Behind the long queues is the EU's new Entry/Exit System (EES), which replaced passport stamps and introduced face scans and fingerprint collections for non-EU citizens crossing into the EU. Technical faults and staff shortages slowed the roll-out down.
While you might've seen the queues, the EU institution and private companies behind the system are less visible. To be honest, we can't blame anyone for not closely following the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice – or eu-LISA, the mother of all EU-acronyms.
Despite being a mouthful, you should probably remember the name: Over the past seven years, eu-LISA and partners have gradually built “the most significant expansion of border surveillance in EU history,” Bárbara Simão, programme officer at the human rights group ARTICLE 19, told us.
Next to the EES, eu-LISA also develops ETIAS, a travel authorisation system for non-EU nationals from 59 visa-exempt countries. According to EU estimates, over 1.4 billion people would use ETIAS, once operational, to pre-screen before travelling to the EU.
Between 2019 and 2025, eu-LISA has built these systems by issuing contracts to private companies worth almost €2 billion. Among them are private security, technology, and defence giants like IDEMIA, IBM, and Leonardo S.p.A.
Simão and her team published a report last week detailing how these contracts were issued. They argue that eu-LISA “allows private companies to have a lot of power in designing and developing the EU's border infrastructure,” Simão explained, “turning them into gatekeepers of the systems with limited democratic accountability.”
Borders Inc.
These private companies don't just design the systems and oversee their implementation. They also function as primary advisers and resolve disputes among contractors. “The companies become the first instance for changes,” Simão continued. What she and ARTICLE 19 point out are “gaps in oversight” that risk lacking democratic accountability in the future.
Take auditing, which happens “on cycles of 3-4 years – which means that a lot can happen within that timeframe before it's ever scrutinised. Oversight is also mostly advisory,” she explained.
Another example is ”evolutionary maintenance.” If the companies detect possible ”improvements” to their systems, their requests to implement them bypass democratic oversight by the European Parliament.
This matters, as the contracted companies and eu-LISA look to scale their operations. To accommodate its vast data collection, eu-LISA has been procuring cloud services and hardware to expand its data centres. These new contracts are worth more than €900 million. Possible candidates include Amazon Web Services, Microsoft, Oracle (whose representatives also attended eu-LISA events), and more.
Developing European border infrastructure is set to remain profitable. The industry is part of the global identity management market, an industry valued at about USD 25.9 billion today, and expected to grow to USD 65.7 billion by 2034. North America holds the largest market share in 2024, at 37% – but Europe was already second, with a share of 28%.
In this new digitised border infrastructure, migration becomes a case study. Migrants cannot opt out of the biometric data collection, screening, or the databases that store this information. This data, for example collected in border controls, is centralised in a single, searchable database that is also accessible to European or national law enforcement.
Including people's data in these systems risks discrimination, including increased police checks – something that isn't just pointed out by NGO's and rights groups, but also the EU's own data protection authority.
And these systems aren't likely going to stop at our borders. “We sometimes forget how these infrastructures can be leveraged to other parts of our lives,” Simão explained. In Europe, the same companies expanding border surveillance also co-design the EU Digital Identity Wallet, a proposal for a single app that would hold all IDs, driver’s licenses, and social security documentation of EU citizens. The contracted companies also build biometric systems worldwide, including in Morocco, Chile, and Colombia.
We reached out to eu-LISA and relevant companies for comment, but did not receive a response by our editorial deadline.