Airport Biometrics: A Primer (2021)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

181   Case Study: The Seamless Passenger Journey at London Heathrow Summary The vision for a seamless passenger journey consists of the deployment of biometrically enabled touchpoints equipped with cameras on a pole and at check-in kiosks, self-service bag drops, ticket presentation gates, and self-boarding gates. This initiative targets both international and domestic customers and encompasses all terminals of the airport, with an initial focus on Terminal 5 (T5) and Terminal 2 (T2). At a later stage, other processing points will be added, such as for immigration and security screening and the ability to enroll and check in using a mobile app. Another parallel initiative consists of biometrically enabled preclearance of passengers traveling from the UK to the United States on selected flights. On arrival at the first touchpoint, the departing passenger consents to the digital process, scans his/her boarding pass, and captures a photo of his/her face (i.e., takes an on-the-day image). The automated passenger identification involves matching this on-the-day image with the image stored in the passenger’s e-passport chip. If there is a positive match, the passenger’s ID is verified. Biometric matching and boarding-pass scanning will be used at subsequent touchpoints to recognize the passenger throughout the remaining journey. For a passenger traveling to the United States, the process also involves matching the on- the-day image against the CBP’s TVS. For the validation to work, it is a prerequisite that the passenger had previously visited the country or that his/her photo was otherwise accessible from a U.S. government database such as for a visa application (Heathrow 2020b). At the heart of the process is the Passenger Authentication Scanning System (PASS2), which was developed by Atkins on behalf of LHR and manages passenger identity throughout the airport. The system incorporates Atkins’ ID management platform (IMP) and is augmented for various tests and trials of different technologies, including those from Yoti, ICM, CEIA, Dorma Kaba, Rockwell Collins, and Aurora AI (Stewart 2019a). Passengers’ biometric data are stored and retained on a per-trip basis and will be cleared at the end of the operational day or after 24 hours (World Travel and Tourism Council 2019) [and within 30 days during the live trials, about which passengers were notified (Heathrow 2020a)]. LHR only keeps anonymized transaction data to monitor and improve the biometric technology. Due to privacy issues and the risk of data breach, LHR prefers not to hold passengers’ biographic data in its IMP and is testing a third-party provider for the verification function. Booking details are not stored either since the passenger is still required to scan a boarding pass. The main benefits are an enhanced experience with faster processing and reduced queuing times for passengers, which allows the airport and airlines to save and optimize their resources and minimize costly terminal expansions. From a government perspective, the automated process is much more accurate, and thus more secured, than manual ID verification. A P P E N D I X G

182 Airport Biometrics: A Primer Key Facts Table G-1 summaries the key aspects of the seamless passenger journey at LHR. Introduction LHR has been using facial biometrics for the departing journey for more than 10 years (Wilcox 2019b), with the original system designed to capture the domestic passengers’ faces at ticket presentation gates and later at boarding gates. This was primarily set up to allow inter- national and domestic passengers to mix in the combined departure lounge, while ensuring that they would board the correct flights. What? ● The seamless passenger journey ● Facial recognition ● 1:1 and 1:few biometric matching Where? ● LHR Passenger process steps ● All the processing points were tested in the lab or with live trials, but full deployment will happen either in the short term (a date has not been set yet due to COVID-19) or at a later stage. ● Online and off-airport check-in (at a later stage) ● Self-service kiosk and self-service bag drop (in the short term) ● Improved security (risk-based; at a later stage) ● Ticket presentation gate (in the short term) ● Security risk-based screening (at a later stage) ● Self-boarding gates (in the short term) ● Border (at a later stage) ● U.S. bound flights: cross-validation with CBP’s TVS (live on some flights and planned for the remaining flights in the short term) ● Cross-border with transit and destination airports (at a later stage) Who? ● LHR was set to launch its first end-to-end biometric deployment in the summer of 2019, bringing facial recognition to the key processing points of the departing passenger’s journey. Atkins’ PASS2 system, which incorporates Atkins’ IMP and various technologies, including those provided by Yoti, ICM, CEIA, Dorma Kaba, Rockwell Collins, and Aurora, were tested. Why? ● The £50 million project is part of a wider program of investments to increase the speed, efficiency, and security of passengers’ journeys, reduce congestion in LHR’s terminals, and increase capacity in the existing facilities, thus postponing costly expansions (Heathrow 2018). Biometrics on the outbound passenger journey were first implemented at T5 to enable the terminal to co-locate domestic and international passengers. A face capture of the domestic passenger is performed at the ticket presentation gates when the passenger presents his/her boarding pass and then again at the boarding gates. This ensures that domestic passengers would not board an international flight and that international passengers would not board a domestic flight. The program was then extended to T2. After extensive testing, the program was ready for full deployment to include all passengers and additional touchpoints. How? ● At the time of writing, manual authentication meant passengers needed to present IDs and travel documents such as boarding passes and passports many times throughout the outbound journey to show that they were authorized to fly. By offering passengers the option to use facial-recognition technology, the process becomes more streamlined and faster. Table G-1. Key facts of case study on the seamless passenger journey.

