Good afternoon Chairman Chaffetz, Ranking Member Cummings, and members of the committee. Thank you for the opportunity to appear before you today to discuss the Federal Bureau of Investigation’s (FBI) use of face recognition (FR) technology.
FBI Programs Perform Face Recognition
The following FBI programs use FR technology for law enforcement purposes.1 They are: (1) the FBI’s Next Generation Identification (NGI) System located at the FBI’s Criminal Justice Information Services (CJIS) Division, and (2) the Facial Analysis, Comparison, and Evaluation (FACE) Services Unit also located at the FBI CJIS Division.
- NGI maintains a mugshot repository that is known as the Interstate Photo System (IPS). All mugshots are associated with tenprint fingerprints and a criminal history record. The NGI-IPS allows automated FR searches by authorized local, state, tribal, and federal law enforcement agencies. The law enforcement agency submits a “probe” photo that is obtained pursuant to an authorized law enforcement investigation, to be searched against the mugshot repository. The NGI-IPS returns a gallery of “candidate” photos of 2-50 individuals (default is 20). The law enforcement agencies then must manually review the candidate photos and perform further investigation to determine if any of the candidate photos are the same person as the probe photo.
The NGI-IPS technology is only used as an investigative lead, and not as a means of positive identification. The NGI-IPS Policy Implementation Guide has been made available to authorized law enforcement users who receive candidate photos from the Next Generation Identification-Interstate Photo System. The policy advises that the photos are not being provided as positive identification and cannot serve as the sole basis for law enforcement action. In addition, the FBI has promulgated policies and procedures that place legal, policy, and security requirements on the law enforcement users of the NGI-IPS, including a prohibition against submitting probe photos that were obtained in violation of the First or Fourth Amendments. It is important to note that the FBI does not retain the probe photos; the probes are searched and deleted. Therefore, the NGI-IPS remains a repository solely of mugshots that are submitted voluntarily with fingerprints pursuant to arrest.
- The FACE Services Unit provides investigative lead support to the FBI field offices, operational divisions, and legal attachés by comparing the face images of persons associated with open assessments2 and active investigations3 against face images available in state and federal FR systems. In limited instances, the FACE Services Unit provides FR support for closed FBI cases (e.g., missing and wanted persons) and may offer recognition support to federal partners. The FACE Services Unit only accepts “probe” photos that have been collected pursuant to applicable legal authorities as part of an authorized FBI investigation. Upon receipt of the photo(s), the FACE Services Unit searches them using FR software against databases authorized for use by the FBI, which results in a photo gallery of potential candidates. The FACE Services Unit performs manual comparisons of candidate photos against the probe photo(s) to determine a candidate’s value as an investigative lead. This service does NOT provide positive identification, but rather, an investigative lead and analysis to support that lead.
In performing the search(es), the FACE Services Unit operates under the authority of the United States Code (U.S.C) Sections 533 and 534; Title 28, Code of Federal Regulations Section 0.85; Title 42, U.S.C. Section 3771; and Title 18, U.S.C. Chapter 123. The FACE Services Unit performs FR searches of FBI databases (e.g., FBI’s NGI), other federal databases (e.g., Department of State’s Visa Photo File, Department of Defense’s Automated Biometric Identification System, Department of State’s Passport Photo File), and state photo repositories (e.g., select state Departments of Motor Vehicles). Memoranda of understanding and agreements have been established with all partners.
Privacy Impact Assessments (PIAs) for the FACE Services Unit and the NGI-IPS have been prepared by the FBI, approved by the DOJ, and posted at https://www.fbi.gov/services/records-management/foipa/privacy-impact-assessments. These PIAs provide to the public an accurate and complete explanation of how specific FBI components are using face recognition technology in support of the FBI’s mission to defend against terrorism and enforce criminal laws, while protecting civil liberties. The PIAs also reflect many of the privacy and civil liberties choices made during the implementation of these programs.
Automated Face Recognition4
In addition to understanding how these FBI programs operate, it is also important to have an understanding of how automated FR works. The following is a brief description of automated FR: The automated FR software uses pattern matching approaches developed within the field of computer vision. Such approaches do not rely upon intrinsic models of what a face is, how it should appear, or what it may represent. In other words, the potential matching is not based on biological or anatomical models of what a face—or the features which make up a face—look like. Instead, the algorithm performance is entirely dependent upon the patterns which the algorithm developer finds to be most useful for matching. The patterns used in automated FR algorithms do not correlate to obvious anatomical features such as the eyes, nose or mouth in a one-to-one manner, although they are affected by these features. Put another way, the algorithms “see” faces in a way that differs from how humans see faces.
The FBI conducted a trade study of FR products, leveraging the NGI Integrator Lockheed Martin, which led to the determination of MorphoTrust as the best cost solution in fall 2010. The FBI has tested and verified that the NGI FR solution returns the correct candidate a minimum of 85 percent of the time within the top 50 candidates.
