FBI wants to exempt its huge fingerprint and photo database from privacy protections
The FBI wants to exempt its burgeoning national database of fingerprints and facial photos from a federal law that gives Americans the right to sue for government violations of the Privacy Act, such as refusing to tell a person if he or she is in the system.
The bureau also wants to shield its data storehouse from other Privacy Act rules, including one that lets people ensure that the information the government holds about them is accurate.
The proposed exemptions, published in May in the Federal Register, have stirred objections from an array of privacy and civil rights advocates. They say that such carve-outs remove a critical check on the use of the huge database in criminal investigations.
In particular, advocates are concerned about the bureau’s deployment of still-developing facial-recognition technology to identify potential suspects. Such technology, they say, may have lower accuracy rates for black people, young people and women. And they worry that it could be misused to track protesters at political rallies.
“The Privacy Act was enacted to ensure that individuals had an enforceable right to know the records that the government keeps about their activities,” said a coalition of groups in a letter to the Justice Department, whose 45 signatories include the American Civil Liberties Union, Amnesty International, the National Immigration Law Center and the ride-hailing services Uber and Lyft. “This is an extraordinarily broad proposal, and the system it affects is extraordinarily sensitive — particularly for the communities it may affect the most.”
But the FBI and Justice Department say the reason they are seeking the exemptions is to ensure that ongoing investigations are not compromised by people learning they are the subjects of probes. They also say that another federal rule gives people the ability to obtain any criminal records they might have in the database. Moreover, the agencies say, only criminal mug shots are searched using facial-recognition technology. And it is used only to come up with leads, not to identify a suspect or verify an identity.
And, they stress, the system is not used to track protesters at rallies.
“The FBI and the Department of Justice take very seriously their strict compliance with the Constitution, federal law particularly the Privacy Act, and their own policies regarding the free exercise of constitutional rights,” the two agencies said in an email to The Post.
The system, called Next Generation Identification (NGI), was launched in 2008. Today, it holds more than 100 million fingerprints from criminal suspects and convicts — including tens of thousands of known or suspected terrorists, as well as people who have undergone background checks to become daycare workers, for instance. It also stores more than 45 million facial photos — criminal mug shots and civilian photos submitted as part of a visa application or hiring process.
NGI is the successor to the FBI’s automated fingerprint database begun in 1999. NGI was created to give the bureau — and the 18,000 state, local and federal agencies it serves — a faster, more powerful capability to search a growing number of fingerprints and mug shots. Fingerprint-matching accuracy is now at 99.6 percent, officials said. Facial-recognition accuracy is at 85 percent, but mug shots are not searched for positive identification, the bureau says.
Thomas E. Bush, a former assistant director of the FBI’s Criminal Justice Information Services Division, which oversees NGI, said the system is critical to homeland security. The State Department, for instance, uses it to screen visa applicants. “If you’re only using name-based systems, a bad guy’s going to beat you,” he said.
But the increased size, power and speed also has advocates worried that inaccuracies will go undetected or that deserving people might lose out on jobs and benefits.
The bureau has exempted its old fingerprint database from many of the same Privacy Act protections, but it is proposing they be extended into the NGI system and applied to photos and other biometrics.
According to figures supplied by the FBI, 43 percent of all federal arrests and 52 percent of all state arrests — or 51 percent of all arrests in NGI — lack final dispositions, such as whether a person has been convicted or even charged. Some of those people, the advocates say, might not be criminals, but the mere fact of having an arrest can disqualify them from a job.
The bureau notes that it has been working on improving disposition rates, but that it often takes years for a criminal case to be disposed of, whether through a conviction or dismissal. They also say that they are not applying the exemptions to fingerprints not held as part of criminal records.
Allowing criminal background checks to be run against records that do not indicate whether a person was ultimately found innocent or guilty “is a remarkable violation of due process,” said Alvaro Bedoya, executive director of Georgetown University’s Center on Privacy and Technology.
Bedoya said that the federal rule cited by the FBI and Justice Department that enables a person to obtain his criminal record is less effective than the Privacy Act, which requires the federal government to respond promptly to citizens’ requests for corrections. The cited regulation leaves that job to the states “and allows that process to go on indefinitely,” he said.
“The big concern is that the FBI is proposing to exempt NGI from any requirement that they update or correct data about somebody in the future,” said Jennifer Lynch, senior staff attorney for the Electronic Frontier Foundation.
The coalition also is concerned that legal immigrants will have their fingerprints in the database, searched millions of times a year, along with other criminal and civilian prints. This violates the principle of equal treatment under the law, Bedoya said.
The group also pointed to 2012 research that found that facial-recognition technology has lower rates of accuracy for black people, women and young people.
Such shortcomings are compounded by the fact, the coalition says, that blacks and Latinos are arrested at disproportionately higher rates than whites, putting them at greater risk of being placed in a suspect pool.
But FBI officials said that any potential lead is drawn from a photo lineup of between two and 50 candidates and the result is reviewed by two technicians before it is provided to an investigator.
In response to civil rights and privacy concerns, the Justice Department has agreed to extend the public comment period from 30 to 60 days, through July 6.
This article was written by Ellen Nakashima from The Washington Post and was legally licensed through the NewsCred publisher network.
Online Degrees & Certificates In Cybersecurity
American Military University's online cybersecurity programs integrate multiple disciplines to ensure you gain the critical skills and management practices needed to effectively lead cybersecurity missions – from government or private industry. Learn from the leader. American Military University is part of American Public University System, which has been designated by the National Security Agency and the Department of Homeland Security as a National Center of Academic Excellence in Cyber Defense Education.