The EU is about to sell our most sensitive data to the US for visa-free travel
edri.org495 points by rapnie 18 hours ago
495 points by rapnie 18 hours ago
The point missing in the article is that, in order to enter the US, one needs to give the US Govt their photo and fingerprints ("biometric data") anyway.
There are two options: visa-free with the biometric data passing on the wire (no hassle), or visa (a major hassle) and biometric data passing in the airport (a minor one).
As a side note, the EU also collects photo and fingerprints from visitors now. Whereas in the US you only need to go through fingerprinting only once (or maybe "once per passport") and only on arrival, in the EU you need to go through it both on every arrival and every departure.
What's unclear to me here is this: under this new scheme does the USA get access to the biometric data of people not travelling to the USA?
From the analysis linked in TFA:
"The automated query can be based on: * Identity information included in the application or in travel documents, such as name, date of birth, national ID number, and/or * the fingerprint of an individual."
Sounds like they could send requests to that computer system just based on publicly available information on a person like name and date of birth, even if the person never applied for a visa or tried to enter the US.
Well, a national ID number isnt usually publicly available info, even if it can be obtained by the US government through illicit means.
But yeah, it does sound that way, but certainly not clear cut to me what the situation is. I.e. does the agreement involve clauses about what to do if this is abused? Do we have a way to detect if theyre using this on non-travellers? Etc.
> a national ID number isnt usually publicly available info
A couple of counterexamples:
Italy's "fiscal code" is generated with a simple algorithm which can be executed manually:
https://en.wikipedia.org/wiki/Italian_fiscal_code
Sweden's "personal identity number" is public information and can be looked up by anyone:
https://en.wikipedia.org/wiki/Personal_identity_number_(Swed...
Belgian National Number is your birth date, then an increment from 1 to 999 for every baby born that day, then a base-97 checksum.
Not sure if still the case: odd numbers for males and even numbers for females.
This also means a person’s Belgian RRN can change.
This is the leaked draft: https://statewatch.org/wp-content/uploads/2026/05/wk_5183_20...
It's not clear how it is supposed to work in detail. But it sounds like it could be implemented in a way that makes illegitimate queries possible. It doesn't sound like they want to really ensure that you can catch those.
In multiple European countries, national ID numbers are public information that can be searched by name and address (i.e. Sweden)
I played with Estonia’s e-residency and they use asymmetric cryptography for everything so the ID is public but does nothing without the corresponding private key.
Only the people who travel to the US should be included in this farce and vice versa the other way…
This all reminds me about how RealID was vital to secure us from terrorism, and it took 20 years to get it in place... with no significant terrorist actions in that timeframe.
IMHO this level of tracking ain't worth the safety gained. Seems like safety gain is just the excuse at this point.
A national ID system (standard in effectively all European countries) is table stakes for state capacity. I find the RealID opposition baffling.
In the US, we like to reduce state capacity. Helps limit the damage bad actors can do when they are in power.
Except such a federal ID already exists: the Passport Card. Make it free to obtain and mandatory to use.
This seems deeply delusional at this point.
As delusional as thinking the 2nd amendment will help "limit the damage bad actors can do when they are in power".
And also according to the DHS is apparently now insufficient to prove citizenship to vote, i.e. goal posts moved.
Is your RealID different? I’ve had one for ages and am not a US citizen. I can’t see how it could be proof of citizenship if I, a non-citizen, has one.
Not to mention that to get around RealID with flights, you just have to pay $45 and you're good to go. Since we all know that bad actors don't have access to that sort of money...
Can you expand on this? How can you board a flight without realID for $45?
Have you been to an airport yet since it became mandatory? They actually have signs around stating it. I had similar thoughts as the GP about that.
Not for roughly the last 6 months. I have been using my passport because my old drivers license doesn't expire until next year. I'll have to look closer or read the signs then. Just never noticed that.
Edit: sorry, I misunderstood the post.
I think a better way of describing it would be, someone broke into your house. The police said they'd patrol it, but it would take 20 years to set up. In those 20 years, no-one broke into your house. You might suspect they had other reasons for wanting to patrol outside your house.
The parent post is saying that the officer didn't show up for 20 years, with no burglaries in your neighborhood in between.
Unmentioned is the effect of having officers watch your home the entire time. Which is the tradeoff not worth the hassle for everyone.
> Whereas in the US you only need to go through fingerprinting only once
Once for each arrival.
Not my experience the last time I entered. I travelled with a friend for whom it was his first time visiting the US. He was fingerprinted, I wasn’t (I was fingerprinted a while ago on one of my previous trips.)
I have gotten fingerprinted every time i arrive, before i got a green card and after i got a green card. Not sure if its related to something else, country of origin or country im traveling from etc.
Ok, it could depend on the type of visa too. I only enter for tourism (B2 I think) and have never overstayed.
Never overstaying, always fingerprinted on arrival.
Your profile probably flagged some checks so they needed to get your fingerprints to actually confirm you are the one on the visa. I've never had to give fingerprints except for my first US visa.
