Collection of Biometric Data From Aliens Upon Entry to and Departure From the United States

Federal RegisterOct 27, 2025

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF HOMELAND SECURITY

8 CFR Parts 215 and 235

[Docket No. USCBP-2025-0033; CBP Dec. 25-06]

RIN 1651-AB12

Collection of Biometric Data From Aliens Upon Entry to and Departure From the United States

AGENCY:

U.S. Customs and Border Protection, DHS.

ACTION:

Final rule with request for comments.

SUMMARY:

This final rule amends Department of Homeland Security (DHS) regulations to provide that DHS may require all aliens to be photographed when entering or exiting the United States, and may require non-exempt aliens to provide other biometrics. The final rule also amends the regulations to remove the references to pilot programs and the port limitation to permit collection of biometrics from aliens departing from airports, land ports, seaports, or any other authorized point of departure. In addition, DHS is requesting comments on the specific collection process as well as costs and benefits for new transportation modalities.

DATES:

Effective Date:

This rule is effective on December 26, 2025.

Submission of public comments:

Comments must be submitted on or before November 26, 2025.

ADDRESSES:

You may submit comments regarding the specific collection process as well as costs and benefits for the newly implemented transportation modalities (the Simplified Arrival process at air entry, sea entry processes, and the process for entry for pedestrians at land) to the Federal eRulemaking Portal:

https://www.regulations.gov.

Follow the instructions for sending comments.

Instructions:

All submissions received must include the agency name and docket number USCBP-2020-0062 or RIN number 1651-AB12. All comments received will be posted without change to

http://www.regulations.gov,

including any personal information provided. For detailed instructions on submitting comments, see the “Public Participation” heading of the

SUPPLEMENTARY INFORMATION

section of this document.

Docket:

For access to the docket to read background documents or comments received, go to

http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Larry Panetta, Director, Biometrics Program Office, Office of Field Operations, U.S. Customs and Border Protection, by phone at (202) 344-1253 or via email at

larry.a.panetta@cbp.dhs.gov.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Public Participation

II. Executive Summary

A. Notice of Proposed Rulemaking

B. Background and Purpose of the Rule

C. Costs, Cost Savings, and Benefits

III. Background

A. National Security and Immigration Benefits of a Biometric Entry-Exit Program

B. Facial Comparison-Based Entry-Exit Process Pursuant to This Final Rule

1. Benefits of a Facial Comparison-Based Process

2. Facial Comparison Technology Gallery Building

3. General Collection Process

4. Facial Comparison-Based Entry Process

5. Facial Comparison-Based Exit Process

6. Alternative Procedures and Public Notice

7. No Match Procedures

8. U.S. Nationals, Dual Nationals and Lawful Permanent Residents

9. Business Requirements for Public-Private Partnerships

IV. Summary of Changes to the Biometric Entry and Exit Regulations

A. General Biometric Exit Requirement for Aliens

B. Collection of Photographs From Aliens Upon Entry and Departure

C. Collection of Biometrics When Departing the United States and Other Minor Conforming and Editorial Changes

V. Discussion of Comments Submitted in Response to the NPRM

A. Overview

B. Discussion of Comments

1. Comments Expressing General Support

2. Comments Expressing General Support With Recommendations

3. Comments Expressing General Inquiries

4. Comments Expressing General Opposition

VI. Statutory and Regulatory Requirements

A. Executive Orders 12866, 13563, and 14192

B. Regulatory Flexibility Act

C. Unfunded Mandates Reform Act of 1995

D. Paperwork Reduction Act

E. Privacy

F. National Environmental Policy Act

Table of Abbreviations and Acronyms

ADIS—Arrival and Departure Information System

APA—Administrative Procedure Act

APIS—Advance Passenger Information System

CBP—U.S. Customs and Border Protection

DHS—Department of Homeland Security

DHS DPIAC—DHS Data Privacy and Integrity Advisory Committee

DHS TRIP—DHS Traveler Redress Inquiry Program

DHS FIPPS—DHS Fair Information Practice Principles

DOT—Department of Transportation

FBD—Facial Biometric Debarkation

FIS area—Federal Inspection Service area

FOIA—Freedom of Information Act

FY—Fiscal Year

GAO—Government Accountability Office

HART—Homeland Advanced Recognition Technology

IDENT—Automated Biometric Identification System

INA—Immigration and Nationality Act

LPR—lawful permanent resident

NARA—National Archives and Records Administration

NIST—National Institute of Standards and Technology

NPRM—Notice of Proposed Rulemaking

OBIM—Office of Biometric Identity Management

OMB—Office of Management and Budget

PIA—Privacy Impact Assessment

PII—personally identifiable information

PCLOB—Privacy and Civil Liberties Oversight Board

RFA—Regulatory Flexibility Analysis

SORN—System of Records Notice

S&T—Science and Technology

TSA—Transportation Security Administration

TVS—Traveler Verification Service

USCIS—United States Citizenship and Immigration Services

VWP—Visa Waiver Program

I. Public Participation

Interested persons are invited to participate in this rulemaking by submitting written data, views, or arguments on the specific collection process, as well as costs and benefits regarding the newly implemented transportation modalities for facial biometric collection, namely, the Simplified Arrival process at air entry, the sea entry processes, and the process for entry for pedestrians at land ports. Comments that will provide the most assistance will reference a specific portion of the final rule, explain the reason for any recommended change, and include data, information, or authority that supports such recommended change. All submissions received must include the agency name and docket number for this rulemaking. All comments received will be posted without change to

http://www.regulations.gov,

including any personal information provided.

Comments submitted regarding any topic other than the specific collection process and costs and benefits on these newly implemented transportation modalities are out of scope for this final rule and will not be considered.

II. Executive Summary

A. Notice of Proposed Rulemaking

On November 18, 2020, the Department of Homeland Security

(DHS) published a Notice of Proposed Rulemaking in the

Federal Register

(85 FR 74162) (hereinafter referenced as “the NPRM”) proposing to amend the DHS regulations with regard to collection of biometrics from aliens entering and exiting the United States.

On February 10, 2021, DHS published a notice in the

Federal Register

(86 FR 8878) stating that it was reopening the comment period for an additional 30 days based on comments received during the initial comment period.

The NPRM referred to “aliens” as “noncitizens.” This final rule uses the statutory term “alien” as appropriate.

DHS received a total of 320 comments in response to the NPRM. The submissions included comments supporting the rule, requesting clarification, providing suggestions for changes, and voicing concerns. After review of the comments, through this final rule, DHS is finalizing the proposed changes in the NPRM without substantive modification.

B. Background and Purpose of the Rule

DHS is mandated by statute to develop and implement an integrated, automated entry and exit data system to match records, including biographic data and biometrics,

of aliens entering and departing the United States.

DHS also has broad authority to control alien travel and to inspect aliens under various provisions of the Immigration and Nationality Act of 1952, Public Law 82-414, 66 Stat. 163, as amended (INA), which may include requiring aliens to provide biometrics and other relevant identifying information upon entry to, or departure from, the United States.

DHS, through U.S. Customs and Border Protection (CBP), has been collecting biometric data from certain aliens arriving in the United States since 2004.

However, currently there is no comprehensive system in place to collect biometrics from aliens departing the country.

Biographic data includes information specific to an individual traveler such as name, date of birth, and travel document number, which are data elements stored in that traveler's passport, visa, or lawful permanent resident card. Biometrics refers to forms of identification based on anatomical, physiological, and behavioral characteristics or other physical attributes unique to a person that can be collected, stored, and used to verify the identity of a person,

e.g.,

fingerprints, photographs, iris, DNA, and voice print.

See

Executive Office of the President, National Science and Technology Council, Subcommittee on Biometrics, “The National Biometrics Challenge,” September 2011, available at

https://www.bing.com/ck/a?!&&p=e3dc11c7c1aa323eJmltdHM9MTcyOTIwOTYwMCZpZ3VpZD0zYmYzOTY1ZS01ZjU1LTY0YmItMTUzMC04MjJhNWUxYTY1MDQmaW5zaWQ9NTE5OA&ptn=3&ver=2&hsh=3&fclid=3bf3965e-5f55-64bb-1530-822a5e1a6504&psq=the+national+biometrics+challenge+2011&u=a1aHR0cHM6Ly9vYmFtYXdoaXRlaG91c2UuYXJjaGl2ZXMuZ292L3NpdGVzL2RlZmF1bHQvZmlsZXMvbWljcm9zaXRlcy9vc3RwL2Jpb21ldHJpY3NjaGFsbGVuZ2UyMDExLnBkZg&ntb=1.

(Last visited May 15, 2025.)

Numerous federal statutes require DHS to create an integrated, automated biometric entry and exit system that records the arrival and departure of aliens, compares the biometric data of aliens to verify their identity, and authenticates travel documents presented by such aliens through the comparison of biometrics. These include: section 110 of the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA), Public Law 104-828, 110 Stat. 3009-546, 3009-558; section 2(a) of the Immigration and Naturalization Service Data Management Improvement Act of 2000 (DMIA), Public Law 106-215, 114 Stat. 337, 338; section 205 of the Visa Waiver Permanent Program Act of 2000, Public Law 106-396, 114 Stat. 1637, 1641; section 414 of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act), Public Law 107-56, 115 Stat. 272, 353; section 302 of the Enhanced Border Security and Visa Entry Reform Act of 2002 (Border Security Act), Public Law 107-173, 116 Stat. 543, 552; section 7208 of the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA), Public Law 108-458, 118 Stat. 3638, 3817; section 711 of the Implementing Recommendations of the 9/11 Commission Act of 2007 (Implementing Recommendations of the 9/11 Commission Act), Public Law 110-53, 121 Stat. 266, 338; and section 802 of the Trade Facilitation and Trade Enforcement Act of 2015, Public Law 114-125, 130 Stat. 122, 199 (6 U.S.C. 211(c)(10)).

See

INA 214, 215(a), 235(a), 262(a), 263(a), 264(c), 287(b) (8 U.S.C. 1184, 1185(a), 1225(a), 1302(a), 1303(a), 1304(c)), 1357(b)).

See

the NPRM, 85 FR at 74169 for more information.

Implementing an integrated biometric entry-exit system that compares biometric data of aliens collected upon arrival with biometric data collected upon departure helps address the national security concerns arising from the threat of terrorism, the fraudulent use of legitimate travel documentation, aliens who remain in the United States beyond their period of authorized stay (overstays) or are present in the United States without being admitted or paroled, as well as incorrect or incomplete biographic data for travelers. As recognized by the National Commission on Terrorist Attacks Upon the United States (also known as the 9/11 Commission), combatting terrorism requires a screening system that examines individuals at multiple points within the travel continuum.

An integrated biometric entry-exit system provides an accurate way to verify an individual's identity, and, consequently, can improve security and effectively combat attempts by terrorists who use false travel documents to circumvent border checkpoints. An integrated biometric entry-exit system can also be used to biometrically verify that a person who presents a travel document is the true bearer of that document, which will help prevent visa fraud and the fraudulent use of legitimate travel documentation.

The 9/11 Commission Report 384-386 (2004), available at

https://9-11commission.gov/report/

(last visited May 15, 2025).

See also

the NPRM, 85 FR at 74107.

Such a system will also allow DHS to confirm more concretely the identity of aliens seeking entry or admission to the United States and to verify their departure from the United States. By having more accurate border crossing records of aliens, DHS can more effectively identify overstays and aliens who are, or were, present in the United States without being admitted or paroled and prevent their potential unlawful reentry into the United States. It will also make it more difficult for imposters to utilize other travelers' credentials. In addition, performing biometric identity verification can help DHS reconcile any errors or incomplete data in a traveler's biographic data.

Ultimately, this provides DHS with more reliable information to verify identities and to strengthen its ability to identify criminals and known or suspected terrorists.

See

the NPRM, 85 FR at 74107 for more information on how biometric identity verification mitigates risks including overstays, unlawful reentry, and other risks.

DHS has faced a number of logistical and operational challenges in developing and deploying a biometric exit capability. This is, in part, because U.S. ports generally do not have designated and secure exit areas for conducting outbound inspections, recording travelers' departures, or comparing biometric information against arrival data.

As stated in the NPRM, CBP has been testing various options to collect biometrics at entry and departure.

The results of these tests and the recent advancement of new technologies, including facial comparison technology, have provided CBP with a model to implement a comprehensive biometric entry-exit solution. Based on these tests, CBP determined that facial comparison technology is currently the best available method for biometric verification, as it is accurate, unobtrusive, and efficient.

This technology uses existing advance passenger information along with photographs, which have already been provided by travelers to the U.S. government for the purpose of facilitating international travel, to create galleries of facial image templates to correspond with who is expected to be

arriving in or departing from the United States on a particular flight, voyage, etc. These photographs may be derived from passport applications, visa applications, immigration applications, or interactions with CBP at a prior border inspection. Once the gallery is created based on the advance information, the facial comparison technology compares a template of a live photograph of the traveler to the gallery of facial image templates. Live photographs are taken where there is clear expectation that travelers will need to provide documentary evidence of their identity. If there is a facial image match, the traveler's identity has been verified. In select cases, fingerprints may also need to be collected, but only as required to better establish links to previously collected traveler biometric records.

See

the NPRM, 85 FR at 74171-74173 for a discussion of these tests.

See

the NPRM, 85 FR at 74173-74178 for a discussion of the benefits of a biometric entry-exit system based on facial recognition.

