DHS watchdog finds TSA lacked oversight of vendor access to passenger ID images

A DHS Inspector General audit found that a TSA CAT-2 biometric system contractor could extract passenger driver's license and passport images while servicing equipment without the agency's knowledge. TSA did not track such extractions and could not confirm data deletion; recommendations to strengthen controls were accepted, but one remains unresolved.

• CAT-2 contractor could copy passenger document photos during repairs and updates
• TSA did not log extractions and did not verify data deletion
• By April 2025, over 2,100 CAT-2 units deployed in 250+ airports
• TSA requested $41 million for CAT in the 2027 budget to accelerate deployment