22
Examination of witnesses
Professor Tim J Wilson and Dr Niovi Vavoula.
Q99 The Chair: Good morning everybody, and welcome to this final oral evidence session of the Justice and Home Affairs Committee inquiry into electronic borders. We have two witnesses today: Professor Wilson, who is with us physically, and Dr Vavoula, who is appearing remotely. Before I ask you both to introduce yourselves and your backgrounds, I want to say a big thank you to Professor Wilson on behalf of the committee. Before we began the public sessions, he very kindly came to a briefing session and advised us on scoping out the inquiry that has followed. So, Professor Wilson, on behalf of us all, thank you very much indeed. Would you now be kind enough to introduce yourself?
Professor Tim J Wilson: Thank you, my Lord Chairman and the other members of the committee for those kind words. It is always an honour to try to bring some academic insight to proceedings such as this, though I am not a real academic in many respects. I spent the greater part of my working life in the Civil Service, the Home Office, what is now the Ministry of Justice—in those days when I first arrived it was the Lord Chancellor’s Department—and a stint in the Treasury, where I did a couple of secondments with an engineering company and a UN organisation working in Russia during the early Putin years. I only subsequently became an academic, where I work with a very practically focussed law school.
We have been doing quite a lot of research into international criminal justice co-operation, particularly within the European Union framework, and more recently with colleagues at Stockholm University around what lawyers, courts and policing officers need to understand about the impact of artificial intelligence and machine learning when it comes to the production of evidence. Strangely enough, that overlaps with quite a lot of the themes of this inquiry.
Dr Niovi Vavoula: Good morning, everyone. I spent almost 14 years in the UK as an academic at Queen Mary University of London and a senior lecturer in migration security, only leaving in February 2024 to receive the chair in cyber policy at the University of Luxembourg. My expertise is on the intersection between technology and law, particularly migration law, and the use of new technologies for border management, migration and asylum, including the ETA, ETIAS, the Entry/Exit System and other large-scale IT systems for foreigners.
Q100 The Chair: Thank you both very much indeed. As you know, we are looking in particular at the introduction of the UK’s ETA scheme and the two EU schemes, ETIAS and EES. We know that there has been some delay in the introduction of the two European schemes, and there is now a suggestion that things will start to happen following the Olympics in Paris. The ETA scheme has already started in some countries for those who want to come to the UK. Can you both give us any information you might have about the likely timescale for the introduction of all three schemes? In so doing, perhaps you could comment on measures that some people have been taking to try to ensure that there is not a conflict whereby all these things get introduced at more or less the same time, which some suggest might lead to a degree of chaos, but perhaps not. Professor Wilson, could you give us your thoughts?
Professor Tim J Wilson: Rather like you, Lord Chairman, I have always taken a close personal interest in ETIAS, and it seems very sensible that it will not come in before the Paris Olympics. The best I can say about that is that it will be before the UK rolls out the ETA to EU citizens. The ETA rollout for the rest of the world is scheduled for next year, so there should not be too huge a clash in that respect, but I think ETIAS will come in between November this year and December next year.
Because of the complexity of a technological project such as this, and the fact that it needs physical infrastructure changes, I do not think there is any shame in strategic postponement, spreading the burden of implementation and not actually enforcing it too rigidly with individual decisions by border officers when it comes in. Believe me, having very recently crossed from Calais to Dover, I can see the problems of fitting yet another facility in, particularly the initial enrolment.
While on the boat the other day, I conducted a kind of straw poll myself; I asked the information point people whether they knew when ETIAS was coming in. After I had to explain what it was, they very helpfully said, “Well, you’ll need to look at a website”. They did not say which one. So that is a big gap in the arrangements. I would have expected to see posters by now saying, “British citizens, this is your last summer when you can come to the Schengen area without ETIAS enrolment unless you’re exempt from it”, and perhaps bookmark-sized slips given to people, just to give notice. It is a bit like the 10-year passport extension point: we have known that ever since Brexit it was going to be a problem, but according to press comments, people have really been caught out by that and have been refused access to flights because they did not realise that the extra time they purchased when they surrendered their passport earlier no longer counts for a flight into the EU.
The Chair: That is very helpful. Could I ask you to just bear in mind that point you made on people being aware of what is going on and ensure that we get an opportunity to discuss it a bit later? We have a question about outstanding issues, and notification would be very helpful.
Dr Niovi Vavoula: According to the latest information that we have on the rollout of the Entry/Exit System, it is supposed to become operational in October 2024, but obviously this is not set in stone. The legislation was adopted in 2017, but there have been significant delays; these delays are normal because it needs to be rolled out not only in airports, but also to land and sea entry points. At the same time, we know from previous history that these delays are normal because a very similar system was adopted and rolled out in the United States a few years after 9/11, which took approximately 20 years for both the entry and exit functions to operate properly. The latest information on the Entry/Exit System is that it will be rolled out in October 2024.
With regard to ETIAS, again there have been significant delays, but the latest information is that it will be rolled out mid-2025. This was agreed between the Ministers of the EU at a meeting in October 2023. One reason why there have been so many delays in connection to ETIAS is that, for it to operate properly in the examination of applications by visa-free nationals, it requires the prior operation of the Entry/Exit System; I can elaborate further on that if you wish. This means that, while they wanted these systems to be rolled out hand in hand at the same time, the Entry/Exit System will have to become operational before ETIAS in order to assist it in the examination of applications.
As for the ETA, you know better than me that it has already started rolling out to specific countries, starting with Qatar in October 2023. Since February 2024 it has been rolled out to nationals in the Gulf region and Jordan; however, its rolling out will be further expanded to countries in North America and Europe as a matter of reciprocity with ETIAS in the EU.
