BEFORE THE DEPARTMENT OF HOMELAND SECURITY WASHINGTON, D.C.

BEFORE THE DEPARTMENT OF HOMELAND SECURITY WASHINGTON, D.C. ) In the Matter of ) ) COLLECTION OF ALIEN BIOMETRIC DATA ) UPON EXIT FROM THE UNITED STATES ) AT AIR AND SEA PORTS OF DEPARTURE; ) DOCKET DHS-2008-0039 UNITED STATES VISITOR AND IMMIGRANT ) June 23, 2008 STATUS INDICATOR TECHNOLOGY ) PROGRAM (US-VISIT) ) ) COMMENTS OF CATHAY PACIFIC AIRWAYS LIMITED By Notice of Proposed Rulemaking ("NPRM") published in the Federal Register on April 24, 2008, 73 Fed. Reg. 22,065, the Department of Homeland Security ("DHS" or "Department") proposed to require that scheduled airlines departing the United States collect, at their own expense, biometric information (currently, fingerprints) from non- U.S. citizen ("alien") passengers who were required to provide biometric information when entering the U.S. This proposal would require U.S. airlines, and airlines that serve the U.S. from scores of other countries, to act as unpaid law enforcement agents of the U.S. government, establish new border inspection facilities in the U.S., and collect sensitive biometric information that is not related to air transportation. Cathay Pacific Airways Limited ("Cathay Pacific"), a foreign air carrier based in the Hong Kong Special Administrative Region of China, respectfully submits that DHS, and not airlines, should collect this biometric information. Many activities that contribute or relate to aviation security, even those once performed by private entities, now are performed by the Department of Homeland Security. It seems unusual for the Department to buck this trend and pass off to U.S. and foreign companies a sensitive function that directly affects national security and law enforcement.

Cathay Pacific appreciates that DHS seeks to minimize the difficulty and cost associated with the new "exit infrastructure" Congress has required at U.S. international airports. 1 But Federal policy does not support the outsourcing of functions that are "inherently governmental," even if it would be cheaper or more efficient. 2 And to paraphrase a key government outsourcing test to determine whether a function is inherently governmental, the exit infrastructure and biometric collection DHS proposes will "significantly [affect] the life, liberty, or property of private persons." 3 Whether or not exit infrastructure and biometric collection could be managed by paid U.S. government contractors, it is clear that that the U.S. should not delegate such a sensitive task to airlines as an unpaid mandate. 4 The U.S. Government Trend Has Been To Assume Domestic U.S. Security Activities Affecting Commercial Aviation 1 DHS's cost estimates are enormous and, because compliance methods have not been fully specified, are clearly not "the last word." Thus, the agency recognizes that these estimates only meet the lowest quality category established by the Association for the Advancement of Cost Engineering (Class 5, for project definitions only 0-2% complete; the accuracy of Class 5 estimates can vary widely). See Air/Sea Biometric Regulatory Impact Analysis, docketed as DHS- 2008-0039-0002, at 38; AACE International Recommended Practice No. 17R-97, "Cost Estimate Classification System," available at http://www.aacei.org/technical/rps/17r-97.pdf. Because so many implementation issues are as yet unresolved, Cathay Pacific is unable to comment on those issues or their cost. But it seems that DHS has almost certainly underestimated: (i) the time required to separate non-u.s. citizens subject to fingerprinting, queue those passengers, and obtain accurate fingerprints; (ii) the impact of that time on passenger plans and on delays that currently plague the U.S. aviation system; and (iii) the cost to carriers of fulfilling this government obligation. 2 Since exit infrastructure, whether provided by airlines or the government, will require the acquisition of "limited, privately owned, high-value space" and other expenditures that DHS found troubling during its pilot programs, see NPRM at 22,070, 77, 79, the final cost to the government may not be significantly cheaper, particularly if the government is required to pay just compensation to airports or airlines. Cf. U.S. CONST. amend. V (Takings Clause). 3 "Performance of Commercial Activities," Office of Management and Budget Circular No. A-76 (May 2003), Attachment A, B.1.a. 4 Rather than simply assuming that airlines can somehow recover from their customers the cost of exit fingerprinting, Congress and DHS should consider a governmental source of funding. Issues raised by exit fingerprinting -- the propriety of airlines performing law enforcement functions at significant, unreimbursed expense -- echo 1980s concerns about carrier detention of inadmissible aliens. Those concerns, in part, led to the 1987 creation of an Immigration User Fee that would fully fund the immigration screening function. See 8 U.S.C. 1356(g) ("immigration services required to be provided to passengers upon arrival in the United States on scheduled airline flights shall be adequately provided when needed and at no cost (other than [immigration user fees]) to airlines and airline passengers...."). - 2 -

