Oversight Committee Finds FBI's Facial Recognition Database Still Filled With Innocent People, Still Wrong 15% Of The Time

from the bigger-but-no-better dept

The House Oversight Committee finally took on the FBI's Facial Recognition Program and discovered what critics have been saying about it for years: it's broken, filled with innocent Americans, and completely out of control.

Approximately half of adult Americans’ photographs are stored in facial recognition databases that can be accessed by the FBI, without their knowledge or consent, in the hunt for suspected criminals. About 80% of photos in the FBI’s network are non-criminal entries, including pictures from driver’s licenses and passports. The algorithms used to identify matches are inaccurate about 15% of the time, and are more likely to misidentify black people than white people.

These aren't new criticisms. While the accuracy of database searches has gotten (slightly) better over the past seven years (it was only 80% "right" in 2010), nothing else has changed. The FBI is working with local agencies, like state drivers license issuers, to ensure its facial recognition database is continually stocked with non-criminal entries.

The database continues to expand, as does its application. As was covered during the hearing, multiple body camera vendors are offering products that provide real-time face scanning, which turns routine patrol work into low-key surveillance. As it stands now, biometric databases and scanning are the real Wild West, but filled with rogue law enforcement efforts, rather than the other way around. Not only did the FBI deploy its biometric database well ahead of its Privacy Impact Assessment, it did so with nothing in the way of legal guidance. Several years later, this hasn't changed either.

“No federal law controls this technology, no court decision limits it. This technology is not under control,” said Alvaro Bedoya, executive director of the center on privacy and technology at Georgetown Law.

The Government Accountability Office's take on the FBI's facial recognition database hasn't improved much since last year. The FBI is still adding as many state databases to its central biometric storage as possible, while its oversight -- both the Inspector General's office and its Congressional overseers -- is being stiff-armed and stonewalled by an agency extremely adverse to attempts to curb its powers. As it expands the database -- and as more vendors and government agencies make use of the collected data -- the number of false positives will only increase. This could make life extremely difficult for any number of Americans.

“It doesn’t know how often the system incorrectly identifies the wrong subject,” explained the GAO’s Diana Maurer. “Innocent people could bear the burden of being falsely accused, including the implication of having federal investigators turn up at their home or business.”

The FBI's testimony attempted to downplay this aspect by claiming the database is only used for "investigative leads," rather than identification of suspects. But that doesn't do anything to change the scenarios presented by the GAO. A mistaken lead could easily turn into a false accusation and being under investigation definitely would result in the feds dropping by a person's work or home.

It's been nearly a decade since the FBI began working on this database and there's nothing to show for it but a slight uptick in accuracy. Civil liberties concerns remain unaddressed while the agency focuses on what's important to IT: adding as many people as possible to the database. It has yet to demonstrate its real-world effectiveness, appearing to be far more interested in the "collect it all" tactics of the intelligence agency it clearly idolizes and emulates.

Filed Under: face recognition, fbi, house oversight committee

House Oversight Committee Calls For Stingray Device Legislation

from the and-only-two-decades-from-their-first-appearance dept

The Congressional Committee on Oversight and Government Reform has issued its recommendations on the use of cell site simulators (a.k.a. "Stingrays," presumably to Harris Corporation's trademark erosion dismay) by law enforcement. Its recommendations are… that something needs to be done, preferably soon-ish. (h/t Chris Soghoian)

Congress should pass legislation to establish a clear, nationwide framework for when and how geolocation information can be accessed and used.

Before it reaches this conclusion, the Committee spends a great deal of time recounting the history of both the devices' usage, as well as any steps taken (most of them very recently) to govern their use.

The report [PDF] points to the Supreme Court's Jones decision, albeit not in a very helpful way. The justices punted on the warrant question, leaving it up to lower courts' interpretation as to whether or not tracking someone with a GPS device violated their privacy. The only thing they did agree on was the intrusion onto the property to install the device on the petitioner's vehicle. Everything else was left unclear, including the lack of a bright line for how much location tracking equals unconstitutional tracking.

Cell site simulators can perform the same function and, until recently, every law enforcement agency in possession of the devices deployed them without seeking search warrants. The DOJ finally suggested warrants might be necessary in 2015, which would only be about 18 years since DOJ elements began using Stingray devices.

A 1997 DOJ guidance bulletin discussed the agency’s views on what legal authority governed the various law enforcement surveillance options, including “cell-site simulator.” According to the 1997 guidance, DOJ took the position that “it does not appear that there are constitutional or statutory constraints on the warrantless use of such a device.” According to a chart that was issued with the guidance, court orders, search warrants, and subpoena requirements were not applicable when deploying this device.

