Who audits airport security and border systems

Supreme audit institutions

Each country has a supreme audit institution, often called the auditor general, national audit office or court of audit. Their global body is INTOSAI. Its founding text, the Lima Declaration, was signed in 1977 at a congress in Lima, Peru ².

The Lima Declaration says audit offices can do their work objectively only if they are independent of the bodies they audit. It says they need enough money to do their job. It says they must report their findings each year to parliament or another responsible body, and that the report shall be published ¹.

Audit offices have examined border systems in detail. The UK National Audit Office reported on 3 December 2015 that the Home Office spent at least 830 million pounds on e-borders and successor programmes from 2003 to 2015. It found the programme had not delivered its full vision. Passenger data coverage was 86 percent in September 2015, against a target of 95 percent by December 2010 ⁹.

The European Court of Auditors reviewed EU border information systems in Special Report 20/2019, adopted on 8 October 2019. It covered the Schengen Information System, the Visa Information System, Eurodac, Eurosur and PNR systems. In a survey of 951 border guards, more than half said they had at some point let someone through without checking the systems. The Commission accepted all five recommendations ⁴.

Parliamentary committees

Audit reports go to parliament. The Lima Declaration says the relationship between the audit office and parliament should be set in the constitution of each country ¹. It says publishing the annual report allows wide distribution and discussion ¹. Parliamentary committees are one forum for that discussion. They can question officials on audit findings and track whether recommendations are carried out.

ICAO aviation security audits

The International Civil Aviation Organization runs the Universal Security Audit Programme Continuous Monitoring Approach (USAP-CMA). ICAO launched the continuous monitoring approach in 2015 ¹².

USAP-CMA checks how well a state runs its aviation security oversight system. It covers the Standards of Annex 17 (Aviation Security) and the security-related Standards of Annex 9 (Facilitation). The programme collects data on performance, finds gaps, assesses their risk, makes recommendations and checks the fixes the state makes ³.

Audits can be on site or carried out as desktop reviews ¹². The audit looks at the state's oversight system, not at one airport or contractor alone. The ICAO page we reviewed describes the method but does not publish individual state results ³.

Data protection regulators

Data protection regulators check whether border agencies, airlines and contractors follow data law. In the EU, a Coordinated Supervision Committee within the European Data Protection Board oversees large shared systems. These include the Schengen Information System, the Visa Information System, Eurodac and the Entry/Exit System. ETIAS is due to follow. Members are the national data protection authorities and the European Data Protection Supervisor (EDPS) ⁷.

Outside the EU, national regulators do this work where they exist. Our country table lists which states have one.

EU bodies for border agencies

Frontex, the EU border and coast guard agency, has an independent Fundamental Rights Officer. The officer runs a complaints mechanism under Regulation (EU) 2019/1896 ⁸.

Anyone can file a complaint about Frontex staff during a Frontex operation, whatever their age or immigration status. A family member, lawyer or organisation can file with proof of authorisation. Complaints must be in writing and filed within one year. They can be in any language and are free. Complaints about Frontex staff go to the Executive Director. Complaints about national officers go to national authorities, but only with the complainant's consent ⁸.

Inspectors general and government auditors in the US

The Department of Homeland Security Office of Inspector General was set up by Congress in 2002. Its stated mission is independent oversight of DHS. The Inspector General is appointed by the President and confirmed by the Senate. Its work covers DHS core missions, including securing and managing borders. It issued 80 reports in fiscal year 2022 and runs a hotline for reports of fraud, waste and abuse ⁵.

The Government Accountability Office reports to Congress. In report GAO-20-568, published on 2 September 2020, GAO found CBP's privacy notices for facial recognition were not always complete or current. Signs gave limited information on how to opt out. CBP had audited only one airline partner as of May 2020. GAO made five recommendations and DHS agreed with all of them. GAO later closed four as implemented ⁶.

Courts

Courts can strike down or narrow the laws behind border data systems. On 21 June 2022 the EU Court of Justice ruled on the PNR Directive in case C-817/19. It kept the Directive in place but limited retention of all passengers' data to six months without evidence of risk. It barred self-learning AI that changes risk criteria without human review ¹⁰.

In the UK, the Court of Appeal ruled on 18 December 2023 that the immigration exemption in the Data Protection Act 2018 was still unlawful, after an earlier ruling in 2021. The court stressed the need for binding rules and parliamentary scrutiny of safeguards ¹¹.

How citizens can read audit reports

The Lima Declaration says audit reports shall be published ¹. Most audit offices post reports on their websites. Here is where to start.

• National audit office: search its report library for border, immigration, customs or aviation security. The NAO e-borders report is one example ⁹.
• European Court of Auditors: special reports are published online in EU languages ⁴.
• GAO: each report page lists recommendations and whether they were carried out ⁶.
• DHS OIG: publishes reports and takes tips through its hotline ⁵.
• Frontex: rights complaints go to the Fundamental Rights Officer ⁸.
• Court rulings: the EU Court of Justice and national courts publish judgments and press summaries ¹⁰.