Connecting the fragments: why passenger data and frontline operations must work as one

A recent seizure at Delhi airport shows how targeting, observation and examination produce results together that none of them would achieve alone, and why the same logic must extend across every agency at the air border.

On 9 September, Customs officers at Indira Gandhi International Airport in Delhi intercepted a consignment that shows how modern border control works when its components are connected. According to published reports, two passengers arriving from Bangkok were flagged through Advance Passenger Information (API) profiling and placed under surveillance, while their checked baggage was monitored. As the operation unfolded, officers saw two other travellers, who had arrived on a separate flight from Kathmandu, moving to collect the Bangkok passengers’ bags. The Kathmandu travellers were stopped at the Green Channel and admitted they had been instructed to pick up the luggage.

The Bangkok passengers were then intercepted, and X-ray and physical examination of the baggage revealed 27.45 kg of suspected hydroponic cannabis.

The quantity is significant, but the method is more instructive. Examined separately, each element of the case would have told only part of the story. The Bangkok passengers, the Kathmandu collectors and the baggage connecting them were each incomplete pieces of evidence, and the result came from linking them. The operation was conducted by Customs, which shows how much profiling, surveillance and examination can achieve when integrated within a single service. The same approach is far more powerful when it is applied across the several agencies that share responsibility for an airport. That requires Passenger Information Units (PIUs), Customs, Immigration, Police and Airport Authorities to cooperate in a structured way.

From data to operational opportunity
A PIU sees what frontline officers cannot: the shape of a journey before the traveller arrives. This capability now rests on an international normative basis. United Nations Security Council Resolution 2396 (2017) obliges States to develop the capacity to collect, process and analyse Passenger Name Record (PNR) data. In 2020, the International Civil Aviation Organisation (ICAO) adopted Amendment 28 to Annex 9 to the Chicago Convention, establishing Standards and Recommended Practices (SARPs) on the collection, use, processing and protection of PNR data, alongside the obligation for States to operate API systems.

The two data sets answer different questions. API establishes the identity of who is actually on board a given flight and generally becomes available around the time of departure. PNR shows how the trip was put together: who booked alongside whom, when and how the ticket was paid for, which contact details were provided, whether the itinerary changed and, where the carrier records it, baggage details. Read together, they expose routings, booking behaviour, travel histories and associations between passengers that are invisible in the arrivals hall.

Flagging a journey of interest is only where the work begins. An analytical product has value only if it reaches the operational level in time, and in a form that frontline officers can act on. Surveillance, baggage tracking, Immigration checks, Customs examination and behavioural observation then test the initial assessment, confirming it, contradicting it or widening it. In Delhi, the analysis pointed to two travellers from Bangkok. The case changed once officers saw passengers from a different origin approach the same baggage, and from that point the task was mapping relationships rather than profiling individuals.

Targeting relationships, not only individuals
Conventional targeting asks questions about the individual: identity, origin, itinerary and the presence of known risk indicators. These remain indispensable, but criminal networks seldom operate through lone actors. The courier, the facilitator, the collector and the organiser may travel on different flights and routes, and they usually take care to appear unconnected. Often the link between travellers reveals more than anything about a single passenger.

The Delhi seizure appears to fit a wider pattern. In May, Customs at the same airport reported a case in which a traveller arriving from Bangkok was placed under observation, and a passenger arriving from Sharjah later admitted he had been told to collect a suitcase booked under the Bangkok passenger’s name. When the same division of roles appears twice in a few months, it can no longer be treated as a one-off, and it can be converted into indicators. Examples include:

• travellers from different origins converging on the same terminal within a narrow time window;
• passengers waiting at a reclaim belt allocated to a flight they were not on;
• baggage checked in by one person and handled by another;
• the combination of arrivals with heavy checked baggage and others with none.

No single indicator is conclusive. Combined with passenger data, they help concentrate surveillance resources on the relationships most likely to matter.

Advanced targeting therefore needs to move from assessing individuals to analysing links and networks. A traveller who attracts no attention alone may become central once associated with another passenger, a particular bag, a recurring booking pattern or an observation made on the ground. These elements are rarely held in one place. The PIU may detect the link in the booking data, Customs the baggage anomaly and Immigration the inconsistency in a traveller’s account. The Police may already hold intelligence on associates, and the Airport Authority may have the CCTV footage (closed-circuit television) or baggage-system records that tie them together.

Surveillance as a shared capability
The operational phase of a case like Delhi depends on keeping people and baggage under uninterrupted observation from the aircraft stand to the terminal exit. At most airports, the capabilities needed for this are distributed among several actors.

Airlines and ground handlers hold the check-in and bag-tag records that tie each item of baggage to the passenger who checked it in, and they control its loading and unloading. The airport operator usually manages the CCTV network, the baggage handling system, the reclaim belts and access control between airside and landside. Immigration officers encounter every arriving passenger at the primary line, where they can verify identity against the passenger data and observe behaviour. Where procedures permit, they can also manage the timing of a passenger’s progress without alerting them. Customs controls the exit channels and holds the examination tools, including X-ray screening, detector dogs and the power to search and seize. The police or specialised drug enforcement units generally hold mobile surveillance capacity, arrest powers beyond the border zone and the investigative lead once a case moves landside. Throughout, the PIU remains the analytical reference point. It can run fresh queries as events develop, for example to check whether newly identified collectors share bookings, contact details or travel history with the original subjects.

