What the audit found
On 14 October 2026, the Electronic Frontier Foundation reported on a Department of Homeland Security Inspector General audit, OIG-26-27, whose unclassified summary is dated 15 September 2026. According to EFF's account, the vendor of TSA's second-generation Credential Authentication Technology (CAT-2) could access and extract sensitive passenger data, including driver's licence and passport images, during troubleshooting and upgrades, without TSA's knowledge. TSA had no clear policy on such extractions, did not track them, could not verify that extracted data was deleted, and gave passengers no notice. The audit made three recommendations, and TSA concurred with all three.
The summary does not establish that anyone misused the data, and it does not describe a breach. That matters. The finding is about governance: the agency could not show what its contractor did with the data.
This is a US story, but it bears on India. India is expanding airport biometrics through DigiYatra, and its data protection law has a lag built into it.
The case for tighter control, stated fairly
TSA's public position is that photos are not kept after a positive ID match, except in a limited testing environment, and that travellers can decline the photo. CAT-2 units are deployed at roughly 350 airports. A critic would say the audit shows the weakness in that promise. A deletion guarantee is only as strong as the ability to verify it, and the people with the deepest system access were contractors, not the agency. That is a serious argument. Biometric identifiers cannot be reissued the way a password can, so the standard for oversight should be higher than for ordinary records.
We accept that premise. What follows from it is a narrower conclusion than the one EFF draws, because EFF opposes government facial recognition as such. The failure documented here is missing process, not the existence of the technology: no extraction policy, no log, no deletion check, no notice. Each of those can be fixed, and TSA has agreed to try.
Where India stands
India's government says DigiYatra holds no central repository of passenger data. As MediaNama reported in 2024, the Civil Aviation Ministry's position is that data is shared only between the passenger and the origin airport and purged 24 hours after departure. The same report noted that a June 2024 dispute over Hyderabad airport's gate cameras left open where facial data is stored, who can access it, and who verifies deletion. Those are the TSA audit's questions, asked of a different system. The Hyderabad episode involved conflicting accounts from an airline and an airport, and it does not show a breach.
The design choice of keeping credentials on the traveller's phone is a real strength. It reduces what any vendor can reach. But architecture is not verification. TSA also says its images are deleted, and the audit's point was that the agency could not show it.
The legal backstop is the Digital Personal Data Protection Act, 2023. As PRS Legislative Research summarises it, the penalty schedule reaches Rs 250 crore for failing to take security measures against data breaches. It also lets the Centre exempt government agencies on grounds such as state security and public order, though the data-security obligation is not among the provisions those exemptions switch off. For airports run by private operators, ordinary fiduciary duties apply.
The timing is the issue. The DPDP Rules were notified in November 2025 and phased in. According to a Legal500 analysis, the security-safeguard rule (Rule 6) and the breach-reporting rule (Rule 7) apply from about May 2027. Rule 6 requires measures such as encryption, masking or virtual tokens, access controls, and logs kept for one year. Rule 7 requires a detailed report to the Data Protection Board within 72 hours of becoming aware of a breach. Rule 6's access-log requirement is close to what the OIG found missing at TSA.
A proportionate response
India does not need a facial-recognition ban or a new statute. It needs operators to adopt the controls that Rule 6 will require, before the legal deadline and not on it. Four steps are enough:
- Vendor access logs. Every remote or on-site extraction of passenger data by a contractor should be logged and attributable.
- Verifiable deletion. Operators should be able to show, not just assert, that the 24-hour purge happened, ideally through periodic independent audit.
- Contract terms. Vendor agreements should bar extraction of production data for troubleshooting unless it is logged and time-limited.
- Published summaries. An audit like OIG-26-27 is possible because the US has an inspector general with a public mandate. India's equivalent could be a periodic public summary from the DigiYatra Foundation or the operators, even in redacted form.
These measures protect the technology's credibility, and the technology has real benefits: faster boarding and a voluntary, phone-held credential. A high-profile failure would hand opponents the argument that biometric travel should not exist at all. Proportionate rules, applied early and verifiably, are what keep that argument from winning.
Limits of this analysis
The public OIG summary is unclassified and short. We have not seen the full report, and EFF says detailed findings are classified. We also have no evidence of a comparable lapse in India. The claim here is that the US case shows a failure mode worth testing for, not that DigiYatra shares it.