The FBI’s high-tech facial-recognition system, which can now search through databases containing hundreds of millions of photos, has not been sufficiently tested for accuracy nor assessed in a timely way for privacy violations, Congress’s watchdog agency said in a report this week.
The Government Accountability Office (GAO) on Wednesday released a report on what is known as the Next Generation Identification-Interstate Photo System, which allows law enforcement agencies to search a federal database containing 30 million images for criminal suspects.
The GAO also reviewed the role of an internal FBI unit called Facial Analysis, Comparison and Evaluation, or FACE, which has access to other federal and state databases. In total, the searchable databases contain 411 million photos.
“We didn’t know the about the extent of the FBI’s interface with the states’ Department of Motor Vehicles databases,” Jay Stanley, a policy analyst with the American Civil Liberties Union, told AMI Newswire on Thursday.
“Overall, the concern is that this is a very powerful surveillance technology, and it needs to be approached with great caution.”
Stanley, who works on the ACLU’s Speech, Privacy and Technology Project, described the bureau’s attitude toward its legal responsibilities for the new technology as “casual.”
“Face recognition is a relatively new technology, and it’s important that not only the FBI, but the public, be aware of its limitations,” Stanley stated in a blog post on the ACLU’s website. “Errors mean random people could be falsely identified as potential criminals and find themselves coming under the FBI’s powerful investigatory microscope.”
According to the GAO, law enforcement agencies can make search requests of photo databases to get a return of between two and 50 photos. Such searches can give law enforcement agencies leads in cases when they only have, for example, a suspect’s photo from a surveillance camera.
The GAO report states that the FBI has not tested for accuracy requests for photo returns of between two and 50. Nor has the bureau evaluated available external databases, such as those of the departments of State and Defense and state DMV photos, for accuracy, the GAO found.
“GAO’s findings are especially shocking, given the timing,” the nonprofit Electronic Frontier Foundation (EFF) said in a statement on Wednesday. “Just over a month ago the FBI demanded its face-recognition capabilities be exempt from several key provisions of the federal Privacy Act – and provided the public with only 30 days to respond.”
The foundation concluded, “Over and over, the FBI’s secret data collection practices confirm why we need more transparency, not less.”
The EFF, which seeks to protect citizens against invasive technologies, also pointed to studies that indicate facial-recognition technology errs in identifying African-Americans, other ethnic minorities and women more often than Caucasians, the elderly and men.
Asked if the bureau had a response to the GAO report, an FBI spokesman referred AMI Newswire to the Department of Justice’s formal responses to several GAO recommendations in the report. The Justice department disagreed with three of six recommendations made by the GAO.
The department balked at determining why a privacy impact assessment was not made prior to using the updated face-recognition system, saying that it had developed such privacy documentation during the development of the system.
The GAO responded that such assessments by law have to be done before the technology is deployed, not years after the fact, as occurred with the FBI’s identification system.
Justice also disputed the recommendation calling on the FBI to test the facial-recognition system to affirm that the system accurately responds to requests for varying numbers of photo matches, saying that the photo results were investigative leads and not meant to be positive identifications. The overall detection rate has been tested for accuracy as well, the Justice department stated.
Justice officials also rejected a recommendation that the FBI should determine whether the external databases it relies on are adequate enough to ensure accuracy, saying the bureau has no authority to enforce accuracy standards for those databases.
The GAO report responds, “We continue to believe that taking steps to determine whether external face-recognition systems are sufficiently accurate would provide the FBI with better assurance that the systems they use are appropriate for its use and would increase the odds of identifying suspects for active investigations while protecting privacy.”