For most law enforcement agencies, the lack of a warrant requirement has allowed them to disguise their Stingray deployments. Most have sought pen register orders instead for this form of real-time location tracking. Others have used parallel construction to hide use of IMSI catchers from courts, defendants, and, in some cases, the prosecutors they work with. This was all heavily encouraged by the FBI's nondisclosure agreement, which it made law enforcement officials sign before allowing them to purchase the devices.

Now, they're everywhere. The IRS has its own devices and feds are attaching IMSI catchers to planes and flying them over cities in hopes of tracking down suspects. What's more concerning is the devices' capabilities, which federal and local law enforcement agencies all swear they've never used.

In testimony before the Committee, DOJ and DHS both confirmed the simulator devices they use do not intercept any communications or content from the cellular devices to which they connect. Specifically, DOJ confirmed that between January 1, 2010 and September 2, 2015, its component agencies using the technology—the FBI; the Drug Enforcement Administration (DEA); the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF); and U.S. Marshals Service (USMS)—only collected dialing, routing, signaling and addressing information in domestic criminal investigations and did not use the devices to collect the content of communications. While the current DOJ and DHS policies require the cell-site simulators to be configured as pen registers and to not collect content, some of the cell-site simulator models used by law enforcement components within DOJ and DHS would be capable of collecting content if the devices had the necessary software installed.

The Committee points out that if the federal government doesn't hand down universal controls for the deployment of these devices, the situation will only devolve from here.

Further, the Committee notes that these devices are available all over the world and with even fewer usage restrictions. And the tech is more widely available than the US government would hope, which means those who care little for policies, guidance, or federal law won't hesitate to deploy these themselves.

It is possible, if not likely, bad actors will use these devices to further their aims. Criminals and spies, however, will not be adopting the DOJ and DHS policies and procedures or any other ethics of surveillance. They will not be self-limiting in their use of these devices so as to not capture the content of others’ conversations. Criminals could use these devices to track potential victims or even members of law enforcement. One can imagine scenarios where criminals or foreign agents use this type of technology to intercept text messages and voice calls of law enforcement, corporate CEOs, or elected officials.

The report notes that devices are already for sale on foreign websites, and those selling them are suggesting purchasers set them up in high-traffic areas (near banks, restaurants, hospitals, etc.) for maximum effectiveness. On top of that, hobbyists and researchers have been able to put together their own IMSI catchers, all without the guidance or assistance of companies who sell their devices to a highly-restricted list of government agencies. The secret is out -- and has been out for years. While any legislation would do little to deter bad actors, it would at least allow the US to act as a role model for foreign governments to emulate and give it some sort of (belated) moral high ground to stand on when restricting US companies from selling surveillance tech to governments with human rights abuse track records.

If nothing else, the hope is that the legislation called for will result in a cohesive, coherent ruleset that's also Constitutionally-sound. Obviously, this will be met with law enforcement resistance, as anything that implements a warrant requirement generally does.

Filed Under: house oversight committee, imsi catchers, stingrays, surveillance
Companies: harris corporation

Law Enforcement's Cluelessness On Display In Congressional Hearing On Undermining Encryption

from the let's-try-this-again dept

Yesterday, the House Oversight Committee held a hearing over this whole stupid kerfuffle about mobile encryption. If you don't recall, back in the fall, both Apple and Google said they would start encrypting data on mobile devices by default, leading to an immediate freakout by law enforcement types, launching a near exact replica of the cryptowars of the 1990s.

While many who lived through the first round had hoped this would die a quick death, every week or so, we see someone else in law enforcement demonizing encryption, without seeming to recognize how ridiculous they sound. There was quite a bit of that in the hearing yesterday, which you can sit and watch in its entirety if you'd like: Thankfully, there were folks like cryptographer Matt Blaze and cybersecurity policy expert Kevin Bankston on hand to make it clear how ridiculous all of this is -- but it didn't stop law enforcement from making their usual claims. The most ridiculous, without a doubt, was Daniel Conley, the District Attorney from Suffolk County, Massachusetts, whose opening remarks were so ridiculous that it's tough to read them without loudly guffawing. It's full of the usual "but bad guys -- terrorists, kidnappers, child porn people -- use this" arguments, along with the usual "law enforcement needs access" stuff. And he blames Apple and Google for using a "hypothetical" situation as reason to encrypt:

Apple and Google are using an unreasonable, hypothetical narrative of government intrusion as the rationale for the new encryption software, ignoring altogether the facts as I’ve just explained them. And taking it to a dangerous extreme in these new operating systems, they’ve made legitimate evidence stored on handheld devices inaccessible to anyone, even with a warrant issued by an impartial judge. For over 200 years, American jurisprudence has refined the balancing test that weighs the individual’s rights against those of society, and with one fell swoop Apple and Google has upended it. They have created spaces not merely beyond the reach of law enforcement agencies, but beyond the reach of our courts and our laws, and therefore our society.

