We already know that the FBI is operating a massive facial recognition surveillance system. We know the agency has slowly been working towards getting access to photos of almost every American to run through this system. We also know it is building this mass surveillance infrastructure without clear authorization from Congress, safeguards, or public input.

The fact that face recognition technology, which can be readily abused, has been deployed by federal agencies largely in secret should give us all pause. The technology gives government agencies the unprecedented power to track who we are, where we go, and who we know. Companies marketing this technology to the government boast that it can be used to track people in real-time, reconstruct past movements from video footage, or identify a hundred individuals from a single photo. This threatens to create a world where people are watched and identified as they attend a protest, congregate outside a place of worship, visit a medical provider, or simply go about their daily lives.

At a House Oversight Committee hearing this week with an FBI witness, we learned new details that further confirm our fears that the FBI’s face recognition apparatus continues to balloon, threatening our fundamental liberties. The details also underscore the urgent need for Congress to put the brakes on law enforcement use of this powerful technology.

Here are some of the most concerning details we learned from the hearing:

1. The FBI’s massive facial recognition apparatus continues to expand and can now match against over 640 million photos.

The FBI now has the ability to match against or request matches against over 640 million photos — a number that Rep. Jim Jordan (R-Ohio) noted is larger than the total population in the US. This includes driver’s license photos from 21 states, including states that do not have laws explicitly allowing their driver’s license repositories to be used in this way. These numbers show that the FBI is moving closer to having the capability to run face recognition searches against photos of virtually every American. 

The FBI is also running large numbers of face recognition searches. According to the FBI, from October 2017 to April 2019, the FBI ran over 152,000 searches of its face recognition system that matches against mugshots. That number does not even include searches on external databases, like passport photos. It is also unusually high when compared to the fact that there were only 10,232 criminal convictions stemming from FBI-led investigations in fiscal year 2017.

2. The FBI claims it can use face recognition on individuals without a warrant or probable cause.

The FBI says that it only performs face recognition as part of authorized investigations or open assessments. But that doesn’t make it any better. Under FBI guidelines, agents can open an assessment without any fact-based suspicion whatsoever. Even preliminary investigations may be opened only in cases where there is mere “information or allegation” of wrongdoing, which the FBI interprets to cover mere speculation that a crime may be committed in the future. Thus, even if the FBI strictly adhered to its internal policies, they would still have broad discretion to use face recognition without a warrant or probable cause, making the technology even more susceptible to widespread use and abuse.

3. The FBI doesn’t even track basic statistics to measure whether the technology is even working.

The FBI claims that face recognition can help to “protect public safety.” But, as their testimony before Congress this week revealed, the FBI doesn’t have the data to back up this claim. During questioning, the FBI confirmed that it does not track how many times face recognition has led to a conviction. Additionally, the agency does not track how many times the use of face recognition leads to arrests, including arrests of individuals ultimately acquitted. 

There is good reason to question the FBI’s efficacy claims. A report on the use of face recognition in the UK found that the technology led to false matches over 90 percent of the time. The fact that the FBI doesn’t even track basic data about efficacy calls into question how they can conclude it has positive law enforcement value.

4. The FBI cannot even confirm that it complies with its constitutional obligations.

The government is required to provide notice to criminal defendants when they are identified by face recognition or where match information may be considered exculpatory. Evidence has suggested the FBI is not complying with this obligation — and this hearing provides more cause for alarm. Twice during the hearing, the FBI was specifically asked whether they notified criminal defendants when other individuals also returned as a face recognition match, which could support defendants’ claims that they are innocent. The FBI witness said she should not confirm that this information was always provided. The FBI also failed to clearly respond to questions regarding whether they even notified defendants in cases where face recognition contributed to their arrest or prosecution. 

5. The FBI won’t reveal information about the companies it has communicated with about face recognition products.

The FBI was asked to name “the companies who lobby or communicate” with the FBI about its face recognition products. The FBI witness evaded this question, and that is troubling. We have already seen examples of companies selling and marketing irresponsible uses of face recognition to law enforcement. For example, Amazon has pushed the use of face recognition in body cameras, which are intended to be tools of accountability, not surveillance. Given this, additional oversight of private companies who sell and market this technology is critical. Congress should press the FBI to provide information on the companies it has communicated with about face recognition, and the information these companies have provided to government decision makers on the efficacy, bias, and potential uses of their face recognition products.

