House Democrats target ICE, TSA data-sharing in new bill

TL;DR

House Democrats introduced the "No TSA Data for ICE Act," which would prohibit the Transportation Security Administration (TSA) from sharing personally identifiable information (PII) of flight passengers with U.S. Immigration and Customs Enforcement (ICE) or U.S. Customs and Border Protection (CBP), and would bar the Department of Homeland Security (DHS (Department of Homeland Security)) from purchasing traveler data from private-sector brokers. The bill would also prohibit use of AI-powered facial recognition tools (summary cites "Mobile Fortify" as an example) and restrict access to TSA PreCheck and Global Entry data for immigration-enforcement purposes. Contractors that provide traveler data-sharing systems, biometric surveillance or facial-recognition technologies, and identity-verification services to DHS components could see scope reductions, compliance shifts, or solicitation re-scopes if the bill advances. Immediate implications include program-level risk to active or planned efforts that transmit passenger PII to ICE/CBP, procure traveler-broker data feeds, or deploy AI facial-recognition at travel checkpoints. Bid, capture, and compliance teams should treat this as medium-severity legislative risk and begin rapid impact assessment and capture re-prioritization pending further legislative action. For guidance on federal contracting basics and compliance framing, see our Winning Federal Contracts Guide (/insights/winning-federal-contracts).

Key Points

• What happened: House Democrats introduced the "No TSA Data for ICE Act" to prohibit TSA from sharing passengers' personally identifiable information with ICE or CBP, bar DHS from buying traveler data from private brokers, prohibit certain AI facial-recognition tools, and restrict access to TSA PreCheck and Global Entry data for immigration enforcement.
• Who is affected: Market segments listed in the event include Biometric Systems; Identity Verification; Data Analytics; AI/Machine Learning; Border Security; Transportation Security; Information Sharing Systems; Facial Recognition Technology — and the NAICS codes and agencies named in segmentation: 518210, 541512, 541513, 541519, 541690, 561621, 561990; DHS, TSA, ICE, CBP. Contract vehicles cited in segmentation: EAGLE II, OASIS+, GSA (General Services Administration) Schedule 70, Alliant 2. Compliance surfaces cited: Privacy Act, FISMA, NIST 800-53, FedRAMP (Federal Risk and Authorization Management Program), DHS 4300A.
• Timeline: Timeline TBD pending source review.
• What contractors should do NOW: Perform a 48–72 hour impact assessment on active task orders and proposals that involve passenger PII, traveler-broker data, facial-recognition, or TSA PreCheck/Global Entry data; flag affected opportunities via capture pipelines; convene legal and compliance to review contract language and data flows against Privacy Act/FISMA/DHS 4300A; begin contingency planning to remove or isolate data-sharing functions if required; and update win/no‑bid and solution positioning in response to potential scope changes.

Who Is Affected

• Market segments: Biometric Systems; Identity Verification; Data Analytics; AI/Machine Learning; Border Security; Transportation Security; Information Sharing Systems; Facial Recognition Technology.
• NAICS codes: 518210; 541512; 541513; 541519; 541690; 561621; 561990.
• Affected agencies: DHS; TSA; ICE; CBP.
• Contract vehicles: EAGLE II; OASIS+; GSA Schedule 70; Alliant 2.
• Compliance regimes cited: Privacy Act; FISMA; NIST 800-53; FedRAMP; DHS 4300A.

Specific NAICS codes, agencies, and contract vehicles listed above are drawn from event segmentation; further authoritative details on bill status, amendments, or targeted solicitations are pending source review.

Frequently Asked Questions

Q: Does the bill already prevent TSA from sharing passenger PII with ICE/CBP?

A: The Summary states the bill would prohibit those sharing activities, but bill status and whether it has passed or been enacted are Pending source review.

Q: Will this legislation immediately stop procurement of traveler data from private brokers by DHS?

A: The bill text described in the Summary would bar DHS from purchasing traveler data from private-sector brokers; whether that prohibition is in force yet or when it would take effect is Pending source review.

Q: How should contractors handling facial-recognition or identity-verification respond now?

A: Immediately inventory contracts and proposals that use facial recognition or that access TSA PreCheck/Global Entry or passenger-broker data. Engage compliance and legal teams to map data flows against the listed compliance surfaces (Privacy Act, FISMA, NIST 800-53, FedRAMP, DHS 4300A). Specific operational restrictions and remediation timelines are Pending source review.

Definitions

• TSA: Transportation Security Administration, the DHS component responsible for transportation security.
• ICE: U.S. Immigration and Customs Enforcement, a DHS component that enforces immigration and customs laws.
• CBP: U.S. Customs and Border Protection, a DHS component responsible for border security and customs enforcement.
• AI-powered facial recognition: Automated biometric systems that match facial images to identities; the Summary cites "Mobile Fortify" as an example.
• TSA PreCheck / Global Entry: Traveler programs referenced in the Summary; the bill would restrict use of their data for immigration enforcement purposes.

Intelligence Response

• Which Cabrillo products to leverage: Use Cabrillo Signals War Room to monitor bill text, amendments, and committee movement; run rescoring and opportunity impact analysis with Cabrillo Signals Match Engine; update saved watches and solicitations in Cabrillo Signals Intelligence Hub to alert on follow-on solicitations and contract modifications; and drive capture and compliance updates through Proposal Studio (Proposal OS) and the Proposal Studio Workflow Tracker.
• Who to notify: Head of Capture and Business Development (for opportunity reprioritization), Chief Compliance Officer / Security Officer (for Privacy Act and FISMA impacts), Program Managers for affected task orders (for immediate technical mitigation), and Proposal Leads (for bid strategy changes).
• First 48-hour playbook:
• Hour 0–4: Cabrillo Signals War Room confirms and tags this event; notify capture, BD, compliance, and PM leads. Pull active opportunities and task orders that reference passenger PII, traveler-broker feeds, facial recognition, TSA PreCheck/Global Entry access.
• Hour 4–12: Run Cabrillo Signals Match Engine rescore on pipelines; generate an impact list. Legal/compliance begin contract clause and data-flow review against Privacy Act / FISMA / DHS 4300A.
• Hour 12–24: Convene capture and program leadership to set win/no-bid and mitigation options. Use Proposal Studio to draft contingency language and revise solution architectures that segment or remove affected data flows.
• Hour 24–48: Update opportunity status, revise capture plans in Proposal Studio Workflow Tracker, and set saved-search alerts in Cabrillo Signals Intelligence Hub for bill movement and new solicitations that reflect legislative change.

Reference materials: Winning Federal Contracts Guide (/insights/winning-federal-contracts). For compliance specifics see our related guides: CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide) and CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide).