Reference

Glossary of airport security and border terms

Airport security and border control use many acronyms. API and PNR are passenger data that airlines send to governments ¹. An eGate reads a chip passport and compares the traveller's face with the photo stored on it ³. EES and ETIAS are new EU border systems ^6,7. Annex 9 and Annex 17 are ICAO rulebooks for border formalities and aviation security ^11,12. This glossary defines 58 such terms in one or two plain sentences each, as of 19 October 2026.

Last checked: 19 October 202625 sources

How to use this glossary

Terms are listed in alphabetical order. Each definition draws on the body that sets the rule or runs the system, such as ICAO, the European Commission, IATA, Interpol or a national agency. Where a term has a legal definition, we give it in plain words and cite the text ^1,3¹⁶.

Some terms mean slightly different things in different countries. A watch list in one country may hold different data from a watch list in another. Check the national law where it matters ²¹.

Terms A to Z

Definitions are current as of 19 October 2026. The numbers in brackets point to the sources listed at the foot of the page.

Term	Meaning
1:1 verification	A check of one person against one stored record, such as a face against the photo in that person's passport chip. NIST tests this as a separate task from 1:N searches ¹⁵.
1:N identification	A search of one face or fingerprint against a large database of many people, called a gallery, to find who the person is or whether they are on a list ¹⁵.
ABC gate	Automated Border Control gate. ICAO defines it as an automated gate for travellers holding electronic machine readable travel documents ³.
Annex 9	The ICAO annex on Facilitation. It sets standards and recommended practices for clearing aircraft, passengers and cargo through customs, immigration, health and agriculture checks ¹².
Annex 17	The ICAO annex on Aviation Security. Its standards are what ICAO audits under USAP-CMA ¹¹.
API	Advance Passenger Information. Passenger and crew details, travel document data and flight details that airlines send to border authorities before departure or arrival ¹.
AVSEC	Short for aviation security. ICAO and national regulators use it as a label for security programmes, rules and audit work.
Biometric data	Under the GDPR, personal data from a technical process applied to a person's body or behaviour that allows or confirms their unique identification, such as a face image or fingerprints ¹⁶.
Biometric template	ICAO defines it as extracted and compressed data taken from a biometric sample. Systems compare templates, not raw photos ³.
Board or no-board message	The answer a government sends to an airline through iAPI telling it whether a passenger may board. It can arrive within seconds of check-in ^1,22.
BOT	Build-Operate-Transfer. A public body lets a private firm build and run a facility or system for a set period, after which it passes to the public body ¹⁹.
Concession	A long-term right for a private firm to run public assets and earn most of its revenue from users. The assets return to the public body at the end of the term, which often runs 25 to 30 years ¹⁹.
CSCA	Country Signing Certification Authority. The top national authority whose certificates let other countries check that an ePassport chip was signed by the issuing state ³.
CT scanner	A computed tomography X-ray machine for bags. It makes 3D images that screeners can rotate, and its software can flag explosives automatically ¹⁴.
Data controller	Under the GDPR, the person or body that decides why and how personal data is processed ¹⁶.
Data processor	Under the GDPR, a person or body that processes personal data on behalf of the controller, such as a vendor running a system for a ministry ¹⁶.
Diffusion	An Interpol request for cooperation that one member country's National Central Bureau sends directly to others, without a formal notice ¹⁰.
Doc 9303	ICAO's specifications for Machine Readable Travel Documents, in 13 parts. The eighth edition dates from 2021 ^3,5.
DPA	Data protection authority. The GDPR calls it a supervisory authority: an independent public body in each EU member state that monitors how the law is applied ¹⁸.
e-visa	A visa applied for, paid for and issued online. The traveller presents the approval, linked to their passport, at the border.
EES	Entry/Exit System. An EU system that records non-EU short-stay visitors each time they cross the external borders of 29 European countries, with their fingerprints and face. It replaced passport stamping on 10 April 2026 ⁶.
eGate	A self-service gate that reads a traveller's ePassport and compares a live face image with the photo on the chip. ICAO calls these ABC gates ³.
eMRTD	Electronic Machine Readable Travel Document. A passport, visa or card with a contactless chip that supports biometric identification of the holder ³.
ePassport	A passport that is an eMRTD. Its chip holds the holder's details and photo, signed digitally by the issuing state ^3,4.
ETA	Electronic Travel Authorisation. The UK version lets visitors from many visa-free countries travel for up to six months and costs 20 pounds as of 19 October 2026. It does not guarantee entry ⁸.
ETD	Explosives trace detection. Staff wipe a bag, item or hands and a machine tests the sample for tiny amounts of explosives or narcotics ²⁴.
ETIAS	European Travel Information and Authorisation System. A planned pre-travel authorisation for visa-free visitors to 30 European countries. As of 19 October 2026 it had no start date and a planned fee of 20 euros ⁷.
EU PNR Directive	Directive (EU) 2016/681, adopted on 27 April 2016. It governs the use of PNR data to prevent, detect, investigate and prosecute terrorism and serious crime in the EU ²³.
False match rate	In biometrics, the share of comparisons between two different people that a system wrongly declares a match. Testers report it alongside the false non-match rate ¹⁵.
FNIR	False Negative Identification Rate. In a 1:N search, the share of people who are in the gallery but whom the system fails to return as a match ¹⁵.
FPIR	False Positive Identification Rate. In a 1:N search, the share of people who are not in the gallery but whom the system still returns as a possible match ¹⁵.
Gallery	The set of enrolled records that a 1:N search runs against, such as a watch list or a database of visa photos ¹⁵.
GDPR	The EU General Data Protection Regulation. It sets rules on processing personal data, including the duties of controllers and processors ¹⁶.
Hold baggage screening	The screening of checked bags before they go into the aircraft hold. EU rules list it as one of the common basic standards of aviation security ¹³.
I-24/7	Interpol's secure global police communication system. Border officers use it to query databases such as SLTD ⁹.
iAPI	Interactive API. Airlines send passenger data to border authorities in real time at check-in, and the authority sends back a board, no-board or advisory answer ¹.
INTOSAI	The International Organization of Supreme Audit Institutions. Nearly every national audit body belongs to it, and it sets international public audit standards ²⁰.
LAGs	Liquids, aerosols and gels. EU regulations adopted since 2009 set extra rules on carrying these through security ¹³.
Liveness detection	Checks that a biometric sample comes from a live person present at the sensor, not a photo, mask or video. Standards call this presentation attack detection.
MRZ	Machine Readable Zone. A fixed area on a travel document that holds the holder's data in a format machines read with optical character recognition ³.
No-fly list	A list of people barred from boarding aircraft. In the United States it is a small subset of the federal terrorism watchlist ²¹.
Overstayer	A traveller who stays longer than permitted. The EES lets EU authorities detect overstayers automatically ⁶.
Passenger Data Single Window	A single entry point where airlines and other carriers submit passenger data once to meet the rules of several national authorities ¹.
Personal data	Under the GDPR, any information about an identified or identifiable living person, such as a name, ID number or location ¹⁶.
PIU	Passenger Information Unit. The national authority that collects, stores and processes API and PNR data and passes results to police and border agencies ².
PKD	Public Key Directory. The ICAO PKD is a central store where states share the certificates needed to check that ePassport chips are genuine ^3,4.
PNR	Passenger Name Record. Booking data held by airlines, such as itinerary, contact details, ticket and baggage details ¹.
PPP	Public-private partnership. A long-term contract in which a private firm finances, builds or runs a public service. Concessions and BOT deals are common types ¹⁹.
Red notice	An Interpol notice asking police worldwide to locate and arrest a person wanted for prosecution or to serve a sentence ¹⁰.
Regulation (EC) 300/2008	The EU framework law on civil aviation security. It sets common basic standards, including screening of passengers, cabin bags and hold bags ¹³.
Retention period	How long data may be kept. The GDPR says personal data must not be kept in identifiable form longer than needed for its purpose ¹⁷.
SAI	Supreme audit institution. An independent national body that audits government spending, such as the GAO in the United States or the NAO in the United Kingdom ²⁰.
SLTD	Interpol's Stolen and Lost Travel Documents database. It held about 138 million records of stolen, lost, revoked or invalid documents as of 19 October 2026 ⁹.
Sole source	A contract awarded to one supplier without open competition. Public buyers usually need a stated legal reason to do this.
Swiss challenge	A procurement method where a firm's unsolicited proposal is published and rival firms may submit competing bids ²⁵.
USAP-CMA	ICAO's Universal Security Audit Programme Continuous Monitoring Approach. It checks member states against Annex 17 and the security standards of Annex 9 and follows up on fixes ¹¹.
User fee	A charge paid by the people who use a service, such as passengers, to fund it. Some border system proposals rely on user fees ²⁵.
Visible Digital Seal	A digitally signed seal on a document that states can check with data shared through the ICAO PKD ⁴.
Watch list	A list of people of interest that screening systems check names or biometrics against. In the United States a single federal terrorism watchlist is kept by the Threat Screening Center ²¹.

