[Senate Report 115-413] [From the U.S. Government Publishing Office] Calendar No. 717 115th Congress } { Report SENATE 2d Session } { 115-413 _______________________________________________________________________ OFFICE OF BIOMETRIC IDENTITY MANAGEMENT AUTHORIZATION ACT OF 2018 __________ R E P O R T of the COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS UNITED STATES SENATE to accompany H.R. 5206 TO AMEND THE HOMELAND SECURITY ACT OF 2002 TO ESTABLISH THE OFFICE OF BIOMETRIC IDENTITY MANAGEMENT, AND FOR OTHER PURPOSES [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT] December 4, 2018.--Ordered to be printed ______ U.S. GOVERNMENT PUBLISHING OFFICE 89-010 WASHINGTON : 2018 COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS RON JOHNSON, Wisconsin, Chairman ROB PORTMAN, Ohio CLAIRE McCASKILL, Missouri RAND PAUL, Kentucky THOMAS R. CARPER, Delaware JAMES LANKFORD, Oklahoma HEIDI HEITKAMP, North Dakota MICHAEL B. ENZI, Wyoming GARY C. PETERS, Michigan JOHN HOEVEN, North Dakota MAGGIE HASSAN, New Hampshire STEVE DAINES, Montana KAMALA D. HARRIS, California JON KYL, Arizona DOUG JONES, Alabama Christopher R. Hixon, Staff Director Gabrielle D'Adamo Singer, Chief Counsel Christopher S. Boness, Professional Staff Member Margaret E. Daum, Minority Staff Director Charles A. Moskowitz, Minority Senior Legislative Counsel Subhasri Ramanathan, Minority Counsel Laura W. Kilbride, Chief Clerk Calendar No. 717 115th Congress } { Report SENATE 2d Session } { 115-413 ====================================================================== OFFICE OF BIOMETRIC IDENTITY MANAGEMENT AUTHORIZATION ACT OF 2018 _______ December 4, 2018.--Ordered to be printed _______ Mr. Johnson, from the Committee on Homeland Security and Governmental Affairs, submitted the following R E P O R T [To accompany H.R. 5206] [Including cost estimate of the Congressional Budget Office] The Committee on Homeland Security and Governmental Affairs, to which was referred the bill (H.R. 5206) to amend the Homeland Security Act of 2002 to establish the Office of Biometric Identity Management, and for other purposes, having considered the same, reports favorably thereon with amendments and recommends that the bill, as amended, do pass. CONTENTS Page I. Purpose and Summary..............................................1 II. Background and Need for the Legislation..........................2 III. Legislative History..............................................3 IV. Section-by-Section Analysis......................................4 V. Evaluation of Regulatory Impact..................................4 VI. Congressional Budget Office Cost Estimate........................5 VII. Changes in Existing Law Made by the Act, as Reported.............5 I. Purpose and Summary H.R. 5206, the Office of Biometric Identity Management Authorization Act of 2018, codifies the Office of Biometric Identity Management (OBIM) and moves the office to the Management Directorate of the Department of Homeland Security (DHS or the Department). Additionally, the Act defines the qualifications and duties of the Director and Deputy Director of the office. II. Background and the Need for Legislation The National Commission on Terrorist Attacks upon the United States, better known as the 9/11 Commission, recommended that DHS swiftly establish a biometric entry-exit screening system for travelers coming in and out of the United States.\1\ In response to this recommendation, Congress required the Secretary for Homeland Security to develop a plan to ``accelerate the full implementation of an automated biometric entry and exit data system.''\2\ In 2004 DHS began collected biometric entry data through their United States Visitor and Immigration Status Indicator Technology (US-VISIT) program.\3\ However, DHS has yet to implement a full biometric entry-exit screening system for travelers.\4\ --------------------------------------------------------------------------- \1\Nat'l Comm'n on Terrorist Attacks upon the United States, The 9/ 11 Commission Report, 389 (2004), available at https://www.9- 11commission.gov/report/911Report.pdf. \2\8 U.S.C. 1365b Sec. 7208 et seq. (Pub. L. 108-458). \3\Gov't Accountability Office, GAO-17-170, DHS Has Made Progress in Planning for a Biometric Air Exit System and Reporting Overstays, but Challenges Remain 3 (2017), available at https://www.gao.gov/ assets/690/683690.pdf. \4\Id. --------------------------------------------------------------------------- The Department created OBIM in March 2013 to replace the US-VISIT program.\5\ The biometric identification program was moved from U.S. Customs and Border Protection (CBP) to an office within the National Protection and Programs Directorate (NPPD).