CBP has fully implemented its facial comparison system in the commercial air environment at entry through a process known as Simplified Arrival. CBP has implemented exit in the air environment primarily through partnerships with airlines at select locations. CBP has also fully implemented facial comparison biometrics at entry in the sea environment through processes known as Facial Biometric Debarkation (FBD), Mobile Primary Face, and Simplified Arrival Sea, and at entry in the pedestrian land environment through a process known as Pedestrian Entry. CBP plans to eventually establish a biometric entry-exit system at all air, sea, and land ports of entry.

See

CBP, Biometrics,

https://www.cbp.gov/travel/biometrics

(last modified April 24, 2025) (last visited May 12, 2025).

As noted above, in this final rule, CBP is seeking comments regarding the specific collection process as well as costs and benefits for these newly implemented transportation modalities (the Simplified Arrival process at air entry, sea entry processes, and the process for entry for pedestrians at land).

CBP estimates that a biometric entry-exit system can be fully implemented at all commercial airports and sea ports for both entry and exit within the next three to five years. CBP plans to continue to work to determine the best option for implementing a comprehensive biometric entry-exit system nationwide, which may include pilot programs to test various options for travelers at exit in the sea and pedestrian land environment as well as for travelers entering and exiting in vehicles at land ports and on private aircraft.

The regulatory changes adopted in this rule are necessary to enable CBP to continue its refinements, and implement facial comparison efficiently once the best solution is identified. As explained in the NPRM, prior to implementation of this rule, CBP could only conduct pilot programs at a limited number of air and sea ports of entry and could only collect biometrics from a limited population.

Private aircraft are those engaged in non-commercial flights, sometimes referred to as general aviation.

See

section 122.1(h) of title 19 of the Code of Federal Regulations (CFR) (19 CFR 122.1(h)).

This final rule advances the legal framework for DHS collection and use of biometrics from aliens through a comprehensive biometric entry-exit system by removing the references to pilot programs and the port limitations and requiring facial comparison biometrics from all aliens on entry and exit.

See

8 CFR 215.8(a) and 235.1(f). Because CBP is still determining the best way to implement biometric entry-exit in certain environments, as listed above, CBP has not included in this rule an analysis of the costs and benefits for those environments that are not yet operational. When CBP moves forward with a large-scale implementation of biometric entry-exit for vehicles at land ports and private aircraft or biometric exit at pedestrian land or sea ports, CBP will publish a notice in the

Federal Register

with information regarding details of implementation and request comments on the newly implemented transportation modalities.

This final rule provides that all aliens may be required to be photographed upon entry and/or departure. Facial comparison technology upon entry and departure makes the process for verifying aliens' identities more efficient and accurate. It enables CBP to match the travelers' biometric photographs with their biographic information. The ability to biometrically verify the identity to confirm the departure of aliens will improve security, comply with federal statutory requirements, and help DHS detect overstays and aliens who are or were present in the United States without being admitted or paroled and prevent their illegal reentry. Having accurate entry and exit records is a fundamental piece of the U.S. immigration system and detecting overstays supports that system. Remaining in the United States beyond the period of authorized stay is unlawful and carries consequences for future visits to the United States.

See

INA 212(a)(9)(B) (8 U.S.C. 1182(a)(9)(B)). Ensuring the travelers' photographs match with their vetted biographic and biometric information also helps CBP prevent document fraud and the use of fraudulent travel documents, or the use of legitimate travel documents by imposters (thereby also assisting in combatting identity theft), and to identify criminals and known or suspected terrorists.

CBP will comply with all legal requirements (

e.g.,

the Privacy Act of 1974, 5 U.S.C. 552a (Privacy Act), section 208 of the E-Government Act of 2002, Public Law 107-347, 116 Stat. 2899, 2921 (44 U.S.C. 3501 note) (E-Government Act), and section 222 of the Homeland Security Act of 2002, Public Law 107-296, 116 Stat. 2135, as amended (Homeland Security Act) (6 U.S.C. 142)) and departmental and government-wide policies that govern the collection, use, maintenance, and disposition of personally identifiable information (PII), including biometrics. As discussed in section III.B.6 of this final rule, U.S. citizens

may voluntarily participate in the biometric verification process. To minimize the data collected on U.S. citizens, CBP will not retain photographs of U.S. citizens collected as part of CBP's biometric verification program in CBP databases once CBP verifies that a traveler is a U.S. citizen. Encounter photos of U.S. citizens will be used exclusively for identity verification purposes and any photos of U.S. citizens will be discarded within 12 hours of verification of the individual's identity and citizenship.

For the purposes of opt out and photo retention policies, U.S. non-citizen nationals are treated the same as U.S. citizens.

C. Costs, Cost Savings, and Benefits

CBP anticipates that during the time period of analysis (2017-2029) this final rule will result in costs, cost savings, and benefits to CBP, approved partners, and travelers. CBP estimates total costs to CBP, outbound air travelers, inbound pedestrian travelers, and approved partners will range between $1.3 billion (in discounted 2024 U.S. dollars) using a three percent discount rate and $993 million (in discounted 2024 U.S. dollars) using a seven percent discount rate. Annualized costs are estimated to be between $122 million using a three percent discount rate and $119 million using a seven percent discount rate. Meanwhile, total cost savings to inbound air and sea travelers, and CBP, will be between $578 million (in discounted 2024 U.S. dollars) using a three percent discount rate and $406 million (in discounted 2024 U.S. dollars) using a seven percent discount rate. Annualized total cost savings are estimated to range between $54 million using a three percent discount rate, to $49 million using a seven percent discount rate. Total net costs from the

implementation of this final rule are expected to range between $722 million (in discounted 2024 U.S. dollars) using a three percent discount rate to $587 million (in discounted 2024 U.S. dollars) using a seven percent discount rate. Annualized net costs are estimated to range between $68 million using a three percent discount rate and $70 million using a seven percent discount rate.

In the economic analysis for this final rule, CBP used a 3% and 7% discount rate showing values in discounted 2024 U.S. dollars, for estimated future quantified and monetized costs, costs savings and benefits.

Additionally, some travelers may perceive having their photographs taken for facial comparison as a loss of privacy; however, CBP could not quantify these costs. Other cost savings that CBP was unable to monetize were an estimated time savings to vessel carriers from a swifter debarkation process when using Facial Biometric Debarkation, approximately 1.25 hours per vessel arrival. Improving national and homeland security efforts through the application of facial comparison technology during biometric identification of individuals entering and leaving the United States is the primary benefit of this final rule. CBP was unable to quantify these enhanced security benefits. Table 1 below shows CBP's estimates for future annualized costs, costs savings, benefits, and net costs from this final rule using three and seven percent discount rates over the period of analysis (2017-2029).

Table 1—Estimated Annualized Cost, Cost Savings, Benefits (2017-2029)

[Discounted thousands of 2024 U.S. dollars]

3% Discount rate

7% Discount rate

Costs

Annualized monetized costs

$122,259

$118,870.

Annualized quantified, but not monetized costs

None

None.

Qualitative (non-quantified) costs

Perceived privacy loss

Perceived privacy loss.

Cost Savings

Annualized monetized cost savings

$54,355

$48,599.

Annualized quantified, but not monetized cost savings

None

None.

Qualitative (non-quantified) cost savings

None

None.

Benefits

Annualized monetized benefits

None

None.

Annualized quantified, but not monetized benefits

None

None.

Qualitative (non-quantified) benefits

Enhanced National Security and identification of visa overstays

Enhanced National Security and identification of visa overstays.

Once fully implemented possible shorter plane turnaround times

Once fully implemented possible shorter plane turnaround times.

Net Costs Annualized

$67,904

$70,271.

III. Background

As discussed above, CBP is responsible for implementing an integrated, automated entry-exit system that matches the biographic data and biometrics of aliens entering and departing the United States. Furthermore, to carry out its mission responsibilities to control the border and to regulate the arrival and departure of both U.S. citizens and aliens, CBP has the authority to confirm the identity of all travelers and verify that they are the authorized bearers of their travel documents.

See

INA 287(b) (8 U.S.C. 1357(b)).

A. National Security, Public Safety, and Immigration Benefits of a Biometric Entry-Exit Program

The primary benefit of a biometric entry-exit system is the enhanced security provided by having biometric confirmation of the identification of alien travelers entering and leaving the United States. CBP has a comprehensive automated biographic information-based system that vets and checks aliens entering and departing the United States. Although this information is extremely valuable to CBP in completing its mission, no biographic information-based system, by itself, can definitively verify the identity of persons presenting travel and identity documents. Modern e-passports can make passport fraud more difficult. However, the best tool to combat passport fraud is to utilize the digital photos contained in e-passports to biometrically verify that a person who presents a travel document is the true bearer of that document. CBP's biometric tests using facial comparison technology support this conclusion.

DHS expects that the implementation of this rule will greatly enhance DHS's ability to identify more of these imposters.

See

the NPRM, 85 FR at 74167-74169 for more discussion on how e-passports mitigate fraud.

In addition to the benefits this technology can provide on entry, an integrated system, including biometric exit, is also essential for maintaining the integrity of the U.S. immigration system. Under current statutes and regulations, entering or staying in the United States without official permission from the U.S. government can cause a person to be legally barred from reentry to the United States for a number of years following that person's departure or

removal.

The absence of an effective biometric exit process has enabled aliens who are present in the United States without being admitted or paroled or who overstayed their authorized period of admission (overstays) to evade immigration laws and avoid the time bars associated with unlawful presence. For Fiscal Year (FY) 2022, DHS estimates that about 853,955 aliens who entered by air or sea and were expected to depart that year overstayed their lawful period of admission, or 3.67 percent of aliens arriving by air and sea.

Through its deployment of biometric exit pilots, CBP has been able to process and document hundreds of aliens who were present in the United States without being admitted or paroled.

Additionally, biometric exit verification can allow CBP to address errors that sometimes appear in an alien's biographic data.

See

INA 212(a)(9)(B) and 217(a)(7) (8 U.S.C. 1182(a)(9)(B) and 8 U.S.C. 1187(a)(7)); see also 8 CFR 217.4(a).

DHS, FY 2023 Entry/Exit Overstay Report (2024),

https://www.dhs.gov/sites/default/files/2024-10/24_1011_CBP-Entry-Exit-Overstay-Report-FY23-Data.pdf

(last visited May 15, 2025).

See generally

Enterprise Management Information System-Enterprise Data Warehouse (internal CBP reporting system); and CBP, DHS/CBP/PIA-034, Privacy Impact Assessment for the Enterprise Management Information System-Enterprise Data Warehouse (EMIS-EDW) Appendix A (2016 and subsequent updates), available at

https://www.dhs.gov/sites/default/files/publications/privacy-pia-cbp_emis_edw-appendixd-january2021.pdf

(last visited May 15, 2025).

Finally, a comprehensive and integrated biometric entry-exit system serves as an important tool in the fight against global terrorism. Since the 9/11 attacks, the United States remains vulnerable to the threat of global terrorism. Recognizing terrorism as one of the most serious threats to international peace and security and the need to take immediate action to address the evolving threat environment, the United Nations Security Council adopted a resolution on December 21, 2017, calling on member nations to increase aviation security and to develop and implement systems to collect biometric data to properly identify terrorists.

The resolution was co-sponsored by 66 countries, including the United States, and passed the Security Council with unanimous support. CBP's biometric exit program will provide another layer of identity verification and another opportunity to stop these individuals from departing without opportunity for further investigation.

S.C. Res. 2396 (Dec. 21, 2017), available at

https://www.un.org/securitycouncil/content/sres23962017#:~:text=Decides%20that%20Member%20States%20shall,and%20suspected%20terrorists%2C%20including%20FTFs

(last visited May 15, 2025).

CBP has conducted extensive tests of the biometric comparison technology prior to implementation of this final rule. All of those tests support CBP's statements above regarding the efficacy of the congressionally mandated biometric entry-exit process.

See

the NPRM, 85 FR at 74171-74173 for more discussion regarding CBP's prior biometric comparison tests and the results of those tests;

See also

Hamood M. Alenezi & Markus Bindemann, The Effect of Feedback on Face-Matching Accuracy, 27 Applied Cognitive Psych. 735 (2013),

https://onlinelibrary.wiley.com/doi/abs/10.1002/acp.2968

(last visited May 15, 2025); and Matthew C. Fysh & Markus Bindemann, Effects of time pressure and time passage on face-matching accuracy, 4 Royal Soc'y Open Sci. 170249 (2017),

https://royalsocietypublishing.org/doi/full/10.1098/rsos.170249#RSOS170249C16

(last visited May 15, 2025).

At entry, CBP uses CBP-owned cameras, CBP's primary arrival subsystem of TECS (not an acronym), and the TVS facial matching service to capture facial biometric data from travelers seeking to enter the United States. TVS automatically creates a template from the image and uses the template to query against a gallery of known identities, based on the manifests for entering flights and vessels that day. At this time, CBP is not actively using galleries of known travelers in the land vehicle environment. CBP uses gallery matching in some instances at land borders, such as bus manifest processing. The process works the same as in the air and sea environments, but APIS submission is currently voluntary for commercial bus and rail operators. CBP does not receive a manifest for pedestrians crossing the land border on foot or for persons traveling in private vehicles. CBP is conducting technical demonstrations to determine the feasibility of gallery matching in the personal vehicle environment at entry. CBP uses one-to-one matching in environments where no manifest exists, such as pedestrian entry. In those cases, CBP will use facial comparison technology to compare the live image captured at the time of application for entry with the traveler's travel document (

e.g.,

passport) when possible.

5. Facial Comparison-Based Exit Process

CBP is using biometric technologies in voluntary partnerships with other federal agencies and commercial stakeholders. These partnerships enable CBP to more effectively verify the identities of individuals entering and exiting the United States, identify aliens who are violating the terms of their admission, and expedite immediate action when such violations are identified. In some partnership

arrangements, an airline or airport authority partner uses its own technology and staff to incorporate TVS biometric facial comparison during the boarding process. These stakeholders have to adhere to strict business requirements and the cameras must meet CBP's technical specifications to capture facial images of travelers, prior to use. Each camera is connected to the TVS via a secure, encrypted connection.

