Facial recognitionThe accuracy of the FBI’s face-recognition technology may be improved: GAO

Published 20 June 2016

The Department of Justice’s (DOJ) Federal Bureau of Investigation (FBI) operates the Next Generation Identification-Interstate Photo System (NGI-IPS) — a face recognition service that allows law enforcement agencies to search a database of over thirty million photos to support criminal investigations. The GAO examined the FBI’s face recognition capabilities, and the extent to which the FBI’s use of face recognition adhered to privacy laws and policies, and the accuracy of these capabilities.

Technology advancements have increased the overall accuracy of automated face recognition over the past few decades. According to the FBI, this technology can help law enforcement agencies identify criminals in their investigations.

The Government Accountability Office (GAO) was asked to review the FBI’s use of face recognition technology. The GAO’s report examines: 1) the FBI’s face recognition capabilities; and the extents to which 2) the FBI’s use of face recognition adhered to privacy laws and policies, and 3) the FBI assessed the accuracy of these capabilities.

The GAO says that to address these questions, GAO reviewed federal privacy laws, FBI policies, operating manuals, and other documentation on its face recognition capability. GAO interviewed officials from the FBI and other federal and two state agencies that coordinate with the FBI on face recognition.

The Department of Justice’s (DOJ) Federal Bureau of Investigation (FBI) operates the Next Generation Identification-Interstate Photo System (NGI-IPS) — a face recognition service that allows law enforcement agencies to search a database of over thirty million photos to support criminal investigations. NGI-IPS users include the FBI and selected state and local law enforcement agencies, which can submit search requests to help identify an unknown person using, for example, a photo from a surveillance camera. When a state or local agency submits such a photo, NGI-IPS uses an automated process to return a list of 2 to 50 possible candidate photos from the database, depending on the user’s specification.

As of December 2015, the FBI has agreements with seven states to search NGI-IPS, and is working with more states to grant access. In addition to the NGI-IPS, the FBI has an internal unit called Facial Analysis, Comparison and Evaluation (FACE) Services that provides face recognition capabilities, among other things, to support active FBI investigations. FACE Services not only has access to NGI-IPS, but can search or request to search databases owned by the Departments of State and Defense and sixteen states, which use their own face recognition systems. Biometric analysts manually review photos before returning at most the top one or two photos as investigative leads to FBI agents.

DOJ developed a privacy impact assessment (PIA) of NGI-IPS in 2008, as required under the E-Government Act whenever agencies develop technologies that collect personal information. GAO says that the FBI, however, did not update the NGI-IPS PIA in a timely manner when the system underwent significant changes or publish a PIA for FACE Services before that unit began supporting FBI agents. DOJ ultimately approved PIAs for NGI-IPS and FACE Services in September and May 2015, respectively. The timely publishing of PIAs would provide the public with greater assurance that the FBI is evaluating risks to privacy when implementing systems. Similarly, NGI-IPS has been in place since 2011, but DOJ did not publish a System of Records Notice (SORN) that addresses the FBI’s use of face recognition capabilities, as required by law, until 5 May 2016, after completion of GAO’s review. The timely publishing of a SORN would improve the public’s understanding of how NGI uses and protects personal information.

The GAO notes that prior to deploying NGI-IPS, the FBI conducted limited testing to evaluatewhether face recognition searches returned matches to persons in the database (the detection rate) within a candidate list of fifty, but has not assessed how often errors occur. FBI officials stated that they do not know, and have not tested, the detection rate for candidate list sizes smaller than fifty, which users sometimes request from the FBI. By conducting tests to verify that NGI-IPS is accurate for all allowable candidate list sizes, the FBI would have more reasonable assurance that NGI-IPS provides leads that help enhance, rather than hinder, criminal investigations. Additionally, the FBI has not taken steps to determine whether the face recognition systems used by external partners, such as states and federal agencies, are sufficiently accurate for use by FACE Servicesto support FBI investigations. By taking such steps, the FBI could better ensure the data received from external partners is sufficiently accurate and do not unnecessarily include photos of innocent people as investigative leads.

The GAO is making six recommendations, including that the Attorney General determine why PIAs and a SORN were not published as required and implement corrective actions, and for the FBI director to conduct tests to verify that NGI-IPS is accurate and take steps to determine whether systems used by external partners are sufficiently accurate for FBI’s use. DOJ said it agreed with one, partially agreed with two, and disagreed with three of the six recommendations.

In response, GAO clarified one recommendation, updated another recommendation. It says it continues to believe that all six recommendations remain valid as discussed further in thisreport.

— Read more in Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy, GAO-16-267(GAO, 2016)