Laws and regulations

FBI has a facial recognition system that can access 411 million photos

According to the US GAO the FBI’s Next Generation Identification facial recognition system has access to 411.9M photos of Americans and foreigners alike.

When we talk about technology, privacy and security are concepts that are often at odds.

Let’s think for example of a facial recognition system, this technology could be used in many contexts for security reason, but often raises serious concerns for the users’ privacy.

Let’s think for example of FBI’s Next Generation Identification (NGI) facial recognition system, it was initially estimated that it has access to 70 million photos, but recently the US Government Accountability Office (GAO) has discovered that the bureau has access to 411.9 million pictures of Americans and foreigners alike.

It is worrisome that the US law enforcement has access to photos of individuals that have no criminal records.

According to the GAO, the FBI’s Facial Analysis, Comparison, and Evaluation (FACE) Services unit has access to an impressive amount of data from various sources. The list of sources included the FBI’s Next Generation Identification (NGI) face recognition database of nearly 30 million civil and criminal mug shot photos, the Defense Department’s biometric database, the State Department’s Visa and Passport databases, and the drivers license databases of at least 16 states. Totaling 411.9 million images, this is an unprecedented number of photographs, most of which are of Americans and foreigners who have committed no crimes.

If you sum the number of pictures from all these sources you will discover that the FBI can access 411.9 million images, most of which are of Americans and foreigners without criminal records.

“Totaling 411.9 million images, this is an unprecedented number of photographs, most of which are of Americans and foreigners who have committed no crimes.” states the nonprofit organization EFF.

The EFF pointed out that the FBI has spent the necessary effort to make sure that its “investigative leads” don’t include photos of innocent people. The FBI hasn’t conducted the necessary tests for the accuracy of NGI’s face recognition capabilities.

According to privacy advocates, the good news is that FACE isn’t available to public queries.

The GAO report includes a lot of details about the facial recognition system used by the FBI, the document is very critical of the way the FBI is rolling out massive face recognition capabilities without providing evidence of privacy implications of its operations to the public.

I invite you to read the GAO’s report.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – FBI, facial recognition system)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Fintech firm Figure disclosed data breach after employee phishing attack

Fintech firm Figure confirmed a data breach after hackers used social engineering to trick an…

19 hours ago

U.S. CISA adds a flaw in BeyondTrust RS and PRA to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BeyondTrust RS and…

21 hours ago

Suspected Russian hackers deploy CANFAIL malware against Ukraine

A new alleged Russia-linked APT group targeted Ukrainian defense, government, and energy groups, with CANFAIL…

1 day ago

New threat actor UAT-9921 deploys VoidLink against enterprise sectors

A new threat actor, UAT-9921, uses the modular VoidLink framework to target technology and financial…

2 days ago

Attackers exploit BeyondTrust CVE-2026-1731 within hours of PoC release

Attackers quickly targeted BeyondTrust flaw CVE-2026-1731 after a PoC was released, enabling unauthenticated remote code…

2 days ago

Google: state-backed hackers exploit Gemini AI for cyber recon and attacks

Google says nation-state actors used Gemini AI for reconnaissance and attack support in cyber operations.…

2 days ago

This website uses cookies.