DHS watchdog says a TSA vendor could pull ID images

The finding in the highlights

Department of Homeland Security Inspector General report OIG-26-27 is dated September 15, 2026. The highlights say TSA's routine deletion of CAT-2 images met federal requirements. They also say the significant weakness is elsewhere: the vendor for that system could access and extract driver's license and passport images while doing troubleshooting and enhancements, and TSA did not know. The privacy desk is Asked directly, When was the report dated, and when did EFF write? The highlights PDF is September 15, 2026, report OIG-26-27. Biometric Update wrote on September 18. EFF wrote on October 14, which is how the finding reached this week's privacy wire.Privacy.

What TSA did not have

The report says TSA lacked policies covering that vendor access, logs of the extractions, a check that the extracted copies were deleted, and notice to the passengers whose documents were involved. A deletion job that meets the rule for the ordinary path does not answer an extraction the agency did not see. A key that stays with the holder is the standing question, and here the images did not. That brief is The document named in the sources is the record this page will keep.the key stays with the holder.

Classified tests stay classified

The highlights say covert-test details are classified. EFF's October 14 article discusses the public privacy findings and does not become a vehicle for those details on this page. Biometric Update's September 18 piece is the earlier news account of the same oversight gap. Three documents, no test method. The paper is Asked directly, What could the vendor do? Access and extract driver's license and passport images during troubleshooting and enhancements, without TSA's knowledge. The report says TSA lacked policies for that access, logs of extraction, verification of deletion, and notice to passengers.Futureweb.

The three recommendations

TSA concurred with the three privacy recommendations. The highlights and EFF describe two as open and resolved and one as open and unresolved. Concurrence is agreement to act. Open means the action is not finished. Resolved, in that pairing, is the watchdog's word for progress on two of them, not a statement that the images are back under a policy that already existed. Security is The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.Security.

Why it is on the privacy wire now

The report is six weeks old. EFF published on October 14, and that post is what the privacy wire carried. The finding did not start on October 14. The public argument about it did, for this paper's sources. A September report and an October essay can be cited together if the dates stay attached. Software is Asked directly, What is left out on purpose? Covert-test details. The report treats them as classified. EFF's October 14 account of the public findings is the wire story. This page does not describe the tests.Software.

License and passport, not a face template in this sentence

The images the highlights name are driver's license and passport images. EFF's headline discusses passenger facial safeguards. This page will use the report's nouns for what was extracted and EFF's essay as the account that brought the report to a general reader. It will not widen license and passport into a biometric system the highlights did not describe in the sentences used here. Hardware is The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.Hardware.

Who is in scope

Travelers whose identity documents were available to the CAT-2 vendor during support work are the people the finding is about. The report does not, in the highlights this page is using, print a count of images extracted. Absence of a count is not a finding that the number was small. It is a limit of this brief. Open source is Asked directly, What did TSA do with the recommendations? TSA concurred with the three privacy recommendations. EFF and the highlights describe two as open and resolved, and one as open and unresolved.Open Source.

What the vendor's role was

Troubleshooting and enhancements are the activities the report names. They are ordinary words for a support contract. The failure is that those activities included extraction TSA did not know about, not that a vendor existed. A contract without a log is the gap. Energy is Asked directly, What did routine deletion get right, on the report? The highlights say routine CAT-2 deletion met federal requirements. The weakness is not that the ordinary delete job failed. It is that a vendor could still pull images outside that routine.Energy.

What would close the unresolved item

A later OIG note that marks the third recommendation resolved, with a policy, a log, a deletion check, and a notice that match the finding. EFF's essay cannot close it. Neither can this page. Mobile is The short answer this page will stand on is this: Routine deletion met federal requirements. The significant weakness is that the CAT-2 vendor could access and extract driver's license and passport images during troubleshooting and enhancements without TSA knowing. TSA lacked policies, extraction logs, deletion checks, and passenger notice. Covert-test details are classified and are not in this brief.Mobile.