FEDERAL BIOMETRICS DISJOINTED PROGRESS. Bottom Line Up Front. Federal Biometric Spending,

Transcription

1 DISJOINTED PROGRESS JULY 2016 Bottom Line Up Front Despite significant advances and proliferation of biometric technology in the commercial market, the federal government has yet to take full advantage of new biometric capabilities. The three primary federal customers, Department of Defense (DOD), Department of Homeland Security (DHS), and Department of Justice (DOJ) have aging biometric systems that require modernization and overhaul. The combination of the new security environment, budgetary constraints, and unclear federal guidelines have impeded efforts. In particular, while the commercial market has readily adopted new biometric collection capabilities or modalities that allow immediate identification and authentication, federal agencies use systems that have limited flexibility, scalability, and interoperability. Nevertheless, the hybrid threat environment of non-state and transnational actors necessitates an enhanced ability to track people of interests. Our national security apparatus requires the tools and integrated systems that allow for quick identification and flagging of people anywhere in the world. Fortunately, the federal government is aware of the importance of biometrics in national security and has begun modernization efforts, albeit at an uneven pace across the entirety of the government. Federal Biometric Spending, % DOD DHS DOJ OTHER 6% MILLIONS OF DOLLARS % 65% 2 0 DOD $332 Million DHS $131 Million OTHER DOJ $33 Million $14 Million Source: FPDS 1

2 Types of Biometrics Federal Biometric Marketspace VISUAL SPATIAL Biometrics, or measuring life in Latin, encompass a variety of means to identify an individual based on their unique biology (i.e. eyes, DNA, fingerprints). The FBI has been at the forefront of this field for several decades, and DOD started to show interest in the late 1990s. Using a variety of hardware, such as handheld scanners, and software, federal agencies employ biometric systems to both authenticate good guys as well as identify bad guys. From the beginning, the collection of biometric data was stovepiped in each agency, and sharing of information was limited. This lack of coordination created gaps and exposure. In recent years, federal agencies have begun modernizing their aging biometric systems and developed data sharing capabilities. However, much of these data sharing efforts are piecemeal solutions that have left the U.S. exposed to potential threats. Nevertheless, each government agency faces a set of challenges that impede the growth of biometric use. For the DOD, it is the lack of clear guidelines to mark the way for future biometric systems. For DHS, it is a history of poor organizational management and resource allocation. And for DOJ, it is the growing privacy concerns of emerging biometric capabilities. The successful expansion of federal biometrics will depend on each agency s ability to address these issues. Summary of Federal Biometric Programs PROGRAM PURPOSE/MODALITIES STATUS DOD - Automated Biometric Idenfication System (ABIS) DOD - Joint Personnel Identification (JPI) DOD - SOCOM Sensitive Site Exploitation - Biometrics DHS - Arrival and Departure System (ADIS) DHS - Automated Biometric Identification System (IDENT) DHS - Homeland Advanced Recognition Technology (HART) DOJ/FBI - Integrated Automated Fingerprint System (IAFS) DOJ/FBI - Next Generation Identification (NGI) Fingerprint, Facial, Iris, Palm Fingerprint, Facial, Iris, Palm Fingerprint, Facial, Iris, DNA Fingerpint, Photograph Fingerprint Fingerprint, Facial, Iris Fingerprint Fingerprint, Facial, Iris, Voice Fingerpints Tattoo/Scars Face Iris Ears Footprints BEHAVIORAL Gait Mouse Keystroke Considered legacy technology and alternatives being sought Retained until life-cycle replacement/waiting for approval for new requirement Uses COTS technology. Issued Broad Agency Announcement ( ) for white papers and proposals Entry System implemented since 2006 but exit system still in pilot Legacy database being phased out New biometric system set to replace IDENT by 2019 Currently expanding into iris and facial modalities. Legacy database being phase out Fingers/Hand Signature OLFACTORY Odor AUDITORY Voice CHEMICAL DNA New biometric system initiated in 2008 to be completed by

