The loops and whorls of index fingers and thumbs may still animate crime thrillers and police procedurals. But for the Federal Bureau of Investigation (FBI), it is last century's technology.
The use of fingerprints has long since been nudged off its once-primary role in crime investigations by the deployment of identification techniques such as whole–palm prints, facial-recognition ready photos, iris scans, voice recordings, and pictures of any scars or tattoos. But the effort to bring all these data points together in one crime-fighting tool has sparked a debate between privacy advocates and the FBI. The debate has focused on what's called the Next Generation Identification (NGI) system—touted by the bureau's high-tech specialists as an effort to cope with 21st-century advances in identification.
As part of NGI, the FBI has been digitalizing— and then destroying—millions of fingerprint cards, including those held in its massive filing cabinets in warehouses in West Virginia. The digital fingerprint records became part of the evolving NGI system. Last month, the FBI announced that NGI reached “full operational capability,” as two other major parts of it went live: Rap Back, a system for monitoring people in “positions of trust,” and the Interstate Photo System (IPS), a massive and growing database of faces.
But while the NGI is being touted as a major advance in crime investigation and prevention, critics contend that it violates Americans’ constitutionally protected right to privacy. Several, including the Electronic Frontier Foundation (EFF) and Electronic Privacy Information Center (EPIC), have gone to court to force the FBI to provide more information on how NGI's components are working.
The first phase of NGI, launched in 2011, established a network of more than 18,000 law enforcement agencies. But the full scope of Rap Back and IPS remains unclear.
Rap Back is basically an ongoing background check. Authorized entities—which are not limited to law enforcement agencies, according to the FBI—that sign up for Rap Back submit identification information (including fingerprints and photographs) of parolees or civilians in “positions of trust,” like school teachers. In return, they receive “status notifications” of any criminal activity.
IPS, the FBI’s new centralized database of photographs, compiles images from various sources where thousands of local law enforcement agencies can go to connect photos or other biometric information to identification data: name, age, address, etc. The FBI claims the new system will be a boon to law enforcement around the country: it will cut down on wait times for searching the bureau's s criminal database, and will offer a wider choice of search options that can help in speedier identification, such as searching for scars, marks or tattoos.
In a press release, the FBI called IPS “a significant step forward for the criminal justice community in utilizing biometrics as an investigative enabler.”
The FBI is investing a lot in the new technology, awarding Lockheed Martin a $1 billion, 10-year contract for building and maintaining the NGI system.
According to the FBI, six states have already been using IPS as part of a pilot program: Michigan, Maryland, Maine, Florida, New Mexico, and Texas. Other states have submitted photos to the database.The Michigan State Police, which has been using IPS alongside its own statewide photo database, has had success with the new technology. According to Pete Langenfeld, who manages MSP’s Biometrics Identification Division, a state trooper recently ran a search using a photo of a woman wanted for thousands in credit card fraud. The photo he submitted — from a Costco account — came back with a few results.
“She popped up,” Langenfeld said. The woman had a prior arrest in Georgia so the trooper was able to pursue the woman in his investigation. “Without that system we wouldn’t have been able to do that,” he said. “Criminals cross state lines.”
Langenfeld said the MSP’s use of facial recognition to identify unknown suspects has come a long way as the technology progressed in recent years. There are still some hiccups, though. Facial expressions can affect the searches. He said a surveillance photo of a suspect smiling might not return any results if the suspect’s mug shot is a “mean mug,” or stare. He also said lower quality images can affect a search.
50 Million Biometric IDs
The overall success of the database will be determined by how many agencies sign on to submit photographs and, possibly more important, submit high-quality images. By next year, the FBI’s goal is to have more than 50 million biometric identities in the database, according to documents received by the EFF through a Freedom of Information Act (FOIA) request.
But many details on NGI, including the one above, have only been made public through requests made under the Freedom of Information Act (FOIA) by privacy advocates. And that’s one of the biggest criticisms of the system: lack of information.
EFF and EPIC have been suing the FBI to fork over documents with details on the program.
