FBI Plans to Have 52 Million Photos in its NGI Face Recognition Database by Next Year

[FBD]

https://www.eff.org/deeplinks/2014/0...base-next-year

skipped first half, posting "why we should be concerned"

Why Should We Care About NGI?

There are several reasons to be concerned about this massive expansion of governmental face recognition data collection. First, as noted above, NGI will allow law enforcement at all levels to search non-criminal and criminal face records at the same time. This means you could become a suspect in a criminal case merely because you applied for a job that required you to submit a photo with your background check. (Because the system is designed to provide a ranked list of candidates, the FBI states NGI never actually makes a “positive identification,” and “therefore, there is no false positive rate.” In fact, the FBI only ensures that “the candidate will be returned in the top 50 candidates” 85 percent of the time “when the true candidate exists in the gallery.”)

Second, the FBI and Congress have thus far failed to enact meaningful restrictions on what types of data can be submitted to the system, who can access the data, and how the data can be used. For example, although the FBI has said in these documents that it will not allow non-mug shot photos such as images from social networking sites to be saved to the system, there are no legal or even written FBI policy restrictions in place to prevent this from occurring. As we have stated before, the Privacy Impact Assessment for NGI’s face recognition component hasn’t been updated since 2008, well before the current database was even in development. It cannot therefore address all the privacy issues impacted by NGI. (Nearly 1 Million Images Will Come from Unexplained Sources....One of the most curious things to come out of these records is the fact that NGI may include up to 1 million face images in two categories that are not explained anywhere in the documents. )

Finally, even though FBI claims that its ranked candidate list prevents the problem of false positives (someone being falsely identified), this is not the case. A system that only purports to provide the true candidate in the top 50 candidates 85 percent of the time will return a lot of images of the wrong people. We know from researchers that the risk of false positives increases as the size of the dataset increases—and, at 52 million images, the FBI’s face recognition is a very large dataset. This means that many people will be presented as suspects for crimes they didn’t commit. This is not how our system of justice was designed and should not be a system that Americans tacitly consent to move towards.

For more on our concerns about the increased role of face recognition in criminal and civil contexts, read Jennifer Lynch’s 2012 Senate Testimony. We will continue to monitor the FBI’s expansion of NGI.

Here are the documents:

FBI NGI Description of Face Recognition Program

FBI NGI Report Card on Oregon Face Recognition Program

FBI NGI Sample Memorandum of Understanding with States

FBI NGI Face Recognition Goals & Objectives

FBI NGI Information on Implementation

FBI Emails re. NGI Face Recognition Program

FBI Emails from Contractors re. NGI

FBI NGI 2011 Face Recognition Operational Prototype Plan

FBI NGI Document Discussing Technical Characteristics of Face Recognition Component

FBI NGI 2010 Face Recognition Trade Study Plan

FBI NGI Document on L-1's Commercial Face Recognition Product

[Muddy]

Where are they mining these photos? Facebook? I swear to god.. 1984 is coming true... Just 30 years late.

[FBD]

According to the FBI, by 2015, NGI may include:

46 million criminal images
4.3 million civil images
215,000 images from the Repository for Individuals of Special Concern (RISC)
750,000 images from a "Special Population Cognizant" (SPC) category
215,000 images from "New Repositories"

However, the FBI does not define either the “Special Population Cognizant” database or the "new repositories" category. This is a problem because we do not know what rules govern these categories, where the data comes from, how the images are gathered, who has access to them, and whose privacy is impacted.

A 2007 FBI document available on the web describes SPC as “a service provided to Other Federal Organizations (OFOs), or other agencies with special needs by agreement with the FBI” and notes that “[t]hese SPC Files can be specific to a particular case or subject set (e.g., gang or terrorist related), or can be generic agency files consisting of employee records.” If these SPC files and the images in the "new repositories" category are assigned a Universal Control Number along with the rest of the NGI records, then these likely non-criminal records would also be subject to invasive criminal searches.