Facial Recognition at Airports: TSA Scale Outpaces Oversight

Nearly 2,500 files. Sitting on a U.S. government-authorized Google Cloud endpoint. Fully accessible. No exploit required. That's not a data breach, that's just negligence dressed up as a product.

This was not a quiet week for facial technology. Between an identity platform's scoring logic turning up on the open internet, a law review piece laying out exactly how TSA's "optional" face scans aren't optional in any meaningful sense, and a Wired investigation into an immigration app that DHS marketed as an identity verifier but technically can't verify a thing, the industry got a hard look in a very unflattering mirror. If you work with facial comparison professionally, you should be paying attention. Not because the sky is falling, but because the standard of proof just quietly shifted, and a lot of practitioners haven't noticed yet.

Act One: The Exposed Logic Problem

Start with the Persona story, because it's the most viscerally alarming. Persona Identities, partially funded by Peter Thiel's Founders Fund, and used by Discord, OpenAI, Roblox, and Lime among others, had its front-end verification code sitting on a publicly accessible endpoint. Researchers found it without writing a single line of exploit code. According to Fortune's reporting, those nearly 2,500 files revealed that Persona conducts 269 distinct verification checks, including facial comparisons against watchlists, screening against lists of politically exposed persons, and adverse media checks across 14 categories including terrorism and espionage. It then assigns risk and similarity scores.

All of that. On the open internet. This article is part of a series, start with Facial Recognition Checkpoint Convergence Investig.

There are two separate harms here, and I want to be precise about both. The obvious one: bad actors now know exactly what triggers a flag and can engineer around it. That's a fraud enablement problem. But the less-discussed harm hits investigators and legal teams directly. When a platform's scoring methodology is publicly known and accessible, opposing counsel can argue, with a straight face, that the methodology was potentially gamed before your client ever ran a check. Chain-of-custody integrity doesn't just apply to physical evidence. It applies to the reproducibility and isolation of your analytical process. If the scoring logic was sitting on a Google Cloud endpoint anyone could read, the integrity of every output produced by that system is now a legitimate question in discovery.

"We didn't even have to write or perform a single exploit, the entire system was just sitting there for anyone to inspect." Researchers, as quoted by Fortune

That quote should make every KYC compliance officer and licensed investigator uncomfortable. Because if researchers can say that, a defense attorney can say it too, and they will.

Act Two: TSA Facial Recognition Expansion at Airports

The TSA story is less dramatic but arguably more consequential for civil liberties at scale. TSA's credential authentication technology, CAT-2 scanners that capture real-time images and compare them against government-issued IDs, is now operating at airports nationwide. The agency promotes it as efficient and secure. Travelers are told it's optional.

TSA PreCheck Touchless ID and What "Optional" Really Means

TSA PreCheck touchless ID is often described as the smoother, faster lane through security, and that framing is part of why so few travelers question it. But touchless ID still relies on the same facial comparison step as the standard line, just wrapped in friendlier branding. Understanding that TSA PreCheck touchless ID is still a biometric checkpoint, not a bypass of one, matters when you're deciding whether to opt out.

Facial Comparison Accuracy Across Demographic Groups

Facial comparison systems don't perform identically across every skin tone, age group, or gender presentation, and the Government Accountability Office has already flagged this gap in TSA's own program. Age and lighting conditions both affect how reliably a facial comparison engine matches a live photo to a government-issued ID. A child's face, which changes rapidly year to year, is a known weak point for these systems, and airports rarely disclose how enrollment photos are re-verified over time.

Security, Screening, and the Illusion of Choice

Airport security screening was designed around the idea of layered checks, not a single biometric gate, but facial recognition at airports is increasingly treated as the default rather than one option among several. When screening staff wave travelers toward the camera without stating plainly that they can decline, security stops being a neutral process and starts being a nudge. Travel through a major hub already involves enough friction that most people won't risk a delay to test whether "optional" is real.

Biometrics, Travel, and the Trust Gap

Biometrics have quietly become the backbone of modern travel, from bag drop to boarding gate, and facial recognition at airports is just the most visible piece of that chain. Every added touchpoint is another place where travel data is collected, stored, or compared, and travelers are rarely told which of those steps they can skip. That trust gap is exactly what Redmon's research and the GAO findings are pointing at.

