection to ensure that any
forward dissemination is for a valid purpose consistent with the
purpose for the original collection, is for a limited use consistent
with the applicable SORN, and that privacy protections are adhered to.
CBP's partnering stakeholders are also held to the same standards. For
additional information on how CBP complies with the FIPPS, please see
the page 15 of the CPE TVS Report.
---------------------------------------------------------------------------
\112\ DHS, The Fair Information Practice Principles, <a href="https://www.dhs.gov/publication/privacy-policy-guidance-memorandum-2008-01-fair-information-practice-principles">https://www.dhs.gov/publication/privacy-policy-guidance-memorandum-2008-01-fair-information-practice-principles</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
DHS prioritizes data protection and security as part of its mission
to protect the homeland and is cognizant of the serious impact that
unauthorized disclosure of information could create for vulnerable
populations. DHS acknowledges that the risk of a data breach is always
technically possible, but DHS works tirelessly to minimize those risks
and continues to safeguard its information from any unauthorized use.
DHS's IDENT already contains controls so that only those individuals
whose jobs require knowledge of information retained in IDENT
(including facial images as discussed in the response in this section
above at the bullet on Retention Periods) are able to access that data
on a need-to-know basis. In addition, government employees accessing
IDENT data must have a valid federal security or suitability clearance.
Misuse of the data in IDENT is mitigated by requiring that IDENT users
conform to appropriate security and privacy policies, follow
established rules of behavior, and be adequately trained regarding the
security of their systems. Also, a periodic assessment of physical,
technical, and administrative controls is performed to enhance
accountability and data integrity.
Further, external connections must be documented and approved with
both parties' signatures in an Interconnection Security Agreement
(ISA), which outlines controls in place to protect the confidentiality,
integrity, and availability of the information being shared or
processed. DHS OBIM is responsible for all PII associated with IDENT,
and the Homeland Advanced Recognition Technology System (HART), the
successor system to IDENT currently in development, whether the data is
held in data centers or in a cloud infrastructure, and therefore
imposes strict requirements for safeguarding PII.\113\ This includes
adherence to the DHS 4300A Sensitive Systems Handbook,\114\ which
provides implementation criteria for the rigorous requirements mandated
by the DHS Information Security Program.
---------------------------------------------------------------------------
\113\ See HART PIA at 38-39.
\114\ DHS, DHS 4300A Sensitive Systems Handbook, Version 12.0
(Nov. 15, 2015), available at <a href="https://www.dhs.gov/sites/default/files/publications/4300A%20Sensitive-Systems-Handbook-v12_0-508Cs.pdf">https://www.dhs.gov/sites/default/files/publications/4300A%20Sensitive-Systems-Handbook-v12_0-508Cs.pdf</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
Additionally, DHS OBIM requires contracted cloud service providers
to segregate IDENT and HART data from all other third-party data.\115\
All contracted cloud service providers must also follow DHS privacy and
security policy requirements and must follow the Federal Risk and
Authorization Management Program (FedRAMP)'s strict configurations,
security assessments, authorizations, and continuous monitoring
requirements.
---------------------------------------------------------------------------
\115\ See HART PIA 38.
---------------------------------------------------------------------------
h. Rulemaking Process--Comment Period
Comment: Several commenters raised concerns regarding the 30-day
comment period and asserted that DHS did not provide sufficient time
for public review. One commenter also alleged that DHS's staggered
issuance of interrelated rules (referencing the USCIS NPRM) created
further difficulties for interested parties as commenters were
prevented from determining how the rules interrelate within the comment
periods for the related rules.
Response: Following the initial 30-day comment period, which closed
on December 21, 2020, CBP, in alignment with DHS transparency efforts,
and based on the previous comments received, re-opened the comment
period for an additional 30 days to provide the public another
opportunity to provide comments on the NPRM regarding the expansion of
facial biometrics to further secure and streamline the international
travel process.\116\ The second period was from February 10 to March
12, 2021.\117\ The combined comment periods amounted to 60 days.