3 DEPARTMENT OF DEFENSE Since 2003, United States Central Command has employed multi-modal biometric technologies to enhance the effectiveness of traditional military operations. Biometrics have been used to screen people entering or working at U.S. and coalition bases, to identify recidivist criminals, and to tie suspects to terrorist activities. DOD Challenges Aging biometric systems Budgetary constraints Evolving security environment Undefined new requirements Emphasis on Whole of Government MILLIONS OF DOLLARS In the past decade, DOD has spent approximately $332M on biometric-related goods and services. The majority of the spending comes from the Army and Special Operations Command (SOCOM). Since 2012, the Army has experienced an almost 70% decline in funding for biometric programs from $116M in FY12 to $17M and $28M in FY16 and FY17 (projected), respectively. SOCOM s biometric spending is much smaller, averaging $3M annually over the last five years. The Army s reduction reflects the drawdown in Iraq and Afghanistan as well as a shifting focus from procurement of new systems to sustainment of Department of Defense Biometric Funding existing systems and research and evaluation of next-generation capabilities. With the exception 140 of FY15, Research Development Testing & 120 PROCUREMENT Evaluation (RDTE) funding for Army biometric RDTE programs has been double that of procurement 100 since FY FY2011 FY2012 FY2013 FY2014 FY2015 FY2016 FY2017 Source: Department of Defense A contributing factor to the Army s diminishing funding for biometric programs is the programs unclear status within the DOD. Born out of a 2004 Joint Urgent Operational Needs Statement (JUONS), the Army s biometric programs were developed as a quick reaction capability (QRC) and were never converted into a Program of Record (POR). Without POR status, biometric initiatives are more susceptible to budgetary constraints and overseas operations. The Army has a software and a hardware biometric program: the central biometric repository known as the Automated Biometric Identification System (ABIS) and the family of tactical biometric devices under the Joint Personnel Identification (JPI) program. Originally the Army planned to develop PORs of next-gen systems to replace ABIS and JPI. However, in the post-iraq and Afghanistan environment, the program office decided instead to focus on upgrading and sustaining current systems. The Army plans to explore alternatives to the current ABIS system while existing biometric devices are to be retained until life cycle replacement or new requirements approved. Sustainment for ABIS and JPI began in 2014 and is expected to last through DOD has yet to identify alternatives or new requirements for successor programs, instead focusing on small pilot programs to test emerging capabilities. These delays in replacing legacy systems will have profound implications on the Army s ability to carry out its biometric mission. A 2013 report from the Director of Office of Testing & Evaluation noted that an upgraded version of ABIS under evaluation was actually less accurate due to its 3

4 legacy technology. The current systems also suffer from severe cybersecurity flaws due to software obsolescence and old hardware. The current DOD inventory of biometric collection devices is also failing to meet emerging biometric needs that have surpassed sustainment levels. The Biometric Automated Toolset - Army (BAT-A), used to capture iris, facial, and fingerprints images, has been criticized for being difficult and costly to modify due to its rigidity and outdated design. Similarly, the Handheld Interagency Identity Detection Equipment (HIIDE) is at capacity and cannot handle the growing Afghan Watch List. These shortcomings stemming from outdated technology pose a security risk to U.S. troops abroad who depend on biometrics to verify credentials and identify adversaries. Contributing to the uncertainty surrounding the Army s biometric programs is DOD s emphasis on a Whole of Government (WOG) approach. According to DOD, a WOG approach means a shift away from the current biometrics and forensics capability-centric focus to a more holistic concept of identity biometric, biographical, and contextual attributes that help distinguish a friend from an adversary. However, DOD admits that it has yet to define the concept of identity and looks to industry for input and innovation. This admission presents an opportunity for the industry to engage DOD and Congress to influence the development of future biometric requirements. While the Army does not have a POR, SOCOM does under the Sensitive Site Exploitation (SSE) program. SOCOM has a reputation for rapidly fielding Commercial Off-the-Shelf (COTS) technologies that would later be adopted by other service components. Last year, SOCOM issued a Broad Agency Announcement (BAA) for white papers and proposals and capabilities that meet its biometric mission requirement in an effort to modernize and upgrade its biometric capabilities. The Army is very likely to incorporate elements of SOCOM s SSE program as it reevaluates its own biometric programs in the coming years. Furthermore, with the Army s withdrawal from Iraq and Afghanistan, SOCOM has arguably become the primary users of biometric devices, which calls into question whether the Army should be the ones funding procurement. DEPARTMENT OF HOMELAND SECURITY DHS Challenges The Department of Homeland Security (DHS) is the second Lack of clear policy guidelines largest federal biometric customer, spending approximately Poor organizational structures $131M in the last decade. The DHS entity responsible for Mismatch of biometric missions and biometrics is known as the Office of Biometric Identity resource allocation Management (OBIM), whose primary mission is to serve Growing biometric demand and need customers across DHS, at other federal agencies, in state for additional modalities and local law enforcement and overseas through storage of biometric identities, recurrent matching against derogatory information, and other biometric expertise and services. The agency oversees two biometric databases, the Arrival and Departure System (ADIS) and the Automated Biometric Identification System (IDENT). The IDENT system is the most widely used biometric database in the U.S. with 95 million subjects processed last year. The number of subjects processed is expected to grow to 174 million annually by 2022, an 83% increase. 4

