FBI Rolls Out Biometric Database On Schedule, Accompanying Privacy Impact Assessment Still Nowhere To Be Found

from the move-along,-nothing-to-see-but-millions-of-faces dept

The FBI has just announced that all systems are go for its biometric database.

The Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Division announced today the achievement of full operational capability of the Next Generation Identification (NGI) System. The FBI’s NGI System was developed to expand the Bureau’s biometric identification capabilities, ultimately replacing the FBI’s Integrated Automated Fingerprint Identification System (IAFIS) in addition to adding new services and capabilities.
This puts the agency pretty much right on schedule for its stated goal of "full operational capacity in fiscal year 2014." As was to be expected from its earlier foot-dragging, the press release makes no note of the Privacy Impact Assessment that was supposed to precede the roll out.

The system itself has been in the works since 2008. Coincidentally, this is also the last time anyone at the FBI delivered a Privacy Impact Assessment. Since then, the database's sweep and power has increased immensely. The PIA promised in 2012 still hasn't been delivered and there's no indication at the FBI's website that one is right around the corner.

The release notes two other tools that will be folded into NGI.
As part of NGI’s full operational capability, the NGI team is introducing two new services: Rap Back and the Interstate Photo System (IPS). Rap Back is a functionality that enables authorized entities the ability to receive ongoing status notifications of any criminal history reported on individuals holding positions of trust, such as school teachers. Law enforcement agencies, probation and parole offices, and other criminal justice entities will also greatly improve their effectiveness by being advised of subsequent criminal activity of persons under investigation or supervision.
Rap Back sounds useful but its tracking of people in "trusted positions" does not include some very specific "trusted positions." This 2012 presentation on Rap Back [pdf] clearly delineates between "trusted" civilians and those exempt from ongoing criminal background monitoring.


Here's the relevant info in case you can't read/see the pic, Rap Back ongoing monitoring and notification service only targets these individuals.
Non-criminal justice applicants, employees, volunteers, and licensees;

Individuals under the supervision or investigation of criminal justice agencies.
Note that "supervision" doesn't mean employees of criminal justice agencies, but rather parolees and those on probation. Presumably, the criminal justice system will police itself, relying only on pre-employment screenings (if that). The problem is that employees with criminal history have been known to jump from agency to agency without their new employers knowing (or caring) about the incidents that forced the job change. Apparently, this is an acceptable situation despite the fact that the DOJ tends to ignore much of the misconduct that occurs in agencies under its command.

The Interstate Photo System sounds like license plates but is actually the FBI's facial recognition database. A high error rate and a flood of too-lo-res-to-be-useful photos hasn't stopped the FBI from pushing this system -- basically a searchable mug shot repository that includes millions of non-criminals just for the hell of it. To reach its lofty goals (52 million pics by 2015), the FBI is including generic federal employee records. The potential for the system to return non-criminals in searches for "candidates" remains high, but the FBI has reassuringly stated that it bears no legal responsibility if any of the 18,000 law enforcement agencies that have access arrest the wrong person.

An unvetted system that can be accessed by thousands is a huge problem. The FBI will join the NSA in hoarding massive amounts of irrelevant data with very little oversight. The hoarding mentality has taken over and everyone involved is hesitant to implement stringent minimization and disposal policies because of the irrational fear that something discarded might be needed later.

If and when the privacy assessment arises, I expect it will be filled with paragraphs that underplay the potential civil liberties violations, lots of explanations as to why there's no expectation of privacy in anything the government collects and some mumbling around the edges about minimization and access control.

While I realize that it's inevitable that the march of technology would lead to this sort of thing -- and while it does have several legitimate uses -- my biggest problem with these advances is that the FBI and others continually stress that it's the only way to keep up with evolving criminal behavior. The justifications deployed point to a constantly-rising criminal threat that has no basis in reality. I cannot buy into the narrative that the best way to combat crime (or terrorism, for that matter) is vast, untargeted databases.

The FBI focuses most of its assets on two opponents: drugs and terrorism. The first is exacerbated by years of bad legislation and policies, and for all the time and money spent, the war doesn't seem to be on the way to being won. The latter has devolved into the FBI's proprietary con game, wherein it sets up a mark or two and takes them down. Now, it's inviting the nation's law enforcement agencies to run searches on a database populated with non-hit data and leave them holding the bag when the inevitable occurs.

An updated privacy assessment isn't going to make this a better idea, especially when the FBI (and the law enforcement agencies that feed info to it) are blithely unconcerned that current background check databases are filled with people who were never criminally charged. An internal change is needed -- one that makes these agencies more accountable to the public for screwing up their lives. But no one up top is interested in fixing what's already broken. They just want to roll out new databases that grab more info. If the FBI insists this is the only way to fight crime effectively, then it needs to exercise the sort of vigilance and internal accountability it's never shown in the past. That starts with a detailed privacy assessment, delivered in a timely fashion. And it's already failed this small step.


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    Anonymous Coward, 16 Sep 2014 @ 1:36pm

    Greetings... criminals

    I mean Citizens... you really are just criminals we have not caught yet.

    Anyhoo... how can it be called "Accompanying" if it is nowhere to be found?

    reply to this | link to this | view in chronology ]

  • identicon
    KRA, 16 Sep 2014 @ 1:42pm

    Big data is to the anti-terror agencies what illegal pot is to the DEA--something that has no chance of solving the real problem, something to justify their existence and growth, and something to give the government obscene power over regular, non-threatening people.

    reply to this | link to this | view in chronology ]

  • icon
    That Anonymous Coward (profile), 16 Sep 2014 @ 1:58pm

    There is no impact on privacy, because we no longer have privacy.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Anonymous Coward, 16 Sep 2014 @ 2:30pm

      Re:

      Sounds like a business opportunity to me. Should we sell it by the pint or pound? Or maybe liters or kilograms? What do you think we should set the initial price at?

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 16 Sep 2014 @ 2:16pm

    Inmates running the asylum

    It must be nice to be able to roll out a system you could reasonably foresee will ruin innocent people's lives and escape all responsibility for it on the basis that you included some fine print saying that it should not be used that way. When can I use the disclaimer that I'm not legally responsible for any of the bad things I cause, because I warned people I might cause them and they didn't try hard enough to stop me?

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 16 Sep 2014 @ 3:04pm

    next up heart rates, x-ray id and brain scans and the once favorable, inferior criminal head size chart

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 16 Sep 2014 @ 7:43pm

    you will do what your told average American or you will be charged with aiding and abetting terrorism.

    Sincerely your overlords

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Show Now: Copymouse
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.