US Isn’t Collecting Only Electronic Data On You — Huge Biometric Database Under Construction, Too
Edward Snowden’s revelations have shed much light on how secret government programs are collecting huge amounts of telephone, email and other electronic data generated by every US citizen even though, as Marcy has shown repeatedly, claims that collecting all of this data have enabled the capture of terrorists turn out to be significantly overblown. Sadly, it’s not just records of our communications that the government is collecting. The FBI is taking the lead in putting together what it calls Next Generation Identification. This program will expand the conventional FBI fingerprint database to include significant amounts of biological, or biometric data. From the FBI’s own description:
The future of identification systems is currently progressing beyond the dependency of a unimodal (e.g., fingerprint) biometric identifier towards multimodal biometrics (i.e., voice, iris, facial, etc.). The NGI Program will advance the integration strategies and indexing of additional biometric data that will provide the framework for a future multimodal system that will facilitate biometric fusion identification techniques. The framework will be expandable, scalable, and flexible to accommodate new technologies and biometric standards, and will be interoperable with existing systems. Once developed and implemented, the NGI initiatives and multimodal functionality will promote a high level of information sharing, support interoperability, and provide a foundation for using multiple biometrics for positive identification.
Wait. See that “etc.” in the “voice, iris, facial, etc”? Given the government’s behavior on electronic data, throwing in an “etc.” on biometric data is pretty unnerving. Impressive work is being done by the Electronic Privacy Information Center to shed light on just what the government is up to with Next Generation Identification. Here is their description of the program:
The Federal Bureau of Investigation is developing a biometric identification database program called “Next Generation Identification” (NGI). When completed, the NGI system will be the largest biometric database in the world. The vast majority of records contained in the NGI database will be of US citizens. The NGI biometric identifiers will include fingerprints, iris scans, DNA profiles, voice identification profiles, palm prints, and photographs. The system will include facial recognition capabilities to analyze collected images. Millions of individuals who are neither criminals nor suspects will be included in the database. Many of these individuals will be unaware that their images and other biometric identifiers are being captured. Drivers license photos and other biometric records collected by civil service agencies could be added to the system. The NGI system could be integrated with other surveillance technology, such as Trapwire, that would enable real-time image-matching of live feeds from CCTV surveillance cameras. The Department of Homeland Security has expended hundreds of millions of dollars to establish state and local surveillance systems, including CCTV cameras that record the routine activities of millions of individuals. There are an estimated 30 million surveillance cameras in the United States. The NGI system will be integrated with CCTV cameras operated by public agencies and private entities.
So just as the government has moved far beyond tapping communications only with a warrant to include the communications of innocent civilians, biometric identifiers of innocent civilians will be included in NGI alongside identifiers of known criminals. And what could possibly go wrong with our information being assembled in this way? Here’s how EPIC says the database will be built and maintained:
The NGI database will be used for both law enforcement and non-law enforcement purposes. It will be available to law enforcement agencies at the local, state, and federal level. But it will also be available to private entities, unrelated to a law enforcement agency. Using facial recognition on images of crowds, NGI will enable the identification of individuals in public settings, whether or not the police have made the necessary legal showing to compel the disclosure of identification documents. The New York City Police Department began scanning irises of arrestees in 2010; these sorts of records will be entered into NGI. The Mobile Offender Recognition and Information System (“MORIS”), a handheld device, allows officers patrolling the streets to scan the irises and faces of individuals and match them against biometric databases. Similarly, children in some school districts are now required to provide biometric identifiers, such as palm prints, and are also subject to vein recognition scans. Clear, a private company offering identity services based on biometric identifiers, attempted to sell the biometric database of its users after its parent company, Verified Identity Pass, declared bankruptcy. The transfer of the biometric database was blocked by a federal district court judge.
There is a substantial risk that personally identifiable information could be lost or misused as a result of the creation of the NGI system. Among the private contractors involved in the deployment of NGI are Lockheed Martin, IBM, Accenture, BAE Systems Information Technology, Global Science & Technology (“GST”), Innovative Management & Technology Services (“IMTS”), and Platinum Solutions. Arizona, Hawaii, Kansas, Maryland, Michigan, Missouri, Nebraska, New Mexico, Ohio, South Carolina, and Tennessee are actively participating in the NGI program. The FBI is pursuing an aggressive deployment of the NGI program, scheduled for completion and full deployment by 2014.
Okay, then. A huge program, costing hundreds of millions of dollars, is being assembled by the same cast of government contractors who have given us decades of cost-overruns and defective products. And they might even give access to the system to private entities? Wow.
Of course, we are expected to believe that this system will work just as it already does on NCIS when Abby or McGee puts a photo into their computer and the identity of the terrorist pops up five seconds later. But in a 300+ page document (pdf) EPIC obtained under FOIA, we have this little nugget that tells us the current state of the art when it comes to facial recognition software:
NGI shall return an incorrect candidate a maximum of 20% of the time.
