GAO wants more privacy protections for facial recognition data

In an era of concerns about the federal government's use of personal data, the Government Accountability Office wants the FBI to step away from traditional law enforcement thinking when dealing with digital images generated by facial recognition technology.

In a report issued June 15, GAO outlined some of its concerns about the FBI's use of facial recognition technology, including how it's handled by a relatively unknown internal unit called Facial Analysis, Comparison and Evaluation (FACE) and by its Next Generation Identification Interstate Photo System (NGI-IPS).

FACE can access 412 million images, including photos from driver's licenses, visas and passports. It can tap resources at the Defense Department, the State Department and 16 states that have their own facial recognition programs. NGI-IPS can access 30 million images kept by the FBI.

Diana Maurer, director of GAO's homeland security and justice team, said both programs were created without up-to-date privacy assessments and with an uncritical eye toward data privacy. That needs to change, she added.

In a June 17 update to the Information Security and Privacy Advisory Board, Maurer said the FBI told GAO that the systems were being used to develop investigative leads and were similar to other investigative tools for which privacy protections didn't necessarily apply. ISPAB advises the National Institute of Standards and Technology.

David Plocher, a senior attorney at GAO, told the board that FBI officials thought facial recognition technology "was the same as looking through mug shots."

Mauer said that attitude is prevalent among national security and law enforcement agencies and stressed that the images generated by facial recognition technology are not photographs in a book but instead are connected to personally identifiable information and should be afforded privacy protections.

Furthermore, she said the FBI’s systems had not been tested in real-world conditions, leaving room for potential misidentification.

"The FBI didn't put a premium on accuracy or privacy," she told ISPAB.

In its response to the GAO study, the Justice Department said the FBI's FACE operations are covered by System of Records Notices, which inform the public about what kinds of information federal agencies maintain and seek to limit the uses and disclosure of that information. In addition, Justice officials said they provide facial recognition support for FBI agents and analysts.

Maurer said the states that share images through the FBI's systems should have a way of notifying their residents about that access.

She told FCW she intends to follow up with the FBI to see how it implements improvements and will post those findings to GAO's website. Public attention and congressional interest in the systems could encourage a better response, she added.