\6\ --------------------------------------------------------------------------- \5\Office of Biometric Identity Mgmt., Dep't of Homeland Sec. (Feb. 20, 2018), available at https://www.dhs.gov/obim. \6\Consolidated and Further Continuing Appropriations Act, 2013, Pub. L. 113-6, Sec. 127 Stat. 356 (2013). --------------------------------------------------------------------------- OBIM's stated mission is to ``provide the Department of Homeland Security and its mission partners with biometric identity services that enable national security and public safety decision making,'' and currently has the largest database of fingerprints within the Federal Government.\7\\8\ Biometric data, such as fingerprints, facial recognition, and other unique identifiers, is used to verify the identity of U.S. persons and non-citizens. Agencies within DHS, like CBP and U.S. Citizenship and Immigration Services, use biometric data to check identities against watch lists and ensure the validity of documents when presented to Federal officers.\9\ OBIM also provides biometric services to and shares information with other Federal agencies as well as state and local governments.\10\ --------------------------------------------------------------------------- \7\Office of Biometric Identity Mgmt., Dep't of Homeland Sec., supra note 5. \8\Biometrics, Dep't of Homeland Sec. (Feb. 6, 2017), available at https://www.dhs.gov/ biometrics. \9\Office of Biometric Identity Mgmt. Identification Servs., Dep't of Homeland Sec. (Feb. 10, 2016), available at https://www.dhs.gov/ obim-biometric-identification-services. \10\Office of Biometric Identity Mgmt., Dep't of Homeland Sec., supra note 5. --------------------------------------------------------------------------- In 2016, CBP took the first steps to implement biometric exit at select airports in the United States.\11\ Photographs of departing travelers on international flights will be captured as biometric data that validates exit from the U.S.\12\ CBP also launched a pilot that includes facial recognition biometric technology at airports.\13\ The pilot includes a number of privacy provisions so that the program adheres to current privacy laws and regulations.\14\ Additionally, no new biometric information is collected--the facial recognition images are matched against existing data, and CBP deletes facial images within hours.\15\ --------------------------------------------------------------------------- \11\Biometric Air Exit, U.S. Customs & Border Protection, Dep't of Homeland Sec. (January 4, 2018), available at https://www.cbp.gov/ travel/biometrics/air-exit. \12\Id. \13\Id. \14\Id. \15\Id. --------------------------------------------------------------------------- On April 28, 2015, the Committee held a roundtable to examine DHS' efforts to implement a full biometric entry and exit system.\16\ Officials from DHS' Science and Technology Directorate, CBP, and Office of Policy, as well as a former counsel to the 9/11 Commission and the American Association of Airport Executives testified on the benefits, challenges, and implications of a full biometric entry and exit system.\17\ In her testimony, Janice Kephart, former counsel for the 9/11 Commission, stated, ``Tracking the arrival and departure of foreign visitors to the United States is an essential part of immigration control, law enforcement and national security.''\18\ --------------------------------------------------------------------------- \16\Securing the Border: Biometric Entry and Exit at our Ports of Entry: Roundtable Before the S. Comm. on Homeland Sec. & Governmental Affairs, 114th Cong. (2015). \17\Id. \18\Id. (testimony of Janice Kephart, former Counsel to the National Commission on Terrorist Attacks Upon the United States). --------------------------------------------------------------------------- This Act transfers OBIM from NPPD to the DHS Management Directorate. NPPD's mission is focused on the cybersecurity and physical security of the nation's critical infrastructure systems including election systems, government buildings, and other sectors.\19\ OBIM's mission is not appropriately aligned within NPPD's mission. On November 16, 2018, the President signed the Cybersecurity and Infrastructure Security Agency Act of 2018, an Act to reform NPPD and rename it the Cybersecurity and Infrastructure Security Agency (CISA).\20\ That legislation realigned CISA to focus squarely on cybersecurity and critical infrastructure protection. It also contains a provision to move OBIM out of NPPD and into the Management Directorate. --------------------------------------------------------------------------- \19\National Protection and Programs Directorate, Dep't of Homeland Sec. (July 14, 2017), available at https://www.dhs.gov/national- protection-and-programs-directorate. \20\Pub. L. No. 115-278 (2018). --------------------------------------------------------------------------- Additionally, a 2018 DHS Office of Inspector General report highlighted concerns that DHS components, such as the Transportation Security Administration and CBP, are not properly coordinating or sharing their biometric data.