The Chair: Thank you. From what you both said, the current expectation would appear to be that the EES—the Entry/Exit System that the EU is going to introduce—will come in some time after the Paris Olympics, in October or November of this year, notwithstanding people’s lack of knowledge about it. Dr Vavoula suggested that ETIAS would come into effect mid-2025. Yet, when we talked to Tom Pursglove MP, the Minister for Legal Migration and the Border, he told us very clearly that the rest of the world, not the EU, would see the ETA in the autumn of this year, coinciding with the EES, and the EU would be introduced “early next year”, which seems very close to the introduction of ETIAS. It seems likely that there will be two different systems being introduced at the same time. Given the 20-year delay as people sorted out previous schemes and so on, do you have any thoughts on whether this is a recipe for serious problems?
Dr Niovi Vavoula: We can envisage a series of problems at border crossing points in the sense that parallel systems will become operational pretty much around the same time, which obviously requires training for border guards and prior information to individuals who are subject to ETA and ETIAS requirements. This therefore may create a series of problems in terms of delays at border crossing points, and delays that have to do with the checks against ETIAS and the ETA by airline companies.
We can also envisage a series of problems because of the implementation of the schemes through the participation of applicants who essentially apply online and have to provide their own information. Incorrect data may be inserted in the systems, causing problems in their application forms which may lead to refusals of authorisations, or requirements for individuals to seek correction of their data in the systems to get the authorisations.
We should bear in mind that these authorisations, both in ETIAS and the ETA, do not give a right to enter either the UK or the Schengen area; they are merely a prerequisite for individuals to travel and board planes, et cetera. This signifies that the bulk of the work will still be on border guards who will have to verify ETA and ETIAS authorisations and conduct searches and registrations of individuals in the EU in the Entry/Exit System. It has already been raised by airlines and border guards that this will delay the border crossing process quite significantly throughout the implementation of the schemes. I expect that, at least in the first months, there will be a bit of chaos at border crossing points.
The Chair: “A bit of chaos”. That will ring in our ears. Are you expecting chaos, Professor Wilson?
Professor Tim J Wilson: I do not think there is anything that I can add to Dr Vavoula’s analysis of the risks of chaos, but perhaps it is appropriate to bear in mind that we need border control systems that are flexible and can respond rapidly to changing circumstances. Pushing the system hard in the next 24 months might be of great benefit for future resilience.
We are all rather scarred by Covid and the way in which border control measures were cobbled together for that. Indeed, most of the discussion about border control focuses on security, criminal justice, co-operation and migration control. Despite what is happening in the Middle East, countries such as most of those in western Europe face much greater threats from pandemics such as Avian flu, for example, which is crossing species. There is something to be said for a stress test of border controls, and there needs to be co-ordinated planning between states and interstate organisations responsible for large-scale passenger movements going forward.
The Chair: Just so I am clear in my own mind, what would that look like? Practically, what are you asking to happen?
Professor Tim J Wilson: I would ask for some kind of joint review of the implementation arrangements between the UK and the European Union, perhaps under the joint parliamentary structure provided for in the TCA—what has been successful and what has caused problems—in order to then say, “We’ve learned our lessons from introducing these schemes, and we’ve managed a certain degree of chaos at the border, successfully or not. What are the implications if we have to make further and rapid unanticipated changes in the coming years?”
The Chair: If there is to be that sort of investigation, does that lead you to have any particular view as to the difficulty that would be created by the introduction of ETIAS at more or less the same time as the ETA for EU citizens is introduced, because then there would not be the opportunity for one to learn from the other?
Professor Tim J Wilson: Dr Vavoula has a better sense than I do of the full implications of managing that process. The destination countries involved are probably going to be reasonably spread, and the physical impact will vary. For the crossings I am used to between the UK and the EU, ETIAS is a really big, significant change that will have a major impact on the juxtaposed controls for railway travel and for some ferry ports. I see keeping ETIAS away from the UK change implementations as a critical factor for a lot of movement between here and the Schengen zone.
The Chair: Thank you, that is very helpful, and I noticed Dr Vavoula nodding.
Lord Henley: I have just one very quick question. Professor Wilson, when are you proposing that the joint review should happen, and by whom? Were you talking about it at a parliamentary level?
Professor Tim J Wilson: I do not know whether there is any structure under the joint parliamentary arrangements established under the Trade and Co-operation Agreement, but it certainly touches on the scope of that treaty in terms of criminal justice co-operation. There are standing committees of officials with a civic forum that could contribute to such a review. So the machinery is there if it could possibly be used; that would be my first choice, rather than try to invent something from scratch.
Lord Henley: More importantly, when do you propose this should happen?
Professor Tim J Wilson: As soon as it is possible to have a firm idea of what the timetable is like, in order to capture information as the changes are introduced.
Lord Henley: Before we have the bit of chaos?
Professor Tim J Wilson: Before we have a bit of chaos, because if we do not have chaos, it may be equally useful to know why we did not have it.
Lord Henley: So we would want a review beforehand, rather than after?
Professor Tim J Wilson: You would put the review machinery in place to collect the evidence to obtain information, and then you would review it after the change, rather than wait until the change and then establish the review.
Lord Bach: For my sins, I am a parliamentary member of the parliamentary group set up under the TCA, and my experience so far is that it is still gathering strength, but it is taking a bit of time to do so. I am particularly interested in your thought that that might be a useful thing for the parliamentarians from both sides to concentrate on, so thank you for that.
Q101 The Chair: One of the big debates has been whether electronic authorisation schemes, the ETA in particular, are there to improve border security or to ease passenger experience going through borders, and what the balance between those two could be. I know that when you spoke to us before, Professor Wilson, you expressed some concern that at times when there are very large numbers of people trying to travel at peak season, the security issues might be diminished to ease the passenger flow and so on. Can you talk to us a little about that balance between security and passenger ease?
Professor Tim J Wilson: Having looked at this since that initial discussion, it should, theoretically at least, reduce the tension between ease of travel and security issues quite a lot. If the systems work properly, they should result in better collaboration between humans and machines. We may see improved operations except in truly exceptional circumstances.