Same here, went in 2019, got fingerprinted, and went again in 2021 and 2025, and they didn't even care about my ESTA, they just waved me through.
The TSA agent asked me the usual questions about where I was staying, how long I was staying, I replied, and despite having printed just about everything out, he just waved me through.
The closest I got was a "random inspection" in an airport, and the TSA agents asked for our passports and to go through our luggage, but as soon as we flashed our Danish passports they lost all interest and just waved us through.
The point of taking biometics is they can check if the same person is travelling on the same passport each subsequent visit.
Sometimes they rely on just image matching, and sometimes they ask for an additional finger scan ( but not normally all fingers of all hands like first registration ).
So perhaps if you have a generic looking face, or have changed your appearance since the first visit you are more likely to be fingerprinted.
What is the point of them taking the fingerprints at all, if they don't verify them on entry?
No. I haven't had to do it in at least two years and I travel here frequently on an EU passport.
not for US citizens at least, whereas I get fingerprinted entering and exiting as an EU citizen in the EU.
That's weird. When I enter France from outside Schengen they don't fingerprint me, and I'm not even a European citizen.
Maybe not at land crossings. I just exited from Portugal and got fingerprinted on exit and entry. Granted I was using my US passport, not my EU
EU changed a lot this year (EU EES and ETIAS, long delayed), so this is probably different now than it was for some people before. It should be passport + biometric in and out, with a passport and biometric enrolled once as well, and visa-free stay duration (and other activities, like criminal stuff) logged against that record as well. Previously if you entered in one country and exited in another there wasn't really any closure of the record, so they effectively didn't care, and you could stay in EU indefinitely (and enter/exit much more while also overstaying, especially if you had multiple passports or could enter/exit from different countries).
> Granted I was using my US passport, not my EU
Then you're American as far as they're concerned. Citizenship isn't something you can tell at a glance or determine by measuring a person.
the person i'm replying to said they didn't have that experience as a non-EU citizen, whereas i did
Thats why. You don't have to go thru this extra check if you use EU passport or if you have temporary/permanent residency (but not travel visa) attached to your passport.
Also worth nothing that if you’ve verified your ID on LinkedIn or anything that uses Persona or some other flavour of Palantir - the US already has all this data and much more.
I hate all this biometric scanning on all sides. As an American it makes me not want to visit the EU to avoid being scanned, and I'd understand the other way too if an EU member was visiting the us.
In the US there have been notorious mistakes of using biometrics to falsely recognize an unknown criminal. Does this happen in the EU too?
It's probably too late but we should try to get rid of this.
> In the US there have been notorious mistakes of using biometrics to falsely recognize an unknown criminal. Does this happen in the EU too?
This my major concern with biometrics and DNA databases. It makes the cops lazy. "Subjects fingerprints and DNA was found on the crime scene, so he's clearly the murderer". That flips the evidence around, suddenly "I" have to prove I'm innocent as opposed to the law proving I'm guilty.
If you can simply collect all DNA and fingerprints from a crime scene, look it up in a database and compile a list of suspects, it also eliminates the possibility that the real perpetrator didn't leave DNA or fingerprints.
Sure, DNA has its use, like "here's the murder weapon, and it has the suspects DNA and fingerprints on it". It's not a guarantee, but it's a closer match.
As for "does that happen in Europe as well", unfortunately yes. There have been cases where the police have found fingerprints and DNA and announced they had the suspect they were looking for, only for said person to be cleared weeks or months later.
As a general rule, DNA and fingerprints cannot be the sole evidence in EU courts. The law will need find more evidence before they can convict you. Also, no death penalty, and "lifetime" in the EU is usually around 10 years, so not a lot of people are found innocent after 30 years.
I suspect that false imprisonment/recognition cases are lessened with biometrics, not increased. I absolutely believe you can point me to individual cases though.
Your DNA and fingerprints are literally everywhere you go, and they don't decay as soon as you leave. Hell, even passing close by a person can transfer your DNA to their clothes.
If the cops have a DNA Database, they "just" need to collect all DNA from a crime scene to compile a list of suspects, and by doing so, they're flipping the question of guilt around, you're no longer innocent until proven guilty, but guilty until proven innocent. You now have to prove you didn't "do it".
How could random prints be falsely linked to me if my prints are not in a database? It can only happen if they are.
You can be falsely linked to a crime without biometric evidence and excluded on the basis of biometric evidence
That can also be trivially done without a biometrics database: just collect and compare when they become a suspect!
>EU also collects photo and fingerprints from visitors now on every arrival and departure.
This world is very depressing. I think this may be my last year on the planet.
No, if you don’t change your passport you only have to scan your fingerprints once in the EU.
If you have a recent EU passport (like 6-8 years), biometrics like fingerprints are already in the chip, and you won't need to be fingerprinted upon arrival or departure, at least in theory, I wouldn't be surprised if some bureaucrat decided that the passport data can't be trusted and we'll fingerprint everybody anyway.
I have just returned from the EU last week and I have been fingerprinted twice — once on entry and once on exit.