Although section 6(a)(1) of Executive Order 12866 and section 2(b) of
Executive Order 13563 recommend as a general matter that agencies
provide a minimum comment period of 60 days, the APA does not prescribe
a minimum number of days necessary to allow for adequate comment. See 5
U.S.C. 553(b). Therefore, in accordance with the APA and the applicable
Executive Orders, DHS set a 30-day comment period and further re-opened
the comment period for an additional 30 days which reasonably provided
the public with a meaningful opportunity to comment. Additionally, CBP
notes that the USCIS NPRM has been withdrawn. 86 FR 24750 (May 10,
2021).
---------------------------------------------------------------------------
\116\ 86 FR 8878 (Feb. 10, 2021).
\117\ 86 FR at 8878.
---------------------------------------------------------------------------
[[Page 48625]]
i. Rulemaking Process--Unauthorized Official and Other DHS Authority
Concerns
Comment: Several commenters claimed that the rule was promulgated
by an unauthorized official making the rule null and void.
Response: It is unnecessary to discuss the merits of the
appointments because the NPRM only proposed changes to DHS regulations
and requested comments. It did not effectuate any change that would
amount to a final action taken by DHS.
Comment: Some commenters alleged that the rule is a violation of
the APA because the administration does not have the authority to issue
regulations that go beyond the agency's statutory mandate or that CBP
has misinterpreted Congress's directions regarding a biometric entry-
exit program. The commenters also alleged that DHS's failure to
substantiate a need for biometrics expansion conflicts with the
requirements of the APA as the APA prohibits agency actions that are
arbitrary, capricious or an abuse of discretion or unsupported by
substantial evidence. See APA (5 U.S.C. 706(2)).
Response: DHS is not exceeding the statutory authorities as they
currently exist. In accordance with the APA, DHS explicitly articulated
both general and specific statutory authority for biometric collection
including photographs, in the NPRM,\118\ reiterates that authority in
Section III.B. of this final rule, and disagrees with commenters that
it does not have authority to promulgate this rulemaking. Additionally,
DHS has provided extensive discussion of the need and purpose for this
rulemaking pursuant to the APA requirements. For more information on
the need for a biometric entry-exit program, see Section II.B. above.
---------------------------------------------------------------------------
\118\ See the NPRM, 85 FR at 74164 for more information
regarding DHS' statutory authority to require biometrics.
---------------------------------------------------------------------------
j. Government Accountability and Oversight
Comment: Several commenters raised concerns regarding effective
oversight activities, and accountability measures. Additionally, some
commenters noted the importance of instituting uniform standards across
the U.S. Government. One commenter supports the Homeland Security
Advisory Council November 2020 findings \119\ and recommendations,
including the establishment of a DHS Biometrics Oversight and
Coordination Council.
---------------------------------------------------------------------------
\119\ See HSAC Biometrics Report.
---------------------------------------------------------------------------
Response: As the Biometric Entry-Exit Program is a congressionally
mandated government program, there are several oversight processes to
ensure compliance with civil rights and civil liberties. These
processes include congressional hearings, congressionally mandated
status update reports and responses to formal congressional inquiries,
as well as audits from the GAO and OIG.
CBP participated in two congressional hearings, one in 2019 \120\
and in 2020,\121\ as well as responded to more than seven congressional
inquiries since 2017 regarding CBP's use of facial comparison
technology.
---------------------------------------------------------------------------
\120\ See About Face: Examining the Department of Homeland
Security's Use of Facial Recognition and Other Biometric
Technologies, Hearing Before the H. Comm. on Homeland Sec., 116th
Cong. (2019) (statement of John P. Wagner, Deputy Exec. Assistant
Comm'r, Off. of Field Operations, CBP), available at <a href="https://docs.house.gov/meetings/HM/HM00/20190710/109753/HHRG-116-HM00-Wstate-WagnerJ-20190710.pdf">https://docs.house.gov/meetings/HM/HM00/20190710/109753/HHRG-116-HM00-Wstate-WagnerJ-20190710.pdf</a> (last visited May 16, 2025).
\121\ See About Face: Examining the Department of Homeland
Security's Use of Facial Recognition and Other Biometric
Technologies, Part II, Hearing Before the H. Comm. on Homeland Sec.,
116th Cong. (2020) (statement of John P. Wagner, Deputy Exec.
