US biometric entry-exit audits: what GAO and the DHS inspector general found

What the audit found

GAO's report GAO-17-170, released on 27 February 2017, found US Customs and Border Protection (CBP) had run four biometric exit pilots since 2013 but still faced planning, infrastructure and staffing problems. It said most US airports lacked secure outbound areas where officers could capture biometric data and that it was "too early to assess the agency's plans." GAO made no new recommendations in that report ¹.

The DHS inspector general's report OIG-18-80 found CBP's pilot at nine airports showed facial recognition could work at departure gates, with a technical match rate averaging 98% from August to December 2017. Only about 85% of passengers were biometrically confirmed on average, and CBP assigned only 43 officers to the nine pilot sites. The report said CBP cut its spending plan from $1 billion to $650 million when visa fee revenue fell short, and that as of January 2018 no airline had agreed to fund or staff the programme long term ².

GAO's report GAO-20-568, released on 2 September 2020, found CBP had deployed facial recognition for air exit at 27 airports as of May 2020. It found privacy notices were not always current or available where the technology was used, that CBP had audited only one of its airline partners and that air exit missed its goal of photographing 97% of travelers, though it exceeded its accuracy goals ⁴.

The official response

DHS and CBP concurred with all five OIG-18-80 recommendations. CBP asked for several to be closed, and the inspector general kept all five open and resolved pending evidence ².

All five GAO-20-568 recommendations went to CBP. GAO's record shows four closed as implemented, covering privacy notices, privacy signs, a plan to audit partners and an alert when performance falls below thresholds. The fifth, on meeting the photo capture requirement, was closed as not implemented after CBP removed that requirement from its operational requirements document ⁴.

CBP concurred with all three OIG-20-71 recommendations and asked that each be closed as implemented. The inspector general kept them open and resolved at issuance pending documents and further action ⁵.

Parliament

This page found no congressional committee report or hearing record tied to OIG-20-71 or GAO-20-568 in the sources reviewed. No public record found as of 19 October 2026 for a congressional action that followed these specific reports ^4,5.

Follow-up audits and recommendations

GAO-17-170 said DHS concurred with and addressed two recommendations from GAO's 2013 work, on milestones for a biometric air exit evaluation framework and on documenting the reliability of overstay data ¹.

Across the reports reviewed here, auditors made 13 recommendations to DHS and CBP: five in OIG-18-80, five in GAO-20-568 and three in OIG-20-71 ^2,45. Four of the GAO-20-568 recommendations are recorded as implemented and one as closed without implementation ⁴. Oversight.gov listed all three OIG-20-71 recommendations as open when checked on 19 October 2026 ⁶. The Oversight.gov entry for OIG-18-80 lists five recommendations but shows no status for each, and their current status was not confirmed as of 19 October 2026 ³.

The dates differ between sources. The OIG-18-80 report is dated 21 September 2018, and Oversight.gov gives an issue date of 19 September 2018 ^2,3. The OIG-20-71 report is dated 21 September 2020, and Oversight.gov gives an issue date of 23 September 2020 ^5,6.

Courts, tribunals and investigations

OIG-20-71, Review of CBP's Major Cybersecurity Incident During a 2019 Biometric Pilot, examined the Vehicle Face System pilot at the Anzalduas, Texas port of entry. It found subcontractor Perceptics, LLC copied CBP biometric data, including traveler images, to its own network without CBP's authorization. Perceptics accessed images on work order dates of 31 August 2018, 2 November 2018 and 31 January 2019, and its network was hit by ransomware before 13 May 2019. CBP learned of the breach on 24 May 2019 ⁵.

CBP first estimated about 184,000 traveler images were compromised and later revised that to about 100,000 unique images. At least 19 images were posted on the dark web. The inspector general found CBP "did not adequately safeguard sensitive data on an unencrypted device" and said the subcontractor broke numerous DHS security and privacy protocols ^5,7.

CBP cancelled Perceptics staff access to CBP systems, required prime contractor Unisys to end its subcontract and in June 2019 temporarily suspended Perceptics from federal contracts, grants and assistance. The suspension was lifted on 26 September 2019 after CBP and Perceptics signed an administrative compliance agreement. By the end of the fieldwork Perceptics was no longer working with CBP ⁵.

No public record of a court case or criminal charge arising from the 2019 breach was found as of 19 October 2026.

Where it stands now

DHS published a final rule on 27 October 2025, effective 26 December 2025, that lets DHS require all noncitizens, of any age, to be photographed on entry and exit. It removes the earlier pilot limits and the cap of 15 air or sea ports ⁸.

The rule says facial comparison is fully in place for entry at commercial airports, seaports and pedestrian land crossings. It says exit in the air environment runs mainly through airline partnerships at select locations, and CBP estimates full entry and exit at all commercial airports and seaports within three to five years ⁸.

Timeline