The US passport holders get fingerprinted on entry only, as I’ve heard.
Ok, weird, I don’t know how the system works then. My wife is Colombian and on her last entry she just scanned her passport and that was it.
If you're an EU citizen, it could be that your wife has an EU residence permit. The rules for EU residents are different.
i just traveled to the EU last week and you're wrong, got fingerprinted on entrance and exit
So let the people who want to go to the US do that and don't send data from the vast majority of people who will never visit the US there. It's claimed that only data of traveler's will be retrieved by the US but it's not 2012 anymore, we all know better.
Both the USA and the EU are doing Evil here. However had, this is not solely confind to biometric data only - this is about selling data to outside agencies, so the EU betrays EU citizens here.
You don’t get fingerprints collected on departure, just on arrival. Unless you go through automated gates maybe?
Not my experience: I’ve been fingerprinted on both the arrival and the departure. There was no automatic gate on the departure, just an officer.
US passport holders only get fingerprinted on the arrival, as I’ve heard.
If the US gets the data anyway, why the need for access?
It's to validate that the fingerprints of the person arriving are the same as the fingerprints of the person who got the passport.
Which you don't need to do, because the fingerprints are in the passport (cryptographically secure so only an authorized reader can access them, and only when able to OCR the inside of the passport). They're signed by your issuing government, so they're much harder to forge than the physical document.
The fingerprints in the passport can't do that?
Most countries' passports don't include fingerprint data. The US passport application process is entirely digital/by mail, for example, with no fingerprinting at all.
EU passports do.
Not those issued in Denmark or Ireland, apparently [1], though I see other sources saying Denmark does fingerprint now. Most countries don't fingerprint children.
[1]: https://en.wikipedia.org/wiki/Passports_of_the_European_Unio...
Seems like Ireland only currently (looking at the Danish Minstry of Foreign Affairs on passports). And, yes, age threshold for kids.
new ones yes but mine is still valid for the next 2.5 years and doesn't.
When passports are valid for 10 years there is always a bit of inertia.
How do they manage that? Do you have to visit a government office to get a passport? I only have a UK passport and it definitely does not include my finger prints as it was obtained by post.
Yes.
In fact, you have to do it twice; once to apply and once to receive it.
In Poland at least, the queues are often a few weeks long, and you have to book online in advance. If it's summer season and you need to travel soon, you usually have to go to some office in Buttfuckville at the other end of the country to get a reasonable date. Passport office hunting is an established practice for people who need one ASAP.
If you're a kid, both of your parents need to be present with you at the appointment at the same time, so they have to coordinate time off work. The fun begins if they're divorced and one lives in a different country.
At least, unlike in the UK/US, the process itself is pretty painless. I got mine just after I turned 18 (see above), and all I really needed to do was to go there, bring my ID, fill a single form and give them the fingerprints.
The process in the US is you open an online form, type in your details, and upload a JPEG of your face! Then you receive a passport in the mail a few weeks later! I would say that is a lot less painful than the Polish process.
The average US border official is a (angry) moron (with a badge and a gun). They've literally fingerprinted me on entry with a US passport because they were too stupid to figure out US citizens don't have to do that. I have been interrogated by CBP to ask if I "work in the country" despite being a citizen. Anything that changes the process from the simplest one-size-fits all will be fucked up, they cannot differentiate the process between foreigner and citizen let alone EU vs some other place.
Edit: Every time I share my border stories I get accused of lying or having done something wrong. I have much much crazier ones. No one believes it until it happens to them. Count yourself lucky if you've never been strip searched or imprisoned by these psychopaths, any belief they are reasonable are formed because you were lucky and have a naïve sort of optimism that if you do everything right it won't happen to you.
The average US border official is just like the average official(and non-official) anywhere; mostly bored, waiting for their workday to be over so they can go home and do the things that they actually enjoy.
Not to say they don't make mistakes or don't fully read/understand their systems. A co-worker was former LEO, had his id stolen at that time. We were traveling back from an a vendor site across the border, the border agent misunderstood the system alert from "double check this guys docs to make sure he is who he says he is" to "Anyone using this id is traveling under a false name!" So he got held and questioned, called his former supervisor, CPB supervisor came and showed him how to get a travel redress number.
Amusingly, since we were traveling together, I got his luggage off the carousel and kept it with me as I watched them question him. After some time they decided to look at his bags and came looking for them, I told them I had them and he was with me. They took the bags and didn't even want to speak with me.
>The average US border official is just like the average official(and non-official) anywhere;
False. CBP is well known as bottom rung in terms of hiring of federal LEO and an employer of last resorts. For example, one of the most prestigious is the Marshals Service, and for instance HSI is typically far closer to "average" or above than CBP is. If you're dealing with something like a DEA or FBI agent that is roughly 'average' and CBP you are roughly dealing with the 'moron' end and roughly the professional and intelligence opposite of the Marshals.
> because they were too stupid to figure out US citizens don't have to do that
This seems extremely unlikely to me. Did you stand in the noncitizens line by mistake?