So far, documents received through FOIA requests by EPIC reveal the FBI is willing to accept an error matching rate much higher than its fingerprint match and the FBI already has agreements with some states to compare state DMV photo databases against the FBI’s to help potentially solve cases.
“It’s a case where you are searching a database of innocent people and running essentially a massive virtual lineup,” Jeramie Scott, a national security counsel at EPIC, told The Crime Report.
Where that exchange between states and the FBI is headed is unclear, however.
That's one reason why EPIC and EFF have been suing the FBI to release still more documents.
“Part of the issue is not being transparent about the use, the regulation, the oversight and the accountability of this program,” Scott says. “It increases the chances of mission creep.”
When asked about what sources the FBI would use for IPS, spokesman Stephen G. Fischer Jr. responded in an email, “Only photos lawfully obtained and affiliated with tenprint fingerprint submissions are retained in the IPS.”
“Neither DMV photos nor images from social media profiles are maintained in the IPS repository,” he added.
Find the Criminal
The advocacy groups claim that under NGI, innocent people who have never been convicted or even suspected of a crime will end up in the same database as criminals. Companies running background checks on employees or prospective employees can submit photographs — many already fingerprint job seekers and send them to the FBI — and those photographs stay in the NGI system.
According to EFF, the FBI plans to have 4.3 million photos taken for “non-criminal purposes” in NGI by next year.
“This means you could become a suspect in a criminal case merely because you applied for a job that required you to submit a photo with your background check,” Jennifer Lynch, senior attorney at EFF, wrote on the EFF website.
The FBI says these fears are misplaced, noting that each agency utilizing the program will develop usage policies.
“All use policies must protect the constitutional rights of all persons and must expressly prohibit the searching of photos collected in violation of an individual's First and Fourth Amendment rights,” Fischer wrote.
“Face recognition technology does not provide positive identifications. As such, IPS users are prohibited from relying solely on the results of face recognition searches for law enforcement action.”
Michigan State Police’s Langenfeld stressed that as well.
“It’s not a positive ID. The cops still have to connect the dots,” he said. “Years ago you could have done this manually, but it would be searching through 15 million photos.”
The FBI promised more information on privacy implications back in 2012, but it hasn’t followed through.
The Senate Subcommittee on Privacy, Technology and the Law held a hearing in 2012, “What Facial Recognition Technology Means for Privacy and Civil Liberties,” where the FBI said they would update their Privacy Impact Assessment (PIA), something required of government agencies to give the public a glimpse at the privacy implications of new programs.
The FBI conducted and released a PIA in 2008, but the programs, along with the technology, within NGI have changed since then.
In response, the FBI said it will complete the PIA — as well as a System of Records Notice (SORN) by the end of 2014.
“As the IPS (including the face recognition service) took place within the final increment of the overall NGI development, an updated PIA has not yet been completed,” wrote Fischer.
Rap Back is not even mentioned in the original 2008 PIA. Critics have questions about what will trigger a status notification.
“It doesn't necessarily mean getting arrested, that’s the most obvious case,” Scott says. “But NGI communicates with the Homeland Security database … so your entering back into the United States if you went overseas could be a trigger for Rap Back and your employer gets notified.”
According to the FBI’s Privacy Impact Assessment on NGI’s interoperability, the Department of Homeland Security’s Automated Biometric Identification System (IDENT) and the FBI’s NGI database will be connected. There will also be a Repository of Individuals of Special Concern” that will include suspected terrorists that can be viewed quickly by agencies during a terrorist event, according to an article on the FBI’s website.
EPIC has been urging the FBI — and Congress if necessary — to set up “clear rules” and protections for the NGI system.
“Face recognition and its accompanying privacy concerns are not going away,” EFF’s Lynch testified at the Senate hearing. “Given this, it is imperative that government act now to limit unnecessary biometrics collection; instill proper protections on data collection, transfer, and search; ensure accountability; mandate independent oversight; require appropriate legal process before government collection; and define clear rules for data sharing at all levels.”.
“This is important,” she continued, “to preserve the democratic and constitutional values that are bedrock to American society.”
Adam Wisnieski is a freelance writer from the Bronx. You can follow him on Twitter @adamthewiz. He welcomes comments from