Defense Management: DOD Can Establish More Guidance for Biometrics Collection and Explore Broader Data Sharing
Released: 2008-10-15T00:00:00

Letter

Background

As the technologies for collecting, storing, and sharing biometrics data advance, DOD and other federal agencies that collect, use, store, and share such data in the conduct of their national security missions have expanded their biometrics efforts. DOD uses biometrics for various purposes— including controlling access to DOD facilities, intelligence analysis, and identifying and verifying non-U.S. persons encountered during field activities in Afghanistan and Iraq. U.S. forces collect, match, and share biometrics data, and DOD has developed a number of policies and procedures to govern these activities. However, guidance for the collection and use of biometrics data is still evolving.

Governmentwide Policies Regarding Biometrics Data Are Evolving

Historically, the FBI has been the dominant federal government user of biometrics, with a long-established fingerprint database—IAFIS—as its primary biometrics data repository. Other federal agencies, like DHS and DOS, also use biometrics in support of their respective national security missions, including border patrol, customs, disaster recovery, naturalization, visa processes, and counterterrorism. DHS’s US-VISIT program office administers IDENT on behalf of all of DHS. IDENT is the database DHS has designated as the central point for all of the department’s biometrics collection, identification, and storage efforts. DOS has access to IDENT data via its sharing agreement with DHS for use in its visa screening process. To date, DOD and DHS have not established a direct link between their two biometrics databases and rely on the FBI’s IAFIS database as an indirect link between DOD and DHS. This is a result of specific biometrics sharing agreements and other information sharing policies and agreements. If biometrics data for non-U.S. persons collected by DOD are not retained in the FBI’s IAFIS, other agencies, like DHS and DOS, that send biometrics data for searching to IAFIS, do not have access to this DOD information when they conduct searches for visa, citizenship, border control, and other homeland security purposes. While limited occasional direct sharing of DOD and DHS biometrics has occurred, it is not regularized.

Several efforts are under way to develop national policies and procedures to better coordinate the use of biometrics data and to ensure that concerns such as privacy are addressed. For example, the National Science and Technology Council has established the Subcommittee on Biometrics and Identity Management to address issues such as identity management, privacy, and biometrics system improvements and to develop policy foundations for those issues. In addition, the Information Sharing Environment Program Manager, in consultation with the Information Sharing Council, is to plan and oversee the implementation of and manage an Information Sharing Environment, an approach that facilities the sharing of terrorism and homeland security information. The Program Manager is also responsible for assisting, monitoring, and assessing the implementation of the Information Sharing Environment by federal departments and agencies to ensure adequate progress, technological consistency, and policy compliance, among other duties.

While these efforts are under way, many departments, including DOD, continue to collect biometrics data to meet their individual missions. However, even within departments, there may not be policies to ensure that officials in different parts of the organization are aware of or have access to biometrics data that are collected by others.

DOD Collection, Matching, and Sharing of Biometrics Data

During DOD field activities, such as those in Afghanistan and Iraq, U.S. forces collect biometrics data for a variety of purposes, such as to control access to U.S. bases in order to protect personnel and to identify and verify non-U.S. persons that they encounter. The primary system for biometrics data collection in U.S. Central Command, including Afghanistan and Iraq, is the Biometric Automated Toolset. The Biometric Automated Toolset is a DOD biometrics system that allows U.S. forces to collect fingerprints, iris scans, facial photographs, and biographical information of persons of interest and store them in a searchable database. DOD has also established the Biometric Identification System for Access, which includes similar types of biometrics data but is limited to use on installations in Iraq to determine whether non-U.S. persons should have access to U.S. bases.

Once U.S. forces have collected the biometrics data, they attempt to compare and match the data to previously collected data stored in the Biometric Automated Toolset and the Biometric Identification System for Access. These data are also sent to ABIS—the DOD-wide database for non-U.S. persons’ biometrics—to determine if U.S. forces have previously encountered an individual and entered the individual’s biometrics data into this database. If there is not a match, the new data are stored in the Biometric Automated Toolset and ABIS and maintained for future use, as appropriate. Figure 1 illustrates this process.

