Face recognition at airports: the CBP and TSA programs and how each matches a face

This page is part of the face recognition section. The distinction it turns on, a one-to-many search against a gallery versus a one-to-one check against a document, is the subject of the 1:1 versus 1:N page; this one applies it to the two programs a traveller meets.

01What does CBP's biometric entry and exit program do?

CBP's biometrics page describes the program as a response to the 9/11 Commission Report, which "authorized the U.S. Government to use an automated system to record the arrivals and departures of visitors at all air, sea and land ports of entry". After "years of testing and pilots" CBP deployed facial comparison, "known as the Traveler Verification Service (TVS)", for entry and exit in the air, land and sea environments (cbp.gov/travel/biometrics). The entry process is branded Simplified Arrival and runs at all international airports; exit runs at 55 airport locations, and the technology also covers 39 seaports and all pedestrian lanes at the Southwest and Northern border ports of entry.

The match is one-to-many. The page describes a camera "connected to CBP's cloud-based TVS facial matching service via a secure, encrypted connection" that "matches live images with existing photo templates from passenger travel documents". The gallery is built per flight: once the system matches the live image with "historical photo templates of all travelers from the gallery associated with that manifest", the traveller proceeds to inspection or exits. CBP states that it has "processed more than 540 million travelers using biometric facial comparison technology and prevented more than 2,000 impostors from entry". Those two figures are CBP's own and are not broken down by airport, year or error type on the page.

02What does TSA's identity verification do?

TSA's program answers a different question at a different point in the journey. At a checkpoint fitted with a second-generation Credential Authentication Technology device, CAT-2, "your picture will be taken and compared with your physical ID or digital ID" (tsa.gov/digital-id). The comparison is one image against one image: the live capture against the photo on the passport, driving licence, state ID or state-issued digital ID the passenger presents. TSA's privacy assessment describes the earlier CAT-C proof of concept in the same terms: the device validated "that the identity document presented by the passenger was authentic" and compared "the passenger's live facial image against the image from the passenger's identity document" (DHS/TSA/PIA-046).

TSA's page carries the program's privacy statements in plain terms. "The photo is optional." "Your photo and personal data are deleted after your identity is verified." "Images are not used for law enforcement, surveillance and not shared with other entities." A passenger who declines is told to "tell the officer if you do not want your photo taken" and that "you will not lose your place in line"; the page lists four ways to present identification at a CAT-2, of which the digital ID is one. All passengers must still carry a physical ID.

03Why are they two programs and not one?

The two programs have separate legal bases, separate systems and separate privacy impact assessments. CBP's is a congressional mandate to record arrivals and departures of visitors; its November 2018 assessment, DHS/CBP/PIA-056, states that CBP "is congressionally mandated to deploy a biometric entry/exit system" and consolidates all earlier TVS assessments into one document (DHS/CBP/PIA-056). It lists four associated systems of records, including Border Crossing Information and the Arrival and Departure Information System.

TSA's is a security screening function. Its assessment, DHS/TSA/PIA-046 of June 2020, covers connecting the CAT device to the Secure Flight system so that boarding pass data reaches the device, and lists one associated system of records, Secure Flight Records. The two documents do not reference each other's galleries: CBP matches against travel document templates for a manifest, TSA against the document in the passenger's hand.

04How is each kind of match measured?

The two programs are scored on different error rates, which is why a single "accuracy" figure for airport face recognition does not exist. A one-to-one check such as TSA's is measured by false match rate and false non-match rate: NIST's FRTE 1:1 track defines FNMR as "the proportion of mated comparisons below a threshold set to achieve the false match rate (FMR) specified" (pages.nist.gov/frvt/html/frvt11.html). A one-to-many search such as CBP's is measured by false positive and false negative identification rates: FNIR is "the proportion of mated searches failing to return the mate above threshold" and FPIR "the proportion of non-mated searches producing one or more candidates above threshold", with NIST's 1:N reports set at an FPIR of 0.003 (pages.nist.gov/frvt/html/frvt1N.html).

The gallery size changes the arithmetic. A per-flight gallery holds only the templates of the travellers on one manifest, so a 1:N search at the gate faces far fewer chances of a false positive than a search against a national database would. The NIST evaluations page explains how the published tests fix the operating point, and why a vendor's score on NIST's test images is not a score on a boarding gate.

05What do the public tests say about border photos?

NIST's 2019 demographic report is the closest public measurement to the airport setting, because border crossing photos were one of its four image sets. NISTIR 8280 processed 18.27 million images of 8.49 million people through 189 algorithms from 99 developers and found that false positive rates "often vary by factors of 10 to beyond 100 times" across demographic groups, while false negative rates varied "often by factors below 3" (doi.org/10.6028/NIST.IR.8280). It also found that some highly accurate identification algorithms showed undetectable false positive differentials, so the effect is a property of the algorithm chosen, not of face recognition as such. The report did not test the CBP or TSA systems themselves, and neither agency page states which algorithm it runs.

No single benchmark score predicts how a face matcher performs on a camera, a gallery and a population it was not tested on. The same gap between a public test and a deployment runs through this site: the InsightFace toolkit lists the training sets behind many open-source matchers, and the deepfake detection on social media page shows what an uncontrolled capture path does to a detector, where an airport gate controls the camera and a social feed controls nothing. The deepfake types table matters less here, because a gate camera sees a physical face, not a video file.