1

Introduction

The use of facial recognition technology (FRT) in a wide and growing variety of contexts has brought into increasing focus both the potential benefits of using FRT and concerns about impacts on equity, privacy, and civil liberties.

WHAT IS FACIAL RECOGNITION TECHNOLOGY?

Facial recognition connects an image of a face to an identity or connects an image of a face to a database entry supporting identification or association with a prior event. Manual comparison of images of faces by humans is a long-standing practice that is slow, has less than perfect accuracy, and is subject to human biases.^1,2,3 By contrast, computer performance of facial recognition tasks is extremely quick and, in many cases, more accurate than human face comparisons.

Modern FRT uses an artificial intelligence (AI) model, typically deep convolutional neural networks, to extract facial features in each image, and then compares the extracted features (not the images themselves) between two images. It can either verify identity by matching a subject image to a record of a single individual (one-to-one

___________________

¹ N. Whitehead, 2014, “Face Recognition Algorithm Finally Beats Humans,” Science, April 23, https://www.science.org/content/article/face-recognition-algorithm-finally-beats-humans.

² P.J. Phillips and A.J. O’Toole, 2014, “Comparison of Human and Computer Performance Across Face Recognition Experiments,” Image and Vision Computing 32(1):74–85.

³ A.J. O’Toole, P.J. Phillips, F. Jiang, J. Ayyad, N. Penard, and H. Abdi, 2006, Face Recognition Algorithms Surpass Humans,” Washington, DC: National Institute of Standards and Technology, https://www.nist.gov/system/files/documents/2021/05/12/frgc_face_recognition_algorithms_surpasshumans.pdf.

matching) or identify an individual by matching the image to a record of an individual in a reference database (one-to-many matching). FRT can

• Associate a face with an identity to allow the person to later verify an identity claim. (Are you who you claim to be?)
• Associate a face with a database entry containing identification data. (Is this person known to us?)
• Match a face with an event or circumstance. (Has this person been seen before?)
• Provide evidence for who an observed person is not. (This is not the person we are looking for.)

Given these abilities, FRT is often used in forensic applications, helping to establish the identity of an unknown perpetrator using still images or video footage much in the way that fingerprint analysis can establish identity using latent prints. However, the applications of FRT extend well beyond forensic uses.

The term “face recognition” is sometimes confusingly misapplied to algorithms that estimate some property of an individual based on analysis of a face image. These include estimation tasks (e.g., how old is this person?); classification tasks (e.g., what sex is this person? does the person smoke?); and a multitude of other aspirational purposes such as emotion or mood determination or disease detection. It is important to make this distinction: Whereas face classification algorithms analyze one image, face recognition algorithms operate by comparing two images, entailing use of entirely different machinery. Moreover, some classification tasks used in the past, such as criminality or sexuality determination, have been debunked and are understood to be unethical pseudoscience. Such nonrecognition face analysis capabilities are not considered in this report.

EXPANDING SCOPE AND SCALE

The technical development of FRT goes back more than 50 years but has accelerated greatly in the past decade with the adoption of deep convolutional neural network techniques from AI, the training of models that extract facial features from large numbers of face images, the curation of increasingly large data sets of facial images (often acquired without the consent of those whose faces are used), and experience gained from industrial adoption and deployment. The term FRT references a large number and variety of face recognition systems that are produced by an array of vendors, each of which uses its own algorithms, data sets used to train the models, and data sets used for comparison.

The acceleration in development, which continues today, has led to deployment in many different applications. FRT is now widely used to unlock smartphones and other personal devices. It is also used increasingly in law enforcement investigations, at international borders, and in airports—as well as in a variety of other government and commercial applications.

Government agencies amass large databases of facial imagery in the process of issuing identity documents such as drivers’ licenses and passports and through the collection of mugshots as part of arrest procedures. Private entities also build databases using images collected from the Internet or on their premises. The boundaries between public and private FRT databases are fluid; law enforcement agencies, for example, regularly make use of databases created by private entities. As a consequence, they can assemble databases of face images and apply FRT to verify identity and make decisions regarding access. Government and commercial databases together make it possible in theory for government agencies to identify a large portion of the U.S. population using FRT.⁴

Although the market for FRT is relatively young and fragmented across a number of smaller vendors, it is growing rapidly. A 2020 industry survey estimated that the market for FRT was about $4 billion, with an anticipated annual growth rate of about 15 percent over the subsequent decade. An industry estimate suggests that by 2030, the global market for FRT will be worth nearly $17 billion.⁵ The technology has become particularly prevalent in law enforcement contexts, with 20 out of 42 federal law enforcement agencies using the technology, according to a 2021 Government Accountability Office report.⁶

In addition to the proliferation of the use of FRT in law enforcement, such systems are increasingly being used at airports and other travel hubs. The Transportation Security Administration (TSA) has now expanded a pilot program to use FRT to verify traveler identity at security checkpoints in 25 airports across the United States.⁷ Meanwhile, Customs and Border Protection has deployed FRT to track travelers exiting the country at 32 airports in the United States, and to track travelers entering the country at every international airport in the country.⁸

Coupled with the expansion of face recognition software and enabling the increasing efficacy of these technologies is the growth of large databases of face images.

___________________

⁴ It is difficult to estimate the precise number of unique database entries available to government agencies, because not all sources are available to or used by any given agency.

⁵ Allied Market Research, 2023, “Facial Recognition Market,” https://www.alliedmarketresearch.com/facial-recognition-market.

⁶ Government Accountability Office (GAO), 2021, “Facial Recognition Technology: Federal Law Enforcement Agencies Should Have Better Awareness of Systems Used by Employees,” https://www.gao.gov/products/gao-21-105309.

⁷ K.V. Cleave, 2023, “TSA Expands Controversial Facial Recognition Program,” CBS News, June 5, https://www.cbsnews.com/news/tsa-facial-recognition-program-airports-expands.

⁸ GAO, 2022, “Facial Recognition Technology: CBP Traveler Identity Verification and Efforts to Address Privacy Issues,” https://www.gao.gov/products/gao-22-106154.

Governments routinely collect large numbers of face images for administrative purposes such as drivers’ licenses and mugshots, and can, where legally authorized, use these images to create very large face recognition reference databases with tens of millions of faces. Meanwhile, private companies have also created very large face reference databases—for example, by collecting billions of images from social media and other websites. Most notably, Clearview AI claims to have collected a database of 30 billion face images (presumably including duplicates and synthetic face images) by collecting images from social media sites.⁹ In the absence of robust privacy protections for face images and other biometric information, government agencies as well as private-sector organizations can use FRT systems that search against these resulting reference databases.

The application of FRT to numerous and growing sources of camera footage is another contributor to the potential scale of use. Conventional security camera footage has long been used by many businesses and in police investigations. With the falling cost of high-quality cameras, networking, and storage, the use of private cameras, such as doorbell-type cameras and cell phone cameras, has increased dramatically in recent years and can provide capture of additional images that can be used for FRT for investigative purposes. Furthermore, many cities have incentivized private security camera ownership,¹⁰ with some offering rebates to cover costs of installing surveillance cameras for the purpose of deterring crime and facilitating criminal investigations. Private video footage is now commonly accessible by law enforcement investigators. As a result, FRT acts as both part of new technologies provided to individuals and law enforcement as well as a technology that can be retrofitted onto existing surveillance structures.

Indeed, there are numerous categories of current or potential use for FRTs. They range from somewhat innocuous uses that pose relatively modest equity, privacy, or civil liberties issues to potential uses that raise significant ethical and legal questions. Although not necessarily comprehensive, this report identifies several categories intended to illustrate this range of current and potential use:

• Law enforcement investigation of a specific lead or criminal act and prosecution.
• Preventive public safety or national security—such as screening for specific individuals known to pose a high risk at a venue or identifying known shoplifters at a retail store.

___________________

⁹ K. Tangalakis-Lippert, 2023, “Clearview AI Scraped 30 Billion Images from Facebook and Other Social Media Sites and Gave Them to Cops: It Puts Everyone into a ‘Perpetual Police Line-Up,’” Business Insider, updated April 3, https://www.businessinsider.com/clearview-scraped-30-billion-images-facebook-police-facial-recogntion-database-2023-4.

¹⁰ Office of Victim Service and Justice Grants, “The Private Security Camera Rebate Program,” Washington, DC Government, https://ovsjg.dc.gov/page/private-security-camera-rebate-program, accessed November 16, 2023.

• In lieu of other methods for verifying identity or presence—such as at international borders and entry/exit points, and to control employee access to workplaces.
• Personal device access.
• Non-opt-in, for commercial and other private purposes—such as retail stores identifying high-value customers.

Chapter 3 describes these categories in more detail and provides illustrative vignettes for each.