Once biometrics data are in ABIS, they can be shared or sent to another biometrics database, such as the FBI’s IAFIS, for additional matching attempts against non-DOD records. DOD has established agreements with the FBI and DHS that allow it to share its biometrics data with them, both to assist DOD in identifying the individuals it encounters during its military activities and to inform other federal agencies of DOD’s interactions with non-U.S. persons who might be of interest. For example, DOD uses the Biometric Identification System for Access to collect biometrics from a non-U.S. person seeking access to a U.S. facility in Iraq and sends that information back to DOD’s ABIS database to see if the new data match any biometrics data currently stored in ABIS. While ABIS is being searched, DOD forwards the biometrics data to the FBI’s IAFIS database to see if there is a U.S. criminal history for the individual seeking access to U.S. facilities in Iraq. Once the FBI conducts its search, it sends the results back to DOD and does not keep noncriminal biometrics data collected using the Biometric Identification System for Access. In other cases, for example, when an individual is detained in Iraq or Afghanistan by DOD, the process is the same until DOD sends the biometrics data to the FBI. In most of these cases, the FBI stores the biometrics data in IAFIS, a criminal database, for potential future use.

During field activities, DOD personnel collecting biometrics data may not know if the person is a non-U.S. person until the data are collected and then matched with already existing data. For example, DOD personnel collecting latent fingerprints during and after combat operations may not know until the fingerprints are matched with existing data if the person is a non-U.S. person.

DOD Has Issued Limited Guidance for Collecting Biometrics Data

The Biometrics Task Force has not issued guidance specifying a standard set of biometrics data that would allow for comparison of newly collected biometrics data with existing biometrics data in the field. Having a standard set of biometrics data would help ensure consistent identification and confirmation of an individual’s identity thus allowing forces to compare data across multiple databases in different commands and to determine whether individuals should be detained. In recognition of the conditions commanders face in the field, DOD delegated responsibility to field commanders to determine the type of biometrics data personnel should collect during their operations. As a result, some units may collect fingerprints and facial photos, while others may collect only iris images, even though they are all using devices that can collect the same types of biometrics. For example, Marine Corps units prefer to collect iris scans during field identification and verification activities, but Special Operations Forces and Army units in other parts of Iraq prefer to collect fingerprints in the field—typically a minimum of two index finger prints and two thumb prints.

The lack of comparable data also has implications for broader national security issues. For example, military personnel may be unable to identify someone who has harmed or attempted to harm U.S. or coalition forces. The collection of similar or baseline data by DOD and departments or agencies involved in national security activities, such as counterterrorism, could enable them to use the same biometrics data across a wide range of national security missions. Given the lack of comparability of the new data collected in the field, such as when a unit collects exclusively iris images, the data would not match against records in larger federal databases, such as the FBI’s IAFIS. If these data could be compared to such databases, this capability would help the unit determine with certainty whether these individuals had been encountered before and whether they should be detained. For example, biometrics files that include only iris images cannot be used to match latent fingerprints collected in combat zones. Thus, military personnel collecting only iris images may be unable to identify someone who has harmed or attempted to harm U.S. or coalition forces.

DOD and other federal agency officials said that there can be a trade-off between tactical (warfighter) needs—for example, the necessity when operating in a hostile environment to perform tasks expeditiously to reduce the risk of bodily harm—and strategic (national security) needs— for example, the ability of intelligence analysts to make connections among individuals, groups, and events, or the use of data for counterterrorism and border security in the United States. Thus, localized discretion about what types of biometrics data to collect may enable DOD personnel to conduct quick and efficient screenings under potentially hostile conditions, but the data they collect may be of little use to both military units in the field and other U.S. government entities in support of future counterterrorism efforts, including border security. Agencies both within and outside of DOD—the National Ground Intelligence Center, U.S. Central Command, U.S. Special Operations Command, the Biometrics Fusion Center, and the FBI—acknowledge that without a baseline national standard for biometrics collection that maximizes the utility of the data both for the warfighters in the field and for national security efforts at home, opportunities to identify persons of interest may be lost.

DOD Shares Data on Non-U.S. Persons through Interagency Agreements, but Some Gaps in Data May Remain

DOD shares biometrics data that it collects on non-U.S. persons with other federal agencies through a variety of interagency agreements, but some gaps in data sharing may remain. Despite the sharing agreements, a DHS memorandum indicates that DHS does not regularly receive certain types of data from DOD. DHS officials stated that this information could potentially be used to carry out DHS’s national security mission. DOS officials also believe such data could be used to support DOS’s visa processing mission. To date, the only regular progress has been the sharing of Iraqi asylum and refugee data, which provide DHS with biometrics data on individuals that DOD has encountered in Iraq.

