On the public side of the arrivals hall, border control can look almost theatrical: fluorescent light, a passport sliding across a counter, a few clipped questions, a stamp or a referral. Behind that calm surface, another machine is running. Customs and Border Protection’s Automated Targeting System-Passenger—ATS-P—pulls in travel records, law-enforcement data, visa files, and prior encounters to help officers decide who deserves a second look. The official story says humans remain in charge. The deeper question is narrower, colder, and harder to shake: when a system like that is watching everyone, who is watching the people inside it?

The Case For

The logs exist because the risk was obvious

CBP’s own privacy paperwork reads like an admission that ATS needed internal supervision from day one. In the 2007 Privacy Impact Assessment for ATS, DHS said ATS user roles were “highly restricted and audited,” that access was based on a demonstrated need to know, and that the Office of Internal Affairs conducted periodic reviews to ensure the system was being used according to policy. The 2021 ATS update repeated the same idea: ATS performs extensive auditing, records user search activity, and relies on role-based access to keep the system inside its mission.

That matters because ATS-P is not a narrow database. As DHS describes it, the platform draws from Passenger Name Records, APIS data, visa systems, TECS, watchlist information, and prior border data to help determine whether a traveler should receive additional screening. In practical terms, that means the system touching your itinerary can also be the system shaping your referral to secondary inspection.

Then the watchdog found the door half open

The strongest evidence for the deeper concern came from DHS’s own inspector general. In Better Administration of ATS Controls Can Further Protect PII, the Office of Inspector General concluded that CBP had implemented robust privacy controls overall, but it also found something more unsettling: management was not conducting periodic reviews of ATS-P user access, inactive accounts were not being disabled after 90 days, and the Office of Internal Affairs had not performed its expected reviews during the fiscal year examined. The audit also found users with privileges they were not authorized to receive.

That is the kind of finding conspiracy-minded readers latch onto for a reason. If the system was built to monitor travelers by aggregating sensitive data, and the internal controls around user access were not being consistently enforced, then the concern is no longer abstract. It becomes structural. The problem is not only what ATS-P knows. It is whether too many people could reach into that knowledge without enough review.

The FOIA trail made the concern harder to dismiss

An EFF-hosted 2007 DHS FOIA release on ATS adds another layer. One CBP memorandum described a “comprehensive audit and verification of user accounts” in ATS-P and said users inactive for more than 90 days would have access removed. In other words, the agency was not merely theorizing about the need for an audit trail. It was responding to a recommendation after oversight had already raised alarms. When you line that up with the later UPAX passenger dossier breakdown, our look inside the National Targeting Center’s passenger hub, and the wider government secrets archive, the pattern becomes clearer: the system kept growing, and so did the stakes around who could touch it.

The Realist’s Eye

An audit trail is not proof of abuse

This is where the mood has to cool down. An audit finding about weak administration is not the same thing as proof that CBP officers were routinely misusing ATS-P. The inspector general did not conclude that the database had become a lawless free-for-all. In fact, the report explicitly said robust controls were in place and focused its criticism on oversight discipline: reviewing privileges, disabling stale accounts, and making sure internal reviews actually happened.

That distinction matters. Bureaucracies often fail in banal ways before they fail in sinister ones. Access lists drift. Reviews get delayed. Supervisors sign off late. That is not comforting, but it is different from proving intentional abuse of passenger records for political, personal, or unlawful ends.

CBP’s system still keeps a human in the loop

DHS has also consistently maintained that ATS is a decision-support tool, not an automatic judge. The 2007 and 2021 PIAs both stress that no adverse action is supposed to occur until a trained CBP officer reviews the information. Travelers are not assigned a public-facing “score” in the passenger environment, and referrals to secondary inspection still sit inside an officer-driven process. The 2021 privacy assessment for CBP’s Unified Secondary module says officers use ATS and related systems to research, interview, and document a referral from primary inspection to resolution. That weakens the most dramatic version of the theory—the idea of a machine silently deciding people’s fate on its own.

And some of the most alarming findings were old

The sharpest oversight failures in the public record date back to the mid-2000s. That does not erase them, but it does force a harder question: are we looking at an enduring secret architecture of misuse, or at a real but partly remediated control problem that became public because DHS’s audit machinery actually worked? The later privacy documents show CBP continuing to describe audits, role limits, annual training, and access reviews. Those assurances could be bureaucratic boilerplate. They could also reflect reforms made after the inspector general’s warning.

What We Know For Certain

• DHS privacy assessments state that ATS and ATS-P use role-based access controls and maintain audit logs of user activity.
• The DHS Office of Inspector General found that periodic ATS-P access reviews were not being consistently performed and that inactive accounts were not always disabled after 90 days.
• The same audit said CBP had implemented robust privacy controls overall, even while identifying oversight weaknesses.
• CBP documents say ATS supports officer decisions about whether a traveler should receive additional screening; it is not described as a fully automated final-decision system.

The Unanswered Questions

• How often are ATS-P audit logs reviewed in practice today, and by whom?
• What consequences followed when DHS found unauthorized privileges or inactive accounts left open?
• How much of ATS-P access oversight is visible to outside watchdogs rather than handled entirely inside CBP?
• When UPAX refreshed the passenger interface, did oversight tooling improve at the same pace as data integration?

The Closer — You Decide

The clean version of the story says the safeguards worked because the audit found the weakness. The darker version says the weakness existed in the first place inside one of the government’s most sensitive passenger-targeting systems. Both things can be true at once. The documents are real. The oversight gaps were real. So is the official claim that humans, audits, and internal controls stand between a traveler and a bad call. The evidence is on the table. You decide.