Assistant Comm'r, Off. of Field Operations, CBP), available at
<a href="https://docs.house.gov/meetings/HM/HM00/20200206/110460/HHRG-116-HM00-Wstate-WagnerJ-20200206.pdf">https://docs.house.gov/meetings/HM/HM00/20200206/110460/HHRG-116-HM00-Wstate-WagnerJ-20200206.pdf</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
Additionally, CBP has published several reports that provide the
public with information on how CBP is implementing the Biometrics
Entry-Exit Program. For example, in August 2019, DHS provided the U.S.
House of Representatives Committee on Homeland Security a comprehensive
report on the program that included material on the operational and
security benefits of the biometric entry-exit system. CBP and TSA's
efforts to address privacy concerns and potential performance
differential errors, and a comprehensive description of audits
performed.\122\
---------------------------------------------------------------------------
\122\ See DHS, TSA and CBP: Deployment of Biometric Technologies
Report to Congress (2019) is posted in the docket for this
rulemaking.
---------------------------------------------------------------------------
CBP has addressed the recommendations from two audits, both in
2020, one by GAO and one by DHS OIG. See Sections V.B.2.c and V.B.4.b
and d, above. CBP is aware of the DHS OIG report on its September 2023
audit, entitled ``DHS Needs to Update Its Strategy to Better Manage Its
Biometric Capability Needs.'' \123\ DHS OIG identified four
recommendations; two for the Office of Strategy, Policy, and Plans to
update and finalize internal DHS strategic plans and a department-wide
policy for biometric collection in all transportation modalities and
two recommendations for the Undersecretary for Management to update and
finalize the DHS biometric implementation plan (roadmap) and for the
Executive Steering Committee to continue the working group to develop a
transition plan to integrate CBP's biometric entry-exit system with
OBIM's HART system. Although none of these recommendations is directly
specific to this rulemaking, CBP takes biometric capabilities seriously
and is dedicated to work cooperatively with DHS to provide critical
input regarding an overall management strategy to acquire and deploy a
biometric solution that meets Department needs, particularly regarding
integration of CBP's biometric entry-exit system with HART (the
successor system to IDENT, as noted elsewhere).
---------------------------------------------------------------------------
\123\ DHS OIG, OIG 23-58, DHS Needs to Update Its Strategy to
Better Manage Its Biometric Capability Needs (2023), available at
<a href="https://www.oig.dhs.gov/sites/default/files/assets/2023-09/OIG-23-58-Sep23.pdf">https://www.oig.dhs.gov/sites/default/files/assets/2023-09/OIG-23-58-Sep23.pdf</a> (last visited May 16, 2025).
---------------------------------------------------------------------------
Furthermore, CBP complies with the requirements of the Privacy Act,
as well as all DHS and Government-wide policies. In accordance with DHS
policy, CBP uses the FIPPs to assess the privacy risks and ensure
appropriate measures are taken to mitigate risks from data collection
through the use of biometrics. CBP's partnering stakeholders are also
held to the same standards. For additional information on how CBP
complies with the FIPPS, please see page 15 of the CPE TVS Report.
Also, the business requirements implemented by CBP with its
partners govern the retention and use of the facial images collected
using CBP's facial comparison technology. The Business Requirements
Documents are available on CBP's biometrics website at <a href="https://www.cbp.gov/travel/biometrics/biometric-privacy-policy">https://www.cbp.gov/travel/biometrics/biometric-privacy-policy</a>. CBP prohibits
its approved partners such as airlines, airport authorities, or cruise
lines and participating organizations (e.g., vendors, systems
integrators, or other third parties) from retaining the photos they
collect under this process for their own business purposes.\124\ The
partners must immediately purge the images following transmittal to
CBP, and the partner must allow CBP to audit compliance with this
requirement.\125\ In order to use TVS, private sector partners must
agree to these Business Requirements.\126\
---------------------------------------------------------------------------
\124\ CBP Biometric Air Exit Business Requirements 10; CBP
Biometric Sea Entry-Exit Business Requirements 10.
\125\ Id.
\126\ CBP Biometric Air Exit Business Requirements 8; CBP
Biometric Sea Entry-Exit Business Requirements 8.
---------------------------------------------------------------------------
Several DHS Offices and Programs also have oversight of CBP
activities. For example, CBP collaborates regularly with the DHS
Privacy Office to ensure
[[Page 48626]]
compliance with privacy laws and policies. The DHS Privacy Office
commissioned the DHS Data Privacy and Integrity Advisory Committee
(DPIAC) to advise DHS on best practices for the use of facial
comparison technology. The DHS DPIAC published its report on February
26, 2019.\127\ CBP has implemented or is actively working to implement
all of the DHS DPIAC recommendations.