During the boarding process, CBP's facial comparison matching service allows CBP to biometrically verify the identity of travelers departing the United States with the assistance of airline or airport partnerships. Once the traveler's photo is captured via a camera at the departure gate, TVS generates a template from the departure photo and uses that template to search the gallery of historical photo templates in the cloud-based gallery. Some airlines now accept CBP's biometric identity verification in lieu of boarding passes as part of a new paperless, self-boarding process. Carriers, pursuant to the APIS regulations, are responsible for comparing the travel document to validate the information provided and ensure that the person presenting the document “is the person to whom the travel document was issued.” 19 CFR 122.49a, 122.49b, 122.75a, and 122.75b. The use of TVS provides a more efficient and accurate way to meet this requirement.

Typically, on air exit, CBP is not permanently stationed at the gate. Therefore, CBP currently relies on the review of biographic data (provided via APIS) to determine whether further inspection on departure is warranted and whether an outbound enforcement team should be sent to the gate. With the use of facial comparison technology, outbound enforcement teams are informed immediately when a no match occurs (via notification on a mobile device) and may, in some cases, determine that additional inspection is warranted. The carrier may also notify CBP if additional CBP inspection is needed.

Outbound processing for travelers on commercial sea vessels (

e.g.,

cruise ships) will resemble the air exit process. It is expected that this process will also be based on an APIS traveler manifest, although CBP is still determining the best way to implement this process. CBP may collect biometrics from travelers leaving the United States at land borders, when staffing permits. CBP may consider and examine partnering opportunities in the future in the land environment to enable more complete collection of biometrics at exit at land borders. When CBP moves forward with a large-scale implementation for entry-exit at land ports or for private aircraft or for exit at sea ports, CBP will publish a notice in the

Federal Register

providing information regarding details of implementation in each new environment and request comments on the newly implemented transportation modalities.

6. Alternative Procedures and Public Notices

All U.S. citizens and nationals are subject to inspection upon arrival into and departure from the United States to confirm their identity and citizenship.

See

INA 287(b) (8 U.S.C. 1357(b)). However, where CBP has implemented a biometric verification program, participation by U.S. citizens in the biometric verification process is voluntary. A U.S. citizen traveler who does not wish to have a photograph taken may request an alternative inspection process. U.S. citizens may notify the airline or vessel boarding agent or a CBP officer if they would like to opt out of the facial comparison-based process at the time of boarding or during the entry process and request that an alternative method of validation be employed. The citizen's identity will then be verified manually by CBP or the gate agent examining the travel document. For example, in the event a U.S. citizen elects not to be photographed at airports where CBP is conducting biometric exit verification, an airline gate agent should perform a manual review of the U.S. citizen's passport. Although CBP and carriers make every effort to ensure no delays or adverse consequences result when a U.S. citizen opts out of the biometric collection, CBP is aware that in some cases, U.S. citizens have alleged that they have been referred to secondary inspection or told they would not be able to board because they declined biometrics. Individuals who feel they were unduly delayed and would like further information regarding their travel record may request information about records contained in the CBP systems through procedures provided by the Freedom of Information Act (FOIA) (5 U.S.C. 552) and the access provisions of the Privacy Act of 1974 (5 U.S.C. 552a(d)) online at

https://www.dhs.gov/foia-contactinformation.

CBP strives to be transparent and provide notice to individuals regarding its collection, use, dissemination, and maintenance of PII, as set forth in this rulemaking, the CBP biometrics website regarding CBP's Biometric Privacy Policy,

https://www.cbp.gov/travel/biometrics/biometric-privacy-policy,

the TVS Privacy Impact Assessment (PIA),

and the CBP Privacy Office report entitled “CBP Privacy Evaluation (CPE) of the TVS in support of the CBP Biometric Entry-Exit Program” (CPE TVS Report).

As detailed in the CPE TVS Report, when airlines or airports are partnering with CBP on biometric air exit, the public is informed that the partner is collecting the biometric data in coordination with CBP.

CBP provides notice to travelers at the designated ports of entry through both physical and either electronic message boards or electronic signs, as well as verbal announcements in some cases, to inform the public that CBP will be taking photos for identity verification purposes. CBP also provides notice to the public that a U.S. citizen may opt out of having a photo taken and request an alternative procedure. CBP works with carriers, airports, and other port facilities to incorporate appropriate notices and processes into their current business models. Examples of such notices are available on CBP's Biometrics Resources website,

https://www.cbp.gov/travel/biometrics/resources.

CBP is aware that, in some cases, adequate signage and notice may not have been installed or provided. CBP seeks to ensure that all locations place signs and notice regarding biometric collection where appropriate.

See

DHS/CBP/PIA-056, Privacy Impact Assessment for the Traveler Verification Service (Nov. 14, 2018, as amended) (TVS PIA), available at

https://www.dhs.gov/sites/default/files/publications/privacy-pia-cbp056-tvs-february2021.pdf

(last visited May 15, 2025).

See CBP Privacy Evaluation (CPE) of the Traveler Verification Service (TVS) in support of the CBP Biometric Entry-Exit Program

(Aug. 15, 2022), (CPE TVS Report), available at

https://www.cbp.gov/document/foia-record/cpe-traveler-verification-service-final-report

(last visited May 15, 2025);

See also

8 CFR 215.1(a). Therefore, a lawful permanent resident is an alien under the INA.

9. Business Requirements for Public-Private Partnerships

The business requirements implemented by CBP with its partners govern the retention and use of the facial images collected using CBP's facial comparison technology. The Business Requirements Documents are available on CBP's biometrics website at

https://www.cbp.gov/travel/biometrics/biometric-privacy-policy

and are also discussed in the TVS PIA.

The CBP Business Requirements prohibit CBP's approved partners such as airlines, airport authorities, or cruise lines and participating organizations (

e.g.,

vendors, systems integrators, or other third parties) from retaining the photos they collect under this process for their own business purposes.

The partners must immediately purge the images following transmittal to CBP, and the partner must allow CBP to audit compliance with this requirement. To use TVS, private sector partners must agree to these Business Requirements.

TVS PIA at 10, 17-18, 21-22.

CBP, Biometric Air Exit Business Requirements, v3.0 at 10 (2023),

https://www.cbp.gov/sites/default/files/assets/documents/2023-Oct/Biometric%20Air%20Exit%20Business%20Requirements5.pdf

(CBP Biometric Air Exit Business Requirements); and CBP, Biometric Sea Entry-Exit Business Requirements, v2.0 at 10 (2023),

https://www.cbp.gov/sites/default/files/assets/documents/2023-Oct/Sea%20Business%20Requirements%20Document10_0.pdf

(CBP Biometric Sea Entry-Exit Business Requirements).

CBP Biometric Air Exit Business Requirements 8; CBP Biometric Sea Entry-Exit Business Requirements 8.

IV. Summary of Changes to the Biometric Entry and Exit Regulations

To advance the legal framework for the full implementation of a biometric exit capability as described above, DHS is amending the regulations in parts 215 and 235 of title 8 of the Code of Federal Regulations (8 CFR parts 215 and 235) that set forth the requirements for providing biometrics upon entry and departure as described below.

A. General Biometric Exit Requirement for Aliens

Prior to the effective date of this final rule, the regulations at 8 CFR 215.8(a)(1) authorize DHS to collect biometric exit information from certain aliens on departure from the United States pursuant to pilot programs at air, land, or sea ports of entry and places a limit of 15 air or sea ports of entry at which

such biometric exit pilots may be established. The reference to pilot programs and the 15 air or sea port limitation hinder DHS's ability to expand and fully implement a comprehensive biometric exit solution. Therefore, DHS is amending 8 CFR 215.8 by removing the reference to pilot programs and the reference to 15 air or sea port limit, allowing DHS to establish a general biometric exit requirement for aliens.

B. Collection of Photographs From Aliens Upon Entry and Departure

To implement a biometric entry-exit system based on facial comparison, DHS is amending the regulations to provide that all aliens may be required to be photographed upon departure from the United States. Specifically, DHS is amending 8 CFR 215.8 to add a new paragraph (a)(1), which provides that an alien may be required to be photographed when departing the United States to determine identity or for other lawful purposes. The collection of photographs from an alien upon departure will assist DHS in determining the alien's identity and whether immigration status in the United States has been properly maintained. The exemptions of certain aliens from the collection of biometrics provided in 8 CFR 215.8(a)(1) and (2), redesignated as 8 CFR 215.8(a)(2) and (3) and revised by this final rule, will no longer pertain to the collection of photographs from aliens upon departure and will only apply to the collection of other biometrics.

In addition, DHS is amending 8 CFR 235.1(f) to add new paragraph (f)(1)(ii), which provides that an alien seeking admission may be required to be photographed to determine the alien's identity, admissibility, and whether immigration status in the United States has been properly maintained. Like the collection of photographs upon departure, the exemptions provided in 8 CFR 235.1(f)(1)(ii), redesignated as 8 CFR 235.1(f)(1)(iii) and revised by this final rule, will no longer pertain to the collection of photographs from aliens seeking admission and will only apply to the collection of other biometrics.

As noted above, DHS is retaining the exemptions in 8 CFR 215.8 and 235.1(f)

for the collection of biometrics other than photographs (

e.g.,

fingerprints and other biometrics) from aliens upon entry to and departure from the United States. This is set forth in redesignated 8 CFR 215.8(a)(2) and (3) and 235.1(f)(1)(iii) and (vi) as amended by this final rule. Notwithstanding these exemptions, DHS is authorized to collect biometrics from aliens, regardless of age, citizenship, or visa status, for law enforcement purposes or in other contexts not addressed by these regulations, such as from aliens attempting to enter the United States illegally between U.S. ports of entry.

The following categories of aliens will remain exempt from the requirements under 8 CFR 215.8 and 235.1 to provide other (non-photograph) biometrics upon arrival to, and departure from, the United States at a U.S. port of entry: Canadian citizens under section 101(a)(15)(B) of the INA who are not otherwise required to present a visa or be issued a form I-94 or Form I-95; aliens younger than 14 or older than 79 on the date of admission; aliens admitted on A-1, A-2, C-3 (except for attendants, servants, or personal employees of accredited officials), G-1, G-2, G-3, G-4, NATO-1, NATO-2, NATO-3, NATO-4, NATO-5, or NATO-6 visas, and certain Taiwan officials who hold E-1 visas and members of their immediate families who hold E-1 visas unless the Secretary of State and the Secretary of Homeland Security jointly determine that a class of such aliens should be subject to these requirements; classes of aliens to whom the Secretary of Homeland Security and the Secretary of State jointly determine it shall not apply; or an individual alien to whom the Secretary of Homeland Security, the Secretary of State, or the Director of Central Intelligence determines it shall not apply.

See

8 CFR 215.8(a)(1) and (2); and 8 CFR 235.1(f)(1)(ii) and (iv).

C. Collection of Biometrics When Departing the United States and Other Minor Conforming and Editorial Changes

DHS is amending 8 CFR 215.8(a) to expand where the collection of biometrics may be required. Prior to the effective date of this final rule, 8 CFR 215.8(a)(1) provided that biometrics may be collected from aliens only when departing “the United States from a designated port of entry.” As described above, this final rule adds new paragraph 8 CFR 215.8(a)(1) and redesignates 8 CFR 215.8(a)(1) as 8 CFR 215.8(a)(2). Both new paragraph 8 CFR 215.8(a)(1) and redesignated paragraph 8 CFR 215.8(a)(2) now provide that biometrics may be collected from aliens “when departing the United States” from any location. This amendment is necessary to allow for the collection of biometrics from individuals upon departure at locations other than from a designated port of entry.

Although the majority of travelers depart the United States from a designated port of entry, a few travelers depart the country from locations that are not designated as ports of entry, including airports such as Ronald Reagan Washington National Airport

as well as other locations such as pleasure boat docks that are not designated ports of entry. To ensure the implementation of a biometric entry-exit system that tracks all individuals departing the United States, DHS may require aliens to provide biometrics upon departure from designated ports of entry or from any other location.

Designated ports of entry are listed in 8 CFR 100.4(a) for aliens arriving by vessel or by land transportation and in 8 CFR 100.4(b) for aliens arriving by aircraft.

This airport is not a port of entry pursuant to 8 CFR 100.4(b) and does not have federal inspection processes or facilities, but it still has a few flights that depart to international locations, mostly those that have CBP preclearance facilities (typically in Canada or the Caribbean).

In addition, DHS is making certain minor conforming and editorial changes in 8 CFR 215.8 and 235.1(f). In 8 CFR 215.8, DHS is redesignating paragraphs (a)(1) and (2) as paragraphs (a)(2) and (3), and revising cross-references and adding paragraph headings as necessary. In § 235.1(f), DHS is redesignating paragraphs (f)(1)(ii), (iii), and (iv) as paragraphs (f)(1)(iii), (v), and (vi), respectively; adding new paragraphs (f)(1)(ii) and (iv); and revising cross-references and adding paragraph headings as necessary. In both §§ 215.8 and 235.1(f), DHS is removing the phrase “[t]he Secretary of Homeland Security or his or her designee” and adding in its place “DHS”, and removing the phrase “biometric identifiers” and adding in its place “biometrics.”

