Gotcha! FBI launches new biometric systems to nail criminals

Nearly 80 years after it began collecting fingerprints on index cards as a way to identify criminals, the Federal Bureau of Investigation is moving to a new system that improves the accuracy and performance of its existing setup while adding more biometrics.

By adding palm print, face and iris image search capabilities, the FBI's Criminal Justice Information Services Division (CJIS) hopes to improve the accuracy of identity searches, make it easier to positively identify and track criminals as they move through the criminal justice system and provide a wider range of tools for crime scene investigators.

To take full advantage of all of the new capabilities, however, federal, state and local law enforcement agencies may need to update their own systems to be able to capture the data, forward it to the FBI and search against the nationwide database.

-------------------------------------------------------------

NGI timeline

1924

The FBI makes its first foray into biometrics, with fingerprints on index cards.

1980

FBI launches its first computer system created to search fingerprint files.

1992

FBI debuts the Criminal Justice Information Services Division.

1995

The Bureau begins work on the Integrated Automated Fingerprint ID System database (IAFIS) to automate fingerprint collection and retrieval.

1999

IAFIS is fully deployed.

2008

Development of the $1.2 billion Next Generation Identification (NGI) system begins.

February 2011

CJIS delivers a more powerful computer system with a more accurate algorithm to match flat and rolled fingerprints to the criminal master file database.

August 2011

The FBI adds the Repository of Individuals of Special Concern, which includes "the worst of the worst" criminals, and launches a system that lets officers in the field use a mobile system to scan two fingers of the suspect and query NGI for a nearly instantaneous response.

February 2012

The FBI launches Interstate Photo System Facial Recognition Pilot with three states, which allows searches against more than 15 million mug shots.

May 2013

A new latent fingerprint matching feature, which matches fingerprints found at a crime scene with those in the system, debuts, with nearly three times greater accuracy. FBI launches a new palm print database and search service; the new system handles 200,000 requests per day with a response time of 10 seconds or less.

2014

- Facial recognition service to go live.

- Iris recognition pilot to launch.

- IAFIS system to be decommissioned.

----------------------------------------------------------------------------------------------------------

"Most booking stations are starting to gather all of the modalities -- fingerprints, palm, and face and iris," says Jon Kevin Reid, assistant section chief in the CJIS division. But many regional and local law enforcement systems don't yet capture all of that information, and will need to upgrade their own systems to reap the benefits from the new system.

The current database, the FBI's Integrated Automated Fingerprint ID System (IAFIS), includes information on 135 million criminals and terrorists, as well as civil servants and other citizens who work in "positions of trust."

Since its launch in 2008, the $1.2 billion Next Generation Identification (NGI) project has been incrementally replacing pieces of the aging IAFIS and adding new features (see the text box at right).

To date, the agency has upgraded the ten-print system hardware and software, launched a new palm-print search capability and is currently piloting face recognition services with an eye toward full deployment next year. An iris recognition pilot will commence next summer.

"NGI is a seven-year program and we're in the last year," says Reid. By the end of 2014, the agency plans to have all new functions rolled out and the entirety of IAFIS decommissioned.

Mobile ID

The recently released mobile ID system is one of the more compelling new features in NGI. It lets officers in the field use a handheld fingerprint scanner during a traffic stop and run a two-fingerprint check against the NGI's newly created Repository of Individuals of Special Concern (RISC).

That subset of the criminal master file includes "the worst of the worst," Reid explains, such as criminals with outstanding warrants,known sex offenders and suspected and known terrorists. Responses come back within six seconds, Reid says.

So far, 13 states are using RISC, and the State of Michigan is currently implementing it, says Scott Blanchard, manager of the automated print identification section at the Michigan State Police.

Core upgrades

In NGI, the ten-print system has also been improved because it now runs on a more powerful, 1,000-blade server farm -- the old IAFIS system runs on 64 blades -- and uses enhanced recognition algorithms. "NGI is faster, more accurate, and has better process flows than IAFIS had," says Blanchard.

Fingerprints are more accurate than facial recognition for identifying individuals. And now in NGI, the ten-print system has been improved because it runs on a more powerful, 1,000-blade server farm.

The matching accuracy rate has risen from 92% to 99% while average response time has dropped from 2 hours to 10 minutes. "That changes the game at the local police station," says Art Ibers, director of the NGI program at government contractor Lockheed Martin.

But the time improvement is for matching fingerprints scanned under controlled conditions, such as at a police booking station. Matching latent fingerprints -- those found at a crime scene -- is much more difficult. With an accuracy rate of just 25%, IAFIS wasn't highly effective for investigators. By contrast, the upgraded NGI capabilities rolled out in May 2013 have had an accuracy rate well above 80% for latents, due to an improved algorithm that takes advantage of more compute horsepower, Reid says.

Going for the palm

A national palm-print database, deployed in May 2013, should also help investigators because palm prints are left at the crime scene 30% of the time. "There will be significant leads around cold cases that we couldn't have gotten before," Reid says.

The State of Michigan has been taking palm prints for five years, but Blanchard says there have been a few kinks getting up and running with the new system. "The FBI has placed requirements on palm print submissions that most states are not meeting," he says.

In a palm capture, NGI requires that the whole hand be captured, not just the palm. "They are trying to compare the fingers from the palm capture to the fingerprints that were rolled to make sure the palm matches the person. Many agencies aren't meeting that requirement. We are capturing just the palm, not the entire hand," Blanchard explains.

In some cases the biometric devices that local law enforcement is using to collect data may need to be modified or replaced entirely. "Until this issue gets resolved, the usefulness of the palm database is limited," he says.