Case Study: The Seamless Passenger Journey at London Heathrow 183   Verification of identity how? ● Identity verification involves matching an on-the-day image taken of the passenger at one of the biometrically enabled self-service touchpoints to the image recorded on the passport’s chip. A single PDE is created and stored in the local IMP. Biometric matching will then be used at subsequent touchpoints to prove it is still the same passenger without the requirement to again provide documentation (i.e., by matching subsequent scans of the passenger’s facial biometrics to those extracted from the first on-the-day image). For? ● The initiative will be extended to all domestic and international flights out of T5 (British Airways), T2, and eventually to all terminals. Enrollment/digital identity creation and verification ● In-person enrollment: The passenger can enroll at a biometrically enabled self-service check-in kiosk, at a self-service bag drop, or at the ticket presentation gate; the passenger scans his/her e-passport [the machine-readable zone (MRZ) contains the passenger’s biographic and biometric data], takes an on-the-day image that is then matched to the passport’s image, and scans or retrieves his/her travel booking; the verified biometric data are then stored in the IMP. ● Mobile enrollment (at a later stage): The passenger uses a mobile device ID verification app, provided by Yoti, to scan his/her passport’s MRZ, gaining access to the passport’s chip and biometric/biographic data. The passenger takes a selfie to authenticate the image on the passport. The verified biometric data are then stored in the IMP. This process was tested in principle, but it will be fully implemented at a later stage. ● Because of privacy issues and the risk of data breach, LHR would prefer not to hold passengers’ biographic data in its IMP; ideally, the verification function should be provided by a third party, and the only data stored in the local IMP would be the biometric data; the booking details would not be not stored either as the passenger is still asked to scan his/her boarding pass at each touchpoint. Table G-1. (Continued). In 2016, LHR developed a new business case to set out the future pathway for automation, innovation, and technology at the airport. In this process, LHR quickly realized that passenger identification was key to creating a seamless passenger journey for all customers, and the bio- metrics technology is the right one to help achieve this objective (Wilcox 2020). See Figure G-1 for an overview of the seamless journey. LHR began a 3-year program of investments to implement automated self-services and augment the existing system for passenger identification, with the aim to increase the speed, efficiency, Source: Beunardeau et al. 2019. Figure G-1. Seamless journey vision.

184 Airport Biometrics: A Primer and security of passengers’ journeys and reduce congestion inside the airport’s terminals. After a series of successful trials, LHR was set to launch its first end-to-end biometric deployment in 2019, bringing facial recognition to the key processing points of the departing passenger’s journey. The deployment was postponed due to the COVID-19 pandemic. How Does It Work? Before the Passenger Journey More than 10 years ago, biometrics were adopted as a means of passenger identification, first at T5 and then T2. Therefore, when it was decided to extend the program to additional touch- points and to all international and domestic passengers, the most cost-efficient and viable option was to augment the capability of the existing IMP, which was developed by Atkins. The platform stores the passenger’s name and biometric data captured at the first touchpoint (self-service check-in kiosk, self-service bag-drop, or ticket presentation gate) by reading the e-passport chip and taking a photo (an on-the-day image). The data stored are referred to as the PDE. The biometric data stored in the e-passport chip are compared to the on-the-day image and, if there is a positive match, the passenger’s ID is verified, and from that point onward, the on- the-day image is used to recognize the passenger throughout the remaining journey, without the need for additional paper-based identification. While it is technically feasible to store additional passenger data, such as the PNR, in the IMP to eliminate the requirement to scan the boarding pass at each touchpoint, LHR staff made the decision to not integrate this step and, therefore, to not store passenger booking details in the IMP. The thinking behind this decision was that passengers will continue to hold a boarding pass (printed or on their mobile app) for the foreseeable future, as confirmed by a passenger survey. This decision eliminated the need to integrate the IMP with the airline DCS where passenger information such as the PNR is kept, significantly simplifying the IMP capabilities and shortening the validation and matching times. The CBP TVS initiative relies on the CBP’s own capabilities to almost instantaneously validate a passenger’s identity by comparing his/her biometrics data (an on-the-day image captured at the boarding gate) against a pre-existing CBP-held database. (For the validation to work, the passenger has to be a returning passenger to the United States with his/her biometric and biographic data already captured by CBP in a previous visit, or his/her photo must otherwise be accessible from a U.S. government database such as for a visa application.) Mobile enrollment was tested to prove that the technology worked and that the IMP could support the integration with a third-party identity app. However, this mobile enrollment capa- bility had not gone live at the time of writing because LHR staff believe that airlines should integrate this capability within their own booking app and, therefore, they should take the lead in pushing this initiative forward. Considering that 60% to 70% of passengers at LHR travel for leisure, and a significant number of these passengers travel only once a year, this capability would have limited value overall. The trial was conducted in partnership with Yoti and consisted of the passenger checking in on the Yoti webpage or using a mobile app. The passenger was asked to share biometric and biographic data by having the app access the passport MRZ and by taking a photo of the day. The data were then stored in a secure Yoti-controlled database that was set up specifically for this trial. At the following processing points, the passenger’s face would be captured by the biometric-enabled touchpoint, translated into a specific readable format, and sent to Yoti’s IMP for verification of identity. Using this approach, referred to as a “self-sovereign ID management”