Any of these links can fail. A bag that cannot be followed through the baggage system, camera coverage that cannot be accessed in real time, or a surveillance team whose authority ends at the terminal doors can limit an operation that began with excellent analysis. Continuous observation is a collective capability, and it has to be planned and rehearsed as one. It cannot be assembled at short notice while the subjects are already walking through the arrivals hall.

Observe or intercept: the decision that must be prepared
Relational targeting raises a question that individual targeting seldom does: when to intervene. Stopping a flagged passenger at the first opportunity secures the evidence and removes the immediate risk, but may catch only the courier. Letting the operation run, as in Delhi, where the collectors were allowed to take the bags and were followed before being stopped, can expose additional members of the network, at the cost of a higher risk of losing the subjects or the goods. Extending observation beyond the airport can reach recipients and organisers further up the chain. Controlled delivery requires legal authorisation, prosecutorial involvement and landside surveillance capacity to be in place beforehand.

Choices of this kind cannot be made reliably in the few minutes available on the arrivals floor. Standard Operating Procedures (SOPs) should settle in advance the criteria for each option, who has authority to decide, which agencies must be informed and what happens if contact with the subjects is lost.

Structure rather than improvisation
This is where cooperation and genuine interoperability differ. In many airports, agencies work together when a case calls for it. Officers know each other, information flows informally, and joint action is arranged as needed. This can succeed, but it depends on personal relationships rather than on procedure, and it tends to weaken when people move on.

A more robust model rests on defined arrangements. These should establish:

• how a PIU disseminates an operational lead and to whom;
• how urgency is graded, from immediate action on an inbound flight to longer-term analytical work;
• which agency coordinates an intervention and holds command while it is underway;
• how operations are deconflicted when another service is already investigating the same individuals;
• what information may be shared, and on what legal basis;
• how results are reported back to the analysts.

Joint airport units, in which officers from different agencies work in a common operational space under shared procedures, are one practical way of turning such rules into routine. Data protection must be part of the design from the start. The ICAO PNR SARPs set safeguards on purpose limitation, retention, onward transfer and independent oversight, and sharing arrangements built around them are both more sustainable and more defensible before a court than informal exchanges.

The goal is not simply to exchange more information. It is to establish an operational cycle in which information reaches the right place at the right moment: analysis prompts action, action produces fresh intelligence, and that intelligence sharpens the next round of analysis. Without such a cycle, passenger-data systems risk becoming analytical archives, while frontline services continue to react case by case.

Closing the loop through feedback
Feedback is the part of the cycle most often neglected. When a passenger identified by a PIU is controlled, the outcome frequently disappears into another agency’s reporting system, and the analysts never learn what the intervention produced. They need to know:

• whether the assessment was accurate and whether anything was found;
• whether the passenger was linked to others;
• whether a new concealment method came to light;
• whether routes, telephone numbers, addresses, financial connections or travel patterns emerged;
• whether the result was a false positive.

Anecdotal feedback is not enough. Each disseminated lead should generate a minimum standard record covering the action taken, the outcome, the indicators that proved relevant and any new associations identified. That record allows simple measures to be tracked over time, such as the hit rate, the false-positive rate and the interval between alert and action.

Positive outcomes refine targeting rules and open further lines into a network. Negative outcomes are just as useful, because they allow weak indicators to be discarded and spare legitimate travellers unnecessary controls. Intelligence then works as a learning system rather than a one-way flow.

One journey, one operational space
The Delhi case also shows why no agency should examine only the segment of a journey that falls within its own remit. For a criminal organisation, passenger data, border checks, baggage, airport surveillance, Customs examination, police intelligence and follow-up investigation are not separate domains. These boundaries exist in administrative charts, while networks move freely across them. The same is true of the divisions between passenger and cargo flows, between airports and land borders, and between pre-arrival targeting and post-seizure investigation. The more these areas are joined up, the better the chance of detecting patterns that no single system can reveal.

What the case teaches
The value of the Delhi seizure lies less in the quantity recovered than in what it shows about connected capabilities. Passenger data opened the opportunity, observation on the ground developed it, the movement of baggage exposed further relationships, and coordinated action turned information into an interception. This is the practical advantage of an integrated border-control model.

PIUs should not operate as detached analytical cells, and frontline services should not be passive recipients of occasional alerts. Both belong to a single intelligence and operational system. Building that system depends on capacity as well as procedure: officers from different agencies need to train together, review cases jointly and practise the handovers on which a live operation relies. When clear procedures, defined responsibilities, trusted channels and systematic feedback support that relationship, the combined system achieves far more than its individual parts.

Intelligence that never leads to action achieves little, and action without intelligence remains reactive. The best results come when the two are joined through cooperation that is structured, continuous and genuinely interagency.

By Cristian Fanelli, Law Enforcement Expert, United Nations Office on Drugs and Crime (UNODC), Border Management Branch – Passenger and Cargo Control Programme