Think about that. In putting out the specifications for the system to be developed (and that is planned to be implemented next year!), the government is willing to get for its huge investment a system that makes a false positive identification one in five times. That could put a very large number of entirely innocent people in a huge pile of trouble very quickly.
The problem is that current technology on facial recognition requires very high quality photographs, preferably full face, for identification to work. That is why it took so long to identify the Tsarnaev brothers even though surveillance photos had been found and both of them had identification photos in the database that was searched.
Putting NGI into full functionality before facial recognition software is ready and with so many innocent civilians in the database is a huge recipe for disaster. And of course, you can rest assured that the government will have built immunity into the system for both itself and the contractors responsible for building the system. I’m assuming that the victims of the false positive identifications will have little to no recourse in recovering the huge expenses they will face in proving their innocence. Many more lives are soon to be ruined at the expense of security theater.
I’ve just started reading up on Next Generation Identification, but from what I’ve seen so far, it looks to me like the biometric database is going to be a perfect clone of the electronic databases: huge haystacks that are incredibly expensive and of very limited to no value when most in need of producing results.
And what exact problem is this trying to solve? Are we so overrun with criminals that can change their fingerprints but willingly submit to iris scans that we have to do this?
I don’t see any case being made for the need just “because we can”.
“Are we so overrun with criminals that can change their fingerprints but willingly submit to iris scans that we have to do this?”
Not criminals but, certainly, potential offenders, oddballs, misfits, un-American activists, unproductive ration guzzlers, deviants… the message is clear enough.
The plan is to assemble files on the entire population,the data, including medical records, is all available somewhere, so that, in the end the population will be defined not physically but bureaucratically. Those without files and bar codes will not exist. Kafka meets Bentham.
A few years ago I went to get my driver’s license renewed in the state of Colorado. The person taking the picture remarked after a few seconds “wow, you have a really symmetrical face”. When I inquired as to what he meant by that, he cheerily went on to explain that “everyone” who gets their Colorado ID taken is automatically entered into a facial recognition database. According to the output, I have unusually symmetrical facial features.
Sure enough, I went searched online, and Colorado (and several other states) very quietly, with no announcement or fanfare, instituted this system several years ago. There’s no option to opt out, as far as I can see. You want an ID in Colorado, you’re in the database.
What, pray tell, are “non-law enforcement” purposes? The examples given are inapt; they pertain to crime detection. More accurately, they are a form of pre-crime detection, arguably inseparable from the exercise of what were formerly known as constitutionally protected forms of speech, association and petitioning of one’s government.
The definition of “safe” here is far removed from FDR’s list of freedom from wants. It relates more to Dr. Szell’s.
@Julie B: The database is being populated through a wide assortment of dragnets, all of which end up feeding the profits of surveillance state contractors, who will keep thinking up possibilities for its use as long as the money flows.
Visit a hospital in Sacramento, for example, and your government issued photo id is scanned into the db, not just examined, along with everything on it, photo included. Since one gives up the data “voluntarily”, that is, if you want to visit someone at all, there are no obvious or auditable restrictions on its reuse. But it’s all to keep us safe, dontchyaknow.
@earlofhuntingdon: I should read a little further before commenting. The example of school districts mandating that parents give up biometric data on children is chilling. Nominal concerns about “safety” (read, child tracking, prosecution of offenders, identification after abduction or death, seem to be the tiniest of fig leafs. Apart from populating the database, such programs ingrain the process of giving up intimate details, normalizing the behavior, just as we accept with only the slightest of grumbles the expanding list of intrusions now deemed necessary in order to board an aircraft.
The debates over cost, invasion of privacy, rules under which such data is retained and used, have been non-existent. That is its own scandal.
Using the data now is problematic (20% false positives). However the data collection is currently operable. Collect the data now, figure out how to use it later. Why spend 10 years waiting to collect data that you can collect now just because you cannot use it. Just like collecting all phone/email/internet traffic. Too much data to actually parse through now, but in 10 years, it will be easily searchable. The government is in it for the long game. Collect everything possible about everyone now so that you can use anything and everything against them later. Its the ultimate in blackmail/control. Over 20 or 30 years everyone does something they shouldn’t do or don’t want others to know. Welcome to every dystopian book/movie ever written, just give it 20 years.
“current technology on facial recognition requires very high quality photographs, preferably full face”
That’s what the camera facing you on smartphones, pads, and computer displays is for. My operating assumption is they can get that or have plans to.
Their ‘tanks’ of data in Utah are going to leak.
We need an IGov app.
I was wondering how the government might get voice prints en masse. Then it occurred to me that when our calls are monitored and recorded for training and quality assurance, we confirm that the voice is ours using other identifiers (SSN, mothers maiden name, etc.). No doubt, companies who collect these conversations are probably trying to figure out how to cash in on them.