New Report Reveals Scope of FBI's Covert Facial Recognition Program

The FBI is using a dubious facial recognition system and a database of hundreds of millions more photographs than previously thought to hunt for criminal suspects, according to a new report by the Government Accountability Office (GAO).

The massive database houses roughly 411 million photos amassed from sources such as driver's licenses, visa applications, biometrics data, and passport applications, as well as surveillance camera footage, the GAO found in its report (pdf).

That number also includes 30 million civil and criminal mugshots--but, as Electronic Frontier Foundation (EFF) senior staff attorney Jennifer Lynch wrote in a blog post on Wednesday, the vast majority "are of Americans and foreigners who have committed no crimes."

FBI officials did not report the potential civil liberties impact of the program until the audit, which breaks both agency policy and federal law, according to the GAO, which noted that 1974 Privacy Act limits the collection of personal data and requires agencies to disclose what kinds of information they are using.

The GAO began its audit to look into a program called the Next Generation Identification-Interstate Photo System (NGI-IPS or NGI), but found instead that NGI was part of a much larger operation known as Facial Analysis, Comparison, and Evaluation (FACE) Services. While the FBI was known to be using facial recognition software, the new report reveals the scope of the program.

The investigation gave some long-awaited answers to the EFF, which previously sought information about the NGI program through a FOIA request. Lynch wrote that, in addition to the revelations about just how many photos the FBI has access to, the agency "has been hiding this fact from the public--in flagrant violation of federal law and agency policy--for years."

The FBI uses its photo database, as well as those of other agencies including the U.S. Department of State and the U.S. Department of Defense (DOD), to cross-reference images of criminal suspects. But the wide scope of the program raises questions about its level of accuracy.

Lynch wrote:

The FBI has conducted only very limited testing to ensure the accuracy of NGI's face recognition capabilities. And it has not taken any steps to determine whether the face recognition systems of its external partners--states and other federal agencies--are sufficiently accurate to prevent innocent people from being identified as criminal suspects. As we know from previous research, face recognition is notoriously inaccurate across the board and may also misidentify African Americans and ethnic minorities, young people, and women at higher rates than whites, older people, and men, respectively.

The FBI "did not specify how often incorrect matches were returned," the report states, adding that there was no information available about the rate of false positives.

As Lynch explained to the Guardian, detailed facial recognition information collected from driver's licenses is typically kept for cases of identity theft. "Data that's being collected for one purpose is being used for a very different purpose and that's not the way we operate in our democratic system," she said.