Finally, DHS is amending 8 CFR 215.8(a) and 235.1(f) to remove the specific references to fingerprints and photographs. Prior to the effective date of this final rule, 8 CFR 215.8(a)(1) and 235.1(f)(1)(ii) provided that any alien may be required “to provide fingerprints, photograph(s) or other specified biometric identifiers” upon arrival into or departure from the United States. Because this final rule adds new paragraphs relating to the provision of photographs, the word “photograph(s)” in these provisions is no longer appropriate. Furthermore, to allow the flexibility for DHS to employ different methods of biometric collection in the future as biometric technology advances, DHS is amending 8 CFR 215.8(a) and 235.1(f) to provide instead that any alien, other than those exempt by regulation, may be required “to provide other biometrics” upon arrival into and departure from the United States.

See

8 CFR 215.8(a)(2) and 235.1(f)(1)(iii). For example, CBP has tested iris technology, and there may be other biometric options that may have potential for implementation in the future.

V. Discussion of Comments Submitted in Response to the NPRM

A. Overview

In response to the NPRM, DHS received 320 comments during the two

30 day public comment periods. Commenters consisted of individuals, advocacy groups, legal service providers, professional associations, State and local governments, and social organizations. The comments and responses are grouped by subject area. Some commenters expressed support for the rule and/or offered suggestions for improvement. The majority of commenters expressed general opposition to the rule, mentioning immigration policy concerns, general privacy concerns, and economic concerns.

B. Discussion of Comments

1. Comments Expressing General Support

Comment:

Several commenters generally supported the proposed rule, providing various rationales or supporting data. Commenters noted that biometrics will streamline the travel process, address national security concerns, provide U.S. citizens with the opportunity to request alternative screening procedures and protect children from being exploited by human traffickers.

Response:

DHS appreciates the support for the rule and agrees that the rule will streamline the travel process and address various national security concerns to include terrorism and nonimmigrants who overstay their authorized period of admission. Furthermore, DHS agrees that the rule preserves the ability for U.S. citizens to request alternative procedures for identity verification. DHS also agrees that this rule will protect youth and children from being exploited by human traffickers; please see the response in Section V.B.4.l.,

Under 14 Children: Privacy, Authority and Accuracy Concerns,

below for additional details regarding the benefits of collecting biometrics from children under the age of 14.

2. Comments Expressing General Support With Recommendations

Comment:

Some commenters expressed support for the rule and offered suggestions for improvement. Commenters supported CBP's efforts to maintain the ability for U.S. citizens to request alternative screening procedures and applauded CBP's efforts to institute privacy protections for all travelers. Commenters noted that an expanded system-wide biometric implementation will not only facilitate travel to include a more hygienic user experience, but also address national security concerns arising from fraudulent documents and those individuals that overstay their authorized period of admission. Several commenters supported DHS's decision to withdraw the 2008 NPRM

which proposed to require commercial air and vessel carriers to collect biometric information from certain aliens departing the United States and submit this information to DHS within a certain timeframe.

73 FR 22065 (Apr. 24, 2008).

Response:

DHS appreciates the support for the rule that provides for continued implementation of the statutorily mandated biometric entry-exit system. DHS also appreciates support for the withdrawal of the 2008 NPRM. DHS agrees that this final rule will streamline the travel process and address various national security concerns to include fraudulent documents and aliens who overstay their authorized period of admission. Furthermore, DHS agrees that the rule preserves the ability for U.S. citizens to request alternative procedures.

a. Recommendation: Provide additional information for both the traveling public and stakeholders regarding U.S. citizens' voluntary participation in the program.

Comment:

Commenters suggested that to instill greater public confidence in the program, CBP should further clarify the option for U.S. citizens to opt out of the program and establish a rule dictating that U.S. citizens' photos may only be kept for up to 12 hours.

Response:

DHS agrees that U.S. citizens should have proper notification of their option to opt-out of facial comparison. This issue is further discussed in Section V.B.4.e.,

U.S. Citizen Opt-Out,

below, including a discussion regarding CBP's authorities, signage/notification, alternative procedures, and training efforts. CBP agrees that the appropriate retention period for U.S. citizen photos should be no more than 12 hours. The National Archives and Records Administration (NARA)-approved records schedule requires destruction of U.S. citizen photos upon confirmation of U.S. citizenship and no later than 12 hours after confirmation of U.S, citizenship CBP worked closely with the NARA to approve the retention period for U.S. citizen photos.

See

DHS, CBP, U.S. Citizen Encounter Photos (DAA-0568-2019-0002), available at:

https://www.archives.gov/files/records-mgmt/rcs/schedules/departments/department-of-homeland-security/rg-0568/daa-0568-2019-0002_sf115.pdf

(last visited May 15, 2025).

Comment:

One commenter suggested that both U.S. citizens and aliens should be required to have their photo taken upon arrival/departure.

Response:

CBP initially considered including U.S. citizens in its biometric entry-exit program because having separate processes for aliens and U.S. citizens at ports of entry creates logistical and operational challenges that affect security, wait times, and the traveler experience. However, CBP determined that the best course of action at this time is to continue to allow U.S. citizens to voluntarily participate in the biometric entry-exit program. CBP does not have plans at this time to require U.S. citizens to be photographed when entering or exiting the United States, as evidenced by DHS's withdrawal of the 2008 NPRM proposing to require biometric collection from U.S. citizens.

See

Withdrawal Notice (85 FR 73644).

Nevertheless, to carry out its responsibilities effectively under the INA, for both arrivals and departures from the United States, CBP must be able to determine conclusively whether a traveler is a U.S. citizen or national or an alien by verifying that the traveler is the true bearer of the presented travel documentation. CBP is authorized to take and consider evidence concerning the privilege of any person to enter, reenter, pass through, or reside in the United States, or concerning any matter material or relevant to the enforcement or administration of the INA.

See

INA 287(b) (8 U.S.C. 1357(b)). A person claiming U.S. citizenship must establish that fact to the examining officer's satisfaction and must present a U.S. passport or alternative documentation.

See

INA 215(b) (8 U.S.C. 1185(b)), 8 CFR 235.1(b), and 22 CFR 53.1.

b. Recommendation: Increase program transparency to address concerns from privacy advocates and members of Congress.

Comment:

Commenters suggested that CBP should provide the public with additional information about the biometric entry-exit program such as data usage, retention, protection, and dissemination, as well as continually update Privacy Impact Assessments and SORNs as biometric technology capabilities and methodologies continue to evolve.

Response:

CBP endeavors to provide notice to the public continuously regarding the biometric entry-exit program including through regular updates of its PIAs and SORNs as well as the CBP biometric website at

https://www.cbp.gov/travel/biometrics.

See Section V.B.4.d.,

Public Notification and Information,

below, for more information on CBP's transparency and communication efforts. See Section V.B.3.c.,

Data Security, Retention, and Dissemination Concerns,

below, for

more information regarding CBP's data usage, storage, and protection. Additional information is also available in various places on the CBP and DHS websites including

https://www.cbp.gov/travel/biometrics

and

https://www.dhs.gov/privacy,

which provide the relevant PIA and SORN, and which are all updated regularly as capabilities and technologies evolve; and

https://www.dhs.gov/compliance,

which includes information on compliance including periodic reviews of Privacy Threshold Analyses (PTAs), PIAs, and SORNs.

Comment:

One commenter suggested that CBP work to make sure travelers understand and adjust to the new system in advance of making biometric collection fully mandatory.

Response:

As mentioned in the NPRM,

through the CBP biometrics website at

https://www.cbp.gov/travel/biometrics,

and the TVS PIA,

CBP strives to be transparent and provide notice to individuals regarding its collection, use, dissemination, and maintenance of PII. CBP has also gradually rolled out the biometric entry-exit program with various voluntary pilots over the past several years giving the public the opportunity to adjust to this new process. As discussed throughout this final rule, CBP is still in the process of determining the best way to fully implement biometric collection at all entry and exit modalities. CBP has maintained a proactive approach to stakeholder engagement and outreach through participation in speaking engagements, conferences, and stakeholder meetings. This outreach has kept CBP on the forefront of domestic and international engagement by allowing CBP the opportunity to partner with airlines, airport authorities, travel associations and agents, embassies, attachés, and privacy advocacy groups to share programmatic updates on CBP's use of biometric facial comparison technology in the air, land, and sea environments.

See

the NPRM, 85 FR at 74177 for more information on CBP's protection of PII.

See

TVS PIA at 19.

CBP also participates regularly in events sponsored by travel industry partners to provide updates which highlight the benefits of biometric facial comparison technology. Some of these partners have included but are not limited to the U.S. Travel Association (USTA), Global Business Travel Association (GBTA), Cruise Line Industry Association (CLIA), American Association of Airport Executives (AAAE), and Airlines for America (A4A), to name just a few. Moreover, to maximize messaging efforts, CBP has often participated in these events in collaboration with its government partners, like TSA or the Science and Technology Directorate (S&T) of DHS.

Comment:

Commenters also suggested that CBP set a minimum acceptable accuracy rate consistent across demographics, which, along with system improvements, should then be studied and publicized regularly. One commenter encouraged CBP to expedite the implementation of the 2020 U.S. Government Accountability Office (GAO) audit.

See

GAO, GAO-20-568, Facial Recognition: CBP and TSA are Taking Steps to Implement Programs, but CBP Should Address Privacy and System Performance Issues (2020), available at

https://www.gao.gov/products/gao-20-568

(last visited May 15, 2025).

Response:

CBP appreciates the commenters' suggestions regarding tracking accuracy rates and effectiveness of improvements to the matching algorithm. CBP does have a minimum acceptable accuracy rate for the program and does regularly track it to ensure program success. CBP's Biometric Air Exit Key Performance Parameters (KPPs) mandate that the system's True Acceptance Rate (TAR) must equal or exceed 97 percent of all in-scope travelers (as previously defined by 8 CFR 215.8 and 235.1) and that the system's False Acceptance Rate (FAR) must not exceed 0.1 percent of all in-scope travelers. Through congressionally mandated reports, such as the annual DHS Entry/Exit Overstay Report

the TSA and CBP: Deployment of Biometric Technologies Report to Congress,

and other public reports, such as the annual CBP Trade and Travel Report,

CBP discusses the accuracy rates of the Biometric Entry-Exit program as well as system improvements. Additionally, CBP continues to collaborate with DHS S&T, DHS Office of Biometric Identity Management (OBIM), and the National Institute of Standards and Technology (NIST) on technical standards and evaluation to ensure optimal system performance.

This report is available for FY22 at

https://www.dhs.gov/sites/default/files/2023-07/23_0707_FY22_FY23_CBP_Integrated_Entry_Exit_Overstay_Report.pdf

and available for previous FYs at

https://www.dhs.gov/publication/entryexit-overstay-report

(last visited May 15, 2025).

This 2019 DHS report is posted in the docket for this rulemaking.

This report is available for FY22 and earlier at

https://www.cbp.gov/document/annual-report/cbp-trade-and-travel-fiscal-year-2022-report

(last visited May 16, 2025).

CBP concurred with the 2020 GAO audit recommendations and has addressed each recommendation, as indicated in the Recommendations for Executive Action Table on the applicable GAO website.

See

GAO, GAO-20-568, Facial Recognition: CBP and TSA are Taking Steps to Implement Programs, but CBP Should Address Privacy and System Performance Issues, Recommendations, Recommendations for Executive Action Table,

https://www.gao.gov/products/gao-20-568

(last visited May 15, 2025).

c. Recommendation: Provide additional information regarding no match and opt-out procedures.

Comment:

Several commenters requested that CBP clarify its process for when a traveler screening yields a no-match result, to include when CBP assistance should be requested. One commenter also requested the number of Biometric Exit-Mobile devices CBP currently has in use today, as they will likely be used for both no-match and opt-out procedures. Additionally, one commenter indicated that CBP should be responsible for the implications of a no-match result.

Response:

As discussed in the NPRM, in the event of no match at departure, the carrier or CBP officer will perform a manual review of the travel document (

i.e.,

scanning a boarding pass and checking a traveler's passport).

If additional inspection is required by a carrier, the carrier line may notify CBP's outbound enforcement teams, but the carrier is not required to do so. Carrier partners should follow internal business rules and policy to manually verify identity and determine boarding status of a traveler. Air carrier and airport partners may contact CBP, in accordance with existing guidelines outlined by the Carrier Liaison Program, when there are issues or concerns with U.S. entry requirements, human trafficking, traveler assessment, fraudulent document detection and imposter identification.

See

the NPRM, 85 FR at 74177, for further discussion of no match procedures.

CBP, Carrier Information Guide: United States Document Requirements for Travel (2023), available at

https://www.cbp.gov/sites/default/files/assets/documents/2023-Nov/Carrier%20Information%20Guide%20ENGLISH.pdf

(last visited May 15, 2025).

CBP may use mobile devices with the relevant CBP-built mobile applications to support its multilayered enforcement approach. These CBP applications include the Biometric Exit Mobile application. Additional information about the Biometric Exit Mobile application can be found in the Biometric Exit Mobile Program PIA.

CBP officers can use the application on any CBP smartphone. CBP does not

dedicate phones to a single mobile application or operation. Rather, officers use these phones to perform various job responsibilities across multiple environments. Ports are provided with enough phones to meet their mobile mission including biometric exit operations. The port will make a determination on how officers will use their phones on a day-by-day basis based on staffing and other law enforcement-related factors.

The updated 2018 PIA for DHS/CBP/PIA-026 Biometric Exit Mobile Program, and all prior versions, are available at

https://www.dhs.gov/publication/biometric-exit-mobile-air-test

(last visited May 15, 2025).

Comment:

One commenter expressed concern that CBP will not have the staffing resources to conduct outbound enforcement operations efficiently.

