Item Number: ____8a__________ Meeting Date: December 10, 2019 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 MOTION 2019-13: A MOTION OF THE PORT OF SEATTLE COMMISSION adopting guiding principles for the public-facing use of biometric technology at Port of Seattle maritime and aviation facilities; establishing a working group to develop policy recommendations governing publicfacing biometric use at the port; and establishing deadlines for further actions. PROPOSED DECEMBER 10, 2019 INTRODUCTION Biometrics is the measurement and analysis of physical and behavioral characteristics that are used to identify individuals through technology. An example of a physical characteristic includes the unique features of an individual's face or their fingerprint. An example of a behavioral characteristic includes an individual's voice, signature, or how they walk. The Port of Seattle has long used various forms of biometrics at its aviation and maritime facilities - for access control and verification of employee, contractor, vendor, consultant identity. However, biometric technology - particularly facial recognition - is increasingly being deployed on the customer-facing side of airport and cruise operations, as both an identity validation as well as a customer facilitation tool to speed up check-in, boarding and screening processes. As with any developing technology, public sector leaders have an obligation to ensure appropriate and responsible use of not only the technology itself, but the related data that is generated. The port commission believes proper biometric policy should balance operational needs, business priorities and regulatory mandates with protections for the interests and rights of passengers, employees and other visitors to our facilities. TEXT OF THE MOTION Port of Seattle Principles for Public-Facing Biometric Technology The Commission hereby adopts the following principles to guide the use of public-facing biometric technology at Port of Seattle facilities: 1) Justified: Biometric technology at port facilities should be used only for a clear intended purpose that furthers a specific operational need. The port does not condone biometrics Motion 2019-13, Biometrics Principles and Biometrics Working Group Page 1 of 5 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 for "mass surveillance" - for example, use of facial recognition on large groups of people without a lawful purpose, rather than single-use for travelers. 2) Voluntary: The use of biometrics to identify and validate travelers through port facilities should be voluntary, and reasonable alternatives should be provided for those who do not wish to participate - through a convenient "opt-in" or "opt-out" process, except in specific situations authorized by the port or required by federal law such as U.S. Customs and Border Protection's (CBP) entry and exit requirements for non-U.S. citizens. Unintended capture of data by biometric technology from those travelers opting out of such biometric data collection, or of any non-travelers or other visitors at the airport, should be prevented; any unintended capture of this data should not be stored. 3) Private: Data collected by biometric technology at port facilities or by port employees from travelers through port facilities should be stored only if needed, for no longer than required by applicable law or regulations, and should be protected against unauthorized access. The port opposes this data being knowingly sold or used for commercial purposes unrelated to processing travelers at port facilities without their clear and informed consent. 4) Equitable: The port opposes discrimination or systemic bias based on religion, age, gender, race or other demographic identifiers. Biometric technology used at port facilities or by port employees should be reasonably accurate in identifying people of all backgrounds, and systems should be in place to treat mismatching issues with proper cultural sensitivity and discretion. 5) Transparent: Use of biometric technology for passenger processing at port facilities should be communicated to visitors and travelers. Individuals should be notified about any collection of their biometric data to facilitate travel at port facilities, and how that data may be used, in easily understood terms. Reports on the performance and effectiveness of the technology should also be made public to ensure accountability. 6) Lawful: Use of biometric technology and/or access to associated biometric data collected should comply with all laws, including privacy laws and laws prohibiting discrimination or illegal search against individuals or groups. 7) Ethical: The port and its partners should act ethically when deploying biometric technology or handling biometric data. Ethical behavior means actions which respect key moral principles that include honesty, fairness, equality, dignity, diversity and individual rights. In particular, use of biometrics at port facilities should comply with Resolution No. 3747, establishing the port's Welcoming Port Policy Directive to increase engagement with, and support for, immigrant and refugee communities. Motion 2019-13, Biometrics Principles and Biometrics Working Group Page 2 of 5 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 These principles will apply until a more comprehensive policy is put in place, through the working group process laid out below. Implementation of Biometric Principles for Maritime and Aviation Use Port leadership will implement an approval process for any proposals for new or expanded use of public-facing biometric technology to ensure alignment with these principles. Any proposal for new or expanded use of public-facing biometric technology will be communicated in advance directly to the port commission and through the port's external communications channels. The use of public-facing biometric technology at port facilities is subject at all times to the port's requirements, which may be revised and changed following implementation of port policies through the working group process described below. Upon implementation, the Port's biometric policies should be incorporated into commitments or agreements governing the use of biometric technology at Port facilities. Because the port does not have jurisdiction over the use of biometrics by the federal government at our facilities, the port will communicate these principles to CBP and other federal partners such as the U.S. Transportation