DHS Audit Exposes TSA Facial Recognition Vendor's Unchecked Access to Passenger ID Images

A federal audit released in September 2026 revealed a significant privacy vulnerability in TSA's checkpoint facial recognition system: the technology vendor could access and copy passengers' driver's license and passport images without the agency's knowledge, oversight, or consent. The Department of Homeland Security Office of Inspector General, in report OIG-26-27, found that the contractor supporting the Credential Authentication Technology 2 (CAT-2) system—a facial comparison platform deployed across approximately 80 U.S. airports—extracted sensitive biometric and biographic data during routine system troubleshooting and maintenance without TSA tracking or authorization. The audit underscores a critical gap between TSA's public assurances about data protection and the operational reality of how passenger information flows through third-party contractors.