Response:

CBP has partnered with multiple stakeholders, including airports and airlines, who are assisting with facilitating the collection at departure through the use of CBP's TVS. TVS provides an automated mechanism to verify the identities of travelers. CBP has also partnered with cruise operators in the entry environment and CBP expects these partnerships will also aid in developing a strategy for biometric exit in the sea environment as well. CBP is still determining the best method for using facial biometrics at land exit.

Comment:

One commenter requested further clarification on the process for families traveling with children, and persons with reduced mobility as experience during the trials has shown that collecting biometric information from these travelers can be difficult and time consuming.

Response:

Air carriers may use discretion when processing travelers with disabilities and families with children, including conducting manual identity verification using the individual's travel document (document review), as is performed for all flights where biometric processing is not available. Additionally, carriers must abide by existing local, state, and federal laws and regulations regarding processing persons with disabilities.

CBP's biometric entry-exit program does not contradict existing accessibility regulations and processes. In many cases, biometric collection equipment accommodates disabilities; furthermore, it is CBP's policy to afford persons with disabilities an equal opportunity to participate in, or benefit from, CBP-conducted services, programs, and activities and to provide reasonable modifications to its services, programs, and activities to qualified individuals with a disability when necessary to avoid discrimination on the basis of disability.

d. Recommendation: Clarify the impact that a biometric exit system would have on airport operations and infrastructure requirements for airports and airlines.

Comment:

Commenters requested that CBP explain whether the program's implementation would require separate screening lines, separate processes, or notifications for passengers. Additionally, one commenter requested clarification on whether non-U.S. citizens could opt out of the biometric exit process to avoid additional burdens on CBP and/or the carriers during boarding such as separate boarding queues (

i.e.,

one for U.S. citizens and one for aliens).

Response:

As noted throughout this rule, on the effective date of this final rule, collection of facial biometrics may be required from all aliens entering or exiting the United States, regardless of age, sex, race and nationality. As indicated on privacy signage, also available on CBP's biometrics website,

https://www.cbp.gov/travel/biometrics/resources,

if a traveler is a U.S. citizen and does not wish to have a photograph taken, the traveler may see a gate agent or CBP officer to request alternative procedures for identity verification. The alternative procedures are intended to be similar to the existing processes at entry and exit. See Section V.B.4.e.,

U.S. Citizen Opt-Out,

below, for more information regarding CBP's authorities, signage/notification, alternative procedures, and training efforts. CBP will continue its transparency and communication efforts, discussed in detail in Section V.B.4.d.,

Public Notification and Information,

below, as it rolls out full implementation of the biometric entry-exit program.

e. Recommendation: Provide details should airlines/airports choose not to participate in the Biometric Entry-Exit Program.

Comment:

Several commenters requested that CBP provide procedures that airlines should follow if they decide not to participate in this voluntary program and that CBP should commit to continue working with those airports that do not participate in the program.

Response:

Participation in CBP's biometric entry-exit program will remain voluntary for carriers under this final rule. If air carriers or airports do not participate, they will continue conducting manual identity verification. However, CBP may supplement this verification with CBP officers conducting periodic biometric exit operations. CBP uses its Workload Staffing Model to determine the staffing requirements and help make allocation decisions for CBP officers at ports of entry, including airports. CBP will continue to use this data-driven methodology to identify staffing requirements by considering all the activities performed by CBP officers at ports of entry, the volume of those activities, and the levels of effort required to carry them out.

f. Recommendation: Provide carrier protections through the SAFETY Act.

Comment:

Some commenters recommended that DHS provide SAFETY Act

legal liability protections for air carriers that participate as partners in CBP's biometric entry-exit program. The commenters stressed the importance of these protections against claims of discrimination in facial comparison technology, as well against any breach of traveler privacy.

Support Anti-Terrorism by Fostering Effective Technologies Act of 2002, Public Law 107-296, 116 Stat. 2135, 2238 (6 U.S.C. 441

et seq.

Response:

DHS will not issue a blanket liability protection. Carriers need to work with their technology providers on seeking SAFETY Act certification for biometric technology devices. The SAFETY Act also is designed for anti-terrorism technology certification, not for general privacy or other areas of discrimination concerns. The SAFETY Act offers liability protection to sellers of qualified anti-terrorism technologies to incentivize the development and deployment of anti-terrorism technology solutions. Additional information is available on the DHS S&T SAFETY Act website at

https://www.safetyact.gov/.

g. Recommendation: Establish an oversight body on DHS biometric programs.

Comment:

One commenter supports the findings and recommendations in the Homeland Security Advisory Council Biometrics Subcommittee 2020 Report,

including the establishment of a DHS Biometrics Oversight and Coordination Council.

Homeland Security Advisory Council, Final Report of the Biometrics Subcommittee (2020) (HSAC Biometrics Report), available at

https://www.dhs.gov/sites/default/files/publications/final_hsac_biometrics_subcommittee_report_11-12-2020.pdf

(last visited May 15, 2025).

Response:

While DHS has not created the specific oversight council as suggested in the 2020 report, numerous oversight processes exist to ensure DHS compliance with civil rights and civil liberties. These processes included congressional hearings, congressionally mandated status update reports and responses to formal congressional inquiries. See Section V.B.4.j.,

Government Accountability and Oversight,

below for more information on the various biometric oversight and accountability mechanisms.

h. Recommendation: Provide more information on the implications of state/local laws and implementation of biometric capabilities in the land and sea environments.

Comment:

One commenter requested that CBP provide additional guidance and clarification on the role of the biometric entry-exit program when local laws conflict with CBP's biometric entry-exit strategy. One commenter indicated that further details on process, timing, cost, etc., in the land and sea environments are necessary to ensure traveler confidence and comprehension.

Response:

CBP is congressionally mandated to implement a Biometric Entry-Exit System and is issuing this regulation to implement such system. The Supremacy Clause of the U.S. Constitution provides that federal laws and treaties are the supreme laws of the land, and it is well established that the power to regulate immigration is exclusively with the federal government. In instances where a state law conflicts with federal immigration laws, the state law must yield. See Section V.4.B.s,

Land and Sea Implementation,

below, for more information on CBP's implementation plan in the land and sea environments.

i. Recommendation: Further coordinate with NIST to examine existing standards that may unintentionally inhibit CBP's ability to consider other biometric modalities.

Comment:

One commenter requested that CBP coordinate with NIST to ascertain gaps that could limit consideration of other biometric modalities—

e.g.,

edge computing platforms, mobile platforms, and cloud-based systems.

Response:

CBP works closely with DHS S&T, OBIM and NIST on technical standards and system performance regarding facial comparison capabilities as well as remaining informed on the development and evolution of other biometric modalities, especially as it relates to the border security mission.

See, e.g.,

DHS/OBIM/PIA-005 Office of Biometric Identity Management (OBIM)-National Institute of Standards of Technology (NIST) Data Transfer 3-5 (2022), available at

https://www.dhs.gov/publication/dhsobimpia-005-office-biometric-identity-management-obim-national-institute-standards

(last visited May 15, 2025).

j. Recommendation: Implement additional changes to the rule to ensure all aliens arriving to and departing from the United States are thoroughly screened and vetted.

Comment:

One commenter requested that CBP remove all age restrictions in 8 CFR 215.8 and 235.1 for all biometric collection regardless of biometric modality and expand biometric collection to include additional biometric modalities (

e.g.,

iris, DNA, voice). Additionally, the commenter requested that DHS finalize both the USCIS and CBP biometrics rules.

Response:

The NPRM published on September 11, 2020, entitled “Collection and Use of Biometrics by U.S. Citizenship and Immigration Services,” 85 FR 56338 (USCIS NPRM), would have implemented the suggested changes if finalized.

On May 10, 2021, DHS withdrew the USCIS NPRM. 86 FR 24750. However, since the withdrawal of the NPRM, the President has issued Executive Order No. 14161,

Protecting the United States From Foreign Terrorists and Other National Security and Public Safety Threats,

90 FR 8451, (Jan. 30, 2025) (E.O. 14161). E.O. 14161 mandates that DHS protect the American public from “aliens who intend to commit terrorist attacks, threaten our national security, espouse hateful ideology, or otherwise exploit the immigration laws for malevolent purposes” and to “vet and screen to the maximum degree possible all aliens who intend to be admitted, enter, or are already inside the United States.” Therefore, DHS will consider future efforts to enhance biometric submission to further the goals of this Executive Order.

Through this rulemaking, DHS is removing the age restrictions for photograph collection under 8 CFR 235.1 for aliens seeking admission to the United States, as well as under 8 CFR 215.8 for aliens departing the United States. See Section V.B.4.l,

Under 14 Children: Privacy, Authorities and Accuracy Concerns,

below, for more details.

3. Comments Expressing General Inquiries

a. Rule Impact

Comment:

Commenters raised questions regarding to whom the rule applies, as well as the purpose and need for the biometric information collected.

Response:

As stated throughout this rule, on the effective date of this final rule, collection of facial biometrics may be required from all aliens entering or exiting the United States, regardless of age, sex, race and nationality. DHS is mandated by numerous statutes as discussed above

to develop and implement an integrated, automated entry and exit data system to match records, including biographic data and biometrics, of aliens entering and departing the United States. CBP has determined that facial comparison technology is currently the best available method for biometric verification, as it is accurate, unobtrusive, and efficient.

Two of the relevant statutes are section 110 of the DMIA (8 U.S.C. 1365a) and section 7208 of the IRTPA (8 U.S.C. 1365b). For a more complete list, please refer to Section II.B. of this final rule.

This final rule improves DHS's ability to meaningfully implement a comprehensive biometric entry-exit system and make the process for verifying the identity of aliens more efficient, accurate, and secure by using facial comparison technology. Implementing an integrated biometric entry-exit system that verifies the identity of aliens at arrival and on exit and then uses that information to confirm that the alien has exited as required is essential for addressing the national security concerns arising from the threat of terrorism, combatting the fraudulent use of legitimate travel documentation, and identifying aliens who overstay their authorized period of admission or are present in the United States without being admitted or paroled. An integrated biometric entry-exit system can also fill the gaps left by incorrect or incomplete biographic data for travelers.

b. Technology Usage and Techniques Accuracy and Misidentification

Comment:

Several commenters raised questions on the training dataset and machine learning models used for facial comparison.

Response:

The information requested regarding the training dataset and machine learning models CBP uses for facial comparison is proprietary information. CBP works closely with DHS S&T, OBIM and NIST on technical standards and system performance regarding facial comparison capabilities. NIST has conducted in-depth analysis on facial comparison algorithms, which showed that the vendor selected by CBP is capable of delivering algorithms with a high accuracy rate.

For more information on NIST's analysis, see Section V.B.4.k,

Accuracy, General Bias, and Misidentification Concerns,

below.

See

NIST, NISTIR 8280, FRVT Part 3: Demographic Effects 8, 26 (2019) (NIST FRVT Demographic Effects Report), available at

https://nvlpubs.nist.gov/nistpubs/ir/2019/nist.ir.8280.pdf

(last visited May 15, 2025).

CBP has issued PIAs for many pilots that were testing/developing facial comparison technology. These PIAs include information about how the algorithms are tested to assure accuracy of the facial comparison technology.

See, e.g.,

DHS/CBP/PIA-025 1:1 Facial Comparison Project, DHS/CBP/PIA-026 Biometric Exit Mobile Air Test, DHS/CBP/PIA-027 Southwest Border Pedestrian Exit Field Test, DHS/CBP/PIA-030 Departure Information Systems Test, and the

TVS PIA. These PIAs are available at

https://www.dhs.gov/privacy-documents-us-customs-and-border-protection

(last visited May 16, 2025).

For more information on how CBP ensures high accuracy rates across all demographics see Section V.B.4.k.,

Accuracy, General Bias, and Misidentification Concerns,

below.

c. Data Security, Retention, and Dissemination Concerns

Comment:

Many commenters had questions regarding the safety and protection of sensitive information with use of this technology and linkage to interagency databases. Additionally, one commenter asked whether protection would be provided to the individuals should a breach or cybersecurity incident occur. One commenter asked if CBP could delete the biometric information but retain the record of the entry or exit.

Response:

Because numerous federal statutes require DHS to create an integrated, automated biometric entry and exit system that records the arrival and departure of aliens, compares the biometric data to verify their identities, and authenticates travel documents, DHS cannot delete personally identifiable data and only retain a record of entry-exit. Furthermore, DHS retains certain records for up to 75 years, which is necessary to support the holding of biometrics of subjects of interest in immigration and border management or law enforcement activities.

See

DHS/NPPD/PIA-002, Privacy Impact Assessment for the Automated Biometric Identification System (IDENT) 25 (2012) (IDENT PIA), available at

https://www.dhs.gov/publication/dhsnppdpia-002-automated-biometric-identification-system

(last visited May 16, 2025) (note that this website refers to this PIA as “DHS/OBIM/PIA-001” due to OBIM renumbering after the DHS National Protection and Programs Directorate (NPPD) became the Cybersecurity and Infrastructure Security Agency within DHS); and DHS/OBIM/PIA-004, Privacy Impact Assessment for the Homeland Advanced Recognition Technology System (HART) Increment 1 PIA (2020) (HART PIA), available at

https://www.dhs.gov/publication/dhsobimpia-004-homeland-advanced-recognition-technology-system-hart-increment-1

(last visited May 16, 2025).

When DHS personnel discover a suspected or confirmed privacy incident, there are a series of actions and activities that must occur to appropriately report, investigate, respond, and mitigate the privacy incident. DHS's policy for responding to privacy incidents is established in the DHS Privacy Office, DHS Instruction Guide 047-01-008, Privacy Incident Handling Guidance (2017).

Additionally, DHS Privacy Policy Instruction 047-01-006, Privacy Incident Responsibilities and Breach Response Team (2017),

provides additional instruction on how DHS and CBP employees should handle and respond to privacy incidents. The Breach Response Team determines the appropriate course of action with respect to any privacy incident investigation, remedy options, resource allocations, risk mitigation, and interagency engagement. DHS and CBP also follow OMB's breach response guidance, including OMB M-17-12 and M-25-04.

Available at

https://www.dhs.gov/sites/default/files/publications/047-01-008%20PIHG%20FINAL%2012-4-2017_0.pdf

(last visited May 16, 2025).

Available at

https://www.dhs.gov/sites/default/files/publications/047-01-006%20Privacy%20Incident%20Responsibilities%20and%20Breach%20Response%20Team%20FINAL%2012-04-17.pdf

(last visited May 16, 2025).

See

OMB M-17-12, available at

https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf

(last visited July 31, 2025) and OMB 25-04, available at

https://www.whitehouse.gov/wp-content/uploads/2025/01/M-25-04-Fiscal-Year-2025-Guidance-on-Federal-Information-Security-and-Privacy-Management-Requirements.pdf

(last visited July 31, 2025).

For more information on how CBP safeguards sensitive information, see Section V.B.4.g.,

Data Security, Retention, and Dissemination Concerns,

below.

4. Comments Expressing General Opposition

a. General Opposition

Comment:

Some commenters provided general opposition for the proposed rule, with little, non-specific reasoning or justification provided.

Response:

DHS appreciates the time these commenters took to read the rule, but DHS respectfully disagrees. DHS's intent for this rule is explained in detail in the rule's preamble and throughout the NPRM. DHS is mandated by numerous statutes to develop and implement an integrated, automated entry and exit data system to match records, including biographic data and biometrics, of aliens entering and departing the United States. Additionally, DHS gave careful consideration to the costs and benefits associated with this regulatory change, as well as considered all of the comments submitted by the public. DHS concludes that after the careful weighing of equities, this rulemaking is necessary as biometrics are simply a more efficient and reliable means of identifying an individual, compared to biographic identifiers.

Comment:

Some commenters requested that DHS not use the term “alien” in the rule.

Response:

DHS used the term “noncitizen” in the NPRM except where quoting directly from statutory or regulatory text that uses the term “alien.” However, DHS uses the term “alien” in this final rule consistent with the statutory and regulatory text.

Comment:

Two commenters suggested that DHS should be abolished.

Response:

Comments suggesting DHS be abolished are outside the scope of this rulemaking. DHS and its homeland security mission are born from the commitment and resolve of Americans across the United States in the wake of the September 11, 2001, attacks. With the enactment of the Homeland Security Act in November 2002, DHS formally came into being as a stand-alone, Cabinet-level department to further coordinate and unify national homeland security efforts, opening its doors on March 1, 2003. As the complex threat environment continues to evolve, DHS will embody the relentless resilience of the American people and continue to ensure a safe, secure, and prosperous homeland.

Comment:

One commenter expressed concern that the use of technology would cause officers to distance them physically from the subject and/or distance them from personal responsibility for tasks done.

Response:

CBP's mission is to protect the American people, safeguard our borders, and enhance the nation's economic prosperity. Technology will never replace the skills and capabilities that can only be exhibited by CBP's personnel in identifying and mitigating threats to the nation. In fact, studies

have shown that it is the combination of humans, with technology at their disposal, that best serve the CBP mission while simultaneously respecting the rights of all persons. Humans, balanced with technology, are essential to successful execution of these biometric programs.

See

P. Jonathon Phillips, et al., Face recognition accuracy of forensic examiners, superrecognizers, and face recognition algorithms, 115 PNAS 6171 (2018),

https://www.pnas.org/content/pnas/115/24/6171.full.pdf

(last visited May 16, 2025).

See also

Hamood M. Alenezi & Markus Bindemann, The Effect of Feedback on Face-Matching Accuracy, 27 Applied Cognitive Psych. 735 (2013),

https://onlinelibrary.wiley.com/doi/abs/10.1002/acp.2968

(last visited May 16, 2025); and Matthew C. Fysh & Markus Bindemann, Effects of time pressure and time passage on face-matching accuracy, 4 Royal Soc'y Open Sci. 170249 (2017),

https://royalsocietypublishing.org/doi/full/10.1098/rsos.170249#RSOS170249C16

(last visited May 16, 2025).

CBP's investment in technology is designed to empower officers to execute the agency's critical law enforcement mission and alleviate the administrative burden on officers so they are able to focus on enforcement. The use of facial comparison technology saves frontline officers' time in matching travelers to

document photos and capturing fingerprints CBP already has in its holdings, allowing for a focus on threat detection and behavioral indicators that technology cannot identify. CBP's workforce is critical to accomplishing CBP's missions.

b. General Privacy Concerns

Comment:

Many commenters disagreed with the rule, stating that the proposal is unnecessary, offensive, an invasion of privacy, infringes on freedoms, and would violate the respect, privacy rights, and civil liberties of U.S. citizens, legal immigrants, aliens, victims of domestic violence, other vulnerable parties, and children.

Response:

DHS disagrees with these comments. DHS recognizes there may be increased sensitivities associated with facial comparison technology. However, DHS complies with all applicable privacy statutes, regulations, and policies. Further, DHS currently includes information about specific privacy protections in the relevant PIAs. The PIAs also direct individuals to the applicable SORNs, which describe the categories of individuals covered by the system, categories of records in the system, legal authority for maintaining the system, purpose of the system, and routine uses of records maintained in the system. All PIAs and SORNs are submitted to the DHS Privacy Office for review and approval by the DHS Chief Privacy Officer.

The privacy compliance documentation process is an iterative process that not only provides transparency into the details of DHS activities, but also shapes those activities by identifying privacy risks as well as mitigations and privacy-enhancing solutions. Privacy is a DHS-wide responsibility, and the DHS Privacy Office works with DHS components, including CBP, to ensure privacy protections are incorporated in the entire lifecycle of DHS projects, programs, and activities. DHS is committed to the fair and equal treatment of all individuals in its screening and vetting activities, ensuring the rights of all people are protected, while taking lawful actions necessary to secure the homeland. In addition to adhering to all relevant statutory and regulatory privacy protections, DHS complies with existing DHS policies, which include the DHS Fair Information Practice Principles (FIPPS)

that ensure privacy safeguards are incorporated throughout the information lifecycle. These safeguards also account for administrative, physical, and technical controls to ensure appropriate collection, use, maintenance, and protection of all information, both biometric and biographic, submitted to DHS. Furthermore, DHS complies with protections in 8 U.S.C. 1367 regarding disclosure of information pertaining to beneficiaries of applications for victim-based immigration relief. DHS will continue to adhere to all statutes, regulations, and policies regarding the privacy rights of individuals departing or entering the United States.

DHS, The Fair Information Practice Principles,

https://www.dhs.gov/publication/privacy-policy-guidance-memorandum-2008-01-fair-information-practice-principles

(last visited May 16, 2025).

Comment:

Some commenters stated the rule violates the fundamental human rights to privacy, provided specifically in Articles 17 and 26 of the International Covenant on Civil and Political Rights (ICCPR)

and Article 12 of the Universal Declaration of Human Rights (UDHR),

which the United States has ratified.

The text of the ICCPR is available on the United Nations Office of the High Commissioner for Human Rights website,

https://www.ohchr.org/en/instruments-mechanisms/instruments/international-covenant-civil-and-political-rights

(last visited May 16, 2025).

The text of the Universal Declaration of Human Rights is available on the United Nations website,

https://www.un.org/en/about-us/universal-declaration-of-human-rights

(last visited May 16, 2025).

Response:

DHS disagrees with commenters that this rule violates any provisions of international law that are applicable within the United States. The tenets of the rights to privacy expressed under the ICCPR and UDHR are already incorporated into U.S. domestic law via the Privacy Act and through DHS regulations and policy guidance. DHS is committed to fair equal treatment of all individuals and the rule complies with all applicable privacy statutes, regulations, and policies.

Comment:

Two commenters mentioned the 2020 DHS Office of the Inspector General (OIG) Report on DHS Privacy oversight inefficiencies.

Response:

CBP is aware of the DHS OIG report on its November 2020 audit, entitled “DHS Privacy Office Needs to Improve Oversight of Department-wide Activities, Programs, and Initiatives”

(Nov. 2020 DHS OIG Report). CBP takes privacy very seriously and is dedicated to protecting the privacy of all travelers. DHS OIG identified three recommendations for the DHS Privacy Office to improve privacy compliance, information sharing access agreements, and privacy training.

Two of the recommendations apply to internal record keeping (compliance and training) and the third applies to oversight of information sharing and access agreements.

None of those recommendations was specific to this rulemaking. CBP reviews all programs and changes to programs to determine any privacy concerns and mitigate any privacy risks.

DHS OIG, OIG-21-06, DHS Privacy Office Needs to Improve Oversight of Department-wide Activities, Programs, and Initiatives (2020), available at

https://www.oig.dhs.gov/sites/default/files/assets/2020-12/OIG-21-06-Nov20.pdf

(last visited May 16, 2025).

Nov. 2020 DHS OIG Report at 17.

c. Privacy Act and Paperwork Reduction Act

Comment:

Some commenters stated that the proposed rule fails to justify its claimed authority to collect biometrics from U.S. citizens or lawful permanent residents (LPRs) protected by the Privacy Act (5 U.S.C. 552a).

Response:

DHS respectfully disagrees with the commenters. In the NPRM, DHS explains in great detail its authority to collect biometrics from all aliens, including LPRs.

Moreover, DHS is authorized to take and consider evidence concerning the privilege of any person, including U.S. citizens, to enter, reenter, pass through, or reside in the United States, or concerning any matter which is material or relevant to the enforcement of the INA and DHS regulations.

See

INA 287(b) (8 U.S.C. 1357(b)). The Privacy Act does not prevent government agencies from collecting information about U.S. citizens and LPRs when needed for the agency to execute its statutory and regulatory responsibilities, but rather requires that the government follow a process for appropriately protecting information and informing the public about collection and retention of the information. Additionally, as noted here and elsewhere throughout this final rule, U.S. citizens are not required to but can voluntarily participate in the facial biometric process.

See

the NPRM, 85 FR at 74164, for more information on DHS' authority to collect biometrics from all aliens.

DHS acknowledges that the Privacy Act requires that “each agency that maintains a system of records shall . . . collect information to the

greatest extent practicable

directly from the subject.” 5 U.S.C. 552a(e)(2) (emphasis added), subject to any exemptions from this provision contained in 5 U.S.C. 552(j) and (k). Nevertheless, as explained in the NPRM, CBP considered and piloted many types of biometrics collections.

Using information gleaned from the pilots as well as public feedback, CBP

has concluded that partnering with carriers and airports to capture facial images is the most viable large-scale solution as it is highly effective, cost effective, and less disruptive than other possible methods.

See

the NPRM, 85 FR at 74171, for more information about CBP's biometrics pilots.

Comment:

One commenter stated that CBP should require airlines and airports to display the Office of Management and Budget (OMB) control number regarding this information collection.

Response:

The OMB control number, 1651-0138, is listed in the TVS PIA. Furthermore, pursuant to the Paperwork Reduction Act of 1995 (“Paperwork Reduction Act”), CBP displays the OMB control number on signage.

See

44 U.S.C. 3507. CBP also provides language for signs that are printed and displayed by airlines, airports and other carriers at each location where biometric collection takes place. Additionally, for the convenience of the public, CBP updated its biometrics website regarding CBP's Biometric Privacy Policy,

https://www.cbp.gov/travel/biometrics/biometric-privacy-policy,

to include the OMB control number.

d. Public Notification and Information

Comment:

Several commenters raised concerns regarding a perceived lack of public information, notification, and awareness for all travelers, including U.S. citizens, with regard to biometric collection pursuant to this rule.

Response:

CBP strives to be transparent and provide notice to individuals regarding its collection, use, dissemination, and maintenance of PII. Besides this rule, additional information can be found on CBP's website, in the TVS PIA, and in the CPE TVS Report.

Where airlines or airports are partnering with CBP on biometric air exit, the public is informed that the partner is collecting the biometric data in coordination with CBP.

CBP provides notice to departing travelers at airport departure gates and travelers arriving at ports of entry through message boards or electronic signs, as well as verbal announcements in some cases, to inform the public that CBP or a stakeholder will be taking photos for identity verification purposes.

CBP also provides notice to the public regarding opt-out procedures for U.S. citizens.

CBP works with airlines, cruise line operators, airports, and other port facilities to incorporate appropriate notices and processes into their current business models.

Additionally, signage posted at CBP's FIS area provides information to travelers on search procedures and the purpose for those searches.

Upon request, CBP officers provide individuals with a tear sheet with Frequently Asked Questions (FAQ), opt-out procedures, and additional information on CBP's biometric matching process, including the legal authority and purpose for inspection, the routine uses, and the consequences for failing to provide information.

Current text for signs and tear sheets are also available on CBP's Biometrics Resources website,

https://www.cbp.gov/travel/biometrics/resources.

See https://www.cbp.gov/travel/biometrics/biometric-privacy-policy;

TVS PIA at 1; and CPE TVS Report at 1, 5-7.

See

CPE TVS Report at 6.

See

CPE TVS Report at 6.

See

CPE TVS Report at 6.

See

CPE TVS Report at 6.

See

CPE TVS Report at 6-7.

See

CPE TVS Report at 6.

Privacy information on the program such as SORNs and PIAs, including the TVS PIA and information on CBP's previous pilots during the development and testing of facial comparison technology, are published on the DHS Privacy website,

https://www.dhs.gov/privacy.