---------------------------------------------------------------------------
\127\ DHS DPIAC, Report 2019-01: Privacy Recommendations in
Connection with the Use of Facial Recognition Technology (2019),
available at <a href="https://www.dhs.gov/sites/default/files/publications/Report%202019-01_Use%20of%20Facial%20Recognition%20Technology_02%2026%202019.pdf">https://www.dhs.gov/sites/default/files/publications/Report%202019-01_Use%20of%20Facial%20Recognition%20Technology_02%2026%202019.pdf</a>
(last visited May 19, 2025).
---------------------------------------------------------------------------
Additionally, in June 2019, the Privacy and Civil Liberties
Oversight Board (PCLOB) started an ongoing oversight project to review
the use of facial comparison technology in aviation security, with the
goal of informing policymakers and the public about these technologies,
their uses, and their implications for security, privacy, and civil
liberties.\128\ CBP hosted the PCLOB for a tour of biometric processes
at Atlanta/Hartsfield International Airport on January 15, 2020.\129\
---------------------------------------------------------------------------
\128\ See PCLOB, Press Release, ``From Booking to Baggage
Claim:'' PCLOB to Examine Use of Facial Recognition and Other
Biometric Technologies in Aviation Security: Board Announces Three
New Oversight Projects, June 26, 2019, available at <a href="https://documents.pclob.gov/prod/Documents/EventsAndPress/eb140554-4fc7-4700-88d2-197d7fe45770/New%20projects%20announcement%20June_25_%202019%20Final.pdf">https://documents.pclob.gov/prod/Documents/EventsAndPress/eb140554-4fc7-4700-88d2-197d7fe45770/New%20projects%20announcement%20June_25_%202019%20Final.pdf</a> (last
visited May 19, 2025); and PCLOB, Current Oversight Projects,
<a href="https://www.pclob.gov/OversightProjects">https://www.pclob.gov/OversightProjects</a> (last visited May 19, 2025).
\129\ See About Face: Examining the Department of Homeland
Security's Use of Facial Recognition and Other Biometric
Technologies, Part II, Hearing Before the H. Comm. on Homeland Sec.,
116th Cong. (2020) (statement of John P. Wagner, Deputy Exec.
Assistant Comm'r, Off. of Field Operations, CBP at 9), available at
<a href="https://docs.house.gov/meetings/HM/HM00/20200206/110460/HHRG-116-HM00-Wstate-WagnerJ-20200206.pdf">https://docs.house.gov/meetings/HM/HM00/20200206/110460/HHRG-116-HM00-Wstate-WagnerJ-20200206.pdf</a> (last visited May 19, 2025).
---------------------------------------------------------------------------
Furthermore, CBP works closely with DHS S&T, OBIM and NIST on
technical standards and system performance. Additionally, CBP is a
member of the DHS Biometric Capabilities Executive Steering Committee
(BC-ESC), which continues to meet quarterly.\130\ The mission of the
BC-ESC is to provide effective governance, oversight, coordination, and
guidance to all DHS and component-level programs that are developing
and/or providing biometric capabilities in support of DHS mission
objectives.\131\ It serves as a forum for cross-component collaboration
and the sharing of biometric challenges, needs, concepts, best
practices, plans, and efforts.
---------------------------------------------------------------------------
\130\ See HSAC Biometrics Report 23.
\131\ See HSAC Biometrics Report 23.
---------------------------------------------------------------------------
Although CBP's Biometric Entry-Exit Program does have sufficient
oversight and accountability mechanisms, CBP is committed to
transparency in its use of facial comparison technology and welcomes
the opportunity to engage with Congress on legislative enhancements and
to provide technical assistance, as necessary. CBP will ensure
compliance with any new applicable legislation or regulations passed.
Comment: One commenter suggested that Congress pass an ethics bill
prior to using facial comparison technology. One commenter suggested
the United States needed a Cyber Bill of Rights.
Response: Comments suggesting Congressional action are outside the
scope of this rulemaking. However, CBP will ensure compliance with any
and all new applicable legislation passed by Congress.
