A company called Clear is using fingerprints and iris scans to spare passengers the first phase of the T.S.A.’s security airport screening process — the document-verification checkpoint and its line. https://www.nytimes.com/2017/09/08/business/airport-security.html

Clear says it can move fliers through checkpoints while maintaining tight security. But the rollout process has been slow — Clear is available only in some terminals at 24 domestic airports — an earlier iteration of the company had a data security issue.

The core of Clear’s business is biometric security, using scans of body parts to verify identity. To enroll, people submit to fingerprint and iris scans at the company’s airport kiosks. The data is captured and stored electronically. Before each flight, Clear customers are prescreened by the T.S.A., like other travelers. But at an

9 airport where Clear is operating, instead of handing passports or driver’s licenses to Subscriber login kiosks. They then walk through a dedicated lane that leads directly to T.S.A. body

and carry-on bag scanners, where they undergo physical screening. There they might encounter a line, typically a shorter one.

The T.S.A. “oversees and actively tests Clear’s technology,” Lisa Farbstein, a T.S.A. spokeswoman, said in an email. The company’s technology is certified by the Department of Homeland Security as part of the Support Anti-Terrorism by Fostering Effective Technologies Act.

The biometrics used by Clear are an improvement over the traditional method of identity verification because they lessen “the human error factor,” said John Pistole, former chief of the T.S.A. “People make mistakes from time to time,” he said. (Mr. Pistole is now a member of the Director of National Intelligence Senior Advisory Group, president of Anderson University in Indiana and a paid adviser to American Airlines and to an airport-security start-up called Evolv Technology.)

Since Apple installed fingerprint readers on the iPhone in 2013, biometric screening has become commonplace. It is used by credit card companies and in consumer products like gun safes.

But in 2003, when Clear was founded, biometric technology was rarefied, known to the public mostly through science fiction films. The company, originally called Verified Identity Pass, filed for bankruptcy in 2009, a year after it temporarily lost a laptop with enrollees’ unencrypted personal information. Verified Identity Pass claimed there had been no security breach, but the T.S.A. required it to encrypt all sensitive personal data and submit to an independent audit before it could resume customer enrollments.

The newfangled nature of the technology was part of the company’s problem, along with a heavy debt load and high operating expenses, said Caryn Seidman Becker, who bought the business in 2010 with Ken Cornick. They had earlier started a hedge fund that closed in the midst of the 2008 financial crisis.

They changed the company’s name to Clear and restarted the business, taking

steps to cut costs and improve efficiency. Verified Identity Pass had been licensing process at airports to 1.5 seconds from five seconds, they said.

The company is making money, Ms. Seidman Becker and Mr. Cornick said, but they wouldn’t disclose how much. Last year, Delta bought 5 percent of Clear. Earlier this year, T. Rowe Price invested $15 million.

Clear operates in 24 airports and seven sports arenas and stadiums, including Citi Field and Yankee Stadium. The partners say Clear has more than one million subscribers, up from the 190,000 they inherited.

In May, Delta began using Clear’s biometric technology for boarding passes at Ronald Reagan Washington National Airport. Fingerprint scans also give Clear members who are Delta passengers entry to airline lounges and are expected to soon allow them to check bags and forgo paper boarding passes at security checkpoints. Delta SkyMiles passengers receive discounts on Clear memberships.

Undiscounted memberships cost $179 per year. Other less-pricey programs also give travelers expedited passage through airport security and are more widely available. For instance, T.S.A. PreCheck costs $85 for five years and is available at 200 airports, and JetBlue passengers can pay $10 per flight to use a faster lane at more than 60 airports.

Still, frequent travelers might appreciate the time savings offered by Clear, which ushers its customers ahead of the T.S.A.’s standard document verification checkpoint as well as the T.S.A. PreCheck checkpoint. Spouses of Clear members can join for $50 and there’s no charge for children under 18 who fly with a subscriber.

Ms. Seidman Becker and Mr. Cornick hope to extend Clear’s reach further. They say the company’s technology could be used to make purchases in stores, ride elevators programmed to stop at a subscriber’s usual floor, get pharmaceutical prescriptions filled and verify a person’s age at bars.

But such notions give pause to internet security experts. “If you’re taking this from airports to bars and retail, how are you locking down your systems to not open 9 them up to attacks?” asks Alvaro Bedoya, executive director of the Center on Privacy run tighter security than folks who ID people at bars.”

One effective way of safeguarding privacy is to convert the raw fingerprints and iris scans into impenetrable ID codes, said Joseph Lorenzo Hall, chief technologist for the Center for Democracy and Technology, a nonprofit internet privacy group. Companies should verify each person’s identity against the stored code, or “hash,” rather than the actual fingerprint or iris scan, he said, and the data should be double-encrypted.

Ms. Seidman Becker said Clear used “multiple systems of proprietary technology” to protect against security breaches. She declined to describe the systems other than to say they involve double encryption. “We spend a tremendous amount of time and capital on keeping customers’ data private and secure,” she said.

If a breach involving raw biometric data were to occur, the consequences would be profound, Mr. Hall said: “Once the raw data is out there, it’s very hard to put the genie back in the bottle.”

Correction: September 9, 2017

An earlier version of this article referred imprecisely to the history of Clear. An initial iteration of the company declared bankruptcy and new owners bought its assets; it was not an early stage of the company. The article also misstated the extent of data security problems at that earlier iteration of Clear. It had a single incident; it wasn’t plagued by

problems.