The ACLU has long sounded the alarm over the FBI’s use of face recognition and, along with over 60 other groups, has called for Congress to halt federal law enforcement use of this technology until Congress debates what, if any, uses should be allowed. The hearing this week provides further evidence that such a moratorium is needed to prevent harm and safeguard our rights.

Neema Singh Guliani, ACLU Senior Legislative Counsel

This piece originally ran at Slate.

Discussing the origins of the FBI’s Russia investigation, Attorney General William Barr recently claimed that “Government power was used to spy on American citizens.” He went on to say, “I can’t imagine any world where we wouldn’t take a look and make sure that was done properly.”

As some were quick to point out, the comments were rich coming from an architect of our government’s modern spying apparatus: As attorney general during the George H.W. Bush administration, Barr played a key role in developing a secret program that served as the blueprint for the NSA’s mass surveillance of Americans’ phone records.

But the hypocrisy of Barr’s comments goes well beyond his past. On Thursday, lawyers from Barr’s Justice Department tried to block a federal court from taking a look at the government’s surveillance of Americans.

The case—brought by the Wikimedia Foundation, which runs Wikipedia, one of the world’s most-visited websites—challenges the constitutionality of the U.S. government’s warrantless spying on Americans’ international internet communications, known as “Upstream” surveillance. (The American Civil Liberties Union, Knight First Amendment Institute, and Cooley LLP are representing Wikimedia in this challenge.)

With the help of companies like AT&T and Verizon, the National Security Agency conducts surveillance on U.S. soil by tapping directly into the internet’s backbone—the physical infrastructure that carries our emails, photos, personal chats, and web browsing. The agency then copies and searches a vast pool of internet communications flowing into and out of the United States. It does all of this without a warrant, in violation of the Fourth Amendment.

Wikimedia’s case could mark the first time a public court weighs in on the constitutionality of this decade-old spying operation. But in stark contrast to Barr’s public expressions of concern over the privacy of Americans, his Justice Department has thrown up a series of litigation roadblocks in an effort to prevent the court from ruling on the legality of this surveillance dragnet.

In fact, on Thursday, Justice Department lawyers argued that Wikimedia’s case should be dismissed outright. They contend that Wikimedia cannot prove with sufficient certainty that its communications are surveilled, and that it therefore lacks “standing” to sue.

But Wikimedia is plainly subject to warrantless surveillance. Wikimedia engages in more than 1 trillion international internet communications per year, with users in almost every country on earth. Because those communications are so numerous and so broadly dispersed across the globe, they travel every path carrying internet traffic into and out of the U.S. Even if the NSA is monitoring just one of those paths, it is monitoring Wikimedia’s communications. The government’s own disclosures about the scope of its surveillance make this clear.

In response to Wikimedia’s lawsuit, the Justice Department is relying on a legal tactic called the “state secrets privilege” to try to block the court from considering several of the government’s official disclosures. The Justice Department’s argument rests on the theory that the court’s consideration of this information would harm national security—even though the government has already declassified and released the same information to the public.

Incredibly, the Justice Department also asserts that the court cannot even rule on Wikimedia’s standing without harming national security, despite the fact that Congress created a special procedure in the Foreign Intelligence Surveillance Act to address this concern. The procedure is designed to account for any conflict between legitimate secrecy and accountability, and it allows lawsuits like this one to go forward.

If the court in Wikimedia’s suit accepts the Justice Department’s state secrets arguments, it would have far-reaching implications. In essence, it would mean that only the executive branch can decide how and when lawsuits challenging government surveillance may proceed—and that the government could unilaterally block courts from taking the very “look” that Barr says is necessary. That view of executive branch power is completely at odds with what Congress intended when it enacted FISA, and it could eviscerate the possibility of meaningful accountability for unlawful spying.

Wikimedia’s communications with its users are sensitive and private. They can reveal intimate information about users’ political affiliations, religious beliefs, medical questions, and personal interests. Just as the government shouldn’t be monitoring the reading habits of ordinary library patrons, it shouldn’t be monitoring what Wikimedia’s users are privately reading online.

If Barr really wants to champion accountability for violations of Americans’ privacy, he should stop trying to shut the courthouse doors on Wikimedia. It’s past time for the public courts to review the legality of the NSA’s surveillance of our internet communications.

Ashley Gorski, Staff Attorney, ACLU National Security Project