BENEFITS AND CONCERNS

FRT is far from the first technology to be used for identification or whose introduction has raised privacy concerns or led to challenges over potentially yielding inequitable outcomes. A number of identification technologies are used in forensic and non-forensic applications, including fingerprint, handprint, iris, and DNA comparison. Video captured by surveillance cameras has long been reviewed by humans to identify potential criminal perpetrators. The location of cell phones, carried by most of the population, can be tracked, and license plate readers can be used to track the movements of motor vehicles. Some of the benefits and concerns raised by FRT are familiar from the earlier technologies, while others are new or heightened by virtue of FRT’s characteristics.

FRT is inexpensive, scalable, and contactless, and it can operate remotely in a covert manner. It allows existing identification tasks to be performed more efficiently than if done manually and enables new identification tasks that would otherwise be impractical. In particular,

• FRT enables the processing of large numbers of individuals quickly. For example, at international entry points, FRT allows arriving passengers to clear passport control very rapidly.
• FRT makes it possible to identify high-risk individuals among large numbers of people entering a location without delaying others. FRT can, for example, be used to screen those entering a concert venue for individuals known to pose a threat to the performers.
• FRT can be a powerful aid for law enforcement in criminal and missing person investigations because it enables investigators to generate leads using images captured at a crime scene. A number of law enforcement agencies have reported successful use of FRT to generate otherwise unavailable leads.

• FRT can be especially convenient as a means of identity verification. For example, FRT allows a smartphone to be unlocked or a payment to be authorized without entering a passcode.

However, there are significant concerns about FRT and the societal implications of its use. These include the following:

• Significant demographic disparities in the performance of FRTs. A number of studies have identified phenotypical disparities (see Chapter 2) and suggest the need for a better understanding of potential biases and disparities in face recognition systems.^11,12,13
  • Drivers of demographics-related performance variation include photography not well adapted to dark skin tones and the under-representation of demographic groups in the training data used to create the models used to extract facial features. Considerable work has been done to understand sources of bias and demographic disparities better and to design robust models and to rigorously evaluate them on large-scale data sets to drive performance improvements.
  • Early FRT systems exhibited significant demographic disparities. Reports of these disparities have led to concerns among civil liberties groups and distrust of FRT in communities already subject to institutional bias and concerns about over-policing.
• Privacy concerns about how face images are collected, used, and retained. For example, some training data sets and reference databases (against which a candidate face image is matched) have been constructed from images scraped from social media and other online sources without any effort to gain consent from those pictured. Although such practices—for example, by Clearview AI—allowed large image databases to be amassed quickly, they have also raised privacy, fairness, and quality concerns. In addition, images captured in real time for recognition create risks of inappropriate data retention, secondary uses, and absent or insufficient opt-out procedures—and raise questions about whether and in what circumstances governments can acquire such information.

___________________

¹¹ K.S. Krishnapriya, K. Vangara, M. King, V. Albiero, and K. Bowyer, 2019, “Characterizing the Variability in Face Recognition Accuracy Relative to Race,” pp. 2278–2285 in 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), https://doi.ieeecomputersociety.org/10.1109/CVPRW.2019.00281.

¹² P. Grother, M. Ngan, and K. Hanaoka, 2019, “Face Recognition Vendor Test (FVRT): Part 3: Demographic Effects,” National Institute of Standards and Technology, https://doi.org/10.6028/NIST.IR.8280.

¹³ K. Krishnapriya, V. Albiero, K. Vangara, M.C. King, and K.W. Bowyer, 2020, “Issues Related to Face Recognition Accuracy Varying Based on Race and Skin Tone,” IEEE Transactions on Technology and Society 1(1):8–20.