The problem with machines is whether they are reliable. We have all been frustrated by e-gates just as we can be frustrated by ticket barriers on the railway or the tube. One of the lessons for implementation which comes out strongly in the inspection reports is the need to talk to people who work on the systems. I know you have had evidence from Mr Neal. As the system beds in, there will be issues that have not been anticipated, and often the best way of resolving problems and ensuring the evolution of the system in a positive and constructive way that reduces tensions between ease of travel and security issues is to work very closely with people actually doing the job. In that respect, the inspectorate, under the new independent chief inspector—a very important appointment—will have a major role to play, but there are other ways of looking at that as well.
Dr Niovi Vavoula: We need to differentiate between the Entry/Exit System, which may be seen as easing travel for passengers more than travel authorisation schemes, including the ETA. Indeed, the Entry/Exit System will abolish passport stamping, and from that perspective, it will make life easier for border guards who have to calculate the timing for which individuals are entitled to remain on national territory and will make it easier for individuals to better know what requirements there are in terms of authorised stay.
On the other hand, electronic authorisations are a wholly new system, and are essentially a lighter visa requirement for nationals who come from visa-free countries. Currently, visa-free nationals are not required to obtain any prior authorisation before travelling to the UK or the EU; they are simply subject to border controls by border guards at border crossing points, which means that ETA, ETIAS or other similar schemes such as the US ESTA, are creating an additional pre-travel burden on applicants who need to apply online for such authorisations by providing a series of data, having access to good internet connection and paying the relevant fee in order to simply get travel authorisation prior to travelling. So, from that perspective, it constitutes a new burden which does not currently exist. That is one thing to consider. It is not really easing their travel; it is a pre-vetting tool. At the same time, possession of travel authorisation is an indication that this pre-vetting has been successful, but it still does not give a right to individuals to enter either the UK or the Schengen area, which means that the burden of doing a proper check on the traveller is still on the border guard.
I would not say that these schemes are profoundly easing travel for passengers, but they are considered more of a pre-vetting tool in order to do a pre-check of individuals to identify those whose travel should be blocked prior to coming to the UK or are unknown to the authorities and need to be prevented from travelling. By unknown, I mean that they have not violated the Immigration Rules in the past, or they do not have a criminal record, but perhaps their characteristics correlate with the characteristics of other groups of individuals who have been considered as dangerous and risky for immigration reasons or public security reasons, and for that reason they should be blocked from travelling. I would consider these schemes more as a light visa, thus more as schemes that prioritise safeguarding border security rather than easing travel for passengers.
Baroness Buscombe: Dr Vavoula, you have just been very reassuring as far as I am concerned. A couple of nights ago I spent an hour at Terminal 2 waiting for somebody. Being on this committee made me more conscious of the extraordinary number of people coming from all over the world in the space of that one hour. The flow was large and constant. Whoever they were and wherever they were coming from, not necessarily the EU or the Schengen area, there were huge numbers of people pouring in. That is one terminal in one airport.
My concern, and to some large degree you have helped to allay it, is security. Instead of calling it another burden on the passenger, should we not, as far as this country is concerned, be calling it a good hurdle? In a sense, it is a deterrent that we are creating through these additional systems. Would you both agree that we should welcome that and make the public aware that we are increasing our border security?
Professor Tim J Wilson: Yes, if the system is working properly it should be a deterrent. It should raise the level of security. The question at the back of my mind is the extent to which the introduction of an electronic system might mask an absence of information against which you can verify the information provided by the applicant. With the EU, there are major arrangements for sharing data about individuals that come into border security. There is something similar within the Five Eyes. For the rest of the world it is much more unknown and, at least with the electronic prior system, border staff know when people are travelling and who they may want to interview and examine. I do not think the electronic system alone will give security. A lot depends on the information flows that back it up, which raise huge human rights and data protection issues. Dr Vavoula is much better equipped to comment on that than I am.
It is also a question of the way in which the system is operated by staff. Do they pick up clues when perhaps someone coming through is behaving slightly differently from what they expect from the profile? I know you have had evidence from people who have been immigration officers or watched immigration officers at work. The essential thing for security is not just introducing a better electronic system but one that works very well—with skilled professional staff, ensuring there are adequate numbers of them who are properly supported and adequately trained. It is a holistic response to an increasing range of problems, and hopefully it will increase the degree of security, but it will not be absolute. It can never be absolute and that is why it needs to be coupled with criminal justice co-operation. Indeed, in some cases you may find a third-country national commits a serious crime in this country which could not have been anticipated because it is all to do with circumstances that arise in this country, although that will not always be the case. So, it will help to improve security, but a lot depends on the information behind it and the staff who are operating it.
The Chair: I know Dr Vavoula has some thoughts on these issues, but we have some later questions where I hope you will perhaps expand your thoughts on them.
Q102 Lord Bach: Professor Wilson, I was not present when you spoke to the committee before—for a pretty good reason: I was not a member of the committee then—so forgive the question if it is slightly naive. Can you both please assume that the ETA has been fully implemented? You have begun to approach the first part of the question, which is how it might evolve once it is fully implemented; perhaps more importantly, how can we ensure that there is sufficient scrutiny and oversight of its operation?
Dr Niovi Vavoula: The ETA has a lot of potential as to how the applications for travel authorisations will be processed. One of the key challenges that I see in the appendix explaining how the ETA operates is how those travel authorisations will be processed. In comparison to ETIAS, for instance, there is a lack of clarity as to how these applications are explained and the extent to which artificial intelligence or simpler algorithms are being used to determine who is a potentially risky traveller. Therefore, one of the key things that has potential in the evolution of the ETA is processing obligations, which may increasingly rely on different artificial intelligence systems.
You may be familiar with the triaging of visa applications, for instance, which has already taken place in the UK Home Office. One could envisage something similar in the case of ETA authorisations and their processing, whereby an AI system could triage the applications from individuals who are considered less risky, or of medium or high risk. Depending on the classification of an application, different scrutiny and examination of the application would take place. This is something that is already being considered for the European level, and I could see it also taking place in the context of the ETA. That is one of the things that would play a role.
