The Government Accountability Office (GAO) has found a lack of training and specific policies related to facial recognition services at the Department of Homeland Security (DHS) and the Department of Justice (DOJ).
Seven law enforcement agencies within DHS and DOJ told GAO that they use facial recognition services provided by commercial and nonprofit entities. The agencies included in GAO’s review were U.S. Customs and Border Protection (CBP), Homeland Security Investigations (HSI), the Bureau of Alcohol, Tobacco, Firearms and Explosives, the Drug Enforcement Administration, the Federal Bureau of Investigation (FBI), the Secret Service, and the Marshals Service. The services used by the agencies gather photos from various sources, such as social media and mugshot websites. In addition, some of these services support certain types of criminal investigations. For example, FBI used Marinus Analytics’s Traffic Jam service to support human trafficking investigations. Meanwhile, CBP officials stated that they have used facial recognition services to identify potential terrorists, transnational criminals, and individuals who pose a higher risk of violating U.S. law
DHS and DOJ officials told GAO that, as of April 2023, the agencies had limited their use of facial recognition services in criminal investigations to conducting identification searches to generate investigative leads, or to help identify potential victims in specific investigations such as human trafficking cases.
GAO found that all seven agencies initially used these services without requiring staff to take facial recognition training. GAO said six agencies had available data and cumulatively conducted about 60,000 searches when they did not have training requirements in place. Two agencies- HSI and Marshals Service – began to require training.
FBI officials told key internal stakeholders that certain staff must take training to use one facial recognition service. However, in practice, GAO said FBI has only recommended it as a best practice. The watchdog also found that few of these staff completed the training, and across the FBI, only 10 staff completed facial recognition training of 196 staff that accessed the service. FBI said it intends to implement a training requirement for all staff, but have not yet done so.
CBP told GAO that it does not require staff to take facial recognition training to access the two services it uses: IntelCenter and Marinus Analytics’ Traffic Jam. CBP officials said this is in part because they believe staff rarely use the facial recognition capabilities of either service, and instead predominantly use other features available through these services. Additionally, CBP officials stated that the agency requires all staff to complete privacy training, and that staff could have taken facial comparison training as part of training for identifying fraudulent documents.
GAO determined that CBP provides staff access to facial recognition services but does not have information on the number of staff that use the facial recognition services or how often. Further, the watchdog found that CBP has not assessed whether staff using facial recognition services to develop and share information in support of other agencies’ criminal investigations could benefit from training on facial recognition technology.
GAO also found that three of the seven agencies had policies or guidance specific to facial recognition technology that address civil rights and civil liberties. The other four agencies—three in DOJ and one in DHS—did not have such policies or guidance. It is worth noting that DHS has plans to finalize a department-wide policy by December 2023. Meanwhile, DOJ has taken steps to issue a department-wide policy, but has faced delays.
GAO is making 10 recommendations, including that FBI implement a training requirement and clarify the status of its training requirement to stakeholders. GAO also recommends that DOJ develop a plan to issue a facial recognition technology policy addressing safeguards for civil rights and civil liberties. Agencies concurred with all 10 recommendations.
