Let’s talk about the last time a border guard stamped your passport.
Maybe you still have it somewhere. A page of ink, a date, an airport code, an officer’s handwriting. Slightly crooked. Nobody designed it. It was a receipt for a human decision — somebody looked at you, looked at the document, and decided you could come in.
That thing is finished.
Not everywhere, and not all at once, but at the Schengen border it’s effectively done. Europe spent last October to April switching on its Entry/Exit System, and since April it has been fully running. You walk up to a kiosk. You put your fingers on the glass. You look at the camera. The machine matches you to the passport in your hand and writes a record — your name, your document number, your face, your prints, the exact minute you arrived, the exact minute you leave.
The stamp is a database row now. And the database row lives for three years.
Picture a man from Johannesburg landing in Frankfurt for a Tuesday morning meeting. He’s done this trip eleven times. He knows which gate, which train, which coffee. He gets to the kiosk, does the fingers, does the face, waits. The light goes amber. It goes red.
Now he’s standing in a side room with a plastic chair and no explanation, because there is no explanation to give him. There’s no letter. There’s no reference number. There’s no officer who made a finding he can disagree with. The system didn’t rule against him. It produced a state, and the state is “not matched.”
His meeting starts in forty minutes. It’s not going to happen. And here’s the part that should bother you more than the camera did — nothing in that chain did anything wrong, and nobody is accountable for the outcome. The fingerprint reader was dirty. The light was bad. His finger was dry from eleven hours in the air. A probability crossed a threshold in the wrong direction, and the only person who pays for that is the man in the plastic chair.
Now, everyone has spent two years arguing about whether facial recognition at borders is ethical. That argument is real, but it’s not the mechanism. The mechanism is retention plus the absence of a decision document.
A visa refusal is a document. A denied entry is an act by a named official under a named power, and you can push back on it. This isn’t that. This is enrolment. The system isn’t deciding whether you may enter — your visa did that. It’s deciding what to remember about your body, and for how long, and who gets to query it.
Three years is a long time. Long enough to outlive the trip, the job, the reason you flew. Long enough that your face sits in a European database through the next two versions of whatever this becomes. And the query access isn’t just border guards. Law enforcement gets in under conditions. The conditions are written down. The practical question — can you find out whether you were queried, and by whom — has an answer, and the answer is no.
Then there’s the second half, which is the part most people haven’t clocked. Before the end of the year, the Commission intends to switch on ETIAS — the pre-travel authorisation for the visa-free world. British, American, Australian, Japanese, Canadian. You apply online, you pay a fee, a system screens you against databases before you’ve packed, and the authorisation attaches to your passport for three years.
On its own, that’s paperwork. Layered on top of a biometric enrolment system that already exists, it’s something else. Now the permission and the body record are joined. The state knows who was cleared, when, on which document, and has your face on file to confirm it was you who showed up.
That’s efficient. It’s also the first time mass movement has required surrendering identity rather than proving a claim.
Here’s the distinction that matters, and it’s the one almost nobody in this debate is making. There are two completely different things you can do with a person at a border.
You can verify: is this the person on this passport, and does this passport have permission. Check it, answer yes or no, and throw the check away. That’s proof without retention. The traveller gets a receipt, the state gets an answer, and nothing is left on disk.
Or you can enrol: capture the body, keep it, and build a searchable history of a human being’s movement.
We chose the second one, and we chose it because it’s operationally easier, not because it’s necessary. Verifiable credentials can prove “this is a valid visa for this person” without the border keeping the face. That architecture exists. It’s been shipping in other sectors for years. It’s not here because a searchable database is more useful to the people who hold it.
So what do you actually do with this.
If you travel for business — and this is the boring, practical part — stop treating arrival as a fixed cost. The biometric step is now a system dependency with a failure rate, and the failure lands on you. Build two hours of slack into any itinerary where a meeting matters. Don’t book the thing that pays for the trip ninety minutes after landing. Carry a second form of proof of your movements — boarding passes, hotel confirmations — because if the record is wrong, you’re the one who has to reconstruct the truth.
If you build systems — the lesson is sharper. Verification and retention are not a policy choice you make later. They’re an architecture choice you make on day one, and retention is always the default because it’s the easier build. Every system that touches a person should be able to answer three questions: what did we check, what did we keep, and can the person see the answer. If the third one is “no,” you didn’t build verification. You built a file.
And if you’re the person on the other side of the glass, in the queue, with your fingers on the reader — the thing worth holding onto is smaller and more stubborn than a policy argument. A border is one of the last places where a human has to prove who they are with their actual body. That’s not a technical inconvenience. It’s the last honest form of proof we have.
Which is exactly why it shouldn’t become the most permanent record we keep.
He got through in ninety seconds, in the end. Somebody waved him past the desk. He made the meeting with four minutes to spare and never mentioned it to anyone.
He’ll never know what the machine wrote down.