The idea that anything in mobile encryption "upends" anything is ridiculous. First, we've had encryption tools for both computers and mobile devices for quite some time. Apple and Google making them more explicit hardly upends anything. Second, note the implicit (and totally incorrect) assumption that historically law enforcement has always had access to all your communications. That's not true. People have always been able to talk in person, or they've been able to communicate in code. Or destroy communications after making them. There have always been "spaces" that are "beyond the reach of law enforcement."

But to someone so blind as to be unaware of all of this, Conley thinks this is somehow "new":

I can think of no other example of a tool or technology that is specifically designed and allowed to exist completely beyond the legitimate reach of law enforcement, our courts, our Congress, and thus, the people. Not safe deposit boxes, not telephones, not automobiles, not homes. Even if the technology existed, would we allow architects to design buildings that would keep police and firefighters out under any and all circumstances? The inherent risk of such a thing is obvious so the answer is no. So too are the inherent risks of what Apple and Google have devised with these operating systems that will provide no means of access to anyone, anywhere, anytime, under any circumstance.

As Chris Soghoian pointed out, just because Conley can't think of any such technology, it doesn't mean it doesn't exist. Take the shredder for example. Or fire.

During the hearing, Conley continued to show just how far out of his depth he was. Rep. Blake Farenthold (right after quizzing the FBI on why it removed its recommendation on mobile encryption from its website -- using the screenshot and highlighting I made), asked the entire panel:

Is there anybody on the panel believes we can build a technically secure backdoor with a golden key -- raise your hand?

No one did -- neither DA Conley nor the FBI's Amy Hess: But, just a few minutes later, Conley underscored his near absolute cluelessness by effectively arguing "if we can put a man on the moon, we can make backdoor encryption that doesn't put people at risk." Farenthold catalogs a variety of reasons why backdoor encryption is ridiculously stupid -- and even highlights how every other country is going to demand their own backdoors as well -- and asks if anyone on the panel has any solutions. Conley then raises his hand and volunteers the following bit of insanity:

I'm no expert. I'm probably the least technologically savvy guy in this room, maybe. But, there are a lot of great minds in the United States. I'm trying to figure out a way to balance the interests here. It's not an either/or situation. Dr. Blaze said he's a computer scientist. I'm sure he's brilliant. But, geeze, I hate to hear talk like 'that cannot be done.' I mean, think about if Jack Kennedy said 'we can't go to the moon. That cannot be done.' [smirks] He said something else. 'We're gonna get there in the next decade.' So I would say to the computer science community, let's get the best minds in the United States on this. We can balance the interests here.

No, really. Watch it here: As Julian Sanchez notes, this response is "all the technical experts are wrong because AMERICA FUCK YEAH."

This is why it's kind of ridiculous that we continue to let technologically clueless people lead these debates. There are things that are difficult (getting to the moon) and things that are impossible (arguing we only let "good people" go to the moon.) There are reasons for that. This isn't about technologists not working hard enough on this problem. This is a fundamental reality in that creating backdoors weakens the infrastructure absolutely. That's a fact. Not a condition of poor engineering practices.

And, really, this idea of "getting the best minds" in the computer science community to work on this, I say please don't. That's like asking the best minds in increasing food production to stop all their work and spend months trying to research how to make it rain apples from clouds in the sky. It's not just counterproductive and impossible, but it takes away from the very real and important work they are doing on a daily basis, including protecting us from people who actually are trying to do us harm. That a law enforcement official is actively asking for computer scientists and cybersecurity experts to stop focusing on protecting people and, instead, to help undermine the safety of the public, is quite incredible. How does someone like Conley stay in his job while publicly advocating for putting the American people in more danger like that?