The other very interesting thing is that the ETA requires the capturing of a facial image by an applicant, which will take place during the online application. This may prompt discussion about the potential of using that facial image, not only for the processing and verification of the identity of the individual, but for future use of facial recognition technology at the border whereby the ETA application facial image will be compared with the facial image captured at the border. These are my initial thoughts. The potential of using artificial intelligence is very much in play, but we do not have much information in the legislation. These are simply my thoughts, so I would welcome any additional comments or questions on that front, and I can elaborate on how I can see that working in practice.
Professor Tim J Wilson: Can I first follow up on Dr Vavoula’s point, which to me is a very important one? Basically, we are dealing with machines that process huge volumes of data to achieve statistical correlations and different brands—I am sure there is a more technical term for it—of algorithms on the commercial market which might give you slightly different results. When there is a fairly good fit between the two sets of data that are being compared, it is probably not a big issue, but there will be times when there is a very tight margin of difference. The use of different algorithms may make a difference to whether someone is given permission to enter or not. Some algorithms are better at working in different circumstances.
One of the problems with this is that there is a very good arrangement for testing the reliability and accuracy of algorithms used in automatic facial recognition that is run by the National Institute of Standards and Technology in the United States. It produces masses of tables which are quite formidable to try to understand, but they give you ratings of the best algorithms on the market, which will give you the most accurate match. The problem is that these are all in test conditions because, to make a comparison of the data being tested, it has to be absolutely identical.
For looking at the impact of Covid masks on automatic facial recognition, it has different types of images, about four or five standard images, which are run against the algorithms. But when they look at the impact of the mask, they are looking at pasting, in effect, but numerically, the image of a mask on a face and how a machine does in that case. In practice, operational conditions, lighting conditions, the way people stand and whether there is dirt on the lens of the camera may make a difference.
There is some very useful information in the test data, but what is really important is knowing how it works. This is an important issue, and there is a very sound legal principle that you do not take decisions that have legal consequences for individuals on the basis of a machine decision; you need human beings to oversee the machine results and make a judgment about whether the machine provides you with sufficient grounds to refuse or allow admission.
The Chair: I am going to stop you at that very point because I know Baroness Buscombe is going to pick that up in a bit more detail.
Q103 Baroness Buscombe: Professor Wilson, you have brought us neatly to the next question: what are the possible implications for individuals of a refusal of an ETA or an ETIAS given, for example, there is no redress for an ETA or ETIAS refusal? We know that you can apply for a six-month visa in the event of refusal; would you like to expand on that, and what do you feel about the implications?
Professor Tim J Wilson: I would like to return to the first question, if possible, or I can send you a supplementary note in writing, because there are a range of issues in evaluating the system as it evolves. On that particular point, one of the main consequences of the refusal of an ETIAS is that instead of paying £15, an applicant has to pay £115—the cost of the cheapest possible visa—in order to travel to the UK. The scheme, as announced by the Government, is most unsatisfactory in that respect. It is important that people who are denied entry in ETIAS have an opportunity to question or challenge that decision so that it is reviewed. Knowing how many people are refused entry, and exactly why, is very important for monitoring the operation of the system.
Baroness Buscombe: Do you think it is better that the British taxpayer pays for that person, rather than that person showing they so wish to come to this country that they are prepared to pay what it actually costs?
Professor Tim J Wilson: The British border control system is already fairly heavily subsidised by people who buy passports and visas. The amount charged for visas, particularly for people who are not well paid and are trying to live with family members in this country, is unconscionable. A surprisingly high proportion of the cost of protecting UK borders is actually met through passport fees and visa applications. My own personal preference would be for progressive taxation.
We are probably talking about a fairly low number of rejections—most people will get through—but given that the service is offered at a rate higher than the EU, it is unreasonable that there is no kind of oversight process in order to challenge or question a refusal. Having paid your £15 fee, you should not then need to go automatically to £115, and we need to know why people are being refused entry in order to see how the system is working. That is in the interest of the taxpayer.
The Chair: Thank you, Professor Wilson. Dr Vavoula, we lost you for a few minutes; the question asked by Baroness Buscombe was about the possible implications for individuals if they are refused an ETA or ETIAS. In light of you not having heard Professor Wilson, do you want to comment on that, or would you prefer that we move on to the next question and you write to us after the session? Which is easier for you?
Dr Niovi Vavoula: I can very briefly address this question and I will provide a more detailed answer in my written contribution. One of the key things to keep in mind is that an individual who is refused a travel authorisation in the context of an ETA will have to apply for a visa. Professor Wilson has already explained that.
I am very interested in the extent to which refusal of an ETA or an ETIAS may have a knock-on effect—either on a visa application in the context of the ETA, or a subsequent ETIAS application in the context of ETIAS—the extent to which the result of a previous application may have an impact on a subsequent one, and the extent to which an individual may be prevented from having access to the UK or Schengen area, not indefinitely, but for a long period of time. These are things that are not very well documented and that we need to see in practice.
The last thing I want to highlight is that research demonstrates that approximately 40% of the countries which generate asylum seekers are visa-free countries. With the introduction of the ETA and ETIAS, individuals who may lawfully wish to apply for an ETIAS or an ETA authorisation in order to come to the UK or the Schengen area, and subsequently apply lawfully for international protection, may be prevented from getting those authorisations. They will therefore not be able to reach the territory of the UK or the Schengen area in order to seek international protection.
Again, this is something that has not really been documented, and the extent to which individuals who are coming from asylum-generating countries are prevented from getting authorisations to come lawfully to the UK and the Schengen area remains to be seen in practice.
Q104 Lord Henley: I would like to move on to some questions about potential privacy concerns and the difference between the schemes—the EU schemes of EES and ETIAS, and our own ETA—because they are very different. Dr Vavoula, could you start by commenting on those potential privacy concerns in relation to the different schemes, and then, Professor Wilson, could you follow on?
