The FBI, DHS, and DOD are responsible for managing and maintaining the following major biometric systems: (1) FBI’s Integrated Automated Fingerprint Identification System (IAFIS). Established in July 1999 and managed by the FBI’s Criminal Justice Information Services division, IAFIS is a national fingerprint and criminal history system that stores, searches, matches, and shares fingerprints. The FBI is currently in the process of transitioning from IAFIS to the Next Generation Identification system, which will include an expansion to biometrics storage and search capabilities for fingerprints; scars, marks, and tattoos; faces; irises; and palms. The Next Generation Identification system is a multiyear effort with six increments that is expected to be completed by 2014. (2) DHS’s Automated Biometric Identification System (IDENT). Established in 1994 and managed by the United States Visitor and Immigrant Status Indicator Technology program, which falls under the purview of the National Protection and Programs Directorate within DHS, IDENT is used by DHS and State for many purposes including border security, information on persons undergoing naturalization and visa processes, and in the agencies’ counterterrorism efforts. IDENT stores, searches, matches, and shares fingerprints. According to DHS officials, the department is beginning to look at the collection of irises and has a goal to begin collecting iris images and facial biometrics by 2013. (3) DOD’s Automated Biometric Identification System (ABIS). Established in July 2004 and managed by the Biometrics Identity Management Agency (BIMA, formerly the Biometric Task Force)—which falls under the purview of the Army—ABIS information is used by DOD to identify and verify non-U.S. persons as friend, foe, or neutral, and to help determine if the individual poses a threat or potential threat to national security. BIMA updated ABIS to the Next Generation ABIS in January 2009, which stores, searches, matches, and shares face, fingerprint, iris, palm, and latent fingerprint biometrics. Several DOD organizations are involved in the management of the biometrics program and in developing guidance on the collection and sharing of biometric information. In July 2000, Congress designated the Secretary of the Army as the Executive Agent for Defense Biometrics. Subsequently, the Secretary of the Army designated the Director of the Army’s Biometrics Task Force as the Executive Manager for Biometrics making this office responsible for developing guidance for collecting and processing biometric information. In March 2010, the Biometric Task Force’s name was changed and it became the Biometrics Identity Management Agency. Additionally, DOD appointed the Director, Defense Research and Engineering, as the Principal Staff Assistant for Biometrics. In February 2008, DOD issued a biometrics directive identifying organizational roles and authorities for managing biometrics. Within DOD, biometric capabilities were initially used in the late 1990s as a tool to protect U.S. forces in Korea, and in Kosovo as an intelligence tool. Since the September 11, 2001, terrorist attacks, DOD’s mission has included military operations in both Iraq and Afghanistan—where a biometric system was used to protect U.S. soldiers and allies from an unidentified enemy by screening and vetting non-U.S. persons. DOD collects biometric information from persons seeking access to U.S. installations in Iraq and Afghanistan, detainees, and persons encountered by U.S. forces during military operations. (See fig. 1 below.) In January 2007, DOD issued a memorandum stating that DOD would immediately adopt the practice of sharing unclassified DOD biometric information collected from non-U.S. persons with other U.S. departments and agencies having a counter-terrorism mission. DOD considers the variety of mission-needs for collecting biometric information, such as counterintelligence screening, and detainee management and interrogation, and in business operations, such as base access control to verify Common Access Card credentials, which take place in a combat environment. However, DOD’s reasons to collect biometric data continuously change as DOD’s role evolves wherever military operations are under way; whether in a desert environment fighting insurgents or on the high-seas fighting piracy. DOD’s directive that describes the purpose, scope, policy, and responsibilities for the biometrics program uses terms defined by the National Science and Technology Council Subcommittee on Biometrics Glossary. Included in the list of terms and their respective definitions are the following. Collect—capture biometric and related contextual data from an individual, with or without his or her knowledge. Create and transmit a standardized, high-quality biometric file consisting of a biometric sample and contextual data to a data source for matching. Match—for the purpose of DOD’s Directive on biometrics, the process of accurately identifying or verifying the identity of an individual by comparing a standardized biometric file to an existing source of standardized biometric data. Matching consists of either one to one (verification) or one to many (identification) searches. Share—exchange standardized biometric files and match results among approved DOD, interagency, and multinational partners in accordance with applicable law and policy. Store—the process of enrolling, maintaining, and updating biometric files to make available standardized, current biometric information on individuals when and where required. To achieve interoperability, policies and implementation guidance on the collection, storage, and sharing of information should be created to ensure compatible implementation of systems based on standards. Standards are developed by Standards Development Organizations, including the National Institute of Standards and Technology, to provide rules and guidelines to promote interoperability among various systems, including biometric systems. Standards Development Organizations also provide rules and guidelines for testing biometrics and for testing conformance to biometric standards. Standards are generally developed through a consensus process that includes the input of various stakeholders from various sectors such as government, academia, and industry. Federal agencies, such as DOD, adopt standards developed by Standards Development Organizations. For example, DOD used standards recommended by the American National Standards Institute and the National Institute of Standards and Technology as a basis to develop DOD’s Electronic Biometric Transmission Specification (DOD EBTS). DOD has adopted standards for collection of biometric information to facilitate sharing of that information with other federal agencies. DOD recognized the importance of such interoperability and directed adherence to internationally accepted biometric standards. Moreover, DOD has applied the standards to some of its collection devices. However, DOD has not applied the adopted standards to the Army’s primary handheld collection device used in Iraq and Afghanistan. As a result, DOD is unable to automatically transmit information collected by this device, which is about 13 percent of approximately 4.8 million biometric records maintained by DOD, to federal agencies, such as the FBI. Further, DOD has not taken certain actions that would help ensure its collection devices meet new and updated standards. First, DOD does not have an effective process, procedure, or timeline for implementing updated standards. Second, DOD does not routinely test devices at sufficient levels of detail for conformance to these standards. Third, DOD has not fully defined roles and responsibilities that specify accountability needed to ensure its collection devices meet new or updated standards. DOD adopted a standard—DOD EBTS—to facilitate the collection of biometrics and to enhance interoperability of biometrics collected by DOD with other federal agencies’ biometric systems. The first version, DOD EBTS version 1.0, was published on August 19, 2005, and the standard has since been updated three times, with the most recent update, DOD EBTS version 2.0, adopted for use by DOD in April 2010. (See fig. 2 for timeline of DOD’s biometric standard.) These DOD standards are based on recommended standards from the American National Standards Institute and the National Institute of Standards and Technology; these standards are also used by the FBI as the basis for its mission-specific requirements. The conformance of biometric collection devices to standards promotes their interoperability with biometric systems within DOD and with other federal agencies, though it does not guarantee interoperability. Prior to adopting DOD EBTS in 2005, DOD had recognized the importance of interoperability and directed adherence to internationally accepted biometric standards. According to a February 2004 DOD’s Chief Information Officer memorandum on DOD compliance with international standards, standardization and interoperability are important for success in fighting terrorism. Success, the memorandum continued, could be enhanced with systems that communicate and share fingerprint data on “red force” personnel, such as detainees, enemy combatants, and foreign persons of interest as national security threats, with other U.S. government systems. Further, DOD’s Chief Information Officer directed that all new and upgraded DOD biometric collection devices used to collect certain data must conform to the FBI’s mission-specific requirement and the devices must be certified as interoperable with the FBI’s biometric systems. In November 2005, the Army’s Chief Information Officer reiterated the importance of standardization and interoperability of DOD’s biometric systems in fighting terrorism and stated that conformance to standards strengthens DOD’s abilities to fulfill its missions. The memorandum further stated that all new or updated DOD collection devices must meet the DOD EBTS standard and be interoperable with DOD’s biometric system ABIS. Consistent with the Army’s position on interoperability, the DOD Directive on Biometrics, issued in February 2008, stated that collection and transmission of biometric information shall be controlled through the use of DOD adopted standards to enhance consistency and interoperability of biometric information.