Surveillance
FBI NGI face contracts grew as GAO cited untested error rates
Award documents and inspector reports show successive facial-recognition work under Next Generation Identification proceeded while the Government Accountability Office recorded incomplete accuracy testing, delayed privacy assessments, and limited public notice of how state and local users query FBI photo holdings.
The Federal Bureau of Investigation’s Next Generation Identification system, or NGI, is the bureau’s primary biometric repository. Public budget justifications, contract notices, and Government Accountability Office reports describe a multi-year expansion of facial-recognition search against the Interstate Photo System, a subset of NGI that holds mug shots and other law-enforcement photographs.
According to GAO, the FBI began operational facial-recognition searches of that photo file years before completing the accuracy and privacy work that the office said federal policy required. A 2016 GAO report found that the bureau had not assessed how often the system returned incorrect candidates, including across demographic groups, and that a privacy impact assessment for the face-search capability had not been published in a timely way. Subsequent GAO work in 2019 and later restated that the Department of Justice and the FBI had not fully implemented earlier recommendations on testing, transparency, and notification of Congress and the public.
Contract vehicles supporting NGI and related identification services appear in federal procurement records. The record shows awards and task orders associated with biometric matching, including facial algorithms supplied through vendors that have long sold civil and criminal identification systems to U.S. agencies. Public notices do not always isolate a single face-only line item; they describe identification, matching, and system sustainment under larger NGI and CJIS programs. Officials have said in open testimony and budget materials that NGI supports criminal investigations and that face search is an investigative lead tool, not a positive identification by itself.
GAO’s accuracy findings sit beside those contracts. The office reported that the FBI had tested the face-search function primarily as an investigative aid that returns a ranked gallery of candidates rather than a yes-or-no match. According to those reports, the bureau had not, at the time of the reviews, completed comprehensive operational accuracy testing of searches run against the full photo database, nor had it fully documented error rates for different populations. GAO noted that other federal users and some state systems rely on FBI holdings, so unmeasured error can propagate beyond headquarters.
The Interstate Photo System, as described in FBI publications and GAO summaries, contains tens of millions of photographs submitted by federal, state, and local partners. Face searches can be initiated by FBI personnel and, under published policy, by authorized external users. GAO found that the FBI had not always required or verified that external agencies using the capability had their own accuracy and privacy controls, and that the bureau’s public materials understated the scope of non-FBI use.
Privacy documentation is part of the public record GAO cited. The office said a privacy impact assessment covering face recognition in NGI was delayed relative to operational use. FBI and DOJ statements in response, as paraphrased in GAO follow-ups and congressional testimony summaries, held that existing authorities, audit logs, and the investigative-lead framing of results mitigated risk, and that additional testing and notices were underway or completed after the initial findings.
Later GAO products and Justice Department inspector-general work continued to track biometric programs. They recorded that some recommendations were closed after the FBI published additional assessments, updated use policies, and reported further testing. Other recommendations remained open or were only partially addressed, according to GAO’s own status tables. The office has repeatedly stated that without documented accuracy across demographics and without clear external-user rules, agencies cannot fully evaluate civil-liberties effects or the reliability of investigative leads.
Procurement continues under the same program family. Budget justifications for CJIS and NGI in recent fiscal years request sustainment, capacity, and algorithm refresh. Public contract data show ongoing work with identification vendors; the documents available on SAM.gov and related portals describe performance of matching services, not classified sources or methods. Nothing in the open record authorizes a claim that a reporter obtained a classified annex. What the record shows is ordinary federal buying for a system GAO has audited in unclassified reports.
State and local fusion with NGI face search is another documented thread. GAO and civil-liberties filings in federal dockets describe memoranda of understanding and user agreements. Courts have seen challenges to particular identifications; those cases turn on specific facts, not a blanket judicial finding that NGI face search is unlawful. Officials have said publicly that a candidate list requires follow-up investigation and is not probable cause by itself.
Accuracy language in vendor marketing and in some agency materials has been more confident than GAO’s audit language. The office’s reports use measured terms: incomplete testing, unknown error rates in operational conditions, delayed PIAs, and insufficient notice. That contrast—expanding contract spend versus documented gaps in independent accuracy work—is what the public paper trail supports.
Congressional committees have held hearings at which FBI and DOJ witnesses described NGI as essential to identifying subjects in criminal cases and missing-person matters. They have also heard GAO witnesses restate the testing shortfalls. The public positions, paraphrased, are that the bureau improved documentation after 2016 and that face search remains an investigative tool. GAO’s position, as written in its reports, is that improvement does not erase the period of operational use without full accuracy characterization, and that some oversight items lingered.
The dispatch does not assert a secret program. It restates what budgets, IG letters, GAO chapters, and contract notices already place in the open: NGI face-recognition capability was procured and used while independent auditors recorded that accuracy, demographic performance, and privacy paperwork were not fully in place, and that external users could query FBI photos under rules the bureau had not fully verified. Subsequent closures of some recommendations appear in later GAO updates; the earlier findings remain part of the official history of the program.