Dr Niovi Vavoula: There are a series of data protection and privacy concerns arising from the introduction and operation of travel authorisation schemes. Obviously, there are differences in the legal framework between the ETA and ETIAS. I have already commented on the lack of specificity as to how ETA applications are being processed by the UK Home Office; this creates a major legality issue, because there is a complete lack of foreseeability on behalf of ETA applicants as to how their personal data is processed, and how the extent to which they are considered a risk or not is determined. That is a major problem and a major pivotal difference between the ETA and ETIAS. The ETIAS scheme at least provides some indication of the way in which applications are processed, either at EU level through the ETIAS central unit in Frontex, or manually by the responsible ETIAS national units in case there is a flagging of an individual as a potential risk.
In the case of the ETA, such information is completely missing, which essentially means that individuals will have no idea why an application has been refused, or why they have been considered a potential risk in terms of irregular migration or public security to justify the removal of an ETA. This is one of the major differences.
In any case, the cross-checking of applicants’ data against other national or international databases can also be a little problematic from a privacy perspective, as I mentioned earlier. These schemes rely on the provision of information by individuals themselves when they apply through online portals. That means that, depending on the individual’s technological literacy, there may be a series of data that is incorrect, such as the way they write their name, or some data that is not verifiable, especially in replying to any questions about immigration status or prior criminal activity, where the individual may lie. This is declaratory data about their intended stay, the purpose of their travel, and so on that cannot be fully verified. So there may be incorrect data that is then used for cross-matching against national or international databases.
In the case of ETAs, cross-checking will take place against other European databases which we know, through different reports, have a series of incorrect data. Essentially, incorrect data imported by the applicants may be cross-checked against potentially incorrect data stored in other large-scale IT systems, or data that is unlawfully processed in international databases such as Interpol databases. So this data matching process may be a little problematic and may lead to false matches—both false positive and false negative errors—which means that individuals may be flagged as a risk for no good reason, or they may escape pre-vetting even though they may need to be flagged as being potentially risky. This is how the data-matching process operates.
At the same time—again, I go back to the major differences between ETA and ETIAS—the extent to which the ETA will operate through cross-checking against algorithms that are more advanced or against artificial intelligence in order to identify potentially unknown risky individuals through algorithm profiling is unclear. The development of algorithms on the basis of previous statistical data in order to determine whether an individual’s data correlates with known profiles of risky individuals is a concern.
In the context of ETIAS, it is very well known that such algorithms are currently developed at European level by the ETIAS central unit established in Frontex, and there have been a series of concerns about the extent to which those algorithms will be discriminatory or non-discriminatory. The legislation itself proscribes discriminatory algorithms. At the same time, the way it is designed may lead to indirect discrimination against ETIAS applicants, because certain indicators that will be used are proxies for protected characteristics. This is textbook indirect discrimination, so it is likely that the algorithmic profiling that will take place in ETIAS will lead to indirect discrimination of specific groups of travellers.
On the other hand, we should note that, ultimately, decision-making is never fully algorithmic, because even if an individual is flagged as potentially risky, their application is still manually examined by the responsible ETIAS national unit, so there is human evaluation of the application that has been flagged. However, extensive literature talks about potential automation bias by the human on the loop or selective adherence to the result of the machine, which may mean that the human in the loop may not be a sufficient safeguard to prevent indirect discrimination against specific groups of travellers.
Apart from that, there are a series of challenges about the potential uses of ETA or ETIAS data and the degree to which they can be used for other law enforcement-related purposes, such as for the prevention, detection, or investigation of serious criminal offences. In the context of ETIAS, it is well known that law enforcement, including by intelligence services, may have access to ETIAS data for the prevention, detection and investigation of terrorist offences and other serious crimes. There is a whole literature about this interplay between border management and law enforcement, and the extent to which law enforcement authorities or intelligence services will make use of such data at national level, and what the implications for individuals will be, remains to be seen.
I will stop there, because I have already talked too much, but I am happy to elaborate on additional concerns, and in my written contributions you will have a bit more on that front.
Lord Henley: You talk about specific groups suffering discrimination. Can you identify in advance what those specific groups might be, or is that something that will emerge as the scheme develops?
Dr Niovi Vavoula: It depends on the algorithms that have been or are being created. Sometimes the algorithms may cast the net too wide, or sometimes be a bit too narrow. There is a balance as to how an algorithm is designed. It is likely that individuals who come from countries that are considered riskier than others may be more prone to such indirect discrimination, but it all depends on the design and the data that is being used in order to create and extract correlations that are then encoded into an algorithm.
Lord Henley: I think I understand. Let us hear from Professor Wilson.
Professor Tim J Wilson: I agree with my colleague, and this points to the importance of getting feedback information about why applications are being refused, having a channel to challenge ETIAS decisions, and, ultimately, scope for judicial intervention in the form of judicial review and redress for individuals where they have suffered discrimination or positive harms.
In terms of the inquiry that was being discussed at the beginning of the meeting, the European Union Agency for Fundamental Rights is very good at addressing and analysing this kind of issue, and it writes very clear reports about complex data and human rights interface problems. It would be an excellent partner to bring into a possible inter-parliamentary inquiry.
As for spotting in advance groups who would be discriminated against, the criminal justice system, following Brexit, perpetuates discrimination against foreign citizens in the UK. They are seen as a flight risk, so they are unlikely to be given bail. At the penalty stage, they are unlikely to be seen as people whose sentence in the form of community service orders or monetary penalties can be enforced—this could have been resolved prior to Brexit because of mutual legal recognition—so they are likely to end up with custodial sentences. The Government are now talking about ending all custodial sentences under 12 months, so automatically a custodial sentence for a third country national in the UK will tip them into a class of people who, under the current rigid mandatory requirements of the Home Office, will not be allowed to re-enter this country under any circumstances whatsoever. This is a case where one needs to have some element for discretion.
Nothing is straightforward. If we look at the Home Office principle of excluding people absolutely if they have a sentence of 12 months or more in a foreign jurisdiction and it will ignore that rule only when the offence is not a criminal offence in the UK, you can see immediate problems, such as those in USA states like Florida, which has very punitive and narrow abortion laws. It is quite conceivable that a doctor, or a lady who has had an abortion, may be refused entry to the UK on the basis of Florida abortion law. Strictly speaking, she should be allowed entry to Northern Ireland because Northern Ireland has taken the step of decriminalising abortion. So there would be no question about someone’s right to enter the UK via Belfast, but would they be allowed to cross the Irish Sea into the rest of the UK?
