The FBI maintains a huge database of more than 411m photos culled from sources including driver’s licenses, passport applications and visa applications, which it cross-references with photos of criminal suspects using largely untested and questionably accurate facial recognition software.
A study from the Government Accountability Office (GAO) released on Wednesday for the first time revealed the extent of the program, which had been queried several years before through a Freedom of Information Act request from the Electronic Frontier Foundation (EFF).
The GAO, a watchdog office internal to the US federal government, found that the FBI did not appropriately disclose the database’s impact on public privacy until it audited the bureau in May. The office recommended that the attorney general determine why the FBI did not obey the disclosure requirements, and that it conduct accuracy tests to determine whether the software is correctly cross-referencing driver’s licenses and passport photos with images of criminal suspects. The Department of Justice “disagreed” with three of the GAO’s six recommendations, according to the office, which affirmed their validity.
The audit came at the request of Minnesota Democratic senator Al Franken. Images of faces are protected personal information under US law. The Privacy Act of 1974 limits the collection, disclosure and use of personal information and requires agencies to disclose what kinds they are using, generally about whom and how.
The FBI did not publish such disclosures, according to the report. The FBI’s system searches not just its own database, but also photo databases maintained by seven participating states, the US Department of State – which issues passports – and the US Department of Defense, shared among federal law enforcement agencies and the participating agencies, though access on the state level is obtained through the FBI.
Initial queries about the program from the EFF, Franken and others referred to the Next Generation Identification-Interstate Photo System (NGI-IPS, or NGI), which allows the FBI and some state and local agencies to cross-reference surveillance camera footage and other photographs with its collection of candidate photos.
But the GAO report found a much larger program, run by the criminal justice information services division of the FBI (CJIS), called Facial Analysis, Comparison and Evaluation, or Face, which “conducts face recognition searches on NGI-IPS and can access external partners’ face recognition systems to support FBI active investigations”.
Beyond simple privacy concerns, said EFF senior staff attorney Jennifer Lynch, is the question of the accuracy of the comparisons between photos of suspects and photos of law-abiding citizens used by the FBI for criminal investigations.
“The FBI has done very minimal testing on the accuracy of their internal system,” Lynch told. “We submitted a Foia request and asked about NGI; in the records we received they hedged. They guaranteed 80%, maybe 85% accuracy if the candidate is in the top 50 responses – so basically what they’re saying is that it’s highly inaccurate! And as the database gets larger, the accuracy goes down.”
The FBI “did not include all possible candidate list sizes and did not specify how often incorrect matches were returned”, according to the GAO report. No information on how often the database returns false positives is currently available. Testing of the ability of NGI to return accurate results, said Lynch, is minimal; testing on the ability of partner systems to return accurate results through Face, according to the report, is nonexistent.
The reason state governments currently keep detailed facial recognition databases from driver’s licenses, said Lynch, is to stymie identity theft and other crimes. “Data that’s being collected for one purpose is being used for a very different purpose and that’s not the way we operate in our democratic system,” she said.
“It’s one thing to develop a system that is made to detect fraud,” Lynch said. “If you have a false positive in a fraud situation, that may mean that somebody has to come down to the DMV and provide further information before they get their new driver’s license. That’s a pain, but it’s not equivalent to being arrested and having to explain yourself to a law enforcement officer while you’re sitting in jail.”
In response to a request for further comment, the DoJ referred to its response letter at the end of the report, in which it said: “The FBI believes GAO staff does not fully appreciate the nature of its face recognition service as being utilized for investigative leads only and not positive identifications.”
The FBI said it believed previous disclosures were adequate and that its searches for leads in criminal cases of records acquired from civilians by DMVs and passport offices were “in strict compliance with federal and state law”.
