Serious privacy concerns on facial recognition system at Indian airports

Serious concerns are being raised over the introduction of facial recognition system at Indian airports. In order to made air travel hassle free, the government from December 2 started paperless entry at select airports in the country. Under the initiative, airports will use facial recognition software called ‘DigiYatra’ for entry. There is no doubt that move will cut down boarding time, but several entries, including the facial recognition, for identification raised concerns regarding passengers privacy. The scheme is being rolled out at seven airports in the first phase – Bengaluru, Delhi and Varanasi starting December 2 and Hyderabad, Kolkata, Pune and Vijayawada by March 2023.

Facial recognition system

This policy of using facial recognition at airports, called “Digi Yatra”, was first announced by the civil aviation ministry in October 2018. Facial features of passengers will be scanned at e-gates located airports to establish identity which will be linked to their boarding pass. For the contactless process, passengers’ travel details will have to be linked to a mobile application. Further, passengers will undergo an Aadhaar-based validation, a self-image capture and will need to upload their boarding pass. Once at the airport, passengers will have to scan their bar coded boarding pass and the facial recognition system installed at the e-gate will validate their identity and travel documents. Passengers can then enter the airport through the e-gate. Currently, this new process is only available for some domestic flights at three airports.

Privacy concerns

There is greater risk in the process given the need to link Aadhaar and provide a self-image. The passenger information could be misused, shared or stolen. “Although technology initiatives like Digi Yatra are used for enhancing convenience and security, they are developed without a data protection regime and robust surveillance reform, which is problematic,” said Kamesh Shekar, programme manager at Delhi-based think tank The Dialogue, reported Scroll. “The data collected through these means are not safeguarded against misuse, who can access data and whether it is only used for the stipulated purpose is unknown,” Shekar said. “Measures to prevent and tackle breaches and abuse are not specified.”

Concerns addressed, claims Ministry

The civil ministry said that personally identifiable information is not stored centrally and travel credentials are held in a secure wallet in the passenger’s smartphone itself. Blockchain technology is being used to secure the uploaded data and all data will be deleted from the servers within 24 hours of use, the ministry added, accruing to the website. Blockchain is a system which records digital data in a way that makes it difficult to carry out alterations. Besides, the policy governing this service assured deleting of the passenger’s biometric data from system within 24 hours of the journey. However, It also mentioned that the data “shall have the ability to change the data purge settings based on security requirements” without being notified, said Aditi Seetha, programme manager, The Dialogue. Further, experts warn that any internet-based technology, including blockchain, is not immune to cyber security threats.

Scroll reported that Anushka Jain, policy counsel at Internet Freedom Foundation, also highlighted that there is a lack of safeguards against passenger data being shared with third parties. “Passengers are required to place their faith in the authorities and hope that your data is not compromised, at least until a new data protection law comes in,” Jain said. “Biometric data such as a person’s face is sensitive personal data,” Jain said. “While fingerprints cannot be captured easily, anyone can capture your face [through a photo]. A person’s face is on various identification cards, but fingerprints are not,” Jain added, emphasising the sensitivity of facial recognition data.

-INDIA NEWS STREAM