FBI Sued for Info on Face Recognition

     SAN FRANCISCO (CN) - The Electronic Frontier Foundation, a technology watchdog, wants the Justice Department to hand over facial-recognition records before switching on the FBI's "bigger, faster and better" biometrics system.
     The Electronic Frontier Foundation (EFF) sued the Department of Justice in a federal FOIA complaint. It claims the FBI has been "dragging its feet" for a year on three FOIA requests.
     The EFF says in the complaint that the FBI has given a presentation "which included a graphic image that implied the Bureau wanted to use facial recognition to be able to track people from one political rally to another."
     The EFF says it wants to "shine the light" on the FBI's biometrics program - slated for launch in 2014 - and particularly its facial-recognition components.
     The FBI's Next Generation Identification (NGI) biometrics database will replace its IAFIS fingerprint system, which contains prints and criminal histories of 70 million criminal subjects and 73,000 known and suspected terrorists as well as 34 million civil prints from employment background checks and LiveScans.
     The NGI - being built on a $1 billion contract with Lockheed Martin - will include multiple biometric identifiers, including iris scans, palm prints, face-recognition-ready photos and voice data, according to EFF.
     The FBI will share the data with law enforcement agencies at the local, state, federal and international levels.
     Photographic capabilities of the old fingerprint database have been extremely limited, allowing law enforcement agencies to submit only criminal mug shots. which are attached to biographical information. The old program lacks facial-recognition capabilities, making it impossible to search through mug shots independently from prints or data.
     The FBI does not accept photographs for civil fingerprinting done for background checks or LiveScans. The EFF says that will change under the new system.
     "NGI will change almost everything about how the FBI treats photograph submissions," the complaint states. "For example, NGI will allow 'the increased capacity to retain photographic images, additional opportunities for agencies to submit photographic images, and additional search capabilities including automated searches via the NCIC [National Crime Information Center].' The proposed new system would also allow law enforcement to 'collect and retain other images (such as those obtained from crime scene security cameras' and from friends and family) and would allow submission of 'civil photographs along with civil fingerprint submissions that were collected for non-criminal purposes,'" EFF says in its complaint, citing the FBI's specs on the new system. (Parentheses and quotation marks as in complaint.
     Once a photograph has been fed into NGI, the system applies face-recognition algorithms to create a unique "faceprint" for each person, according to the complaint. This will allow law enforcement agencies to upload the photo of an unknown person and search a database of faceprints to find matches.
     The EFF says the FBI has been testing its facial-recognition software with states that already have face-photo search capabilities in their own criminal databases. Also, DMVs in 37 states use facial-recognition programs-and the FBI is working with 10 of them, according to the complaint.
     The group claims that the FBI's plans go way beyond mug shots and driver's license photos: "The Face Recognition Pilot Program memorandum of understanding between FBI and Hawaii states that full implementation of the program will 'permit photo submissions independent of arrests' and 'permit bulk submission of photos being maintained at state and federal repositories.' The FBI has also stated in a public presentation given at a national biometrics conference that it wants to use its facial recognition system to 'identify unknown persons of interest from images' and 'identify subjects in public datasets.' In the same presentation, the FBI included a graphic image that implied the Bureau wanted to use facial recognition to be able to track people from one political rally to another," the EFF says in its complaint.
     When launched next year, the FBI has said, the new system will already hold
     12 million "searchable frontal photos," according to the EFF.
     The NGI will be fully interoperable with databases at the Department of Homeland Security, the State Department and the Department of Defense, as well as 43 states, Puerto Rico and at least 77 countries that have agreements with the FBI.
     The EFF says the system raises privacy concerns, since for the first time, civil and criminal records will be linked.
     "The FBI appears poised to link or combine the civil and criminal records in NGI under a 'Master Name' or unique identifier. At a 2012 meeting, the Criminal Justice Information Services Advisory Board - a body 'responsible for reviewing appropriate policy, technical and operational issues' related to programs such as IAFIS - discussed plans to link the records, which could allow system users to search criminal and civil records at the same time. The board stated that although 'all information about a person in the system' would be maintained 'as a single record,' the system itself would be designed to ensure that 'retained civil submissions remain untainted by criminal submissions.'
     "FBI has not explained to the public how NGI or IAFIS's system design would ensure that civil submissions are not 'tainted' by criminal submissions or explained why it is necessary to combine the two types of data," the EFF says in the complaint. (Footnotes omitted.)
     The government's use, and potential misuse, of face-recognition technology raises red flags for the EFF. It noted that Sen. Al Franken, D-Minn., questioned the technology in a Senate Judiciary subcommittee hearing last year.
     "'Facial recognition creates acute privacy concerns that fingerprints do not,'" Franken said, according to the EFF complaint. "'Once someone has your fingerprint, they can dust your house or your surroundings to figure out what you've touched. Once someone has your faceprint, they can get your name, they can find your social networking account and they can find and track you in the street, in the stores you visit, the government buildings you enter and the photos your friends post online. ... I fear that without further protections, this technology could be used on unsuspecting civilians innocent of any crime or could be used to instantly identify someone walking down the street. I urge the FBI ... to do more to protect people's privacy so that this new technology isn't abused.'"
     The FBI's own privacy assessments have not kept pace with rapidly developing facial recognition technology, the EFF claims. Is says that although the FBI promised Congress last year that it would revise its privacy memo, it continues to accept photo submissions from states involved in the test program and in compiling its massive database.
     Researchers and government officials acknowledge that face-recognition technology is not infallible, and that results depend on image quality, according to the complaint.
     "It performs well with consistent lighting conditions and poses. However, with variable lighting, shadows, backgrounds, poses or expressions, the error rates are significant. Other factors, such as age of the subject, gender and race also affect accuracy. Further, as facial recognition databases increase in size, the risk of false positives-such as a person being misidentified as the perpetrator of a crime-increases as well," EFF states in the complaint, citing multiple research reports. (Footnotes omitted.)
     The FBI recognized this problem as early as 2008, though it suggested that proper training would mitigate the issues. It said in its privacy memo that policies would be adopted "to emphasize that photographic matches are not to be considered 'positive' identifications, and searches of the photographs will merely result in a ranked listing of candidates," according to the EFF complaint.
     The EFF says it submitted three FOIA to the FBI, in June and July 2012. It asked to see the files in their native format, text-searchable when applicable, and preserving "parent/child" relationship of emails and their attachments.
     EFF's first request sought records on the FBI's pilot program with states to build its facial recognition database. In October, the FBI reported finding 7,380 records that were "potentially responsive" to EFF's request, but EFF says it has not received any of them.
     The second and third requests, both on July 5, 2012, sought information about the plan to combine civil and criminal data and the reliability of NGI's face-recognition software. The FBI acknowledged receiving these requests almost immediately, but that's last the EFF has heard about them from the FBI.
     Privacy concerns of the American public demand a response from the FBI, the group says.
     "NGI will result in a massive expansion of government data collection for both criminal and noncriminal purposes," EFF staff attorney Jennifer Lynch said in a statement Wednesday. "Biometrics programs present critical threats to civil liberties and privacy. Face-recognition technology is among the most alarming new developments, because Americans cannot easily take precautions against the covert, remote, and mass capture of their images.
     "Before the federal government decides to expand its surveillance powers, there needs to be a public debate. But there can be no public debate until the details of the program are presented to the public."
     The EFF asks the court to order the FBI to process immediately and deliver in their entirety all the records demanded in the three FOIA requests.