Transportation security agencies have leaned hard into the efficiency argument for facial recognition at airports, and it's not a baseless one, shorter lines and fewer manual ID checks are real benefits. But technology adopted for throughput still has to answer for its error rates, and security decisions made at that scale affect millions of travelers who never signed up to be part of an accuracy study. The Government Accountability Office has previously flagged TSA's facial program for incomplete accuracy documentation across demographic groups, particularly for travelers with darker skin tones. So we have a system that: (a) passengers don't know is optional, (b) has documented demographic accuracy gaps, and (c) is actively expanding. TSA has been transparent about its plans to scale the program significantly. That combination should make anyone who cares about evidence quality very nervous, because biased error rates in the enrollment phase become biased evidence downstream. Previously in this series: Face As Boarding Pass Facial Comparison Evidence S.

Act Three: TSA Facial Recognition, Verification vs. Identification

The Mobile Fortify story is the one that directly implicates investigative practice. DHS launched the app in spring 2025 to, in their words, "determine or verify" the identities of individuals stopped by immigration agents. The rollout was explicitly tied to an executive order calling for expedited removals and expanded detention. High stakes by any measure.

But according to Wired's review of internal records, Mobile Fortify was not designed to reliably identify people in the field and was deployed without the scrutiny that has historically governed privacy-impacting technology rollouts. The kicker? DHS kept calling it an identity verifier. It isn't, and the distinction isn't semantic.

"Every manufacturer of this technology, every police department with a policy makes very clear that face recognition technology is not capable of providing a positive [identification]..." Source cited in Wired

Verification and identification are technically distinct tasks with different error rate profiles, this is well-documented in NIST's Face Recognition Vendor Testing literature. Verification asks: "Is this person who they claim to be?" Identification asks: "Who is this person?" They're not the same question, they don't carry the same confidence levels, and conflating them in an operational context is, in the nicest possible terms, a methodological disaster waiting to happen in front of a judge.

This is exactly why the shift toward documented, methodology-first facial comparison matters right now. When a practitioner uses landmark-based Euclidean distance analysis to produce a numerical, reproducible similarity measure, rather than a black-box score from a platform whose logic may or may not be sitting on a public endpoint, they have something they can actually explain on the stand. They can say: here are the landmarks I used, here is the distance calculation, here is what the number means, here are its limitations. That's forensic discipline. That's what separates evidence from assertion.

Look, nobody's saying the only good facial comparison is a perfect one. The counterargument to all of this is real: facial technology, even imperfect, closes cases. It finds missing persons. It catches fraud that human review misses. Slowing adoption for the sake of methodological purity has genuine costs. But that's a false binary. The question was never "use it or don't." The question is whether you can defend exactly how you used it, the inputs, the process, the confidence level, the stated limitations, when someone in a courtroom asks. Up next: Facial Recognition Checkpoints Tsa Immigration Rai.

Three stories. One pattern. The facial systems drawing the most scrutiny this week, an exposed KYC platform, a coercive airport scan program, a field app marketed beyond its technical capabilities, all share the same core flaw: they present outputs without auditable process. They ask you to trust the score without showing you the work.

The investigators who will come out of this moment intact are the ones who already know what their Euclidean distance threshold is, why they chose it, what it means when a score hits 0.72 versus 0.91, and how to put that in writing for someone who's never seen a facial comparison report before. That's not a niche technical skill anymore. That's table stakes, and this week, in three separate news cycles, the industry made it very clear why.

So here's the question worth sitting with: if a client called you tomorrow and asked to see your facial comparison methodology documentation, not the output, the methodologyhow long would it take you to produce it, and how confident would you be handing it to their lawyer?

Facial recognition at airports isn't a future concern anymore; it's the system most travelers already walk through without a second thought. The gap between how the technology is marketed and how it actually performs is exactly what this week's three stories exposed, one agency and one platform at a time.

For investigators, the practical takeaway is simple: treat any facial recognition information is deleted claim from an agency or vendor as a starting point for questions, not a closing statement. Ask how long data is actually retained, who can access it before deletion, and whether deletion applies to derived scores as well as raw images. TSA's facial recognition technology has expanded largely on the strength of efficiency claims, without matching transparency about retention and audit trails.

The same scrutiny applies to biometric facial comparison technology used anywhere entry into a secure space is being controlled, airports, courthouses, or corporate campuses. If the underlying comparison method can't be explained in plain language, it shouldn't be treated as dispositive evidence. TSA is optional in name at many checkpoints, but the practical experience of travelers suggests the opt-out process needs the same documentation rigor as the technology itself.

None of this means facial recognition technology at airports is inherently bad security policy. It means the technology has outpaced the paperwork, and that gap is where legal exposure, civil liberties complaints, and flawed evidence all tend to grow.