Since the events of September 11, 2001, the President and Congress have issued broad policies that require federal agencies to share counterterrorism information, and federal agencies have in turn issued their own policies. A January 2007 Deputy Secretary of Defense memorandum called for DOD to immediately adopt the practice of sharing unclassified DOD biometrics data records with other U.S. departments and agencies that have counterterrorism missions, including data related to terrorism information defined in the Intelligence Reform and Terrorism Prevention Act regarding terrorists, detainees, and those individuals or groups posing a threat to the United States, U.S. persons, or U.S. interests, but excluding data pertaining to U.S. persons, defined as U.S. citizens and aliens lawfully admitted for permanent residence. The memorandum also specified that the sharing of biometrics data records on an individual must be conducted in accordance with U.S. laws and regulations and international agreements. This memorandum was issued pursuant to Homeland Security Presidential Directive 6, Homeland Security Presidential Directive 11, an interagency memorandum of understanding agreeing to support the Terrorism Screening Center, and the Intelligence Reform and Terrorism Prevention Act of 2004—all federal policies that encourage the sharing of terrorism information. Also, the Intelligence Reform and Terrorism Prevention Act of 2004 directed the President to, among other things, create an Information Sharing Environment for the sharing of terrorism information in a manner consistent with national security and with applicable legal standards relating to privacy and civil liberties. The act further stated that the President shall ensure that the Information Sharing Environment provides and facilitates the means for sharing terrorism information among all appropriate federal, state, local, and tribal entities and the private sector through the use of policy guidelines and technologies. To the greatest extent practicable, the President shall ensure that the Information Sharing Environment, among other things, connects and builds upon existing systems capabilities in use across the government, where appropriate; allows users to share information among agencies, between levels of government, and as appropriate with the private sector; and facilitates the availability of information in a form and manner that facilitates its use in analysis, investigations, and operations. The act also created a Program Manager to plan and oversee the implementation of the Information Sharing Environment, among other responsibilities. Additionally, the National Science and Technology Council has several efforts under way to develop national policies and procedures to better coordinate the use of biometrics data among federal agencies.

According to DOD’s January 2007 memorandum, sharing unclassified DOD biometrics data with other U.S. departments and agencies with counterterrorism missions includes data related to terrorism information defined in the Intelligence Reform and Terrorism Prevention Act regarding terrorists, detainees, and those individuals or groups posing a threat to the United States, U.S. persons, or U.S. interests, but excludes data pertaining to U.S. persons, defined as U.S. citizens and aliens lawfully admitted for permanent residence. The memorandum further states that the sharing of unclassified biometrics data unrelated to terrorism information will be determined based upon relevant law and directives and will require, at a minimum, a written memorandum from a requesting agency stating the official need for the data, the intended use of the data, the protections and safeguards that will be afforded the data, and the nature or extent of possible further distribution of the data to other organizations or agencies. Further, the memorandum states that sharing of biometrics data on an individual must be conducted pursuant to U.S. law and regulations and international agreements where appropriate.

DOD and other federal agencies involved in national security operations share biometrics data through a variety of agreements that have evolved on a case-by-case basis. However, a 2007 DHS memorandum indicates that the department is not receiving frequent updates on some DOD biometrics data. DHS officials said that the department could use these data for national security purposes. According to an April 2007 DHS memorandum, certain categories of information that DHS is not receiving frequent updates on include information from DOD’s Biometric Automated Toolset. According to DHS officials, DHS does not have a sharing agreement with DOD regarding these data, and such an agreement could allow DHS to update its database on a routine basis. Because DHS obtained the data from DOD as a one time event through the FBI, it received only the data that existed at that 2006 date. Additionally, the DHS memorandum states that DHS does not have access to DOD’s Biometric Identification System for Access, a noncriminal database. While DOD sends Biometric Identification System for Access data to the FBI for potential matches, the FBI does not retain this noncriminal information. According to FBI officials, DHS has sharing agreements with the FBI, but in this case, since the FBI told us that it does not retain the DOD data and DHS does not have an agreement with DOD, DHS does not receive the data. Lastly, the DHS memorandum states that DHS receives latent fingerprint images from various sources under Operation Iraqi Freedom and Operation Enduring Freedom as part of the larger set of all latent prints associated with the FBI’s Unsolved Latent File—latent fingerprints that have not been linked to an identity. However, the memorandum further states that DHS has requested that DOD submit latent fingerprints separately to better provide awareness of any possible subsequent DOD-specific latent fingerprint identifications.

