House Democrats target ICE, TSA data-sharing in new bill

Overview

House Democrats have introduced the "No TSA Data for ICE Act," a bill that would prohibit TSA from sharing personally identifiable information (PII) of flight passengers with ICE or CBP, bar DHS (Department of Homeland Security) from purchasing traveler data from private-sector brokers, and restrict immigration enforcement access to TSA PreCheck and Global Entry data. The legislation would also prohibit use of AI-powered facial recognition tools like Mobile Fortify for these purposes. Contractors that provide data-sharing systems, biometric surveillance technologies, identity verification services, or that supply traveler data to DHS components could see program requirements, allowable data flows, and procurement demand change. Contractors should treat this as a medium-severity policy risk that could affect existing task orders and future procurements involving TSA, ICE, CBP, or other DHS components. Early preparedness will reduce bid risk, ensure contract compliance, and preserve capture posture as solicitations and agency guidance evolve. Monitor the bill’s progress and prospective implementing guidance from DHS components.

Immediate Actions (This Week)

• [ ] Inventory contracts and task orders that involve TSA, ICE, CBP, or DHS data-sharing, biometrics, or traveler-data purchases; flag items where passenger PII, PreCheck, or Global Entry data is accessed or exchanged.
• [ ] Pause any new data-sharing integrations or pilot work that would share flight passenger PII with immigration enforcement until legal/contract review clears continued activity.
• [ ] Notify contracts, legal, and program leads of the legislative proposal and request a rapid legal risk assessment for affected workstreams.

Short-Term Actions (30 Days)

• [ ] Review and update Statements of Work, Data Use Agreements, and subcontractor flow-downs to identify clauses that may conflict with prohibitions on sharing traveler PII or purchasing brokered traveler data; prepare amendment language templates.
• [ ] Conduct a technical assessment of biometric/AI systems (including deployments of tools like Mobile Fortify) to document current use-cases, data sources, and the ability to disable/segregate immigration-enforcement-specific capabilities.

Long-Term Actions (90+ Days)

• [ ] Build alternative technical architectures and proposal messaging that remove or segregate traveler PII-sharing functions, offer privacy-preserving designs, or propose non-brokered data solutions to DHS components.
• [ ] Update capture plans for relevant NAICS and market segments (Biometric Systems, Identity Verification, Data Analytics, AI/Machine Learning, Border Security, Transportation Security, Information Sharing Systems, Facial Recognition Technology) to reflect potential reduced demand or changed contract requirements; identify adjacent opportunities.

Compliance Checklist

• [ ] Privacy Act — assess applicability where DHS components process passenger PII and ensure existing processing conforms to statutory privacy requirements and agency policy.
• [ ] FISMA — ensure systems that handle traveler data continue to meet federal information security requirements under FISMA.
• [ ] NIST 800-53 — verify system security controls are current for systems that store or process passenger or biometric data.
• [ ] FedRAMP (Federal Risk and Authorization Management Program) — confirm any cloud services supporting DHS data processing meet FedRAMP authorization requirements where applicable.
• [ ] DHS 4300A — review DHS-specific acquisition and information handling policies for impacts to ongoing and future work.
• [ ] Data purchase & broker contracts — identify and quarantine any arrangements that procure traveler data from private-sector brokers; prepare contract remediation or termination plans.

Resources

• [Link to bill text — No TSA Data for ICE Act] (TBD pending source review)
• [Link to agency guidance — DHS / TSA / ICE / CBP guidance on traveler data and biometrics] (TBD pending source review)
• Relevant Cabrillo Club guides:
• Winning Federal Contracts Guide (/insights/winning-federal-contracts)
• CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide)
• CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide)

How Cabrillo Club Automates This

Cabrillo Signals War Room — Already detected this event and delivered this briefing within minutes. War Room continuously monitors legislative activity, policy announcements, and agency guidance so your team receives immediate alerts when bills like the No TSA Data for ICE Act are introduced or amended. It also aggregates related press and committee actions to give programs early sightlines for capture and compliance planning.

Cabrillo Signals Match Engine — When this event changes the risk or relevance of opportunities, the Match Engine automatically rescales your opportunity pipeline. It updates match scores and keyword relevance for listings tied to TSA, ICE, CBP, biometric systems, identity verification, and traveler-data work, so capture managers instantly see which pursuits rise or fall in strategic priority.

Cabrillo Signals Intelligence Hub — The Intelligence Hub tracks the affected agencies, NAICS codes, and contract vehicles identified for this event; use its saved-search and alert features to notify you when follow-on solicitations or official agency guidance appear (including alerts for SAM.gov (System for Award Management) matches). Configure alerts scoped to the listed NAICS, agencies, and vehicles so capture teams get only the relevant notifications.

Proposal Studio (Proposal OS) — Proposal Studio automates the production of compliance matrices, first-draft technical approaches, and win-theme language that reflect the new restrictions on passenger PII-sharing and biometric use. It pulls your past performance and contract language to generate amendment templates and bid/no-bid analyses factoring in the policy change.

Proposal Studio Workflow Tracker — The Workflow Tracker enforces a capture workflow (9-gate model) triggered by this event: rapid risk review, legal clearance, technical mitigation plan, proposal update, and final certification. It routes compliance reviews to contracts and legal, tracks supplier certifications and data-source attestations, and produces audit-ready documentation packages for proposals or contract modifications.

Call to action: use your Cabrillo Signals War Room alert for this bill, run a saved search in the Intelligence Hub for affected solicitations, and generate an initial compliance matrix in Proposal Studio to start remediating at-risk pursuits.