A link to the TVS PIA is provided on CBP's Biometric Privacy Policy website,

https://www.cbp.gov/travel/biometrics/biometric-privacy-policy.

Also available on CBP's Biometric Privacy Policy website is the CPE TVS Report.

In response to the 2020 GAO audit recommendations,

and as noted in the Status of Recommendation 1 in the Recommendations for Executive Action Table on the applicable GAO website,

CBP launched its updated biometrics website on September 1, 2020 (

https://www.cbp.gov/travel/biometrics

). The purpose of the site is to deliver information to the public and other stakeholder groups. The site provides a user-friendly communication channel for promoting facial comparison technology and biometrics information in a dynamic and interactive manner. As a testament to CBP's commitment to privacy protections, outlined in the DHS FIPPS, the CBP biometrics website includes the current locations using facial comparison technology, as well as information on how to request alternative screening and copies of CBP's privacy signage on display. The information provided, including a link to CBP's TVS PIA, is yet another tool CBP uses to ensure technology sustains and does not erode privacy protections.

See

GAO, GAO-20-568, Facial Recognition: CBP and TSA are Taking Steps to Implement Programs, but CBP Should Address Privacy and System Performance Issues (2020), available at

https://www.gao.gov/products/gao-20-568

(last visited May 16, 2025).

See

https://www.gao.gov/assets/gao-20-568.pdf

(last visited May 16, 2025).

Additionally, CBP has briefed the staff of the CBP Information Center to ensure the staff has the latest information to answer questions. CBP will continue to ensure that content is up to date on the CBP biometrics website, as required, and when substantive updates are made, CBP will provide new details to the CBP Information Center.

Furthermore, CBP regularly conducts periodic signage audits that include local CBP personnel to ensure signs are accurate and placed appropriately.

It is important to note that, unlike FIS areas, the airport departure areas are not managed by CBP personnel. However, CBP will continue to work with its airline/airport partners to ensure that privacy signage is available, on display, and reflective of current privacy messaging for travelers.

See

CPE TVS Report at 7.

Comment:

Additionally, some commenters stated that all signage and communication should clearly identify a contact and process for any traveler to file a grievance should the traveler feel that the traveler was improperly or unfairly treated during the biometric collection process.

Response:

If a traveler believes that CBP actions are the result of the TVS maintaining incorrect or inaccurate information, (

i.e.,

if the TVS finds a mismatch, false match, or no match) inquiries may be directed to CBP Information Center, Office of Public Affairs—MS1345, U.S. Customs and Border Protection, 1300 Pennsylvania Avenue NW, Washington, DC 20229, or online at

https://help.cbp.gov/s/?language=en_US.

Travelers may also contact the DHS Traveler Redress Inquiry Program (DHS TRIP), 6595 Springfield Center Drive TSA-910, Springfield, VA 22150-6901, or online at

https://www.dhs.gov/dhs-trip,

if they have experienced a travel-related screening difficulty, including those they believe may be related to incorrect or inaccurate biometric information retained in their record(s). Individuals making inquiries should provide as much identifying information as possible regarding themselves to identify the record(s) at issue. Further, an individual may submit a Privacy Act amendment request to have their travel history record amended if they believe there is incorrect or inaccurate information in their record(s). Privacy Act amendment requests may be sent to

privacy.cbp@cbp.dhs.gov.

CBP agrees that it is important to advise the traveling public of appropriate redress mechanisms if a traveler believes that CBP actions are the result of the TVS maintaining incorrect or inaccurate information. Nevertheless, CBP must be mindful of the limited space on the sign itself. Current signage language directs travelers to the CBP biometrics website for more information. The CBP biometrics website includes several additional links to additional resources such as information on the FOIA, the CBP Information Center and a link to the DHS website,

https://www.dhs.gov.

On the DHS website, the public can submit a DHS TRIP complaint as discussed above.

CBP will continue to keep the public informed regarding the use of facial comparison technology as it expands to additional locations.

Comment:

One commenter requested additional information on exactly who will be targeted for this biometric collection.

Response:

As discussed throughout this rule, upon the effective date of this final rule, collection of facial biometrics may be required from all aliens entering or exiting the United States, regardless of age, gender, race, or nationality.

Comment:

One commenter indicated this rule fails to provide individuals with a choice or general awareness on whether travelers' personal information will be used to develop and/or train machines or algorithms.

Response:

CBP has issued PIAs for many of the pilots that have tested facial comparison technology.

Furthermore, the relevant SORNs are clear that DHS/CBP may use biometrics for purposes of testing new technology and identity verification.

See

https://www.dhs.gov/privacy-documents-us-customs-and-border-protection

(last visited May 16, 2025).

See

DHS/CBP-006 Automated Targeting System SORN, 77 FR 30297, 30301-02 (May 22, 2012); and DHS/CBP-007 Border Crossing Information (BCI) SORN, 81 FR 89957, 89960-61 (Dec. 13, 2016).

See also

DHS/ALL-041 External Biometric Records (EBR) SORN, 83 FR 17829, 17831-32 (Apr. 24, 2018); DHS/ALL-043 Enterprise Biometric Administrative Records (EBAR) SORN, 85 FR 14955, 14957 (Mar. 16, 2020); DHS/CBP-011 U.S. Customs and Border Protection TECS SORN, 73 FR 77778, 77780-81 (Dec. 19, 2008); and DHS/CBP-021 Arrival and Departure Information Systems (ADIS) SORN, 80 FR 72081, 72083 (Nov. 18, 2015). These SORNs are available at

https://www.dhs.gov/system-records-notices-sorns

(last visited May 16, 2025).

Comment:

Two commenters noted that they had only just heard about this rule and that the previous administration did not want input from the public.

Response:

DHS respectfully disagrees. In addition to following the legal requirements for providing notice to specifically seek input from the general public in accordance with the Administrative Procedure Act (APA), 5 U.S.C. 553(b), by publishing the proposed rule in the

Federal Register

on November 19, 2020, CBP also issued a press release.

In February 2021, in alignment with DHS's transparency efforts, DHS published another notice in the

Federal Register

to allow the public another opportunity to provide comments on the NPRM regarding the expansion of facial biometrics to further secure and streamline the international travel process. 86 FR 8878 (Feb. 10, 2021). Furthermore, CBP issued a separate press release discussing the NPRM and reiterating that the comment period was reopened.

CBP, National Media Release, CBP Enhances Biometrics for Non-U.S. Travelers Entering and Exiting the United States, Nov. 20, 2020, available at

https://www.cbp.gov/newsroom/national-media-release/cbp-enhances-biometrics-non-us-travelers-entering-and-exiting-united

(last visited May 16, 2025).

CBP, National Media Release, CBP Reopens Comment Period Regarding Enhancements to Biometrics for non-U.S. Citizens Entering, Exiting United States, Feb. 9, 2021, available at

https://www.cbp.gov/newsroom/national-media-release/cbp-reopens-comment-period-regarding-enhancements-biometrics-non-us

(last visited May 16, 2025).

e. U.S. Citizen Opt-Out

Comment:

A few commenters raised concerns about U.S. citizen options for opting out of using this biometric technology, including training of officers, signage and notification, alternative inspection methods, and authority to collect data.

Response:

DHS disagrees with these comments. Pursuant to section 287(b) of the INA (8 U.S.C. 1357(b)), all U.S. citizens are subject to inspection upon arrival to and departure from the United States to confirm their identity and citizenship. However, as noted here and elsewhere throughout this final rule, U.S. citizens can voluntarily participate in the facial biometric process. As mentioned on the privacy signage, also available on

https://www.cbp.gov/travel/biometrics,

if a U.S. citizen does not wish to have a photograph taken, the U.S. citizen may see a gate agent or CBP officer to request alternative procedures for identity verification.

The alternative procedures implemented pursuant to this rule are intended to be similar to the existing process at entry today, in which a CBP officer physically examines the traveler's documentation to ensure the bearer is the true owner and scans the document to pull up the traveler's data for inspection. On exit, airline partners would then conduct manual identity verification using the travel document, as is done today with minimal impact to the boarding and exit process. If there is some question as to the authenticity of the passport or whether the person presenting the passport is the person to whom the passport was lawfully issued, the airline will contact CBP for additional inspection, and a CBP officer may perform a manual review of the passport. A CBP officer may ask the traveler questions to validate identity and citizenship. As mentioned above, every effort will be made to not delay or hinder travel; however, as the alternative procedures include a more manual process it may be slower than the automated process using facial comparison technology.

Prior to deploying facial comparison technology to ports of entry, CBP conducts extensive and ongoing officer training, including emphasis on U.S. citizens being able to request to opt-out of having their photo taken and instead proceed through the traditional inspection process consistent with existing requirements for entry into the United States. Additionally, CBP sends reminder memos to the field offices to ensure compliance.

Comment:

Commenters also raised concerns regarding the possibility of an eventual biometric collection mandate for all U.S. citizens.

Response:

At this time CBP does not have plans to require U.S. citizens to be photographed when entering or exiting the United States as evidenced by DHS's withdrawal of the 2008 NPRM which would have proposed to require biometrics from U.S. citizens.

See

Withdrawal Notice (85 FR 73644).

f. Disability, Religious and Language Accommodations

Comment:

A few commenters raised concerns surrounding religious and language accommodations, including the need for alternative processing for travelers with religious affiliations, disabilities, or limited English-language proficiency.

Response:

CBP treats all international travelers with dignity, respect and professionalism while keeping the highest standards of security. For travelers with religious affiliations and/or disabilities, CBP policy generally allows for alternative processing on a case-by-case basis. These methods include fingerprint scans or requesting additional documents to establish identity and citizenship. On exit, the

airline gate agent may conduct manual identity verification of travelers by using their travel documents, as is performed for flights where biometric processing is not available, and may notify CBP to conduct further examination, if necessary. For example, if there is some question as to the authenticity of the passport or whether the person presenting the passport is the person to whom the passport was lawfully issued, airline partners will contact CBP for additional inspection, and a CBP officer may perform a manual review of the passport. A CBP officer may ask the traveler questions to validate identity and citizenship.

CBP requires the full face to be viewable. As such, CBP may request that the individual adjust or remove religious headwear to the degree necessary for identification verification. Should religious headwear need to be removed, CBP endeavors to provide as much privacy as possible. During processing, if a traveler requires special consideration due to religion, cultural, or privacy concerns, CBP officers and managers should endeavor to reasonably accommodate the traveler's request.

CBP has long recognized the importance of effective and accurate communication between CBP personnel and the public they serve. Language and communication barriers can negatively affect interactions with the public, provision of services, and law enforcement activities. Ensuring effective communication with all persons facilitates the CBP mission. CBP has a protocol for the use of interpreters and translation services, which is triggered by a request for interpreters or language services.

Air carriers and airport authorities may also provide interpreters for travelers, typically through Airport Ambassadors. CBP also utilizes other means of interpretation and translation, including Agency employees certified to provide language services. Additionally, CBP developed an internal smartphone translation application, CBP Translate, to facilitate basic officer-traveler conversations. Privacy information about CBP Translate is provided in DHS/CBP/PIA-069 Privacy Impact Assessment for the CBP Translate Application (2021), available at

https://www.dhs.gov/publication/dhscbppia-069-cbp-translate-application

(last visited May 15, 2025).

See

CBP, Language Access,

https://www.dhs.gov/publication/language-access-plan-us-customs-and-border-protection

(providing links to the DHS and CBP Language Access Plans) (last visited May 16, 2025).

Comment:

One commenter expressed concern over requiring travelers to remove their face masks during the facial comparison process.

Response:

The Centers for Disease Control and Prevention's Order entitled “Requirement for Persons To Wear Masks While on Conveyances and at Transportation Hubs”

has expired and most travelers no longer wear masks. However, CBP recognizes that some travelers still choose to wear masks and understands the concerns of those travelers. During both entry and exit, traveler identity must be verified, whether it is by a CBP officer or by a gate agent (on departure). To verify identity, it is necessary to see a person's face, whether it is being viewed by a camera or by a person. An argument can be made that it takes less time for a camera to capture a photo and do a backend comparison than it does for a person to make the same comparison and decide whether or not the faces match. In that case, using facial comparison technology lessens the time a traveler has to be without wearing a mask.

See

86 FR 8025 (Feb. 1, 2021).

As such, once at the primary inspection booth, CBP requires that all travelers momentarily lower their masks either to conduct the facial comparison match or to visually confirm that the traveler is the true bearer of the travel document. Requiring travelers to briefly remove their masks does not violate any laws. Upon departure, CBP defers to stakeholders, but does request that travelers pull their masks down as much as possible and ensure that no other facial obstructions (

e.g.,

hats or glasses) are present. If CBP officers are present upon departure, CBP will request that travelers pull their masks down. Nevertheless, facial comparison technology continues to improve. For example, a 2020 DHS S&T study showed that systems are often able to correctly identify individuals with masks.

CBP will continue to consider alternatives to mask removal using improved technology for those rare cases where travelers are still using masks.

DHS S&T, News Release, Airport Screening While Wearing Masks? Facial Recognition Tech Shows up to 96% Accuracy in Recent Test, Jan. 4, 2021, available at

https://www.dhs.gov/science-and-technology/news/2021/01/04/news-release-airport-screening-while-wearing-masks-test

(last visited May 16, 2025); DHS S&T, Demographic Variation in the Performance of Biometric Systems: Insights Gained from Large-Scale Scenario Testing (2021), available at

https://www.dhs.gov/publication/demographic-variation-performance-biometric-systems

(last visited May 16, 2025).

g. Data Security, Retention, and Dissemination Concerns

Comment:

Several commenters raised concerns surrounding data security, retention, and dissemination to include protecting the biometric data from breaches, cyberattacks, or insider threats, and implementing appropriate safeguards and storage protocols.