A national palm-print database, deployed in May 2013, should help investigators because palm prints are left at the crime scene 30% of the time.

Many law enforcement computer systems are now playing catch-up, both for machine-to-machine data sharing between their own booking systems and NGI, and for workstation software that queries the NGI system. For example, the Western Identification Network, used by law enforcement agencies in eight states in the Pacific Northwest, doesn't yet support sharing of the new biometric data, and workstation software used by law enforcement in Seattle to search the new NGI database needs to be updated as well.

Current plans call for these features to be added over the course of next year.

"We are experimenting with workarounds" until the software is upgraded over the next year, says Carol Gillespie, manager of the King County Regional Automated Fingerprint Identification System in Seattle.

Recognizing mug shots

Mug shots have long been a staple of IAFIS, but the FBI's Interstate Photo System Facial Recognition Pilot project, launched in February 2012 in three states, now lets participating law enforcement organizations use face recognition to search against over 15 million of those images. The system returns a ranked list of potential matches. The service will be fully deployed next June.

With IAFIS matching was visual only. Using face recognition algorithms to search for a match against another photo is new; it matches the photo taken at the booking station or from a crime scene with mug shots in the NGI database that have a high probability of being a match.

Face recognition isn't nearly as accurate as fingerprints when identifying individuals. "If you had a perfect gallery it would be in the 80% range for matching," Reid says. But that's for the best case. Most existing mug shots weren't taken with facial recognition in mind. The right pose and high image quality increase the odds of finding a match.

But image quality for mug shots varies widely and when matching against crime scene evidence, such as images from security cameras, the accuracy degrades significantly from that best case.

Nonetheless, face recognition is proving to be an effective tool during active investigations for the Michigan State Police. "The system has been very beneficial in attempting to identify unknown subjects who commit crimes of identity theft and fraud," says Pete Langenfeld, manager of the digital image analysis section.

The response time for an inquiry has averaged less than three minutes, he says. And because the people who commit such crimes often cross state lines, investigators don't need to contact every jurisdiction to see if they have a face recognition program. But, he cautions, "Any candidate derived from a facial recognition search should be considered an investigative lead only, and not positive identification."

Experimenting with iris recognition

CJIS has been working with the Federal Bureau of Prisons and National Sheriffs Association to launch a pilot iris recognition project, but whether it will eventually be included in the new NGI/IAFIS system is still undecided. "We know there are business cases, but is it something we want to support at the national level?" Reid asks. A formal pilot will be deployed in the summer of 2014, he says.

Iris recognition, while very accurate, is unlikely to supplant the well-established ten-print system for criminal identification purposes, and it's of limited use for investigations because, as Reid points out, "There isn't an iris left at the scene." So far, the best use for iris recognition has been in tracking criminals as they pass through the criminal justice system. "Prisons like it because you can do it without having to touch the individual," Reid says.

The Michigan State Police aren't capturing iris images during booking, but Blanchard says they have been experimenting with the technology as a way to provide access to secure rooms. "It's more secure than access cards and cleaner [and] less intrusive than fingerprints," he says. "If it's more efficient and cost effective, we'll roll it out department-wide."

While it's more costly than other biometrics, iris recognition system prices have been coming down. And in some applications, Blanchard says, the added security and reliability may be worth the extra cost.

To date, NGI has been returning twice as many identifications with multimodal biometrics as it did with the old IAFIS system. While Blanchard has been pleased with the new system's performance, he says it will take time for the majority of law enforcement agencies to get set up to collect and share the new classes of biometric data.

"It's a revolutionary change," Reid adds -- one that should improve law enforcement's effectiveness, particularly for criminal activity that crosses state lines.

----------------------------------------------------------------------------

National database rats out those with rap sheets

It's common for people hired into positions of trust -- such as a school bus driver or substitute teacher -- to be fingerprinted and have their information checked against the FBI's criminal history database. But what happens if that person subsequently commits a crime? Depending on the law in a given jurisdiction, that person might not be rechecked for years, says Reid.

About 30 states currently do continuous checks so that they're notified immediately by email if an individual in their jurisdiction is arrested.

However, those systems won't necessarily flag people who offend in another state. Next summer, as part of its NGI initiative, the FBI will add a similar 'rap back' reporting feature to its system. "If the individual is arrested, you'll know, no matter what state it was in. It gives you a national look at someone," he says.

The state of Michigan has had its own rap back system in place since 2006. While the state wants to know if a trusted person commits crimes outside of the state, it also wants to keep details about that citizen other than their fingerprints private, since they're not criminals. "The FBI's system will just track that 'John Smith' has a criminal record in three states and points to the state computers for users who want more details. We track that John Smith works in adult foster care, substitute teaches in two schools and is a volunteer soccer coach," says Peitro Seifero, manager of the criminal history unit with Michigan's Criminal Justice Information Center.

The system has been very successful: In 2012, the state of Michigan had 61,897 rap back notifications on 20,474 people. A rap back notification triggers from an arrest, a conviction or an update to a conviction.

It's a criminal database, so to get in there the person must have been arrested and charged with a crime at some point. "But adding federal coverage will provide more comprehensive coverage," Seifero says. Also, Seifero says, "some of those are repeat customers who were arrested several times or have rap back subscriptions with multiple employers."

-------------------------------------------------------------------------------------------------

This article, Gotcha! FBI launches new biometric systems to nail criminals, was originally published at Computerworld.com.

Robert L. Mitchell is a national correspondent for Computerworld. Follow him on Twitter at Twitter twitter.com/rmitch, or email him at rmitchell@computerworld.com.