Case Study: The Seamless Passenger Journey at London Heathrow 185   approach, LHR IMP would not store passport details and would therefore be less exposed to privacy concerns or data breeches. The Passenger Journey At the first touchpoint (self-service kiosk, self-service bag drop, or ticket presentation gate), the passenger’s consent is given to use his/her face biometrics and biographic information; the passenger scans his/her boarding pass (printed on paper or on his/her mobile app) and his/her passport; the kiosk camera captures the passenger’s face (on-the-day image); the boarding pass is validated directly with the airline DCS; the passenger’s biometric data are accessed via the e-passport chip and verified against the on-the-day image; and if there is a match, the passenger’s face biometrics, name, flight number, and PNR information, known as PDE, are stored in the airport IMP and will be used for identification at the other biometric-enabled processing points at the airport. The process and technology are capable of handling group enrollments versus one-on-one enrollments. At other biometric-enabled processing points, the passenger is identified by a comparison between the camera capture at the processing point and the on-the-day image stored in the IMP. In case of no match or if the passenger wishes to opt out, he/she can proceed to staffed processing points. In the case of selected U.S.-bound flights and for returning passengers to the United States, the passenger scans his/her boarding pass at the boarding e-gate, the passenger’s identity is validated, and the biometric data are verified against the CBP TVS database. Retention and Storage The PDE storage and retention are per trip, and all information is deleted at the end of the operational day or after 24 hours. After that, only anonymized transaction data are retained to monitor and improve the biometric technology. During live trials, the data were kept for 30 days. System Architecture Flow Diagram The flow diagram of this case study can be found in the Seamless Passenger Journey at London Heathrow case study in Chapter 2. Stakeholders and Responsibilities Stakeholders In the early stages, airline partners (including British Airways) and suppliers (including the airport system and the hardware and IMP vendors) worked collaboratively to map the journey, define the concept of operations, and test the technology. UK government bodies were involved in different stages of the process. For example, LHR was collaborating with the UK Department for Transport to test the prospect of risk-based differentiated security. In addition, LHR worked with lawyers and the Information Commis- sioner’s Office (ICO) to look at the process from a privacy perspective. The compatibility of the PDA data format and its integration with the government database was tested in principle on both inbound and outbound processes, but no live trials were imple- mented due to the regulatory and policy changes required to make the implementation possible. As previously mentioned, the U.S. government, in particular CBP, also collaborated with LHR. To gain further stakeholders’ buy-in, demonstration days were held throughout the initiative. LHR also actively shared its experiences with other airports and aviation industry bodies, such as IATA and ACI.

186 Airport Biometrics: A Primer Responsibilities and Governance The seamless travel initiative’s governance can be summarized as follows: • Heathrow staff led the initiative and secured the necessary funding for lab testing, live trials, and any other related activities. • Several working groups and sub–working groups were established to include all stakeholders and focus on specific subject matters such as technology, processes, and regulation. This governance structure developed at the beginning of the initiative in 2016 was kept in place. Timeline and Planning The program was initiated by Heathrow staff in a series of workshops to discuss the future of automation and passenger identification and how technology and innovation could shape the passenger journey. A business case to support the initiative was developed, and the initiative was officially started in 2016. Since then, LHR has embarked on a series of lab tests and live trials, which have provided invaluable insights on each aspect of the journey, including human inter action and perception. Those tests included the following: • Testing individual and group enrollment and biometric matching at various airport touch- points, such as kiosks, bag drops, and entrance to security; • Enabling off-airport enrollment using an app; • Allowing passengers’ automated access at subsequent touchpoints once they have enrolled at the first touchpoint, thus expediting their journey; • Looking at the prospect of enabling risk-based differentiated security in collaboration with the UK government; • Testing a cross-border solution in collaboration with CBP’s TVS system (Heathrow 2020b); and • Testing a third-party provider of verification function. The approach taken by LHR was to retrofit existing or new self-service equipment with cam- eras on a pole rather than have cameras integrated in the equipment itself. This decision was made to provide a sense of consistency across the various touchpoints and the terminals so that passengers would know what to expect and where to look. Procurement and Vendor Selection By early 2019, lab tests and trials were successfully completed, vendor selections were finalized, and an initial investment of £50 million was secured. The initial phase of the rollout at T2 and T5 was planned to start in mid-2019. Once completed, this would be the largest rollout of biometric technology, with more than 5000 touchpoints. Due to the global pandemic and the drastic decrease in passenger numbers, the deployment was put temporarily on hold. Use Case Review Benefits The benefits for the various stakeholders are highlighted in the Table G-2. Responses from Passengers During the lab tests and live trials, it was shown that biometric verification without a board- ing pass was technically feasible. However, passengers’ feedback indicated that they prefer the combination of facial biometric capturing and boarding-pass scanning at different gates and