Filed Under: blake farenthold, daniel conley, encryption, house oversight committee, kevin bankston, matt blaze, mobile encryption, oversight committee

Congress: The TSA Is Wasting Hundreds Of Millions In Taxpayer Dollars

from the oversight-indeed dept

The House Oversight Committee has come out with a report slamming the TSA for tremendous amounts of waste, specifically in the "deployment and storage" of its scanning equipment. Basically, it sounds like the TSA likes to go on giant spending sprees, buying up security equipment and then never, ever using it. A few data points

• As of February 15, 2012, the total value of TSA’s equipment in storage was, according to TSA officials, estimated at $184 million. However, when questioned by Committee staff, TSA’s warehouse staff and procurement officials were unable to provide the total value of equipment in storage.
• Committee staff discovered that 85% of the approximately 5,700 major transportation security equipment currently warehoused at the TLC had been stored for longer than six months; 35% of the equipment had been stored for more than one year. One piece of equipment had been in storage more than six years – 60% of its useful life.
• As of February 2012, Committee staff discovered that TSA had 472 Advanced Technology 2 (AT2) carry-on baggage screening machines at the TLC and that more than 99% have remained in storage for more than nine months; 34% of AT2s have been stored for longer than one year.
• TSA knowingly purchased more Explosive Trace Detectors (ETDs) than were necessary in order to receive a bulk discount under an incorrect and baseless assumption that demand would increase. TSA management stated: “[w]e purchased more than we needed in order to get a discount.”

Oh yeah, and it appears that the TSA isn't very good at tracking this stuff. When asked about the total cost of managing this equipment, the TSA was unable to provide an answer. And then it appeared to willfully mislead Congress about this:

• TSA intentionally delayed Congressional oversight of the Transportation Logistics Center and provided inaccurate, incomplete, and potentially misleading information to Congress in order to conceal the agency’s continued mismanagement of warehouse operations.
• TSA willfully delayed Congressional oversight of the agency’s Transportation Logistics Center twice in a failed attempt to hide the disposal of approximately 1,300 pieces of screening equipment from its warehouses in Dallas, Texas, prior to the arrival of Congressional staff.
• TSA potentially violated 18 U.S.C. Sec. 1001, by knowingly providing an inaccurate warehouse inventory report to Congressional staff that accounted for the disposal of equipment that was still in storage at the TLC during a site visit by Congressional staff.
• TSA provided Congressional staff with a list of disposed equipment that falsely identified disposal dates and directly contradicted the inventory of equipment in the Quarterly Warehouse Inventory Report provided to Committee staff on February 13, 2012.

One of the theories that was floated a few years ago when there was that big rush to rollout the nudie scanners, was that much of it was being driven by fear mongering from former government officials, like Michael Chertoff, who had economic relationships with the makers of the equipment. This report doesn't confirm any of that, but it sure seems to fit that narrative pretty perfectly. Fear monger away, have the TSA buy a ton of questionable equipment it doesn't actually need, and then have much of that equipment just sit in a warehouse. All on the taxpayers' dime.

Filed Under: congress, house oversight committee, michael chertoff, scanners, tsa, waste

TSA Freaks Out, Gets Longtime Critic Bruce Schneier Kicked Off Of Oversight Hearing

from the congressional-security-theater dept

If you read this site, you probably already know who Bruce Schneier is. We've certainly mentioned the longtime security expert plenty of times. He's been one of the leading vocal critics of "security theater" from the TSA, and therefore a perfectly reasonable counterpoint to the TSA in a hearing by the House Oversight Committee looking into TSA reform. I don't think anyone has thought quite as much about how the TSA could do things better than Bruce Schneier. But, as you can see from the website of the hearing, Schneier was removed from today's hearing: He didn't get sick or have something better to do. Hell, he didn't even miss a flight. Instead, according to Schneier, the TSA itself had him removed from the panel:

On Friday, at the request of the TSA, I was removed from the witness list. The excuse was that I am involved in a lawsuit against the TSA, trying to get them to suspend their full-body scanner program. But it's pretty clear that the TSA is afraid of public testimony on the topic, and especially of being challenged in front of Congress. They want to control the story, and it's easier for them to do that if I'm not sitting next to them pointing out all the holes in their position. Unfortunately, the committee went along with them.

As Tim Lee notes in reporting on this story, the TSA has done similar things in the past, and even been rebuked by Rep. Jason Chaffetz -- and yet it had no problem doing it again. The fact that Schneier is a part of that lawsuit is meaningless and shouldn't stop him from testifying at all. Schneier is a clear thorn in the side of the TSA, and if it's so afraid of having him speak to Congress, that really says a lot about the (lack of) confidence it has in its own arguments. If you can't stand to let a critic speak, it suggests that perhaps your own argument isn't very strong.

Filed Under: bruce schneier, congress, darrell issa, house oversight committee, security theater, tsa