Are federal facial recognition programs supported by existing law?

Members of Congress from both parties say law enforcement agencies are relying on decades-old laws to justify use of facial recognition tech.

Rep. Elijah Cummings (D-Md.), chairman of the House Oversight and Reform Committee, said at a June 4 hearing that the American people were being placed in jeopardy by "systems that are not ready for prime time."

For example, the FBI's Facial Analysis, Comparison and Evaluation Services (FACE) unit can search or request searches across the Departments of State and Defense and 21 state governments, reaching 641 million photos. The FBI also manages the Next Generation Identification-Interstate Photo System, which allows law-enforcement agencies around the country to cross-reference photos of unknown persons against a database of criminal photos and mugshots in order to find a possible match. The system will automatically return between two and 50 possible matches from the database.

Kimberly Del Greco, deputy assistant director of the FBI's Criminal Justice Information Services, told lawmakers the FBI does not provide true matches for any photos sent or conduct real-time facial recognition, saying many of the choices about how to use the interstate photo system are made by state or local law-enforcement agencies. She also said law enforcement must have an open assessment or investigation before using the system.

She cited both the 1994 federal Driver's Privacy and Protection Act, which allows states to disclose personal information including department of motor vehicle photos, as well as unspecified state laws that were established prior to the advent of facial recognition technology, to support the work done by the FACE unit.

"We're just leveraging that state law … that's already in place,"  Del Greco said.

Austin Gould, assistant administrator of the Transportation Security Agency, cited the 2001 Aviation and Transportation Security Act for the authority behind a Customs and Border Protection pilot program in Atlanta that conducts facial recognition of international travelers at airports during boarding and bag drop off.

Rep. Mark Meadows (R-N.C.) disagreed.

"I'm actually on the Transportation Committee, and I can tell you we never envisioned any of this," he said.

While Gould said only the Atlanta pilot program captures images during a traveler's bag drop, BuzzFeed News has reported that the agency is using facial recognition technology at 17 international airports. Later in the hearing, Meadows called for TSA to halt its work.

"There are inefficiencies in TSA … that have nothing to do with facial recognition, and until you get that right I would suggest that you put this pilot program on hold," Meadows said. "Because I don't know of any appropriations that specifically allow you to have this."

Lawmakers repeatedly took issue with witness answers about where government agencies are deriving their legal authority to operate facial recognition programs and to what extent they notify or ask for consent beforehand.

They also expressed frustration at the FBI's inability to close five outstanding Government Accountability Office recommendations made in a 2016 report regarding its operation of facial recognition system as well as the failure of other witnesses to provide metrics around how many American citizens have had their images captured and whether the programs are effective or having a positive impact.

Gretta Goodwin, director for the homeland security and justice division at the Government Accountability Office, told the panel that Justice Department and FBI were still not publishing systems of records notices about their facial recognition programs in a timely manner despite a 2016 recommendation from GAO. Such notices would provide transparency about the existence of individual software systems related to the program as well as the types of data being collected.