DHS watchdog: vendors could extract passenger ID images from TSA facial-recognition system

A Department of Homeland Security watchdog has found a “significant weakness” in privacy protections for the Transportation Security Administration’s facial-recognition identity-check system, saying a vendor was able to pull sensitive passenger ID images during maintenance work without TSA knowing.

The finding appears in an unclassified summary of audit OIG-26-27, “Effectiveness of TSA’s Identity Authentication and Biometric Technology,” published by the Department of Homeland Security’s Office of Inspector General in September 2026. The audit focused in part on TSA’s Credential Authentication Technology 2, or CAT-2, systems, which scan a traveler’s ID at airport checkpoints and compare it with a live photo to verify identity.

That matters because CAT-2 is already widely used across the country. A Privacy and Civil Liberties Oversight Board staff report published May 9, 2025, said TSA had deployed more than 2,100 CAT-2 devices at more than 250 U.S. airports as of April 2025. TSA and DHS have said that in routine one-to-one identity verification, live images and ID images are typically kept only briefly on the device and then deleted or overwritten.

But the inspector general said the audit uncovered a different problem: vendor access during troubleshooting and system enhancements. According to the unclassified summary, the CAT-2 vendor “was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and enhancements, without TSA’s knowledge.”

The summary said TSA’s oversight of that process was inadequate. “TSA lacked clear policies, did not track when this data was extracted, could not verify that extracted information was properly deleted, and did not notify passengers when their biometric and biographic information may have been stored,” the summary said. “As a result, although passenger information was generally protected during routine operations, weaknesses in vendor oversight created a risk that sensitive personal information could be retained or exposed.”

The watchdog said it issued one finding and three recommendations tied to the privacy and data-handling issue. TSA agreed with all three. “We issued one finding and three recommendations to strengthen controls, improve oversight, and ensure transparency and the proper handling of passenger data. TSA concurred with all three recommendations. Two recommendations are open and resolved, and one remains open and unresolved,” the summary said.

The public summary leaves major details unanswered. It does not identify the vendor by name, say which airports were involved, give the dates of the data extractions, or estimate how many passengers may have been affected. It also does not say the information was misused or publicly disclosed. The finding is about a risk created by weak oversight, not a confirmed public leak.

That distinction is important because TSA has publicly described the system as one in which images used during ordinary identity checks are retained only briefly. The inspector general’s finding points instead to a gap in controls when data moved outside that routine flow and into vendor hands during maintenance or troubleshooting.

With the technology now deployed at hundreds of airports, the audit raises questions about how TSA governs the companies that help keep the system running, even when the agency says routine passenger images are short-lived. TSA’s public materials also say travelers can opt out of the facial-comparison photo at the checkpoint.