\21\ Moving OBIM to the Management Directorate, as a direct report to the Secretary for Homeland Security, allows DHS to better integrate biometric systems and share information across DHS and the entire Federal Government. The purpose of the Management Directorate is to facilitate communication and clearly define responsibilities so that DHS components and offices are effective and efficient.\22\ The Act codifies OBIM for the first time, placing it within the Management Directorate, specifies the qualifications and duties of the Director of the office, and establishes a Deputy Director. --------------------------------------------------------------------------- \21\Dep't of Homeland Sec., Office of Inspector General, Progress Made, but CBP Faces Challenges Implementing a Biometric Capability to Track Air Passenger Departures Nationwide (OIG-18-80) (Sept. 21, 2018), available at https://www.oig.dhs.gov/sites/default/files/assets/2018- 09/OIG-18-80-Sep18.pdf. \22\Management Directorate, Dep't of Homeland Sec. (July 10, 2018), available at https://www.dhs.gov/directorate-management. --------------------------------------------------------------------------- III. Legislative History Representative Martha McSally (R-AZ-2), along with Representatives Don Bacon (R-NE-2), Mike Gallagher (R-WI-8), Clay Higgins (R-LA-3), and Michael McCaul (R-TX-10), introduced H.R. 5206 on March 7, 2018. The bill was referred to the House Committee on Homeland Security. Representative John Katko (R- NY-24) joined as a cosponsor on March 8, 2018. The House Committee on Homeland Security considered H.R. 5206 at a business meeting on June 6, 2018. The House of Representatives passed H.R. 5206 under suspension of the rules by voice vote on June 25, 2018. The Act was received in the Senate and referred to the Committee on Homeland Security and Governmental Affairs on June 26, 2018. The Committee considered H.R. 5206 at a business meeting on September 26, 2018. During the business meeting, Senator Kamala Harris offered an amendment to require the OBIM Director to consult with DHS's Office of Civil Rights and Civil Liberties. The amendment and the Act as amended were agreed to by a voice vote en bloc. Senators Johnson, Portman, Lankford, Enzi, Hoeven, McCaskill, Carper, Heitkamp, Peters, Hassan, Harris, and Jones were present for both votes. Consistent with Committee Rule 11, the Committee reports the Act with a technical amendment by mutual agreement of the Chairman and Ranking Member. IV. Section-by-Section Analysis of the Act, as Reported Section 1. Short title This section establishes the short title of the Act as the ``Office of Biometric Identity Management Authorization Act of 2018'' or the ``OBIM Authorization Act of 2018''. Section 2. Establishment of the Office of Biometric Identity Management This section establishes the Office of Biometric Identity Management. This section moves OBIM from NPPD to the Management Directorate. It also identifies the qualifications and duties that the Director of OBIM shall perform and allows the Director to create offices within OBIM with a notification to Congress within 30 days. This section also establishes a Deputy Director of OBIM. V. Evaluation of Regulatory Impact Pursuant to the requirements of paragraph 11(b) of rule XXVI of the Standing Rules of the Senate, the Committee has considered the regulatory impact of this Act and determined that the Act will have no regulatory impact within the meaning of the rules. The Committee agrees with the Congressional Budget Office's statement that the Act contains no intergovernmental or private-sector mandates as defined in the Unfunded Mandates Reform Act (UMRA) and would impose no costs on state, local, or tribal governments. VI. Congressional Budget Office Cost Estimate U.S. Congress, Congressional Budget Office, Washington, DC, October 3, 2018. Hon. Ron Johnson, Chairman, Committee on Homeland Security and Governmental Affairs, U.S. Senate, Washington, DC. Dear Mr. Chairman: The Congressional Budget Office has prepared the enclosed cost estimate for Department of Homeland Security legislation ordered reported by the Committee on Homeland Security and Governmental Affairs on September 26, 2018. If you wish further details on this estimate, we will be pleased to provide them. The CBO staff contact is Mark Grabowicz. Sincerely, Keith Hall, Director. Enclosure. Department of Homeland Security Legislation On September 26, the Senate Committee on Homeland Security and Governmental Affairs ordered two pieces of legislation to be reported:H.R. 5206, the Office of Biometric Identity Management Authorization Act of 2018; and H.R. 6439, the Biometric Identification Transnational Migration Alert Program Authorization Act of 2018. Each act would mostly codify a current program in the Department of Homeland Security (DHS). CBO estimates that enacting the legislation would not significantly affect spending by DHS. Enacting the legislation would not affect direct spending or revenues; therefore, pay-as-you-go procedures do not apply. CBO estimates that enacting the legislation would not increase net direct spending or on-budget deficits in any of