Matthias Monroy

Under the new ETIAS system, Frontex processes application forms from travelers from visa-free countries. The border agency is to develop an algorithm to determine their risk. A court ruling may have brought those plans crashing down.

On Tuesday, the European Court of Justice (ECJ) published a landmark decision on the EU’s passenger data system. Among numerous other violations of fundamental rights, the court in a preliminary ruling criticizes the use of „self-learning systems“ that search for anomalies in the mass data that is collected without any reason.

The automated pre-assessment of travelers is also criticized. According to the ECJ, the use of predictive selectors or algorithms must be ruled out in the warrantless screening of passengers. The ruling is thus also significant for the European Travel Information and Authorization System (ETIAS), which is to use algorithms to profile all travelers from third countries. It is scheduled to go live in nine months.

Irregular migration, security, epidemics

The ETIAS is a pre-authorization system for visa-free travelers from currently 60 countries. It is managed by the EU Agency for the operational management of large-scale IT systems (eu-LISA). Similar systems have been set up in the USA, Canada and Australia, for example.

Via an online application, travelers must submit personal and planned travel information to ETIAS before arriving at the borders. Based on the application form, an assessment system determines possible risks with regard to irregular migration, security or epidemics.

Around 250 officials are responsible for this at the ETIAS central office, which was set up at the EU border agency Frontex. If the check reveals a „hit,“ the incident is forwarded to the national ETIAS offices in the member states for further processing. Entry bans can then be imposed there.

Research on virtual border officer

The ETIAS became known in digital civil rights circles because border police, institutes and surveillance companies have been researching a „lie detector“ for this purpose. In the iBorderCtrl project, a virtual border guard was used to ask travelers more than a dozen questions and check whether they made a positive impression. The project ended three years ago and was initially intended to investigate the feasibility of such a system.

Even without a „lie detector,“ ETIAS is a project that deeply intrudes on travelers‘ privacy. Every application submitted to Frontex is first checked against EU and Interpol databases. This is followed by a query of an ETIAS watch list. It is kept by the EU police agency Europol and includes people who might be linked to terrorism or crime. Medical reasons such as infectious diseases can also lead to inclusion in the list.

In addition to names and aliases, the watch list also logs previous trips to „conflict zones.“ It is constantly updated; for this purpose, Europol works closely with ETIAS Central Unit and also receives new information about suspects through it. Europol can then initiate criminal investigations. The ETIAS Regulation allows police authorities to use the data in this way for law enforcement purposes.

Predefined risk indicators

According to Article 33 of the ETIAS Regulation, Frontex is also to develop an algorithm that will enable automatic profiling of travelers. The border agency bases this on predefined risk indicators based, among other things, on the watch list.

A combination of different data contains various elements, including age group, gender and nationality, as well as origin and residence. Where known to Frontex or Europol, the „educational level“ or occupational group of potentially dangerous individuals is also taken into account.

Admittedly, the risk indicators used to analyze travelers for dangerousness are based on anonymized data. According to the ECJ ruling on passenger data retention, however, these must be targeted and proportionate. Accordingly, risk indicators may in no case be based solely on a person’s gender or age. The processing of information on ethnic or social origin is also excluded. Thus, ETIAS is likely to violate the principles cited by the court ruling.

Processing large amounts of data

Notwithstanding this, eu-LISA, Europol and Frontex continue to push forward with the use of machine learning in ETIAS. In a study entitled „Use of Artificial Intelligence,“ rules for processing large amounts of data in the ETIAS Central Unit are to be developed this year.

In this way, trends or existing risks could be detected, for example. The laws required for the use of „artificial intelligence“ at EU level and in the member states will also be examined. Subsequently, the „AI component“ will also be used for other EU databases.

At the heart of the new system is a new Central Reporting and Statistics Register (CRRS), which contains empirical data and analytical reports from the Schengen Information System and the Visa Information System. In this way, the EU Commission wants to enable conclusions to be drawn about the quality of the data processed. In addition, the information stored there can be used for „political and operational purposes.“ This also includes risk analysis by Frontex.

New organizational structure at Frontex

Frontex has reorganized its organizational structure for the new tasks under ETIAS. The responsible „Risk Analysis Unit“ is now located in a new department „Information Management“. It is headed by the post of deputy director, Uku Särekanno from Estonia, which has also been newly established. Previously, Särekanno was responsible for the introduction of new databases at eu-LISA.

The ETIAS system is not yet operational. It is not just technical problems that need to be overcome before the scheduled launch in March. The planned profiling is also not yet clearly regulated from a legal point of view. According to Article 89 of the ETIAS Regulation, the Commission must adopt a delegated act „to further define the risks related to security or illegal immigration or a high epidemic risk“. However, there has been no initiative on this so far, according to sources in the EU Parliament.

Image: This is how the EU border agency pictures its new ETIAS Central Unit for processing applications from visa-free countries (Frontex).