5 MILLIONS OF DOLLARS DHS Biometric Funding, US-VISIT OBIM HART FY2013 FY2014 FY2015 FY2016 FY2017 Source: Department of Homeland Security Historically, DHS biometric programs have been stymied by the lack of clear policy guidelines and poor organizational structures. In the wake of 9/11, the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program was created to track the entry and exit of foreign visitors to and from the United States. The program quickly expanded beyond its initial mandate to include providing services to other national security agencies as well as developing and testing biometric entry/exit systems. In 2006, US-VISIT successfully established an entry system that collected biometric data from incoming foreign visitors but failed to do the same with an exit system. A 2010 DHS memo claimed this failure was due to the (1) disruptive nature of biometric collection on travelers; (2) lack of cooperation from air carriers and airports, and (3) questions on personnel responsible for biometric data collection. In reality, the failure was due to the lack of communication and collaboration with the existing system s end users. U.S. Customs and Border Protection (CBP), who is ultimately responsible for the full implementation of entry/exit programs, participated and contributed inputs during pilots, but never had the final say, control, or accountability for getting the job done. US-VISIT s failure to develop an exit biometric system for over ten years has attracted congressional attention. Over the last three years, Congress has made a number of policy adjustments and reorganizations of the US- VISIT program. However, rather than streamlining and clarifying responsibilities, these reorganizations simply served to mismatch missions and available resources. CBP gained full control and accountability on developing a biometric exit system but the funding remained with OBIM. The administration has recognized this misalignment and in the FY7 Presidential Budget Request proposed that US-VISIT, renamed the Office of Biometric Identity Management (OBIM), be transferred from NPPD to CBP. Moving OBIM to CBP, the largest user of the IDENT system, will ensure that the new biometric system addresses the customer s needs. FY22 FY21 FY20 FY19 FY18 FY17 FY16 FY15 FY14 FY13 FY12 FY11 FY10 Projected Growth of IDENT/HART Searches and Gallery Size SEARCHES GALLERY SIZE Although it has taken several years for the federal FY09 government to properly reorganize DHS biometric mission, the future looks bright. OBIM is modernizing its IDENT system through the Homeland Advanced Recognition Technology (HART) program over a course of four years from HART will include more flexibility to allow better plug-and-play architecture, scalability, and multi-modality recognition such as the already available fingerprinting along with additions of iris, face, and THOUSANDS Source: Department of Homeland Security 5