According to the April 2007 DHS memorandum, DHS was discussing how it could obtain additional biometrics data from DOD. According to DHS, these data could be used to (1) prohibit individuals from entering the United States who are determined to be inadmissible based on these data and other relevant information, (2) detain individuals for law enforcement reasons if needed, or (3) provide additional information about refugees and their potential eligibility to enter the United States. DHS officials further stated that the department could receive some of the DOD data through the FBI, if the FBI retained it, or if DHS had a specific data-sharing agreement with DOD. The DHS memorandum states that DHS will continue to engage DOD regarding the sharing of additional biometrics data. However, DHS officials stated that to date the only progress has been the sharing of Iraqi asylum and refugee data, which provides DHS with biometrics data on individuals that DOD has encountered in Iraq. DOS officials stated that they also could potentially use DOD’s Biometric Identification System for Access data. According to DOS officials, these data could assist DOS in verifying that a non-U.S. person has legitimately accessed U.S. facilities in Iraq.

Conclusion

If DOD does not have a standard set of biometrics data for use in the field, then it will be unable to determine whether the individuals its forces encounter in the field are friend, foe, or neutral and will therefore possibly endanger its forces. Moreover, until comprehensive information sharing agreements are worked out or the National Science and Technology Council develops and implements a national architecture for biometrics data collection, in consultation with information sharing environment efforts, biometrics information collected by U.S. forces from individuals encountered in the field may not be fully utilized by other federal agencies for national security activities. For example, the sharing of latent fingerprints collected by DOD personnel in combat zones could potentially help enable a DOS consular official to deny a visa to an individual who attacked U.S. forces in Iraq. Opportunities to reduce gaps in our security through comprehensive data sharing may be lost unless remaining needs for biometrics data are appropriately filled. Because potential harm could come to U.S. interests from those individuals DHS and DOS could have prevented from entering the United States—if those individuals were determined to be inadmissible based on these data and other relevant information—it is important that DOD, the FBI, DHS, and DOS work together to determine the biometrics data needed and to share these data in accordance with applicable laws, regulations, and international treaties.

Recommendations for Executive Action

We recommend that the Secretary of Defense direct the Secretary of the Army’s Executive Manager for Biometrics to establish guidance specifying a minimum baseline standard set of biometrics data for collection during military operations in the field so that biometrics data can be compared across multiple databases in different commands and across federal agencies as appropriate and in accordance with U.S. laws and regulations and international agreements.

Additionally, we recommend that until a formalized, governmentwide biometrics data-sharing architecture is implemented, the Secretaries of Defense and Homeland Security, in consultation with other federal agencies, such as the FBI and DOS, determine if biometrics information sharing needs are being met and address, as appropriate, any biometrics data-sharing gaps that may exist, in accordance with U.S. laws and regulations and international agreements, as well as information sharing environment efforts.

Agency Comments and Our Evaluation

We requested comments on a For Official Use Only draft of this report from the Executive Office of the President’s National Science and Technology Council; DOD; DOS; DHS; the FBI; the Program Manager, Information Sharing Environment; and the Office of the Director of National Intelligence’s National Counterterrorism Center. DOD was the only agency to provide written comments on the For Official Use Only version of this report. As such, this public version of the For Official Use Only report was sent to DOD for comment. DOD partially concurred with our recommendation to establish guidance specifying a standard set of biometrics data for collection during military operations in the field. In comments, DOD stated that if our recommendation to establish this guidance was directed at DOD personnel in stable environments—not field environments—then DOD fully agreed with our recommendation and would take action to implement it. However, DOD commented that if we were referring to collection in field environments, DOD officials still wanted to rely on commanders’ judgment as to what to collect. In our recommendation, we referred to collection of biometrics during military operations in the field, which we equate to DOD’s screening operations of suspicious or potentially hostile individuals, which could include biometrics collection in hostile environments. Our point was that if one unit collected one type of biometrics, such as an iris scan from an individual, and another unit later collected fingerprints from the same individual, no match could be made between the two different encounters of the individual and potential persons of interest could be released. Moreover, DOD acknowledges this risk in its comments, stating that DOD officials want to continue to rely on the commanders’ judgment on the biometrics to be collected during military operations in the field, including hostile environments. However, we continue to believe that DOD should establish guidance for a minimum baseline biometrics collection standard to mitigate this risk, especially since guidance in place in Afghanistan, a hostile area of operations, already establishes such a minimum. A DOD document sets forth the procedures for standardization of mandatory fields that must be completed during the collection processes for various biometrics collection systems. Collecting biometrics data above and beyond such a minimum baseline standard could be left up to the commander’s discretion; however, we continue to believe that a minimum biometrics collection requirement for military operations in the field, or what DOD calls screening operations, should be established, as was done for Afghanistan operations, to mitigate the risks we identified and DOD acknowledged in its comments. Based on DOD’s comments on the For Official Use Only draft report, we revised this recommendation and the final report to reflect the appropriate office responsible for this guidance and to clarify that we intend for DOD to establish a minimum standard for biometrics data collected from individuals encountered during military operations in the field.

