The FBI is building a massive facial recognition database that could contain as many as 52 million images by 2015, according to information obtained by the EFF via a freedom of information request.
The agency's Next Generation Identification (NGI) system is an update to its existing fingerprint database - which itself contains over 100 million records - and has been in development for years.
In addition to photos, it also includes biometric data such as iris scans and palm prints.
In 2012 the NGI database contained 13.6 million images, covering somewhere between 7 and 8 million individuals. By the middle of last year that had grown to some 16 million images.
The new system will be capable of processing 55,000 direct photo enrolments daily and has the ability to conduct tens of thousands of searches every day. It is estimated that by 2015 the database will contain 52 million facial images.
The EFF cites its biggest concern as being the fact that the FBI anticipates having as many as 4.3 million images of non-criminals stored in the NGI database by next year.
Under the current system there is a clear separation between the records of criminals and non-criminals which are stored in separate databases.
But with the new system that distinction will be blurred - all records will now be stored on one database, irrespective of whether or not someone has been arrested for a crime.
In the past, the FBI has never linked the criminal and non-criminal fingerprint databases. This has meant that any search of the criminal print database (such as to identify a suspect or a latent print at a crime scene) would not touch the non-criminal database. This will also change with NGI. Now every record - whether criminal or non - will have a "Universal Control Number" (UCN), and every search will be run against all records in the database. This means that even if you have never been arrested for a crime, if your employer requires you to submit a photo as part of your background check, your face image could be searched - and you could be implicated as a criminal suspect - just by virtue of having that image in the non-criminal file.
Furthermore, non-criminals that previously applied for jobs where the employer asked for fingerprints may have seen them passed over to the old database. With NGI, employers will now take photos and pass them over too.
EFF also expressed concerns over the origins of some of the images.
By 2015, the FBI estimates that the NGI will include:
- 46 million criminal images
- 4.3 million civil images
- 215,000 images from the Repository for Individuals of Special Concern (RISC)
- 750,000 images from a "Special Population Cognizant" (SPC) category
- 215,000 images from "New Repositories"
But the FBI doesn't define either the "Special Population Cognizant" or the "New Repositories" category.
This, the group says, is a problem as there is no way of determining what rules govern these categories, where the data comes from, how the images are gathered, who has access to them, and whose privacy is impacted.
Finally, EFF has concerns over NGI serving up questionable responses to search queries:
We know from researchers that the risk of false positives increases as the size of the dataset increases - and, at 52 million images, the FBI's face recognition is a very large dataset. This means that many people will be presented as suspects for crimes they didn’t commit. This is not how our system of justice was designed and should not be a system that Americans tacitly consent to move towards.