6 possibly voice and DNA. In FY16, DHS was given $52.8M for HART Increment I, which began the process of transferring IDENT s core systems to HART. The FY17 Presidential Budget Requests includes another $65M for Increment 2, which would expand the system to include iris and facial recognition. At the completion of Increment 4 in FY19, HART will reach Full Operating Capability. It will support 450 million unique identities and 720 thousand daily fingerprint transactions while offering greater efficiency, capacity, and performance for more modalities than the legacy IDENT system. DEPARTMENT OF JUSTICE The Department of Justice has the most extensive and mature biometric programs in the United States. Primarily under the jurisdiction of the Federal Bureau of Investigation, DOJ has a longstanding history of biometric DOJ Challenges Accuracy of new modalities from lack of control over collection Privacy concerns of new modalities use and served as a model of best practices for other agencies. For example, DOD modeled its ABIS system after the FBI s Integrated Automated Fingerprint Identification System (IAFIS). In contrast to DOD and DHS, the FBI has a more comprehensive approach to biometrics that includes not only the development and prototyping of new capabilities but also addressing standards, best practices, and privacy and policy concerns. For example, to further centralize biometric activities, the FBI established the Biometrics Center of Excellence (BCOE), a one-stop-shop for biometric collaboration and expertise. In 2015, BCOE established the Biometrics Technology Center, a collaborative effort between the FBI and DOD on advancing biometric capabilities for the entire federal government. Like the DOD and DHS, the FBI is undergoing massive modernization efforts. Starting in 2008, the FBI initiated a $1.2 billion Next Generation Identification (NGI) program. Over the course of 10-years, the program would replace IAFIS with multi-modal capabilities for the collection and repository of Federal Biometric Data Sharing fingerprints, facial images, iris scans, and voice samples. NGI became fully operational in 2014 and quickly became the world s largest and most efficient STORES BIOMETRICS FROM - VISA APPLICATIONS electronic repository of biometric - IMMIGRATION VIOLATORS - OTHER BORDER CREDENTIALS criminal information. According to Amy - LATENT PRINTS FROM DHS, DOJ, DOD Hess, the Executive Assistant Director of the FBI s Science & Technology Division, a fingerprint inquiry from local law enforcement to NGI now only takes five minutes compared to hours with the old IAFS system. In FY 2014 and FY15, approximately 70 million and 77 million fingerprint background checks were processed, respectively. DHS IDENT DOJ NGI SHARES BIOMETRIC FILES SHARES BIOMETRIC FILES SHARES BIOMETRIC FILES STORES BIOMETRICS FROM - DOMESTIC ARRESTS - LIMITED INTERNATIONAL ARRESTS - LATENT PRINTS FROM CRIME SCENES - SOME LICENSING EMPLOYMENT AND OTHER APPLICATIONS Furthermore, the FBI has been the pioneer in efforts to incorporate new biometric capabilities, though not without some challenges. From 2002 DOD ABIS STORES BIOMETRICS FROM - BIOMETRICS ENABLED WATCH LIST (BEWL) - ENEMY COMBATANT; OTHER CRIMINAL MASTER FILES 6

7 to 2004, the FBI ran a number of vendor tests to evaluate existing commercial face recognition and fingerprinting technologies. These technologies would later form the foundations of the NGI program. However, a May 2016 GAO report expressed concerns about the privacy and accuracy of the facial recognition technology. The FBI has rejected calls to reassess the privacy impact of the system or ensure the accuracy of its matches. The agency claims it has adequate internal policies to avoid privacy violations and that match accuracy depends on the quality of data provided by local law enforcement. BCOE is also evaluating iris scans, voice samples, contactless fingerprinting, profile and ear recognition, and scar/tattoo recognition as potential modalities. Other Issues INTEROPERABILITY In a 2008 report, the GAO concluded that gaps in [government] agencies biometric collection and sharing processes can increase the risk that terrorists will avoid identification in subsequent encounters with U.S. personnel during military operations, the visa application process, and U.S. border crossing. Interoperability between different biometric systems has been a longstanding concern among government agencies, with potential national security implications. While the agencies have established formal and informal data sharing arrangements, a formalized, government-wide biometrics data-sharing architecture is still missing. The lack of common architecture means future systems will continue to experience interoperability issues and will require additional investments. Moreover, the federal government lacks a centralized watch list or database of biometric data on possible terrorists. Currently, government officials have to initiate separate searches on the different biometric databases, an inefficient and sometimes impractical process. Facial recognition technology is a new and powerful tool that holds great promise for law enforcement, he said. But if we don t ensure its accuracy and guard against misuse, I am concerned about the risk of innocent Americans being inadvertently swept up in criminal investigations. -U.S. Senator, Al Franken (D-Minnesota) Another area of concern is the need to standardize biometric data being collected, which does not have a straightforward solution. For example, DOD prefers to give commanders in the field the flexibility to gather what they deem is appropriate under the circumstances. This preference for flexibility results in the collection of different data that are not necessarily comparable to each other or with other systems. The balance between flexibility data collection and consistency will have to be addressed to increase interoperability. PRIVACY The expansion of biometric use in the commercial and federal space has attracted the attention of privacy advocates. Advocates argue that biometrics are intrusive and that there is a high potential a third party (particularly other government agencies) can gain access and abuse such data. In essence, there is an impression that biometric data lowers or removes an individual s control of who has access to their personal information. 7

