The FBI could soon compare suspects' faces against a digital database of millions of photographs. That concerns some civil liberties advocates, who worry that nobody outside the bureau knows what limits, if any, have been placed on adding photos to the database or how accurate those facial recognition searches are.
By next year, the FBI plans to have 52 million photos in a biometric database that also holds fingerprints, according to documents obtained by the privacy group Electronic Frontier Foundation (EFF) and released Monday. According to those documents, the database contained pictures of 7 million to 8 million people as of 2012.
"There should be congressional oversight of this, and there should be rules," said Jennifer Lynch, an EFF staff attorney.
For example, Lynch asked, "How do you get your picture out of the database once it's in there? And how do you even find out that it's in there?"
The FBI is building the giant biometric database, called Next Generation Identification, to replace its current electronic fingerprint records. The bureau has previously said that agents will be able to query the database with facial recognition software and that its contents will be shared with state and local law enforcement agencies.
But beyond that, the bureau is creating Next Generation Identification under a shroud of secrecy: The FBI showed its files to the EFF only as part of a Freedom of Information Act lawsuit and only with redactions. Stephen Fischer, a spokesman for the FBI's Criminal Justice Information Services, declined to comment to HuffPost about the EFF release.
Lynch said the EFF is particularly concerned that the FBI is mixing criminal mugshots and non-criminal photos, like those taken of state employees, in the same database. By 2015, the bureau estimates, the database could have 4.3 million non-criminal photos.
Next Generation Identification could also make it easy for law enforcement to pull a suspect's friends and acquaintances into an investigation. Lynch pointed to the trove of facial photos on people's Facebook pages.
"Let's say that you downloaded a picture from somebody's Facebook page, and there was a second person in the picture and that person wasn't identified. A law enforcement person could run it," she said.
Lynch fears that the FBI has no rules in place to prevent it from someday linking Next Generation Identification to the states' driver's license databases -- which would likely bring photos of most adult Americans into the system.
And there's the problem of false positives. Lynch said that the FBI refused to release data on how often facial recognition searches identify a person in a photo incorrectly.
"Unfortunately, they withheld most of the records that related specifically to accuracy of the identification process," said Lynch.