Nothing is straightforward, which is why we need to have scope for review of these automated decisions. There will be a lot of complexities like this which will be thrown up in practice.
Lord Henley: And there could even be further problems, as the criminal law in England and Wales diverges from that in Scotland.
Q105 Lord Sandhurst: My question is directed at Professor Wilson first, but do come in, Dr Vavoula.
We no longer have access to certain EU databases. In particular, I have SIS II in mind, which is a huge EU-wide security database. Indeed, it is its largest. EU members, so not now the UK, have what is called real-time data input and access to it in real time. It also tells you about people who are sought after for whatever reason, good or bad. We have lost all that, and we have lost the link-up with the UK Warnings Index. Do you agree with what I am putting to you?
Professor Tim J Wilson: Yes.
Lord Sandhurst: Good. What are the implications for the UK of that loss? What are the key gaps? Will UK ETA be able to help to put things back?
Professor Tim J Wilson: Yes. I think it was a shock for many of us when it was quite clear that SIS II was not a possibility post Brexit. I remember discussing this with a very senior member of the Commission’s legal secretariat, who made it absolutely clear that what is available only to member states and members of Schengen could not be made available to the UK.
Ireland may give us a slight back door if the opportunity is taken, but you are quite right. The UK is much more exposed now than it was before in terms of travellers from the Schengen area, where it used to have the benefits of real-time information from Schengen. The absence of information from ECRIS—the conviction database—again not in real time, depends on a member state entering it into an Interpol system, which is then transposed into a UK system. This will take time. It is cumbersome, and people will be missed, but I think the UK has no access at all to ECRIS third-party nationals—ECRIS-TCN, as it is called.
Lord Sandhurst: So do we have ordinary access?
Professor Tim J Wilson: We have ordinary access, which is EU citizens and British citizens in the EU, I think.
Lord Sandhurst: I do not mean to be discriminatory, but am I correct that that does not include someone coming from outside the EU?
Professor Tim J Wilson: Yes. Not an American convicted in Paris. That will be denied to us because we will not have that third-party information. Americans do not tend to show up in these databases, so that is probably a fairly neutral country to adopt.
There is a big gap as a consequence. When I did detailed work on extradition between the UK and EU member states and looked at the flow of hits in the Prüm DNA database system across borders, I suddenly realised that third-country nationals are a very important part of the story of what is going on in criminal justice co-operation. It is very important not to know about people simply in terms of nationality; you need to know whether there is any information about where they are travelling from. You may get someone from a third country applying to come to the UK, there is nothing in the third country database—if you have access to that—to say that they have a conviction, but there may be quite worrying conviction data held in an EU country that I do not think the UK will get access to now.
Lord Sandhurst: Will the introduction of ETA help in any respect?
Professor Tim J Wilson: It would help if the UK was given access to those databases, but, picking up Dr Vavoula’s points, the Government are not saying which databases can be used to verify the information that applicants are entering into the system when they are applying for ETIAS permission to enter the UK.
Lord Sandhurst: Dr Vavoula, what would you like to add to that?
Dr Niovi Vavoula: The loss of the UK’s access to the Schengen Information System has been documented as creating a series of delays, because, as an alternative, Interpol avenues of information exchange have been used that have been considered more cumbersome and time-consuming.
Lord Sandhurst: Is that because it is not real-time information and it is dependent on an individual country entering it on to the system?
Dr Niovi Vavoula: Yes, exactly. These have been long documented as challenges. To the best of my knowledge, the UK aspires to the development of the International Law Enforcement Alerts Platform, which will compensate for the loss of access to the Schengen Information System. It will be a single platform for UK law enforcement authorities to access and sell alerts related to people, documents and objects with international partners on a reciprocal basis, and the EU is considered to be a priority in this respect.
This may replicate some functionalities of the Schengen Information System, but it will take some years before gaining access to EU datasets; it is expected to be 2027-28 at the earliest. At the same time, there has also been significant criticism of the bypassing of EU data protection law, so the extent to which this may go forward is a bit unclear.
Apart from access to SIS, notwithstanding the fact the UK was never part of the Schengen area, it is also missing out on benefiting from new developments at the EU level. For instance, large-scale IT systems will now become interoperable. The UK could not benefit from interoperability because it only had access to Eurodac and the law enforcement branch of SIS. But, now, interoperability with complex PNR data, on which the UK participated, and Prüm data, which the UK also participated on, means that the UK is now missing out on new developments that would enhance its capability to connect the dots between border management and law enforcement data for better border security and law enforcement.
There is potential, however, because, to the best of my knowledge, a proposal for exchanges of border control data between border security authorities in the EU and in third countries. That proposal is still under negotiation, but it may be of interest to the UK to follow in the next months or years because it will make it possible for border guards to exchange real-time border control information with counterparts in third countries.
The Chair: I am struggling to understand what you are saying at the moment. Are you saying that discussion about potential collaboration on systems is taking place, or you are just saying that it would be good if they did take place? Is there some evidence that there is conversation taking place?
Dr Niovi Vavoula: A Commission proposal is being negotiated at the moment regarding the potential transfers of border control data between border control authorities in the EU to third countries. There has been a lot of criticism about the extent to which this means a violation of EU data protection law, because those transfers may take place with border guards in third countries that do not have a good enough data protection framework—for instance, with Turkish or Libyan border guards. This is for the UK to follow as an initiative, because it may also have implications for the potential of increasing co-operation with the UK border guards.
Lord Sandhurst: Just for clarification, are you talking about internal EU Commission deliberations about this before it goes externally? They are currently deliberating as to whether they might do this.
Dr Niovi Vavoula: There is a Commission proposal. There is a Bill, to put it into UK terms. There is a proposal for legislation, which means that it is subject to negotiations.
Lord Sandhurst: But this is an EU matter.