How the terms connect

Many of these terms describe one journey. An airline sends API and PNR to a country's PIU, often through a single window, and may receive a board or no-board answer through iAPI ^1,2. At the border an eGate reads the MRZ and the ePassport chip, checks its signature with certificates from the PKD and runs a 1:1 face check ^3,4.

Rules and oversight sit around this. ICAO sets standards in Annex 9 and Annex 17 and audits them under USAP-CMA ^11,12. In the EU, the GDPR sets the duties of data controllers and processors, and national DPAs supervise them ^16,18. National audit bodies, or SAIs, check how public money is spent on these systems ²⁰.

Common questions

What is the difference between API and PNR?

API is passport and flight data sent to border authorities before a flight. PNR is the booking record an airline holds, such as itinerary and contact details ¹.

Is an eGate the same as an ABC gate?

Yes. ICAO uses the term Automated Border Control gate, and many airports call the same machines eGates ³.

Are EES and ETIAS the same thing?

No. EES records entries and exits of non-EU short-stay visitors and has fully replaced passport stamps since 10 April 2026 ⁶. ETIAS is a planned pre-travel authorisation and had no start date as of 19 October 2026 ⁷.

Who checks that countries follow ICAO security rules?

ICAO audits member states under USAP-CMA against Annex 17 and the security standards of Annex 9 ¹¹.

Sources

Spotted an error? Write to [email protected]. See how we work on the methodology page.