the four consecutive 10-year periods beginning in 2029. Neither act contains intergovernmental or private-sector mandates as defined in the Unfunded Mandates Reform Act. On June 28, 2018, CBO transmitted a cost estimate for H.R. 5206 as reported by the House Committee on Homeland Security on June 21, 2018. On August 6, 2018, CBO transmitted a cost estimate for H.R. 6439 as ordered reported by the House Committee on Homeland Security on July 24, 2018. CBO's estimates of the two versions for each piece of legislation are the same. The CBO staff contact for this estimate is Mark Grabowicz. The estimate was reviewed by H. Samuel Papenfuss, Deputy Assistant Director for Budget Analysis. VII. Changes in Existing Law Made by the Act, as Reported In compliance with paragraph 12 of rule XXVI of the Standing Rules of the Senate, changes in existing law made by the Act, as reported, are shown as follows: (existing law proposed to be omitted is enclosed in brackets, new matter is printed in italic, and existing law in which no change is proposed is shown in roman): HOMELAND SECURITY ACT OF 2002 * * * * * * * SEC. 1. SHORT TITLE; TABLE OF CONTENTS. (a) Short Title.--This Act may be cited as the ``Homeland Security Act of 2002.'' (b) Table of Contents.--The table of contents for this Act is as follows: Sec. 1. * * * * * * * * * * TITLE VII--MANAGEMENT * * * * * * * Sec. 710. Office of Biometric Identity Management. * * * * * * * TITLE VII--MANAGEMENT * * * * * * * SEC. 710. OFFICE OF BIOMETRIC IDENTITY MANAGEMENT. (a) Establishment.--The Office of Biometric Identity management is established within the Management Directorate of the Department. (b) Director.-- (1) In general.--The Office of Biometric Identity Management shall be administered by the Director of the Office of Biometric Identity Management (in this section referred to as the ``Director'') who shall report to the Secretary, or to another official of the Department, as the Secretary may direct. (2) Qualifications and duties.--The Director shall-- (A) have significant professional management experience, as well as experience in the field of biometrics and identity management; (B) lead the Department's biometric identity services to support anti-terrorism, counterterrorism, border security, credentialing, national security, and public safety; (C) enable operational missions across the Department by receiving, matching, storing, sharing, and analyzing biometric and associated biographic and encounter data; (D) deliver biometric identity information and analysis capabilities to-- (i) the Department and its components; (ii) appropriate Federal, State, local, and tribal agencies; (iii) appropriate foreign governments; and (iv) appropriate private sector entities; (E) support the law enforcement, public safety, national security, and homeland security missions of other Federal, State, local, and tribal agencies, as appropriate; (F) manage the operation of the Department's primary biometric repository and identification system; (G) manage Biometric Support Centers to provide biometric identification and verification analysis and services to the Department, appropriate Federal, State, local, and tribal agencies, appropriate foreign governments, and appropriate private sector entities; (H) oversee the implementation of Department- wide standards for biometric conformity, and work to make such standards Government-wide; (I) in coordination with the Department's Office of Strategy, Policy, and Plans, and in consultation with relevant component offices and headquarters offices, enter into data sharing agreements with appropriate Federal, State, local, and foreign agencies to support immigration, law enforcement, national security, and public safety missions; (J) maximize interoperability with other Federal, State, local, and foreign biometric systems, as appropriate; (K) ensure the activities of the Office of Biometric Identity Management are carried out in compliance with the policies and procedures established by the Privacy Officer appointed under section 222; (L) consult with the Office for Civil Rights and Civil Liberties of the Department about biometric technologies that may result in disparities in the treatment of individuals on the basis of their race or ethnicity; and (M) carry out other duties and powers prescribed by law or delegated by the Secretary. (c) Deputy Director.--There shall be in the Office of Biometric Identity Management a Deputy Director, who shall assist the Director in the management of the Office. (d) Other Authorities.-- (1) In general.--The Director may establish such other offices within the Office of Biometric Identity Management as the Director determines necessary to carry out the missions, duties, functions, and authorities of the Office. (2) Notification.--If the Director exercises the authority provided by paragraph (1), the Director shall notify the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate not later than 30 days before exercising such authority. [all]