Your Face at the Border Doesn't Get Deleted. It Gets Filed for 75 Years.

Picture this: You walk through an airport border crossing. A camera scans your face. A green light flashes. You grab your bag and move on, figuring that photo disappeared the moment the gate opened. It didn't. And in Israel, the head of the country's domestic intelligence agency recently decided that photo — along with millions like it — should be available to his agency whenever it wants, for whatever purpose it decides. No new law required. No public vote. Just access.

This is the story nobody's really telling you. The public conversation about border biometrics — biometrics meaning the digital record of your physical body, things like your face, fingerprints, or voice — has mostly focused on whether the technology works. But a Türkiye Today report on a Haaretz investigation pulls back the curtain on the much thornier question: what happens to your face data after the gate swings open?

The One Word That Changes Everything

The Shin Bet — Israel's equivalent of the FBI, responsible for internal security — wanted access to the facial recognition database maintained at Israel's border crossings. That part alone wouldn't be shocking. Security agencies want data. That's their whole job. But here's the word that matters: unrestricted.

Not "access under a judge's order." Not "access in active terrorism cases." Not "access with a 30-day audit review." Unrestricted. As in: we want in, and we don't want to explain ourselves every time we look.

Under Israeli law, that database belongs to the Population and Immigration Authority — think of them as the government office that manages who enters and exits the country. The law says the data can only be used for border identification purposes, and it mandates deletion within 90 days. The Shin Bet has no legal right to access it. Full stop. The Haaretz investigation found the agency's director, David Zini, pushed for this access anyway — and that a proposed legal amendment that would have authorized it "has not advanced in the Knesset," Israel's parliament. This article is part of a series — start with Retail Facial Recognition Washington Privacy Gap.

Here's where it gets genuinely unsettling. This isn't just a request that got denied. A 2022 government report found that the Population Authority had already been storing facial images past the legally required 90-day deletion window — and transferring them to Shin Bet without authorization. The rule existed. The deletion requirement existed. The data moved anyway.

"Shin Bet chief demands access to airport facial images database without approval." — Haaretz headline documenting Shin Bet Director David Zini's push for unrestricted access to border facial data, as reported by Haaretz

That's not a hypothetical risk. That's a documented violation — and then a follow-up request to make the violation legal retroactively. It's the policy equivalent of a teenager sneaking out all year, then asking their parents to just officially extend curfew.

This Is Not Just an Israel Story

Before you think "well, I don't cross Israeli borders," let me walk you through what's been happening on this side of the world.

U.S. federal immigration agencies ran facial recognition searches against state driver's license databases — millions of American faces, scanned and compared, without the knowledge of the states or the drivers. States like Utah eventually passed laws specifically to block that. As the German Marshall Fund of the United States has documented, this kind of quiet expansion — where data collected for one reason quietly becomes available for another — is not the exception. It's the pattern.

Meanwhile, the Department of Homeland Security has set a retention window — meaning the period they plan to hold onto biometric data — of up to 75 years for international travelers, according to U.S. Customs and Border Protection. Seventy-five years. If you crossed a U.S. border at age 30, your biometric record may outlive you. That's not a security measure. That's an archive. Previously in this series: Someone Is Building A Fake You And Your Bank Has 30 Seconds .

And audits — meaning the official check-ups meant to confirm the rules are being followed? A review by the U.S. Government Accountability Office found that CBP (Customs and Border Protection) had audited just one of its more than 20 commercial airline partners on privacy compliance. One. Out of twenty-plus. That means the rules exist, the agreements exist, and almost none of it is being meaningfully checked.

Look, nobody's saying every government official is acting in bad faith. Most security agencies genuinely believe wider access helps them catch bad people. The Shin Bet's argument — that facial comparison helps identify suspects caught on crime scene footage — isn't crazy. There are real cases where that kind of identification matters. But the answer to "this tool would be useful" is not "so let us have it with no limits." That's not how any functioning legal system is supposed to work. You make the case, you get the law passed, you build in the oversight. The problem in Israel isn't that an intelligence agency wants better tools. It's that "unrestricted" is doing an enormous amount of work in that sentence, and nobody with authority seems to be pushing back on it hard enough.

Why Data That Sits Around Gets Used

Here's a dynamic worth understanding, because it explains a lot. Once a government builds a facial database, there's immediate pressure to justify the cost of building it. That pressure doesn't come from villains — it comes from bureaucratic logic. You spent $40 million on an infrastructure system. It's sitting there. Someone's going to ask why you aren't using it more.

According to Investigative Post, U.S. border facial recognition implementation has steadily expanded beyond its original scope, with deletion and retention practices varying significantly by program and agency. The scope creep — where data collected for one specific purpose starts being used for broader ones — isn't usually dramatic. It's incremental. A new request here, a policy tweak there, a proposed amendment that "hasn't advanced" yet but might next year.

The One Thing You Can Actually Do

If you've ever wondered whether a photo or a profile is really who it claims to be — or more to the point here, whether a face scan is really "just for the border" — you're asking exactly the right question. That skepticism is healthy. Encourage it in your family too, especially kids who'll be crossing borders for the next 50-plus years. Up next: Your Face Is Being Scanned At The Grocery Store And Washingt.

The single most useful habit you can develop: ask what a face scan is used for before you submit to one — and in voluntary contexts like employer verification apps, retail loyalty programs, or event check-ins, you can simply opt out. Most people don't know they can. Border crossings are compulsory if you're traveling internationally, but every other context? You have more say than you've been led to believe.

Also worth knowing: if you're a U.S. citizen, you currently have the legal right to opt out of facial recognition at airport boarding gates (TSA policy, as of this writing). Airlines and airports don't advertise this. Ask at the gate. It is allowed.

Here's the thing that should stick with you. Israel had the law right. Ninety-day deletion. Single authorized agency. Clean limits on paper. And the data was still transferred without authorization — and then the agency that received it illegally turned around and asked for legal permission to keep doing it. What that tells you is that the quality of the law matters less than the quality of the enforcement. And right now, in most countries running border biometric programs, enforcement is the part nobody's figured out yet.

Your face at that border crossing isn't just a key that opens a gate. Somewhere, in a database with a 75-year retention window, it's also a record. The question worth asking your representatives — out loud, in writing, loudly enough that they actually answer — is simple: who decides what happens to that record next?