8 The FBI s facial recognition system has become the focal point of privacy advocates in recent years. Although still in pilot testing, critics argue that equipping facial recognition technology to a surveillance system would allow administrators to actively track any individual throughout his/ her daily life. Moreover, advocates insist digitized biometric information can be stolen and used improperly. However, many of these arguments demonstrate a lack of understanding of how biometric technologies work. Digitized biometric information in itself cannot be easily used by third party interlopers as they would require physical replicas. The attacker would have to find a way to decode the digitized biometric data and then convert them into physical copies to bypass a biometric security system. Nevertheless, abuse of biometric information by those with lawful access to biometric systems is a legitimate concern. Currently, only Texas and Illinois have laws regarding biometric capture for commercial uses. Congress last attempt to pass a Biometric Information Privacy Act in 2014 never reached the floor for votes. As new modalities are introduced and federal agencies modernize their biometric collection system, the calls for privacy legislation are likely to increase significantly. 8

9 Glossary ABIS Automated Biometic Identification System (DOD) ADIS Arrival and Departure System DHS Department of Homeland Security IDENT JPI NGI Automated Biometric Identification System (DHS) Joint Personnel Identification Next Generation Identification DOD Department of Defense OBIM Office of Biometric and Identity Management DOJ Department of Justice POR Program of Record FBI Federal Bureau of Investigation QRC Quick Reaction Capability HART IAFS Homeland Advanced Recognition Technology Integrated Automated Fingerprint System US-VISIT United States Visitor and Immigrant Status Indicator Technology BlackArch Partners Third Party Independent Research Disclaimer: This constitutes a research report prepared by an independent third party research provider. BlackArch has not reviewed the accuracy of this report. Any opinions expressed herein are statements of judgment on the date of the report and are subject to future change without notice. Neither this information nor any opinions expressed herein are a solicitation to purchase or sell any securities, and nothing contained in this report is or should be construed as investment advice. This information contains forward looking predictions that are subject to certain risks and uncertainties which could cause actual results to differ materially from those currently anticipated or projected. BlackArch provides this information to its clients in an effort to provide comprehensive information of a broad range of possible opportunities. Any questions regarding this report or its contents must be addressed to your BlackArch Representative. Neptune Advisory th Street SE Washington, DC Scott Ellison scott@neptuneasc.com Kevin Jiang kevin@neptuneasc.com Patrick McCarthy, CFA patrick@neptuneasc.com David Schopler schop@neptuneasc.com This report is proprietary to Neptune Advisory and is intended for the exclusive use of the recipient and its employees and should not be copied or further distributed, circulated, disseminated, or discussed. Neptune Advisory does not provide advice, reports, or analyses regarding securities and this report should not be understood as performing any analysis or making any judgment or giving any opinion, judgment or other information pertaining to the nature, value, potential, or suitability of any particular investment. This report is based upon information believed to be reliable at the time it was prepared. However, Neptune Advisory cannot guarantee the accuracy or correctness of any judgment, opinion or other information contained in this report. Neptune Advisory, its partners, employees or agents have no obligation to correct, update, or revise this report or advise or inform recipient should Neptune Advisory or any of its partners, employees or agents determine that any judgment, opinion, or other information contained in this report is inaccurate or incorrect or should Neptune Advisory or any of its partners, employees or agents change their view as to any judgment, opinion or other information expressed herein. Neptune Advisory, its partners, employees and agents shall have no liability to you or any third party claiming through you with respect to your use of this report or for any errors of transmission. Partners and employees of Neptune Advisory or their family members may own securities or other financial interest of, or have other relationships or financial ties to, of one or more of the issuers discussed herein. 9