Biometric facial recognition, now in use at nine US international airports, has been met with cooperation from airlines and barely a whisper of protest from US travelers.

Not having to fish around one’s bags to produce a passport is a compelling idea for some travelers.

But a new report from the Center on Privacy and Technology at the Georgetown University Law Center in Washington says the US Customs and Border Protection’s (CBP) biometric exit program is “on shaky legal ground” and is fraught with threats to personal privacy.

The program uses biometric facial scanners, which compares captured images to photos in the US passport database.

The CBP, part of the Department of Homeland Security (DHS), has openly stated that it is looking to expand the program to the scanning of every traveler leaving the US and although the scanners are already being used on US citizens, the CBP lacks the statutory authority to do so.

The Georgetown report also says that the DHS is “failing to comply with a federal law requiring it to conduct a rule-making process to implement the airport face scanning program — a process that DHS has not even started.”

Two US senators — Edward Markey (D-Mass.) and Mike Lee (R-Utah) have asked for a halt to the program’s expansion.

In a letter to Homeland Security Secretary Kirstjen Nielson, the senators say that Congress has repeatedly voted to authorize biometric entry-exit scanning of foreign nationals, but it has never authorized its use on US citizens. They say:

“In fact, Congress has pointedly neglected to authorize DHS to use the program on US citizens for any purpose.”

The senators ask the DHS to explain why it is using the technology on US citizens at the international airports in Atlanta, Boston, Chicago, Las Vegas, Miami, New York, Houston and Washington without Congressional approval.

They also ask the DHS to address several of their privacy concerns about the program.

The Georgetown Center’s report states that current flaws in the facial recognition technology will result in a false denial for one in every 25 travelers. Those false denials appear to be weighted by the subjects’ race or gender.

In their letter to Secretary Nielson, the senators request a copy of whatever is read or provided to travelers to ensure that they are informed that US citizens have the right to opt out of facial scanning.

The American Civil Liberties Union has taken the issue a step further, calling upon the airlines to decline to participate in the program until privacy concerns are satisfied.

In an article published last August, ACLU legislative counsel Neema Singh Guliani and senior policy analyst Jay Stanley noted that when JetBlue announced its facial scanning test at Boston, it “cast the face recognition system as a matter of passenger convenience, with little mention of the program’s role in CBP’s larger biometric tracking vision.” The convenience comes in the form of not having to produce passports or other documents, assuming the system clears the passenger.

Delta Air Lines said its test of biometric facial scanning at baggage drops is a “natural next step” in streamlining airport processes, adding that it “is always willing to partner with the CBP.”

The senators, the Georgetown Center and the ACLU have also challenged the DHS’s purported justification for its biometric exit program: to detect and prevent visa overstay travel fraud.

The fraud is committed when an imposter uses someone else’s boarding pass to leave the country so that it appears the visa violator has honored its terms.

The report describes the program as “a solution in search of a problem.” The DHS has “never studied whether there is a problem that necessitates a change in its approach to tracking travelers’ departures.”

The department’s claims that the program will reduce visa overstay fraud are at best based on scanty anecdotal evidence, the report says.

Its conclusion was blunt.

“DHS should not be scanning the faces of Americans as they depart on international flights — but DHS is doing it anyway,” it states.

Jennifer Gabris of the Office of Public Affairs at US Customs and Border Protection says any US citizen who is concerned about participating in the current “technical demonstrations” of biometric technology need only let a CBP officer or airline gate agent know.

The traveler’s documents will be reviewed to ensure he or she is the true bearer of the passport that is being presented, Gabris says.

Travelers are not prevented from boarding as a result of facial recognition mismatch for purposes of these technical demonstrations, she says.

Gabris adds:

“If it is determined that US citizens are to be the subject of mandatory biometric collection as part of the biometric entry-exit system required by statute, CBP will publish the required documentation establishing such mandatory collection under the appropriate authorities, as well as additional privacy documentation.”