Fourteen federal agencies reported using facial recognition technology systems owned by non-federal entities to support criminal investigations, and 13 out of the 14 agencies did not have up-to-date information on what non-federal systems were being used by employees, the Government Accountability Office (GAO) has reported.
According to GAO, the 13 agencies did not fully assess the potential risks, such as privacy and accuracy, of using non-federal systems.
“Most federal agencies that reported using non-federal systems did not own systems,” GAO said. “Thus, employees were relying on systems owned by other entities, including non-federal entities, to support their operations.”
GAO requested information regarding the use of non-federal systems by one of the agencies and agency officials told GAO that they needed to poll field division personnel because that information was not maintained by the agency.
“These agency officials also told us that the field division personnel had to work from their memory about their past use of non-federal systems, and that they could not ensure we were provided comprehensive information about the agency’s use of non-federal systems,” GAO said.
Another agency initially told GAO that their employees did not use non-federal systems but after conducting a poll, the agency learned that employees had conducted over 1,000 facial recognition searches using non-federal systems.
One agency, the U.S. Immigration and Customs Enforcement, implemented a tracking system of what non-federal systems their employees were using, GAO reported. In November 2020, the agency was developing a list of approved facial recognition technologies that employees could use and log-in sheets were made available to employees in order for supervisors to monitor the technology use.
“The agency will allow the use of non-reviewed systems under exigent circumstances; however, supervisor approval is required,” GAO said. “The use of systems that have been reviewed and not approved for use is strictly prohibited, even in exigent circumstances, according to U.S. Immigration and Customs Enforcement.”
Aside from using facial recognition technology to support criminal investigations, federal agencies have also used this technology for surveillance, traveler verification, research and education.
According to GAO, six agencies used facial recognition technology between May and August 2020, during the civil unrest following the death of George Floyd, to support criminal investigations. Three agencies reported using this technology on images from the events on January 6 at the U.S. Capitol. Agencies also used the technology to verify the identity of individuals remotely during the COVID-19 pandemic.
GAO made 26 recommendations consisting of implementing a mechanism to track non-federal systems with facial recognition technology used by employees. Recommendations were made to eight of the 21 entities covered by GAO’s review and they generally concurred.
