GAO wants more privacy protections for facial recognition data
- By Mark Rockwell
- Jun 20, 2016
In an era of concerns about the federal government's use of personal data, the Government Accountability Office wants the FBI to step away from traditional law enforcement thinking when dealing with digital images generated by facial recognition technology.
In a report issued June 15, GAO outlined some of its concerns about the FBI's use of facial recognition technology, including how it's handled by a relatively unknown internal unit called Facial Analysis, Comparison and Evaluation (FACE) and by its Next Generation Identification Interstate Photo System (NGI-IPS).
FACE can access 412 million images, including photos from driver's licenses, visas and passports. It can tap resources at the Defense Department, the State Department and 16 states that have their own facial recognition programs. NGI-IPS can access 30 million images kept by the FBI.
Diana Maurer, director of GAO's homeland security and justice team, said both programs were created without up-to-date privacy assessments and with an uncritical eye toward data privacy. That needs to change, she added.
In a June 17 update to the Information Security and Privacy Advisory Board, Maurer said the FBI told GAO that the systems were being used to develop investigative leads and were similar to other investigative tools for which privacy protections didn't necessarily apply. ISPAB advises the National Institute of Standards and Technology.
David Plocher, a senior attorney at GAO, told the board that FBI officials thought facial recognition technology "was the same as looking through mug shots."
Mauer said that attitude is prevalent among national security and law enforcement agencies and stressed that the images generated by facial recognition technology are not photographs in a book but instead are connected to personally identifiable information and should be afforded privacy protections.
Furthermore, she said the FBI’s systems had not been tested in real-world conditions, leaving room for potential misidentification.
"The FBI didn't put a premium on accuracy or privacy," she told ISPAB.
In its response to the GAO study, the Justice Department said the FBI's FACE operations are covered by System of Records Notices, which inform the public about what kinds of information federal agencies maintain and seek to limit the uses and disclosure of that information. In addition, Justice officials said they provide facial recognition support for FBI agents and analysts.
Maurer said the states that share images through the FBI's systems should have a way of notifying their residents about that access.
She told FCW she intends to follow up with the FBI to see how it implements improvements and will post those findings to GAO's website. Public attention and congressional interest in the systems could encourage a better response, she added.
Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.
Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, tele.com magazine and Wireless Week.
Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.
Click here for previous articles by Rockwell.
Contact him at firstname.lastname@example.org or follow him on Twitter at @MRockwell4.