Airlines began the security screening of their passengers in the 1970s to counter an increase in criminal and terrorist incidents aboard or using commercial aircraft. While this government-mandated and -regulated screening was costly, there was a clear and direct benefit to airlines, their employees, and their passengers in preventing the carriage of weapons and other dangerous objects on board aircraft. Despite this direct interest, Congress concluded after September 11 that security screening was so critical to national security that it must be done by Federal employees. Similarly, the government now is withdrawing from airlines the obligation to vet passengers against government watchlists. 5 As with screening, there are logical links between this function and airline interests, as airlines already maintain the necessary manifest data for their own business purposes. Watchlists also support their direct interest in securing aircraft, employees, and passengers against criminals and terrorists. Yet, as with screening, Congress has directed that DHS assume the watchlist matching function. Moreover, it is telling that DHS made a policy decision to begin the transition on international flights. Among the reasons cited? "[T]o take the watch list out of foreign air carrier hands," presumably for security reasons. 6 Against this reasoning, forcing airlines to begin a purely immigration-related function like exit fingerprinting is simply illogical. Screening and watch list vetting and screening at least address the immediate security of outbound flights, but DHS seemingly does not intend for exit biometrics to be used, at first, to enhance flight security. See Regulatory Impact Analysis at F-7. Where, then, is the direct and immediate benefit to airlines, their employees, and their passengers? At present, the sole function of the proposed entry-exit system is to allow DHS to attempt to prove, perhaps years later, whether a particular person left the U.S. in a timely fashion. The Government, Not Regulated Private Parties, Should Collect Biometric Information Used For Law Enforcement Purposes Privacy Considerations Any "personally identifiable information" ("PII"), if mishandled or misused, can affect a person's life, liberty, or property and therefore is entitled to privacy protection under the laws of the U.S. and many other countries. Both the existing Advance Passenger Information System ("APIS") program and the proposed exit infrastructure involve the collection of PII. But the collection of fingerprints or other biometric information raises greater privacy issues than the current APIS collection of names, flight numbers, addresses, and other textual information because it requires a more invasive 5 Intelligence Reform and Terrorism Prevention Act of 2004 ("IRTPA"), 4012(a)(2), Pub. L. No. 108-458, 118 Stat. 3638, 3717; Secure Flight Program, 72 Fed. Reg. 48,356, 48,357 (NPRM Aug. 23, 2007). 6 See http://www.dhs.gov/xabout/gc_1168618952015.shtm, accessed June 13, 2008. - 3 -

collection procedure. And the potential harm if biometric information is mishandled or misused is greater because it is a more accurate and precise method of identifying an individual. It is axiomatic that PII protection is reduced as it is handled by more people and processed through more systems. And DHS's own rulemaking documents recognize that carrier collection and retransmission of biometric information would be the weak link in US-VISIT privacy: [C]arrier collection of biometrics [could result in] the loss of control over the use and disclosure of [covered aliens'] PII. The opportunities for the misuse of PII, and the serious impact that carrier misuse would have on covered aliens and the integrity of the US-VISIT Program makes the misuse of biometrics by carriers a high risk. The Carrier Discretion Solution with carrier collection has the lowest degree of privacy of all alternatives since the biometric data must be collected by a private company and then transferred to the Government as with all solutions utilizing carrier collection business processes. 7 Government contracting policy also recognizes that it may not be appropriate to place non-government personnel in situations where they can gain access to sensitive information. 8 It is worth noting that statutes addressing who should enter data into the entry-exit system refer to government officers and employees for privacy and security reasons. The first statute to require such a system set a deadline for "available alien arrival and departure data... when collected or created by an immigration officer at an airport or seaport, [to be] entered into the system...." 9 It also required "the Attorney General, in consultation with the Secretary of State, to determine which officers and employees of the Departments of Justice and State may enter data into, and have access to the data contained in, the integrated entry and exit data system." 10 In clarifying what DHS must include in its entry-exit system, Congress later required DHS to "incorporate a simple and timely method for... determining which government officer provided data so that the accuracy of the data can be ascertained." 11 7 Privacy Impact Assessment issued April 15, 2008 in conjunction with the NPRM, 1.7, available at www.dhs.gov/xlibrary/assets/privacy/privacy_pia_usvisit_exit.pdf; Regulatory Impact Analysis 3.3.2. 8 See Federal Acquisition Regulation (48 C.F.R.) 7.503(d)(11). 9 Subsection 110(d)(1) of the Illegal Immigration Reform and Immigrant Responsibility Act of 1996, as amended by section 2 of the Immigration and Naturalization Service Data Management Improvement Act of 2000, Pub. L. No. 106-215, 114 Stat. 337, 338. 10 Id., subsection 110(f)(1). 11 IRTPA 7208(f)(4), 118 Stat. 3820. - 4 -