DOD concurred with our recommendation to determine if biometrics information sharing needs are being met and if there are any gaps in sharing that may exist. In its comments, DOD stated that it is fully participating in and fully supportive of interagency forums specifically chartered to address improved sharing of biometrics data and interoperability of biometrics systems.

The Executive Office of the President’s National Science and Technology Council; DOD; DHS; the Program Manager, Information Sharing Environment; and the Office of the Director of National Intelligence’s National Counterterrorism Center provided technical comments on the For Official Use Only version of this report, which we have incorporated into this report as appropriate.

DOD’s written comments are reprinted in appendix II.

As agreed with your offices, we are sending copies of this report to the Chairman and Ranking Member of the House Committee on Armed Services and other interested congressional parties. We are also sending copies of this report to the Secretary of Defense; the Secretary of State; the Attorney General of the United States; the Secretary of Homeland Security; the Executive Office of the President’s Office of Science and Technology Policy, National Science and Technology Council; the Director, the Federal Bureau of Investigation; the Director, National Counterterrorism Center; and the Program Manager, Information Sharing Environment, Office of the Director of National Intelligence.

If you or your staff have any questions concerning this report, please contact me at (202) 512-5431 or dagostinod@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Scope and Methodology

We focused the scope of our work on the Department of Defense (DOD), the four military services (Army, Navy, Marine Corps, and Air Force), the Department of State (DOS), the Department of Homeland Security’s (DHS) U.S.-Visitor and Immigrant Status Indicator Technology (US-VISIT) program office, and the Department of Justice’s Federal Bureau of Investigation (FBI). Federal agencies outside of DOD were included because of their use of DOD-collected biometrics as part of their national security portfolios, and we reviewed their use of biometrics inasmuch as it relates to the biometrics information collected by DOD and shared with other agencies. Any other information gathered regarding federal agencies outside of DOD was strictly for background purposes. Because DOD viewed some aspects of the report as sensitive and designated them For Official Use Only, and because other information was classified, some details of our evidence could not be discussed in this report.

Methodology

To determine the processes and procedures under which DOD is collecting biometrics data for military operations, we reviewed DOD-wide and service-specific directives, memorandums, concepts of operations, and standard operating procedures. To develop background on the collection of biometrics data by DOD, we analyzed information published by GAO, DOD, the Defense Science Board, and the Executive Office of the President’s National Science and Technology Council. We reviewed documents from and obtained the perspectives of officials in relevant DOD commands and agencies throughout the department and the military services, as listed in table 1. The documents and meetings with officials allowed us to obtain an integrated understanding of how DOD uses biometrics, specifically for military operations such as detainee management, force protection, and identifying individuals during combat operations.

To assess the extent to which biometrics data collected by DOD are shared with other federal agencies, we met with and reviewed documents from officials at DOD and the federal agencies listed in table 2.

The documents and meetings with officials allowed us to obtain an integrated understanding of how biometrics collected by DOD are shared with other federal agencies with national security (specifically counterterrorism) missions. To determine the processes and procedures under which DOD is sharing biometrics and related information with other federal agencies, we reviewed DOD-wide and service-specific directives, memorandums, and interagency agreements, as well as relevant agreements between other federal agencies, such as the FBI and US-VISIT. We also gathered and reviewed documentation regarding the information sharing environment and the National Science and Technology Council.

We conducted this performance audit from May 2007 to May 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contacts

Acknowledgments

In addition to the contact named above, Lorelei St James, Assistant Director; Bethann Ritter; David Artadi; Brian Kime; Joanne Landesman; Katherine Lenane; John Nelson; and Karen Werner made key contributions to this report.