Case Study: The Seamless Passenger Journey at London Heathrow 187   touchpoints. This approach seems more natural and reassures passengers that the process is secured and that they are correctly completing the departing journey. LHR therefore assumed that the boarding pass would not be disappearing in the short to middle term. It is noteworthy that passengers’ feedback was always positive when they were asked about identity management as a means to deliver a secured and seamless journey. However, they were quite skeptical and negative when hearing the term “biometrics.” In addition, LHR established a consultation group of 3,000 people to gauge the public’s sentiment on privacy. The vast majority of the respondents said they were okay with sharing their personal data if they received transparent information on how their data would be used and if they had control over their data (who to share it with and why). System Performance and Specification Review To overcome the problem of poor ambient lighting, a decision was made early on to adopt cameras augmented with infrared technology. This technology consistently provides better quality images for matching purposes. Some of the biggest challenges had to do with additional functions having to be performed at some of the processing points, such as visa checks (when visas are not electronic) and excess baggage payments. Fall-Back Options The intention was never to completely eliminate manned positions. Therefore, in the case of no matching, lack of consent, or if the technology failed, staffed counters or roaming agents would be always available at each touchpoint. Concerns Data privacy was addressed from the beginning, and the principles of privacy by design were incorporated in the system architecture where access to data was provided only on a need-to- know and authorized-to-know basis. Stakeholder Benefits Passengers Enhanced experience with a more seamless journey Faster processing and reduced queuing times Airport Increased passenger processing throughputs postponing the need of costly capital expansion programs More efficient use of existing infrastructure Co-location of international and domestic passengers in the same departure lounge with significant increase in efficiency Government Enhanced security: ID validation is much more accurate than manual validation (almost double the matching rate) Reduced staffing costs as fewer passengers have to be manually processed Airlines The biggest beneficiaries Staff reduction or redeployment where most needed Operational improvements such as on-time performance Table G-2. Seamless journey stakeholder benefits.

188 Airport Biometrics: A Primer LHR engaged ICO to perform a full review of the seamless passenger journey initiative. Specifically, the ICO reviewed the role and the relationships between the different business partners (airport, airlines, suppliers) involved in the processing of biometric personal data, confirmed that data management met GDPR/General Data Protection Act of 2018 (DPA18) provisions, and assessed LHR’s proposed method for obtaining explicit passengers’ consent to use their biometric data in a live environment. Lessons Learned The key lesson learned was that the seamless passenger journey initiative was not about tech- nology, but rather was about human interaction with the technology. The technology exists, and lab tests proved that it worked. However, if the technology is not intuitive and user friendly, ultimately it will not serve its purpose, and this was proved over and over during live tests. Apparently simple things, such as the distance from the camera during image capture, where the passenger was looking during image capture, crowding around cameras, and tight queuing in proximity of boarding gates, would cause poor image quality and no matching. Human inter- action was carefully analyzed, and appropriate solutions were identified throughout the trials. Findings and Trends Findings Biometrics, combined with self-service processing, deliver tangible efficiencies in processing times, reduction in staffing requirements, and a significant improvement in safety and security with a much higher matching rate than that measured in manual processes. These benefits are significant when the deployment of biometrics and automation is on a large scale, as it will be in the case of LHR. Future Situation and Broader Implementation Other initiatives, such as mobile enrollment, risk-based security, and the integration of immigration in the seamless journey, are on hold as of the time of writing. The cross-border initiative (between three airports, three governments, and two airlines) was initiated by Heathrow with involvement from IATA. It is in the technical testing phase, an identity management mobile app is in the process of being developed, and the function of the third-party broker (providing a platform to verify identity, which in the case of the United States is CBP, but is different in other countries) has been discussed and could hypothetically be provided by IATA. This solution minimizes risk to airports as they will not be responsible for holding biographic passenger data. Trends Identified A self-sovereign approach is the most promising form of passenger data management. Under this model, the passenger would control what personal data he/she wants to share and with whom. This model could be applied more broadly to the entire passenger journey. The model has successfully been adopted in other industries, such as financial services, but the adoption of such a model in aviation is proving more challenging.