Privacy & Civil Liberties
Powerful tools need hard limits
An app that verifies faces and records locations can be misused. ISAE must earn trust in writing before any pilot.
Current practice, and its risks
DHS’s Privacy Impact Assessment for ATD says the SmartLINK app uses one-to-one verification, deletes photos from the device, and transmits location only at check-in. It also acknowledges that ATD data may be used for other ICE purposes, that contractor records are generally kept seven years, and that some records are kept permanently. Under the current program, a failed match can trigger an alert that leads to arrest.[67] ISAE’s design removes that link.
- Function creep: check-in locations repurposed to plan operations against families and communities.
- Error and bias: NIST found demographic differences in face-recognition false-match and false-non-match rates across many algorithms.[65]
- Chilling effects on schools and health care; contractor control of sensitive data; and constitutional exposure over location data (Carpenter v. United States).[68]
- ICE has reportedly used a field face-recognition app, Mobile Fortify, to match people against government systems.[66] ISAE is deliberately different.
ISAE safeguards
Enforcement firewall
Data used only for supervision, services and the participant’s own case. Exceptions only for listed serious grounds (terrorism or national security; violent felonies causing death or serious injury; sexual offenses; human trafficking or for-profit smuggling; or a court warrant for any of these), each with a judicial warrant or court order. Every request logged and publicly counted; no bulk export.
Biometric limits
One 1:N face search at enrollment only, as a lead. Any doubt means fingerprint follow-up later, with no adverse action meanwhile and no arrests at enrollment. All later check-ins 1:1. Independent demographic testing before deployment and every year.
Location limits
Captured only at the moment of check-in. No continuous tracking or geofencing for green-tier participants; GPS monitors only on an individualized finding.
Retention
Biometric templates deleted within 90 days of program exit; location records purged on a fixed schedule; no permanent retention.
Human review
A failed check-in match is never acted on automatically: human review and an alternative check-in (a voice call or a case-worker visit) come first. Technical failure is not non-compliance.
Transparency & oversight
Plain-language notices in the participant’s language, access and correction rights, an independent ombudsman, quarterly public reporting, annual IG audits, full implementation of GAO’s ATD recommendations,[35] encryption and breach-notification duties.