The end of biometric security at airports?

Media attention is shifting away from London Heathrow’s new Terminal 5. A backlog of 28,000 bags is being cleared via Milan, and the number of cancelled flights seems to be gradually coming down. But what about the biometric security controls?

As I’ve discussed before, the purpose of the fingerprint and photo system is to enable the terminal’s operators to have a common lounge for domestic and international passengers. This should reduce the requirement for lounge space in the terminal, simplify management of aircraft stands, and remove the need for a whole tier of airport staff. The security concern that arises is that of collusion between travellers to exchange documents and allow an international passenger to enter the UK without clearing immigration.

In response to a complaint to the Information Commissioner’s Office raised by Privacy International, the airport’s operator BAA switched off the fingerprint component of the security controls prior to the Terminal’s opening. Passengers are now verified using travel documents and facial images alone. BAA insists that the fingerprint scheme does not retain any personally identifiable information for more than 24 hours, and that the database is purged at midnight. In fact the facial image system is one of the systems that has worked well since T5 opened.

Despite public statements to the contrary from the Home Office, and an understandable desire by BAA to forget the whole issue, sources at BAA have insisted that the Home Office mandated the biometric security controls. If they were integrated into the e-Borders programme then this would make sense, but it seems a little odd that they’re demanding them as independent controls, unless the plan would be an integration at some point in the future (the ‘frog-boiler‘ approach to rolling out a scheme).

It seems highly likely that the fingerprinting system will not be switched on for the foreseeable future. There are sufficient teething problems with T5 without introducing another, so BAA and BA won’t want to use it. The Home Office insist they don’t need it, and if they did then we’d see it at other airports as well. That said, there are rumours that BAA does still have plans for broader use of fingerprint controls.

If BAA has any such plans then it needs to introduce greater transparency about the systems. Specifically, we need to see an independent review of the business case by the Information Commissioner’s Office; scrutiny of the technical controls by an independent expert; a public debate about the reasonableness of this approach, where BAA answers its critics’ questions, and the Home Office publicly reasserts its position; and ongoing security testing of the operational system to ensure that the data therein is suitably protected.

FOOTNOTE: One of our readers has kindly commented on the earlier article, and provided the following, which I’ve quoted in full:

I raised a few questions with BAA (before T5 opened) about the operation of

the biometric system. Below is the reply I received.

Since sending my original email, I have since had the “pleasure” of coming

back to the UK through T5. My photo was taken, but not my fingerprints.

When we boarded the UK connecting flight, I was unaware of any further

photographic check being made. As far as I could tell, boarding passes were

simply scanned as normal.

The BAA reply:

Thank you for taking the time to contact us regarding your recent visit to

Heathrow Airport. I would like to apologise for the delay in replying to

your email.

If I may explain, as part of the process of modernising Heathrow and

transforming it into a world class airport, BAA has introduced common

departure lounges for both domestic and international passengers travelling

through Terminal 1 and Terminal 5.

Traditionally, domestic passengers and international passengers have been

segregated for border control purposes. However, new technology means

passengers can enjoy the same facilities whilst still being able to

identify the status of individual passengers.

As international and domestic passengers will mix in the common lounge, we

need to capture a photo image of departing domestic passengers. Ideally

finger print data will be taken too, this personal data is encrypted

immediately and is destroyed within 24 hours of use, the data capture does

not include personal details. The photo and fingerprinting is referred to

as Biometrics. At the gate, this data is reconciled to confirm the

passengers’ identity and ensures that UK border control regulations are

met. Please be assured if you have been through the biometric process in

Terminal 1 your data has been destroyed. Thank you for pointing out the

mistake with the incorrect year for the Data Protection Act in the

biometric security leaflet. This has been amended.

As you may have seen in the media, following a meeting with all relevant

parties, including the Information Commissioner and the Border and

Immigration Agency, the introduction of fingerprinting for domestic

passengers and international passengers transferring onto domestic flights

at Heathrow has been temporarily delayed. BAA has opened Terminal 5 using

a photographic identification process only. We will be working closely

with the Information Commissioner and the Home Office over the next few

weeks to agree the best approach going forward.

Thank you again for your feedback and I do hope that any future journeys

you may choose to take through Heathrow will prove to be much more


Yours sincerely,

Christine Page

Traveller Communications

For and On Behalf of BAA Heathrow