Dr Niovi Vavoula: It is an EU matter, but it may have significant implications, because it will allow the exchange of immigration data with border guards in third countries.
The Chair: That is very helpful, thank you. We will move on because time is beginning to catch up on us. Dr Vavoula, I know you are not going to respond to the next couple of questions at this stage, although you are very generously going to write to us in the next few days.
Q106 Lord Filkin: Professor Wilson, I have a question, as you have seen, about the common travel area between the Republic of Ireland and the UK, a particular product of our history and our geography. Could you address the three questions in the note on how the nature of co-operation intersects with the introduction of electronic border systems? First, what is the status of the co-operation between the Republic of Ireland and the UK on the common travel area? Secondly, what is the potential for greater co-operation? Thirdly, to what extent is further co-operation influenced by Ireland being in the EU?
Professor Tim J Wilson: This is very relevant to the last question and the EC consultation about data sharing beyond the EU to help to cover this data gap. Just like the UK, the EU has rich data inside its border, but the rest of the world has a data shortage. People are beginning to say, “We’re advancing on electronic border controls, but we’re not making the progress needed in obtaining verifiable data to use for checking what people say in their applications”.
As far as the Republic of Ireland is concerned, it has always surprised me that the common travel area is almost an afterthought; it never seems to get a lot of attention unless there are issues about whether you have a border in Ireland itself or in the Irish Sea. In many respects, it is a mini Schengen, but it is an asymmetrical mini Schengen. If there is anything on the SIS II about a person entering Ireland, wherever they are coming from, the Irish border officer has that information in real time as wide as it goes in the EU system.
The UK does not offer that, so for anyone entering the UK from a non-EU country, there may be information not picked up by the UK. They may then cross to Northern Ireland, and the Northern Ireland-Irish border is just something you can walk over. People may enter the UK with no initial intention of going to Dublin but, as planned, to go to Belfast and take the view that it is a shame not to go to Ireland at the same time.
I always hoped that the EU would say that Ireland is at a disadvantage in that respect compared with the Schengen Information System in terms of all other member states because it has this open border with a non-Schengen state. That alone should be sufficient grounds for considering whether an Irish-UK authority could be established so the Irish and UK borders could be managed in a more collaborative fashion. I am not suggesting one country takes over another, but that intelligence is shared and there is proactive collaboration between the relevant agencies in both countries.
I do not know whether that can be developed under the intergovernmental structures provided for in the Good Friday agreement, but my suspicion is the EU initiative that Dr Vavoula is talking about will take a long time. I think something along those lines will happen, but we could be a decade away. In some respects, it looks much simpler to say there is this issue with Ireland; if a positive Irish-UK approach is made, should the EU not be encouraged to think about it?
Q107 Lord Filkin: Could I ask you to comment on the relationship questions regarding the status of the co-operation between the Republic of Ireland and the UK on the common travel area and the potential for greater co-operation and to which extent? You have mentioned that is limited to some extent by the third party—the EU itself—but perhaps you would address the relationship between the two parties.
Professor Tim J Wilson: The real issue that has to be grasped is that, if the UK wants this deep collaboration with Ireland as an EU member or the EU generally, it has to track EU criminal justice border legislation. There can be no question about leaving the European Convention on Human Rights; it has to maintain data adequacy that goes much further than data adequacy inspection and determinations by the Commission than for member states, as our intelligence service activities are covered by the data adequacy decisions made within the Commission.
Very foolishly, the Johnson Government refused the offer in the draft treaty published by the European Union in March 2020 that offered the UK Government—not a UK court—the opportunity to be represented at proceedings that touched on its TCA relationship with the EU or EU member states before the Court of Justice of the European Union, or to become a party to proceedings that touch on those issues, because the issues are so entwined.
There is a very clear ruling by the Luxembourg court called Ruska Federacija, of which I expect Dr Vavoula is aware, and which I will send to the committee afterwards. That ruling makes it absolutely clear that member states have considerable discretion in many areas—including who they admit through their borders—but, where this overlaps with European law, what they agree with a third state has to be consistent with European law.
We have an effective lock around human rights and being able to shape our own law so it is not in breach of European law, where what the UK requires is dependent on European co-operation. There is also the conditionality issue: is the UK serious about the European Convention on Human Rights? Is it serious about modern data protection law? These are important issues, but I am afraid they are not really recognised in some places.
Q108 Baroness Meacher: Again, Dr Vavoula, I gather you do not want to respond orally today to the question I am now going to ask but that you will be writing to the committee; we look forward to hearing that response. For the record, the question is what are the other outstanding issues with reference to the common travel area and the ETA system, and how should those be addressed? Professor Wilson, I do not know whether you wish to respond.
Professor Tim J Wilson: I am very conscious of time, but, trying to do it as a list, there was a very interesting discussion in oral evidence, I think linked to Tony Smith, about passports and identity cards, and the States of Jersey have raised it. I will send you a note on passports and identity cards.
Again, it needs to be recognised that the EU has moved to standard identity cards. Under the TCA scheme, as a French resident, I have given my fingerprints as well as my facial image, and it is now encapsulated in the equivalent of a French identity card; it is a higher level of biometrics than a UK or French passport.
The other outstanding issue is monitoring the performance: what is going right, and what is going wrong. I am thinking particularly about ETA and ETIAS. I will send you a note if I may because effective scrutiny oversight requires information that can be categorised in terms of the system itself, and data exchange arrangements. My apologies: in my written evidence I refer to hard wiring when I meant to say hidden wiring; it is the database connectivity, which is to some extent clearer for the EU than the UK.
Another issue is management and professional staff capabilities; there is a crossover to all the problems we are seeing with Horizon and Birmingham City Council, where the inability to manage IT contracts is causing unbelievable problems, and there is a lack of candour at a management level in reporting the true situation to politicians.
It is also very important to look at staff capabilities and development. Northumbria University and the University of Derby are developing academic approaches and working with police officers, CPS, and defence lawyers to look at how their work is impinged by AI, ML, and the huge volume of digital information, which may be relevant to looking at the effectiveness of border control.