Against this clear recognition that carrier biometric collection poses a greater privacy risk than government collection -- regardless of carriers' best security efforts -- DHS's attempt to "mitigate" that risk falls short of the mark. To opine simply that "carriers must take steps to protect the privacy of the information collected and should only retain the biometrics collected... for a reasonable time," NPRM at 22,073, is not enough; it simply invites foreign governments to protest such cavalier U.S. government treatment of their nationals' biometric information. The solution is to keep sensitive information like fingerprints in the hands of the government, which already collects biometric information at US-VISIT entry stations and at consular offices worldwide. Law Enforcement Considerations Government outsourcing policy also recognizes that it is inappropriate to rely on private parties to perform, and in many cases even to support, law enforcement activity. 12 Yet the primary purpose of exit fingerprinting is to support DHS's law enforcement mission. The exit program is expected to "provide DHS with evidence supporting approval or rejection of any subsequent application for admission to the U.S., a visa application, or other immigration benefit." See NPRM at 22,071. DHS also asserts that the "location of an alien deemed to be a threat may profitably be learned upon a delayed basis" with the assistance of exit biometric information "and relayed to the appropriate international authority to support U.S. intelligence and criminal law enforcement functions." NPRM at 22,079. It would be some time before courts consider whether biometric information collected by airlines could legally be used for the evidentiary purposes DHS anticipates or whether notice and chain of custody issues, for example, will be insurmountable. Regardless, it is likely that airlines would need to advise passengers that they are collecting evidence for law enforcement purposes, 13 that airline employees would be called to testify as to exit fingerprinting matters, and that errors in the exit process would affect passengers' future life, liberty, and property. These are daunting propositions. And while DHS has claimed that the exit function "is not designed around law enforcement at the time of alien traveler exit," 14 the prospect that carriers ultimately may be required to transmit biometric information before departure suggests the contrary. 15 12 See Federal Acquisition Regulation 7.503(c)(1)(8). 13 Cf. Federal Acquisition Regulation 7.503(d)(13) (noting potential impropriety of "[c]ontractors participating in any situation where it might be assumed that they are agency employees or representatives.") 14 Regulatory Impact Analysis at F-7. While DHS refers to the "Comprehensive Exit Charter" for this proposition, no such document is contained in the rulemaking record. 15 NPRM at 22,073. Indeed, the NPRM indicates that the DHS pilots were designed to allow immigration officers to question outgoing passengers during biometric collection. Id. at 22,070. - 5 -

By staffing the exit process with airline rather than DHS personnel, the agency may jeopardize its ability to benefit fully from real-time review of departing passengers or force airlines into playing a still more active role in law enforcement. The Participation of Foreign Airlines In U.S. Exit Infrastructure Would Have Other Foreign Policy Implications Nowhere does the NPRM address the fact that most of the air carriers that would be required to collect biometric information are foreign companies, owned and controlled by foreign nationals and, in some cases, foreign governments. Yet DHS's requirement that foreign airlines collect biometric information in the U.S. would have security and public policy implications within the U.S., and it also could affect U.S. citizens and air carriers operating in other countries. U.S. national security policy clearly contemplates that non-citizens should not possess certain types of sensitive information or technology. Thus, as noted above, it is difficult to square DHS's concern that watchlists remain "out of foreign carrier hands" with a proposal to let those same foreign carriers collect sensitive biometric information. It also is worth noting that the U.S. Export Administration Regulations currently require an export license, in most cases, for the very fingerprint technology that DHS would require foreign airlines to employ in the U.S. 16 The rulemaking record does not indicate whether DHS has considered the impact of these regulations, e.g., whether it would prevent foreign carriers' headquarters from contracting for fingerprint readers directly or from using, testing, and repairing them outside the U.S. Finally, international civil aviation relies on governments worldwide to impose only reasonable and non-discriminatory requirements on airlines and passengers. Some countries may feel that DHS's proposed exclusion of charter air operations and airline small businesses from the biometric collection requirement would be discriminatory. And of the other countries that process departing air passengers for immigration purposes, those that rely on government funding or personnel to perform that function may revisit their policy if their own airlines must fund and perform U.S. immigration exit processing. 17 16 The export to most other countries of fingerprint analyzers classified in Export Control Classification Number ("ECCN") 3A981, and related software and technology under ECCN 3D980 and 3E980, requires a license for "crime control reasons." See 15 C.F.R. Part 774, Supp. No. 1; 15 C.F.R. 742.7(a); Notice of Inquiry, 73 Fed. Reg. 14,769 (Mar. 19, 2008). 17 Indeed, aviation treaty obligations may preclude DHS from imposing its unpaid mandate on carriers: "Contracting States shall provide sufficient services of the public authorities concerned [with clearance controls], without charge, to operators during working hours established by those authorities." Annex 9 (Facilitation) to the Convention on International Civil Aviation, para. 6.60 (12th ed. 2005). - 6 -