Comment: Several commenters referenced specific abuse or misuse of
power concerns. Some commenters mentioned alleged human rights
violations committed by CBP and ICE. The commenters were concerned
generally with CBP and ICE abuses, including a concern that this rule
would open the door for further abuses of power and human rights
violations.
Response: As documented in the DHS Core Values,\132\ DHS employees,
including those of CBP, execute the duties and responsibilities
entrusted to the agency with highest ethical and professional
standards. Each DHS employee has a responsibility to the United States
Government and its citizens to place loyalty to the Constitution, laws,
and ethical principles above private gain. To ensure that every citizen
can have complete confidence in the integrity of the Federal
Government, each employee shall respect and adhere to the principles of
ethical conduct set forth in the Code of Federal Regulations as well as
the implementing standards in supplemental agency regulations. See 5
CFR part 2635. Furthermore, CBP officers and agents follow the CBP
Standards of Conduct.\133\ Section 3.1 of the CBP Standards of Conduct
specifically states, ``The conduct of CBP employees must reflect the
qualities of integrity and loyalty to the United States; a sense of
responsibility for the public trust; courtesy and promptness in dealing
with and serving the public; and a standard of personal behavior that
reflects positively upon, and will be a credit to, both CBP and its
employees.'' \134\ Section 7.11.2 further provides, ``Employees will
not make abusive, derisive, profane, or harassing statements or
gestures, or engage in any other conduct evidencing hatred or invidious
prejudice to or about another person or group on account of race,
color, religion, national origin, sex, sexual orientation, age, or
disability.'' \135\ The safety of CBP employees and the public is
paramount during CBP operations.
---------------------------------------------------------------------------
\132\ DHS, Core Values, <a href="https://www.dhs.gov/core-values">https://www.dhs.gov/core-values</a> (last
visited May 19, 2025).
\133\ CBP, Directive 51735-013B, Standards of Conduct (2020),
available at <a href="https://www.cbp.gov/sites/default/files/assets/documents/2021-Jan/cbp-standards-conduct-2020_0.pdf">https://www.cbp.gov/sites/default/files/assets/documents/2021-Jan/cbp-standards-conduct-2020_0.pdf</a> (last visited
May 19, 2025).
\134\ CBP, Directive 51735-013B, Standards of Conduct 1 (2020),
available at <a href="https://www.cbp.gov/sites/default/files/assets/documents/2021-Jan/cbp-standards-conduct-2020_0.pdf">https://www.cbp.gov/sites/default/files/assets/documents/2021-Jan/cbp-standards-conduct-2020_0.pdf</a> (last visited
May 19, 2025).
\135\ Id. at 11.
---------------------------------------------------------------------------
Alleged violations by CBP or ICE officers or agents are outside the
scope of this rulemaking.\136\
---------------------------------------------------------------------------
\136\ Although outside the scope of this rulemaking, DHS notes
the launch of the Office of the Immigration Detention Ombudsman
(OIDO), a new and independent office within DHS as mandated by
Congress. See section 106 of the Consolidated Appropriations Act,
2020, Public Law 116-93, 133 Stat. 2317, 2505 (amending section 405
of the Homeland Security Act (6 U.S.C. 205)). OIDO is an independent
office within DHS and is not a part of ICE or CBP. OIDO's role is to
assist individuals with complaints about the potential violation of
immigration detention standards or misconduct by DHS (or contract)
personnel; provide independent oversight of immigration detention
facilities, including conducting unannounced inspections and
reviewing contract terms for immigration detention facilities and
services; and serve as an independent office to review and resolve
problems stemming from the same. See sec. 405(a)-(b) of the Homeland
Security Act (6 U.S.C. 205(a)-(b)); DHS, Office of the Immigration
Detention Ombudsman, <a href="https://www.dhs.gov/office-immigration-detention-ombudsman">https://www.dhs.gov/office-immigration-detention-ombudsman</a> (last visited May 19, 2025).
---------------------------------------------------------------------------
k. Accuracy, General Bias, and Misidentification Concerns
Comment: Several commenters raised concerns regarding the accuracy,
reliability, and potential bias of facial comparison technology,
particularly its impact on specific demographic groups.
Response: DHS is aware of several NIST stu
[…truncated; see source link]Indexed from Federal Register on October 27, 2025.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.