11/4/13. NGI: A closer look at the FBI’s billion-dollar biometric program. Adam Vrankulj, biometricupdate.com
Representing a $1.2 billion investment by the U.S. federal government, the FBI’s massive Next Generation Identification (NGI) program is a ten-year lifecycle project that hinges on biometric identification technologies and has seen privacy advocates butt heads with law enforcement since its inception.
Split into six “increments,” Lockheed Martin was awarded a contract in 2008 to design, build and implement the program on behalf of the FBI, which ultimately aims to enhance the abilities of the agency’s aging IAFIS from the mid-nineties.
BiometricUpdate had a chance to talk with the FBI about what the program entails, how it works as well as some next steps for this controversial project.
Increment Zero: Workstation Replacement
Increment zero went live in 2008 and was an overall “tech-refresh” of IAFIS workstations, replacing obsolete hardware with new high-definition monitors, as well as the introduction of modular and replaceable infrastructure for examiners.
Increment One: Ten-print processing
Increment one, which went live in 2011 enhanced the agency’s ability to perform back-end processing of ten-print fingerprint data from IAFIS, using algorithms from MorphoTrak, a subsidiary of Morpho. This initially saw a 92.6 percent accuracy rate, though according to Art Ibers, director of criminal justice solutions for Lockheed Martin, the NGI is now 99.6 percent accurate in this regard.
“We had increment one and IAFIS side-by-side for five days, and in those five days, the NGI identified 910 additional matches that the legacy system missed,” Ibers said. “We immediately saw value.”
This was an important increment in establishing the NGI, as ten-print records have been collected widely for years at local, state and federal levels, so there was a large dataset to begin with. Now, synced at a national level, law enforcement agencies say they’re seeing results.
According to Clark Nelson, a senior VP of Marketing at MorphoTrak, the company continues to invest heavily into research and development for improving its processing algorithms as even minor adjustments lead to significant improvements when dealing with big data.
“If you think about it, when you’re talking about databases of tens of millions – or upwards of hundreds of millions of records – and about thousands of searches per day, an extra tenth of a percent in accuracy can lead to hundreds of new matches,” Nelson said. “Even though [our algorithms] are 99 percent accurate already, we strive to go beyond that.”
Increment Two: RISC
Increment two was rolled out in August 2011 and saw the establishment of the Repository for Individuals of Special Concern – RISC, as it’s known. This database contains the biometric data of known or suspected terrorists, sex offenders, wanted persons and other persons of special interest. It’s accessed primarily with a mobile devices and fingerprint data collected from two index fingers. According to the FBI, it gives “situational awareness” to enforcement officers in the field in the 16 U.S states and 689 separate law enforcement agencies with access to the system.
The FBI’s Brian Edgell, unit chief of the implementation and transition unit, NGI, says there are roughly 1,200 RISC transactions per day and that a typical use example is when someone can’t provide identification to law enforcement or there is reasonable cause to question identification provided. Officers can scan a person’s two index fingers to cross-reference with the RISC database and see if it turns up a match. “The FBI maintains this repository and states have access to it,” Edgell said. “We’re very pleased with how RISC is going.”
Increment Three: National Palm Repository and Latent Searches
Increment three, the most recently deployed increment, was first introduced in early May this year with the aim of improving the NGI’s latent processing services and establishing a national palm print repository.
According to the FBI, with the new latent processing system, cold cases can be solved more easily and in the four months since launching, it’s already paid off. “[Investigators] can register latent prints in the file, and we can cascade new prints coming in every day against that,” Edgell said. “If there’s a match, we can give leads to latent examiners to who can do a one-to-one comparison to see if they can make an identification.”
“Under IAFIS, we only searched composite records, so if someone had six or seven prior arrests, we could only search the compilation of that data, but now we can search all arrest events.”
The NGI’s third increment also includes the creation of a national palm print database, which combines the existing palm repositories of at least 25 states, Edgell says. This system also employs MorphoTrak processing and matching algorithms. This includes enrolled palm prints, as well as latent prints from crime scenes. “Under the old system, it was very difficult to search the entire file,” Edgell said. “Not knowing what part of the hand it was – right or left – is often a challenge. Investigators used to have to search four or five different ways. Now it can be accomplished with a single search of the entire repository.”
Increment Four: Facial Recognition and Rap Back
The fourth increment is perhaps the most controversial, as it introduces face as a modality to the NGI. There’s been a lot of coverage regarding this deployment and a lot of concern for the scope of the system and it’s set to go live next summer.
Reported previously in BiometricUpdate.com, the Electronic Frontier Foundation sued the FBI over access to its facial recognition records based on three Freedom of Information Act requests it made a year ago.
“NGI will result in a massive expansion of government data collection for both criminal and noncriminal purposes,” EFF Staff Attorney Jennifer Lynch said. Lynch testified before the U.S. Senate on the privacy implications of facial recognition technology in July last year. “Biometrics programs present critical threats to civil liberties and privacy. Face-recognition technology is among the most alarming new developments, because Americans cannot easily take precautions against the covert, remote, and mass capture of their images.”