Finally, comparative research. It is very important that whatever is being done to research the ETA is being replicated—ideally in a standard package of research for ETIAS and the other systems—and that seemed to me an ideal Horizon project. I am not seeking work; I am retiring this year, either academic or calendar, so this is not me seeking work, but there are good people in academia who could make very helpful contributions over decades as electronic border management beds in.
Baroness Meacher: Professor Wilson, the committee is most grateful to you for not seeking work but maybe offering to give us some help, so thank you very much indeed, and thank you to Dr Vavoula.
The Chair: We come to our final question, and hopefully you will both contribute to it. Baroness Prashar.
Q109 Baroness Prashar: My question is about the value of passports from the security point of view. Will travelling with passports continue into the future?
Dr Niovi Vavoula: Thank you very much for this question, and thank you for your understanding in allowing me to provide my written comments on the previous two questions. In principle, I support Professor Wilson’s comments.
In reality, we should understand a passport as a legal document that allows for the identification of an individual or the verification of the identity of an individual, and as a document that allows us to understand for how long an individual can be lawfully residing or staying on a national territory in accordance with national laws.
We can think of a future whereby a passport may not have the same value as it currently has because of the introduction of new technologies that may replace what a passport can now do. For instance, in the context of the Entry/Exit System, we already know passport stamping will be abolished, which means the border guards will not have to calculate the time remaining for an authorised stay through the stamps an individual may have in their passport, but rather a digital technology will do that job for them and will inform the individual of their authorised stay accordingly. From our perspective, the function of a passport may be replaced by the Entry/Exit System.
A visa is still affixed to a passport, but there are a series of visa schemes that allow for the processing of visa data through those databases; a passport’s value is therefore partly no longer relevant. The rise of facial recognition technologies may also replace the value of the passport on that front. As I gave the example with ETIAS, potentially capturing a facial image may be enough to be compared with the facial image captured at the border crossing point; the same can also take place with a visa.
I still see some value in the passport in order to verify the facial image of the individual with the facial image on the passport. So the passport will remain relevant for now, but I see its relevance decreasing in the future.
Professor Tim J Wilson: Passports may become less important for international travel, particularly when there is something like a standardised, high-quality, EU-standard identity card; that is very much the view of the Government of Jersey, in effect.
Ironically, we can see something like internal passports emerging for security reasons. The US introduced the REAL ID Modernization Act in 2005 to implement a 9/11 Commission recommendation and driving licences issued by states are now being standardised around federal rules. In about two years, no one will be allowed to board an aircraft in the USA unless they have a foreign national passport, a Real ID Modernization Act driving licence, or perhaps a Social Security card. It is rather Soviet, but the USA is introducing effectively internal passports. I sometimes find I cannot get into buildings in the UK—such as the BBC—without producing my UK passport, so we increasingly need some kind of robust photo identification which might have other biometrics in it.
Baroness Prashar: You mentioned the question of identity cards; could they replace passports?
Professor Tim J Wilson: Yes; I do not see why not. Although, as I mentioned before, there would then be a slight gap in UK funding because the profit on passport issue is used to subsidise border controls; at least it was when I last looked at the figures from NAO data, but I will send you the figures and see if there is anything further.
Lord Filkin: Professor Wilson, could I ask one general question that you may not be able to respond to now but would be very helpful? Our inquiry has lots of rich evidence about the front end of the system—facial recognition and potential risk of queues—but we are well aware that the ability to detect people of potential concern rests on our ability to access databases that are up-to-date with relevant risk factors, which you have touched on in passing. Is there any overarching analysis of where the gaps are, by which countries, and by the nature of which risks, so we are aware of the holes in the system? Secondly, the perhaps more difficult one: how could we fill or close those gaps?
Professor Tim J Wilson: I will send a note in very quickly to the committee because I am very conscious of the speed with which you will produce the report. There is a kind of diagram issued by the Commission, which has been around since about 2016, and some of this information is in dispersed systems where the data is held in member states and not in central EU databases. Fingerprints and DNA are good examples of that.
There is not anything similar for the UK, although there should be. At one time, an organisation called ACRO—which used to be the ACPO, Association of Chief Police Officers—was the official reception point for ECRIS data et cetera and helped with visa inquiries from Canada and the USA. It used to publish a very good annual report that indicated we exchanged criminal justice data, for example, with 11 countries outside the EU for a long time. Before the reports disappeared, it went up to 13 countries. The big players in that are mostly Commonwealth Caribbean countries, but the really big player is the USA and there is a memorandum of understanding between ACRO and the FBI.
More recently, there has been some kind of intergovernmental agreement between the UK Government and the Government of India, which is very important. I do not know how they are working, but I will try to give an indication of the sort of information that might be asked for. I have not tried to get information by freedom of information requests, but requests from Members of this House are much more effective and powerful, and there is greater timeliness to the real-time information than academics can obtain.
Lord Filkin: Do you see why it is an important question for us?
Professor Tim J Wilson: Yes.
Lord Filkin: Dr Vavoula, do you wish to add anything to that question about significant data gaps relating to people of concern; either the data is not there or the systems connecting to them are not there?
Dr Niovi Vavoula: I do not have anything to add at this stage, thank you.
The Chair: We would be enormously grateful for any additional thoughts you have. I am going to bring this to a close. I have found it fascinating and, on behalf of the whole committee, thank you very much for your contributions.
This is our very last session on this issue. We have all learned a lot during our eight evidence sessions, and we still have many questions. For example, I am now beginning to wonder why the UK’s ETA scheme is not going to be a requirement for visa holders if it gives us all this additional security data. If we are going to get rid of passports, that enormously helpful information contained within a passport— looking at where people have been in recent years and months and whether that might lead us to have some suspicions—would never be in anything else, as we heard about in one of our sessions. Different forms of data are collected in a passport, an ETA, ETIAS, ID card, driving licence, or whatever.
All sorts of issues are still going through our heads, so we will be interested in our own response when we have managed to put it together. Thank you for your contributions to help us do that.