The FBI manages the CJIS Division Advisory Policy Board (APB) Process, which holds meetings twice a year. The APB is comprised of members of local, state, tribal, and federal criminal justice agencies that contribute to and use CJIS systems and information. It is responsible for reviewing policy issues and appropriate technical and operational issues related to FBI CJIS programs (such as the NGI) administered by the FBI’s CJIS Division, and thereafter, making appropriate recommendations. Through the APB Process, users can provide feedback and suggestions or bring issues to the attention of the FBI’s CJIS Division. To date, no users have submitted concerns to the FBI regarding the accuracy of face searches conducted on the NGI-IPS.
The FBI performs audits as they serve an important role in identifying and mitigating risks associated with users of information systems not meeting policy requirements. In a recent audit of the FBI’s use of FR by the Government Accountability Office (GAO), the FBI advised that the NGI-IPS operated in a limited capacity as a pilot program from December 2011 through April 2015. While the early stages of planning for formal NGI-IPS audits began during the system’s pilot phase and prior to GAO’s review, the formal draft audit plan was completed on schedule in summer 2015 and approved by the CJIS APB in June 2016.
The FBI worked with the APB and agreed upon an audit schedule that includes use of the NGI-IPS, although the number of actual NGI-IPS participants is currently limited. The FBI CJIS Division’s CJIS Audit Unit (CAU) currently executes the formal audits to assess compliance with requirements primarily derived from the NGI-IPS Policy and Implementation Guide. The audit is conducted in conjunction with existing national identity services audits externally at state identification bureaus and federal agencies, and may include reviews at a selection of local agencies that access the NGI-IPS. The NGI-IPS audit plan also provides for an internal audit of the FACE Services Unit to be conducted in accordance with existing procedures for FBI internal audits associated with CJIS system access. Procedures for both external and internal audits include review of NGI-IPS system transaction records and associated supporting documentation provided by audit participants.
Currently 11 states have connectivity with the NGI-IPS and as of February 2017, the FBI has conducted NGI-IPS audits at the following four states:
- Maine – 06/16/2016
- Michigan – 06/16/2016
- Delaware – 10/16/2016
- Arizona – 02/17/2017
No significant findings of noncompliance have been identified during the four NGI-IPS audits and there have been no observations of unauthorized requests or misuse of the NGI-IPS. However, three relatively minor issues were identified at one state*:
- Enrollment Discrepancy: The state submitted 1.3 million criminal photos to the CJIS Division in bulk. Of the 1.3 million submissions, 450,000 were rejected back to the state because the Date of Arrest (DOA) did not match the DOA on file with the FBI.
- Area of Concern: The state did not have an established NGI-IPS training program.
- Area of Concern: The state did not have written procedures for the proper enrollment of scars, marks, and tattoos.
*It should be noted that these issues are tentative, pending finalization of the audit results.
Additionally, the CAU has scheduled the audit of the FACE Services Unit for 2018 to coincide with the existing triennial FBI internal audit.
Finally, the FBI’s strength is directly attributed to the dedication of its people who work for and on behalf of their fellow citizens. Our adversaries and the threats we face are relentless. The FBI must continue to identify and use new capabilities such as automated FR to meet the high expectations for the FBI to preserve our nation’s freedoms, ensure our liberties are protected, and preserve our security. Quite simply put, we at the FBI cannot fail to meet our assigned mission. We must continue to exceed expectations and never rest on past successes. Hence, we must embrace new technologies such as automated FR and optimize allocated resources to achieve mission objectives. I want to thank all of my colleagues for their support, and each and every employee at the FBI for their dedicated services. I am pleased to answer any questions you might have.
1The Forensic Audio, Video and Image Analysis Unit (FAVIAU) conducts facial identification examinations or “one to one” (1:1) image comparisons as a component of the forensic services in the Digital Evidence Laboratory. The FAVIAU works with the Office of the General Counsel for legal review of each case submitted in accordance with the Case Acceptance Policy. The Operational Technology Division and FAVIAU personnel have monitored the development of automated FR capabilities for two decades and have determined that the limitations of the technology do not make it suitable for use in forensic 1:1 casework, at this time.
2Per the Domestic Investigations and Operations Guide (DIOG), Section 5.4.1 Assessment Types and Section 5.5 Standards for Opening or Approving an Assessment, updated 09/28/2016: Assessments may be opened to detect, obtain information about, or prevent or protect against federal crimes or threats to the national security. They must have an authorized purpose and clearly defined objectives; they cannot be arbitrary or based on speculation. The assessments must not be based solely on the exercise of First Amendment rights or on the race, ethnicity, gender, national origin, religion, sexual orientation, or gender identity of the subject, or a combination of only such factors. The assessment must be an appropriate use of personnel and financial resources.
3Per the DIOG, Section 6 Preliminary Investigations: Preliminary investigations may be opened on the basis of “allegation or information” indicative of possible criminal activity or threats to national security. Full investigations may be opened when there is “an articulable factual basis” of possible criminal or national threat activity.
4In addition to the use of automated FR technology to search probe images against a gallery, as described for the NGI, the FBI also utilizes automated FR as a way to organize or “triage” digital image files which have been obtained pursuant to an authorized law enforcement investigation.