According to Edgell, there are many of misconceptions around the images that will be used in this deployment.
“We have a true image search of the mugshot repository – that’s our gallery,” Edgell said. “The photos that we’re searching have a corresponding ten-print and an arrest event. We’re not searching the internet. We’re not searching things like Facebook or social media. We’re not searching outside entities like passports or the DMV.”
“There are a lot of things on network television that lend themselves to the notion that the FBI does more than that, or that law enforcement does more than that, and it’s just not based upon fact. Certainly, technology would enable us to do other things, but authority today does not. We stay within our legal authority and operate within it.”
The FBI offers a free facial recognition toolbox to law enforcement agencies to cross-reference mugshot material, and the number of agencies using this system is increasing.
“Today we have about 16 million usable mugshots in the repository and correspondingly, we have approximately 75 million criminal history records in the repository, so there’s a significant gap between the number of fingerprints we’re searching and the number of mugshots, but that number’s increasing much like our palm prints.,” Edgell tells me. “We’re in an effort now because we had a place to store the mugshots, but no technical ability or business process that allowed for automated searching. Now we do.”
The second aspect of this fourth increment is something the agency is calling “Rap Back,” which offers the continuous monitoring of people in “positions of trust.” Examples include bank tellers, teachers and people that work with the elderly. There are 30 states today that have laws requiring ten-print background checks for these people and these are typically renewed every five years.
“We’re now able to take these records and retain them to cascade against inbound arrest records, so that if someone who holds a position of trust goes out and commits a crime in another state, within a 24-hour period we can notify the state who then notifies the granting authority. They determine whether that person is able to still hold that position or not. The FBI only notifies the state or local agency of an arrest event, the adjudication and, if any, disciplinary action is determined by appropriate authorities,” Edgell said.
Before Rap Back, Edgell says that infractions that occur out of state could be missed until another background check is performed five years down the line.
Background checks won’t be the only use for the Rap Back program, though. The FBI does have a criminal justice intent in mind for this program as well. In particular, this pertains to people released from prison who are still under correctional supervision. If these people go out and get arrested – in a different state, for example – the Rap Back system would immediately inform supervising authorities who could determine disciplinary action.
Increment Five: Iris Recognition
Increment five is a pilot test of iris recognition and its set to being soon.
“People in criminal justice who manage people are seeing good utility in iris, so we’re doing a pilot with several of the big agencies or states that are doing that around the country and then we’ll go back to [Office of Management and Budget Affairs at the White House] with our findings if we want to operationalize, because we’ll have to request additional funding to do it, but that gets underway later this month,” Edgell said.
There’s been a lot of focus on iris recognition as of late, and its potential addition to the NGI is unsurprising.
Earlier this year, NIST delivered a new publication for Personal Identity Verification (PIV) cards, which added support for iris images.
During a tense congressional subcommittee hearing in June, Charles Romine, the director of the NIST Information Technology Laboratory promised a standard for iris images in federal identity cards, as the committee’s chair Rep. John Mica was adamant the agency be held to account for this new standard, which had reportedly been delayed many times in the past. Now that the standard has been delivered, this storm has passed.
NIST has also recently published a new IREX study, which found that iris is a stable biometric modality, not affected over time by aging eyes.
Currently, many correctional facilities throughout the United States collect iris information and have been active adopters of this technology, not only for inmate identification, but also as a way to perform access control to different sections of prisons without the need to unshackle enrolled and previously-approved prisoners.
Edgell says this is a compelling dataset, as everyone in prison has been arrested, so the data has already been collected and is within reach of the agency. Iris is also a preferred modality for many Homeland Security and Defense Department objectives — some of which include arrest events. According to Edgell, this could also form part of the usable iris dataset for the NGI, but at this point nothing has been set in stone and data from immigration programs and other data collection efforts would not be included, unless someone’s been arrested – in which case it could be fair game for the FBI.
Increment Six: Tech Refresh
The final increment of the NGI – the sixth – which will encompass the final two to three years of the project, is another tech refresh to ensure all software and hardware used in the program is up to date and can avoid quick obsolescence.
Mentioned earlier, privacy has been a major concern surrounding the NGI program, but according to Edgell, little of what the program encompasses is new – only the technology being used is.
“NGI did not require the creation of any new authority for the FBI. The FBI had all the authority to do everything I’ve already described. We just didn’t have the technology to do it or the business process to go along with it, so now we are matching up to our authorities to do these things.”
Edgell is also adamant to point out that there is a crucial distinction to be made between what the FBI maintains and what the FBI searches. For example, says Edgell, ten-fingerprint searching with the mobile ID system for RISC illustrates this point.
“The only thing we have is a piece of metadata that we retain that says we received a search at a certain time, from an agency, and what the response was. The only way we would alter the criminal history repository is [the officer] affected the arrest, took the individual into custody, conducted a live scan and submitted a booking to the criminal history repository.”
So far, says Edgell, the NGI is “on schedule, within budget and within scope.”