Half of the United States is registered in police facial recognition databases, and they’re completely unregulated

If you’re an adult in the United States, there’s a 50/50 chance that you’re in a government facial recognition database.

And despite being widely used, the nation’s facial recognition system is messy, unreliable, and widely unregulated, according to a new report (large PDF) by Georgetown Law’s Center for Privacy and Technology. The report was built on 1,500 pages of state and federal government records made public by Georgetown Law, as well as dozens of interviews with law enforcement agencies, researchers, and private companies. Its findings not only shine light on the fact that these databases exist, but that they’re widely accessible to law enforcement and used without any regulation or oversight.

The most alarming statistic in the report is that 117 million American adults, about half the population, have their photos registered in some law enforcement database. This massive number isn’t just one central database, but a network of state driver’s license databases accessible by the FBI and state authorities on a state-by-state basis, as well as an internal FBI database. However, the FBI has access to search 16 state databases simultaneously—containing about 64 million Americans—without a warrant. Law enforcement can match any image they have against these records at will.

Alvaro Bedoya, executive director of the Center for Privacy and Technology, tells Quartz that the lack of accountability when matching a biological marker to records in a database of law-abiding citizens is an unprecedented regulatory gap.

“This has never happened before. It hasn’t happened with fingerprints, it hasn’t happened with DNA,” Bedoya said. “Until now there’s been a line, that unless you commit a crime we don’t record the facts of your body.”

FBI and state searches might not even be effective. Of 36,420 FBI state license and mugshot searches between 2011 and 2015, a mere 210 queries presented a likely candidate for investigation. That’s 0.6%. Data isn’t available for how many of those likely candidates were arrested or convicted. These likely candidates might not even be an exact match, because the recognition software used by the FBI is set to give the closest matches, rather than returning no matches at all, according to Bedoya.

Constant facial recognition, or mass analysis of faces with the hopes of catching someone on a list, is also expected to be widely adopted. The Los Angeles Police Department currently uses this kind of software, and four other major police agencies have expressed interest or plans to do the same thing.

Lawmakers have yet to impose concrete regulation on facial recognition use by law enforcement. Other forms of biometric identification, like fingerprints, geolocation tracking, or DNA, require warrants. Even automatic license plate tracking has been curtailed.

“This is a rules-free zone,” Bedoya said. “There is literally no comprehensive state law saying when this can be used and how it can’t used.”

home our picks popular latest obsessions search