You are viewing an archived webpage. The information on this page may be out of date. Learn about EPIC's recent work at epic.org.

EPIC v. DHS - Body Scanner Complaints

Top News

Background

In EPIC v. DHS, EPIC sought the release of documents regarding the procurement and use of body scanners by the Transportation Security Administration (TSA) in U.S. airports.

In February 2007, the Transportation Security Administration, a component of the US Department of Homeland Security, began testing passenger imaging technology - called “whole body imaging,” "body scanners," and "advanced imaging technology" - to screen air travelers. Body scanners produce detailed, three-dimensional images of individuals. Security experts have described whole body scanners as the equivalent of "a physically invasive strip-search." In 2007, TSA tested whole body imaging systems at airport security checkpoints, screening passengers before they board flights. The agency provided various assurances regarding its use of whole body imaging. TSA stated that whole body imaging would not be mandatory for passengers and that images produced by the machines would not be stored, transmitted, or printed. TSA also stated that an algorithm will be applied to the image to mask the face of each passenger.

But on April 27, 2007, TSA removed from its website assurances that its whole body imaging technology would “incorporate a privacy algorithm” that will “eliminate much of the detail shown in the images of the individual while still being effective from a security standpoint.” And on February 18, 2009, TSA announced that it would require passengers at six airports to submit to whole body imaging in place of the standard metal detector search, which contravenes its earlier statements that whole body imaging would not be mandatory. On April 6, 2009, TSA announced its plans to expand the mandatory use of whole body imaging to all airports.

On June 4, 2009, the U.S. House of Representatives passed HR 2200, a bill that would limit the use of whole body imaging systems in airports. The bill prevents use of whole body imaging technology for primary screening purposes. HR 2200 was referred to the Senate for consideration on June 8, 2009. The legislation was referred to the Senate Committee on Commerce, Science, and Transportation. TSA renewed its call for mandatory body scans for all air travelers in the wake of the attempted bombing of Northwest Flight 253, which traveled from Amsterdam to Detroit on December 25, 2009.

EPIC's Freedom of Information Act Requests and Subsequent Lawsuit

On April 14, 2009, EPIC filed a Freedom of Information Act (FOIA) request with the US Department of Homeland Security (DHS) for agency records that directly relate to the TSA body scanner program. EPIC requested the following agency records:

  • all documents concerning the capability of passenger imaging technology to obscure, degrade, store, transmit, reproduce, retain, or delete images of individuals;
  • all contracts that include provisions concerning the capability of passenger imaging technology to obscure, degrade, store, transmit, reproduce, retain, or delete images of individuals;
  • all instructions, policies, and/or procedures concerning the capability of passenger imaging technology to obscure, degrade, store, transmit, reproduce, retain, or delete images of individuals.

DHS acknowledged receipt of EPIC's FOIA request, but failed to disclose any documents. On November 9, 2009, EPIC sued DHS to force disclosure of the body scanner documents. The suit challenged DHS's failure to disclose public records and failure to comply with the Freedom of Information Act. On the heels of EPIC's lawsuit, DHS disclosed key documents, including technical standards, but failed to produce all records demanded in EPIC's FOIA request. The lawsuit is ongoing.

On July 2, 2009, EPIC filed a second, related FOIA request. EPIC requested the following agency documents:

  • All unfiltered or unobscured images captured using Whole Body Imaging Technology (WBI);
  • all contracts entered into by DHS pertaining to WBI systems, including contracts for hardware, software or training;
  • all documents detailing the technical specifications of WBI hardware, including any limitations on image capture, storage or copy;
  • all documents, including but not limited to presentations, images and videos used for training persons to use WBI systems;
  • all complaints related to the use of WBI and all documents related to the resolution of those complaints;
  • all documents concerning data breaches of images generated by WBI technology.

DHS acknowledged receipt of EPIC's FOIA request, but failed to disclose any documents. On January 13, 2010, EPIC sued DHS to force disclosure of the additional body scanner documents. The second suit challenged DHS's failure to disclose public records and failure to comply with the Freedom of Information Act. This suit was later consolidated with EPIC's first lawsuit against DHS.

Documents Obtained by EPIC Through Its Lawsuit

On January 11, 2010, EPIC released documents obtained from DHS as a result of EPIC's lawsuit.

The disclosed documents include TSA Procurement Specifications for body scanners, TSA Operational Requirements for the machines, a TSA contract with L3 (a company that manufactures whole body imaging devices), and 2 TSA contracts with Rapiscan, another body scanner manufacturer (1), (2).

The documents contradict numerous assurances made by the TSA regarding the body scanners. The records demonstrate:

  • The device specifications, set out by the TSA, prove the machines’ ability to store, record, and transfer images, contrary to the representations made by the TSA
  • The device specifications, set out by the TSA, include hard disk storage, USB integration, and Ethernet connectivity that raise significant privacy and security concerns
  • The DHS Privacy office failed to adequately assess the privacy impact of these devices
  • The TSA continues to withhold critical documents from the public concerning body scanners' operation.

On March 2, 2010, EPIC obtained further documents from DHS as a result of EPIC's lawsuit. These documents included more than thirty traveler complaints to the TSA regarding WBI machines. The complaints described a variety of problems with WBI machines, including objections to the invasive nature of the machines and complaints about improper signage and a lack of transparency regarding the pat-down alternative. The complaints indicated that TSA was not fulfilling its duty to inform passengers of their options regarding WBI machines.

On March 15, 2010, EPIC obtained hundreds of pages of additional traveler complaints (see below for links). This further contradicted TSA's statements that travelers approve of WBI machines and are being informed of their option for a pat-down.

On April 15, 2010, EPIC obtained several hundred more pages of documents. This included hundreds of pages of traveler complaints, an updated Procurement Specifications Document, and several vendor contracts. DHS refused to release several of EPIC's requested documents, including over 2000 WBI machine generated images.

Legal Documents

EPIC v. the Department of Homeland Security, Case No. 09-02084(RMU) (D.D.C.filed Nov. 9, 2009)

Freedom of Information Act Documents

News Items

Share this page:

Defend Privacy. Support EPIC.
US Needs a Data Protection Agency
2020 Election Security