Security Administration (TSA) and U.S. Coast Guard. We will not only notify them of our desired standards, but also work with these agencies and Congress to ensure that federal programs in place at port facilities are aligned as closely as possible with port policy regarding utilization of public-facing biometric technology. Through this motion, a port working group is established to develop further recommendations governing port policy related to use of public-facing biometric technology, which shall be submitted to the commission by the end of the 2nd quarter of 2020. Issues to be addressed by this working group include: • • • • • • • • • • • • the strategic use and objectives of biometrics; procurement; transparency and accountability for biometric implementation; auditing of this technology to ensure compliance and accuracy, and auditing prior to approval of expansion of technology; commitments or agreements with airlines, cruise operators, and other Port tenants and users; handling biometric data collected and stored from the technology; protection of personally identifying information; data security protocols and protection from unlawful or unauthorized access; alignment with the port's Welcoming Port Policy; state and federal policy priorities; outreach and public awareness strategy to prepare travelers and community members; and any other relevant topics that arise. In addition, the working group should develop a comprehensive list of known public-facing biometric implementation being planned at port facilities over the next five years. Motion 2019-13, Biometrics Principles and Biometrics Working Group Page 3 of 5 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 The working group will include, but not be limited to, representatives from the following port departments: Aviation Security; Aviation Operations; Airport Innovation; Maritime Security; Maritime Operations; Commission Office; Office of Equity, Diversity & Inclusion; Information and Communications Technology; Information Security; Government Relations; Legal; and Police. The working group shall also seek input from maritime and aviation industry partners and other stakeholders. The policy recommendations shall be delivered to Commission by the end of the 2nd quarter of 2020, and the Commission may create an ad hoc, limited term Commission Committee to oversee these efforts. STATEMENT IN SUPPORT OF THE MOTION Due to technological advances, perceived customer benefits and federal requirements, there will be a significant increase in public-facing facial recognition technology deployment by public and private sector users over the next few years, including in airport and seaport settings that will impact travelers and other visitors to our facilities. In advance of this expansion, the port commission believes that it has an obligation to institute proper policy frameworks and clear guidelines to reduce potential misuse and abuse, while improving public understanding of the benefits and risks. Specifically, the port must ensure individual privacy, civil liberties, and equity, and that biometric technology and use of the associated data is aligned with state and federal laws intended to protect those rights. Biometrics are used in various forms at the port's aviation and maritime facilities: • Across the port, port-issued identification cards currently utilize fingerprint biometrics to access secure or restricted areas or to permit authorized personnel access to port facilities outside of normal business hours or in locations where there is no other monitoring of access. In addition, many port employees are issued iPhones with fingerprint and facial recognition as an alternative to password protection, and facial recognition is also used on Microsoft Windows 10. • At Seattle-Tacoma International Airport (Sea-Tac), airport employees are required to scan their fingerprint at many secure doors throughout the facility. Sea-Tac also offers travelers the option of using CLEAR to validate the identity of a traveler as they process through TSA checkpoints using biometric technology instead of using traditional identification and validation methods. • On the maritime side, biometric data is required by federal regulation for issuance of TSA-issued Transportation Worker Identification Credential (TWIC) smart cards that are required to access maritime facilities regulated by the U.S. Coast Guard and cruise terminal operational areas. In addition, the cruise industry is increasingly taking advantage of biometrics as a passenger facilitation tool; for example, Norwegian Cruise Line and CBP have partnered for use of facial recognition for disembarkation of guests at Pier 66. Motion 2019-13, Biometrics Principles and Biometrics Working Group Page 4 of 5 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 One of the leading drivers of the expected deployment of public-facing biometrics over the next few years is implementation by CBP of a Congressionally mandated biometric exit-entry screening process for international air passengers. Sea-Tac's International Arrivals Facility will incorporate facial recognition for almost all arriving passengers (other than those U.S. citizens who opt-out), and CBP is working with the port and its airline partners to incorporate this technology into departing international passenger processes. Facial recognition is also increasingly being utilized by the port's private sector partners. Delta Air Lines opened the first full biometric airport terminal in Atlanta in November 2018, and is working to bring aspects of their "curb to gate" experience to Sea-Tac. Similarly, many of the port's cruise partners are working to streamline the check-in and boarding process for their travelers through facial recognition. Some members of the public and various advocacy organizations have expressed concerns about the rapidly expanding use of facial recognition. These stakeholders have raised issues around privacy, equity and civil liberties, although their main focus has been on broad law enforcement use of this technology for "mass surveillance" rather than the kind of customer facilitation uses that are being considered at port facilities. They support the use of appropriate regulation to ensure protections against abuse, discrimination and unintended consequences. ADDITIONAL INFORMATION ATTACHED Presentation slides Motion 2019-13, Biometrics Principles and Biometrics Working Group Page 5 of 5