Response:

CBP is committed to protecting all sensitive information in its possession, including mitigating, to the extent possible, the risk of data breaches from information systems containing PII. Privacy is implemented by design. It is ensured in this instance because data protection is built into the design, architecture, and implementation of the biometric technology, ensuring data protection through the architecture and implementation of the biometric technology. As further detailed below, there are four primary safeguards to secure traveler data: secure encryption during data storage and transfer; irreversible biometric templates; brief CBP retention periods; and secure storage.

•

Encryption:

CBP stores TVS information in secure CBP systems and temporarily in a secure virtual cloud environment.

CBP uses two-factor authentication and strong encryption to transfer the data between the camera, the TVS cloud matching service, and CBP systems as well as for PII at rest (in storage). Moreover, just as CBP encrypts all biometric data at rest and in transit, CBP requires its approved partners under the TVS partner process to encrypt the data, both at rest and in transit.

See

TVS PIA at 26; CPE TVS Report at 15.

•

Templates:

A biometric template is a digital representation of a biometric trait of an individual generated from a biometric image and processed by an algorithm. The template is usually represented as a sequence of characters and numbers.

For TVS, the secure biometric templates created from the photos cannot be reverse engineered to recreate a biometric image. The templates generated for the TVS are proprietary to a specific vendor's algorithm and cannot be used with other vendors' algorithms.

See

TVS PIA at 6, 26; CPE TVS Report at 15-16.

•

Retention periods:

The entirety of TVS is in the cloud.

For U.S. citizens, the biometric image is destroyed immediately following confirmation of U.S. citizenship, but no later than 12 hours only under specific

circumstances.

If there is a system or network issue, photos will reside in an inaccessible queue for up to 12 hours and will be processed once the system and/or network connectivity is re-established and proper dispositioning (confirmation of U.S. citizenship) can occur. For all other travelers, CBP temporarily retains facial images in the internal cloud for no more than 14 days for confirmation of travelers' identities, evaluation of the technology, assurance of accuracy of the algorithms, and system audits. Gallery photos of all air and sea travelers are purged from the TVS external cloud matching service no later than 12 hours after entry or departure. CBP's cloud service provider, using a configurable managed service, automatically deletes the data. Additionally, the data cache is in an encrypted form and the cloud service provider does not have the encryption keys. CBP does not create galleries for the land environment. Photos of aliens who are required to provide a biometric as well as those U.S. citizens who participate in CBP's Global Entry Program, are securely transferred from CBP's cloud service providers to DHS IDENT, and any successor systems.

Certain other federal agencies may access IDENT with the approval of DHS, if the purpose of their access is consistent with the applicable SORNs, which are available on the DHS website,

https://www.dhs.gov/system-records-notices-sorns.

DHS retains certain records in IDENT for up to 75 years, which is necessary to support the holding of biometrics of subjects of interest in immigration and border management or law enforcement activities.

See

TVS PIA at 6; CPE TVS Report at 15.

See

TVS PIA at 9-10; CPE TVS Report at 11, 16.

See

TVS PIA at 8-9.

See

TVS PIA at 22.

See

TVS PIA at 21.

•

Access controls:

Only authorized CBP personnel and authorized representatives of approved CBP partners have access to the cameras, and only authorized CBP staff and cloud service provider personnel have access to the cloud database.

100

Although authorized cloud personnel may access the database, they do not have keys to decrypt the data. CBP access controls ensure only authorized access to the facial images. Initial TVS access is not activated for an individual without completion of the CBP Security and Privacy Awareness course.

101

The course presents Privacy Act responsibilities and agency policy with regard to the security, sharing, and safeguarding of both official information and PII. The course also provides information regarding sharing, access, and other privacy controls. CBP updates this training regularly, and TVS users are required to take the course annually.

102

Furthermore, the cloud service provider selected for this initiative is required to adhere to the security and privacy controls required by NIST Special Publication 800-144, Guidelines on Security and Privacy in Public Cloud Computing (2011)

103

and the DHS Chief Information Officer.

100

See

TVS PIA at 26; CPE TVS Report at 15.

101

See

TVS PIA 2 at 7; CPE TVS Report at 15.

102

See

CPE TVS Report at 15.

103

Available at

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-144.pdf

(last visited May 16, 2025).

CBP experienced a cybersecurity incident during a biometric pilot in 2019.

104

DHS OIG reviewed the incident to determine whether CBP ensured adequate protection of biometric data during the 2019 pilot.

105

In response to the 2019 cybersecurity incident, CBP has taken and continues to take robust measures to protect information systems containing PII. CBP response actions are detailed in CBP Comments to the Draft Report found in Appendix B to the Sept. 2020 DHS OIG Report regarding the incident.

106

104

See

DHS OIG, OIG 20-71, Review of CBP's Major Cybersecurity Incident during a 2019 Biometric Pilot 5 (2020) (Sept. 2020 DHS OIG Report), available at

https://www.oig.dhs.gov/sites/default/files/assets/2020-09/OIG-20-71-Sep20.pdf

(last visited May 16, 2025).

105

Sept. 2020 DHS OIG Report at 5.

106

Sept. 2020 DHS OIG Report at 22-23.

In addition to the assessment of biometric exit stakeholders, discussed in more detail below, CBP is working with DHS S&T, Office of Test and Evaluation, to develop and execute a cybersecurity test plan that will ensure all required security controls are in place on existing hardware and software. Additionally, CBP has contracted with a third-party vendor to perform an adversarial assessment to identify and mitigate any cyber vulnerabilities.

Comment:

Several commenters also suggested auditing stakeholders (such as port authorities, air carriers and sea carriers) to ensure compliance.

Response:

CBP understood the need to build a system that all stakeholders within the travel continuum could participate in without building their own independent systems. To address these challenges and satisfy the Congressional mandate, CBP, as outlined above, is working closely with its partners to integrate biometrics with existing identity verification requirements to the extent feasible. CBP agrees that it needs to ensure that its partners comply with and adhere to DHS and CBP privacy and security policies. To that end, CBP developed Business Requirements Documents, available on CBP's biometrics website at

https://www.cbp.gov/travel/biometrics/biometric-privacy-policy,

which partners sign and return to CBP as acknowledgement by the stakeholder that it agrees to all CBP terms and technical specifications as well as any other requirements as determined by CBP.

107

CBP Biometric Air Exit Business Requirements 8; CBP Biometric Sea Entry-Exit Business Requirements 8.

These business requirements implemented by CBP with its partners govern the retention and use of the facial images collected using CBP's facial comparison technology. CBP prohibits all approved partners such as airlines, airport authorities, or cruise lines and participating organizations (

e.g.,

vendors, systems integrators, or other third parties) from retaining the photos they collect under this process for their own business purposes.

108

The partners must immediately purge the images following transmittal to CBP, and the partner must allow CBP to audit compliance with this requirement.

109

In order to use TVS, private sector partners must agree to these Business Requirements.

110

108

CBP Biometric Air Exit Business Requirements 10; CBP Biometric Sea Entry-Exit Business Requirements 10.

109

CBP Biometric Air Exit Business Requirements 10; CBP Biometric Sea Entry-Exit Business Requirements 10.

110

CBP Biometric Air Exit Business Requirements 8; CBP Biometric Sea Entry-Exit Business Requirements 8.

CBP comprehensively assesses compliance with DHS's security and privacy requirements on the part of CBP and CBP's partners. This includes security interviews with partner IT departments, security scans of biometric processing systems, and penetration tests of those systems. CBP has conducted 14 assessments thus far.

111

CBP has not found any instances of stakeholders' retaining photos in violation of the Business Requirements Document.

111

Information provided by CBP's Biometric Entry-Exit Strategic Transformation Admissibility and Passenger Programs office subject matter expert on January 4, 2024.

CBP's cybersecurity resilience efforts, including the assessment of biometric exit stakeholders and adversarial assessment, align with Executive Order 14028, “Improving the Nation's Cybersecurity,” 86 FR 26633 (May 17, 2021), which highlights the need to strengthen collaboration between the private sector and the Federal Government.

Furthermore, CBP is taking steps to promote data minimization and privacy protections by using an airline-generated alphanumeric unique ID (UID) to disassociate the biographic information associated with the new facial images. As CBP verifies the identity of the traveler, either through the automated TVS facial comparison process or manual officer processing, the backend matching service returns the “match” or “no-match” result, along with the associated unique identifier. There is no additional PII shared with industry partners, which minimizes harm to individuals should cybersecurity incidents occur. A UID is generated by either the travel agent, travel website hosting service, or the airline at the time of the reservation. The UID is comprised of a sequential number (which is only valid for the particular airline and the specific flight), plus the Record Locator, a six-digit code used to access additional information about the traveler.

Comment:

Several commenters also suggested limiting forward dissemination.

Response:

DHS discloses information sharing pursuant to the relevant SORNs, under the Privacy Act. As discussed above, these SORNs are available on the DHS website at

https://www.dhs.gov/system-records-notices-sorns.

DHS abides by all applicable confidentiality statutes and regulations that may limit the use and sharing of information about vulnerable populations including those covered by IIRIRA 110 (8 U.S.C. 1367) (Violence Against Women Act, T nonimmigrant visas, and U nonimmigrant visas); INA 244 (8 U.S.C. 1254a(c)(6)) and 8 CFR 244.16 (Temporary Protected Status); INA 245A (8 U.S.C. 1255a(c)(5)(A) and (B), LIFE Act, Pub L. 106-553 § 1104(c)(5) and 8 CFR 245a.2(t); 245a.3(n), and 8 CFR 245a.21) (Legalization under the LIFE Act); INA 210 (8 U.S.C. 1160(b)(6)(A) and (B)), 8 CFR 210.2(e) (Special Agricultural Workers); and 8 CFR 208.6 (Asylum, credible fear, and reasonable fear, and applicable by DHS policy to Refugee information).

Additionally, in accordance with DHS policy, CBP uses the DHS FIPPs

112

to assess the privacy risks and ensure appropriate measures are taken to mitigate risks from data collection through the use of biometrics. DHS applies FIPPS-based protection to ensure that any forward dissemination is for a valid purpose consistent with the purpose for the original collection, is for a limited use consistent with the applicable SORN, and that privacy protections are adhered to. CBP's partnering stakeholders are also held to the same standards. For additional information on how CBP complies with the FIPPS, please see the page 15 of the CPE TVS Report.

112

DHS, The Fair Information Practice Principles,

https://www.dhs.gov/publication/privacy-policy-guidance-memorandum-2008-01-fair-information-practice-principles

(last visited May 16, 2025).

DHS prioritizes data protection and security as part of its mission to protect the homeland and is cognizant of the serious impact that unauthorized disclosure of information could create for vulnerable populations. DHS acknowledges that the risk of a data breach is always technically possible, but DHS works tirelessly to minimize those risks and continues to safeguard its information from any unauthorized use. DHS's IDENT already contains controls so that only those individuals whose jobs require knowledge of information retained in IDENT (including facial images as discussed in the response in this section above at the bullet on

Retention Periods

) are able to access that data on a need-to-know basis. In addition, government employees accessing IDENT data must have a valid federal security or suitability clearance. Misuse of the data in IDENT is mitigated by requiring that IDENT users conform to appropriate security and privacy policies, follow established rules of behavior, and be adequately trained regarding the security of their systems. Also, a periodic assessment of physical, technical, and administrative controls is performed to enhance accountability and data integrity.

Further, external connections must be documented and approved with both parties' signatures in an Interconnection Security Agreement (ISA), which outlines controls in place to protect the confidentiality, integrity, and availability of the information being shared or processed. DHS OBIM is responsible for all PII associated with IDENT, and the Homeland Advanced Recognition Technology System (HART), the successor system to IDENT currently in development, whether the data is held in data centers or in a cloud infrastructure, and therefore imposes strict requirements for safeguarding PII.

113

This includes adherence to the DHS 4300A Sensitive Systems Handbook,

114

which provides implementation criteria for the rigorous requirements mandated by the DHS Information Security Program.

113

See

HART PIA at 38-39.

114

DHS, DHS 4300A Sensitive Systems Handbook, Version 12.0 (Nov. 15, 2015), available at

https://www.dhs.gov/sites/default/files/publications/4300A%20Sensitive-Systems-Handbook-v12_0-508Cs.pdf

(last visited May 16, 2025).

Additionally, DHS OBIM requires contracted cloud service providers to segregate IDENT and HART data from all other third-party data.

115

All contracted cloud service providers must also follow DHS privacy and security policy requirements and must follow the Federal Risk and Authorization Management Program (FedRAMP)'s strict configurations, security assessments, authorizations, and continuous monitoring requirements.

115

See

HART PIA 38.

h. Rulemaking Process—Comment Period

Comment:

Several commenters raised concerns regarding the 30-day comment period and asserted that DHS did not provide sufficient time for public review. One commenter also alleged that DHS's staggered issuance of interrelated rules (referencing the USCIS NPRM) created further difficulties for interested parties as commenters were prevented from determining how the rules interrelate within the comment periods for the related rules.

Response:

Following the initial 30-day comment period, which closed on December 21, 2020, CBP, in alignment with DHS transparency efforts, and based on the previous comments received, re-opened the comment period for an additional 30 days to provide the public another opportunity to provide comments on the NPRM regarding the expansion of facial biometrics to further secure and streamline the international travel process.

116

The second period was from February 10 to March 12, 2021.

117

The combined comment periods amounted to 60 days. Alt

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.