• The use of substandard face recognition systems in high-stakes operational environments. While a number of use cases for FRT may have low stakes for potential improper results, such as failing to unlock a personal device, other operational uses can result in serious consequences, such as false arrest and detention. The consequences of error thus vary tremendously by use case, making blanket rules or generalizations about use challenging.
• Impacts on an array of privacy, civil liberties, and equity issues. FRTs are highly personal, uniquely powerful, and potentially extremely intrusive. Opting out of showing one’s face is not a realistic option in most circumstances. If used for real-time surveillance, FRTs can dramatically increase the scope and reduce the cost of collecting detailed information about a person’s movements, activities, and associations. Without responsible guidelines, FRT systems permit easy open-ended collection of face data, even when the collecting institution has no particular person or incident as its focus. With respect to equity, just as unease about disproportionate surveillance in historically disadvantaged communities gives rise to concerns about the inequitable burden on those communities, disproportionate use of FRT would likewise raise concerns about an additional burden.
• Potential risk of differential treatment due to the ease of identification. The low cost of using FRT increases the ease with which persons may be identified for exclusion or rewards in ways that were once practicably impossible. For example, high-end retailers might use FRT to identify wealthy shoppers for preferential treatment or property owners might identify and deny entry to individuals who are not part of a protected class.
• Compounding disadvantages. For example, residents in public housing may be subject to enforcement of minor rules through the use of FRT originally intended to address public safety concerns.
• Mass surveillance, political repression, and other human rights abuses. If applied broadly and without safeguards, FRT allows repressive regimes to create detailed records of people’s movements and activities, including political protests or organizing, and to block targeted individuals from participation in public life. This is not hypothetical; there is evidence of such use in multiple countries.

These concerns stem from an array of related characteristics of the technology, including the following:

• Highly personal. The face is a uniquely individualizing part of the body that is much more visible than other individualizing body parts as fingerprints or iris patterns. FRT can be operated at a significant distance and is inextricably tied to an individual in a way that other techniques, such as cell phone trackers or license plate readers, are not.
• Pervasive. FRT can exploit the large and growing number of images available from cameras operated by governments (e.g., cameras installed on city streets), businesses (e.g., security cameras), and individuals (e.g., doorbell cameras). Moreover, FRT can easily be applied after the fact to stored images and video. It is impossible or at least highly impractical to opt out of collection of face imagery by such devices—in contrast to alternatives such as cell phone tracking or license plate readers, where it is costly but not entirely impractical to opt out.
• Ubiquitous. Many if not most people can be recognized: in the United States most faces are all already in a government database and many people’s labeled faces are available online. The technology is readily available to the private sector as well as to governments.
• Stealthy. It is difficult to detect whether FRT is being used in a given setting and for what purposes.
• Inexpensive. In contrast to human review of camera footage, FRT is automated. Relatedly, the marginal cost of using FRT is very low—unlike, for example, DNA testing, which still has a nontrivial per-use cost.

THE GOVERNANCE OF FACIAL RECOGNITION TECHNOLOGY

FRT raises novel and complex challenges for governance. The complexity arises because many legal and policy questions arise at points ranging from the development of the technology to deployment and use. There are distinct and unsettled legal and policy questions at numerous junctures, and governance of the technology will depend on both where and how FRT is used. Furthermore, the regulation of FRT might take place at different levels of government (i.e., national, state, and local), and at any given level, FRT might be subject to regulation by existing general laws (e.g., those related to intellectual property, privacy, law enforcement), technology specific law or regulation, or both.

Complicating this picture is the fact that, from a societal perspective, FRT is problematic because it impacts a core set of interests related to freedom from state and/or private surveillance, and hence control over personal information. Its use therefore has the ability to interfere with and substantially affect the values embodied in commitments

to privacy, civil liberties, and human rights. Thus, there are multiple legislative and non-legislative approaches aimed at the governance of FRT. The following sections identify some recent efforts directed at the governance of FRT.¹⁴

Facial Recognition Technology Legislation in the United States

In the United States, no federal regulation currently imposes a general constraint on the public or private use of FRT. Several bills have been introduced in Congress to regulate FRT, but so far none have come up for a vote.

At the state level, several states have enacted broader privacy laws to protect biometric information. Illinois became, in 2008, the first state to enact legislation that regulates collection, use, safeguarding, and retention of biometric data.¹⁵ Arkansas, California, Texas, and Washington subsequently enacted similar laws.

At the municipal level, the city of San Francisco became, in 2019, the first U.S. city to ban the use of FRT by its public agencies, including its police department, under its administrative code.¹⁶ Other cities, including Oakland, California, and Somerville, Massachusetts, subsequently passed local ordinances restricting the use of FRT by public agencies. Since then, some have called for a reconsideration of these policies in light of concerns about crime.

Facial Recognition Technology Legislation Outside the United States

Perhaps most notably, the European Parliament recently passed the text of the Artificial Intelligence Act (the AI Act), an extensive and complex statute intended to regulate the development and use of artificial intelligence. The final text of the act had not been released as of this writing, but the act would complement the European Union’s General Data Protection Regulation (GDPR)¹⁷ and the Law Enforcement Directive of the European Union.¹⁸

Within the European Union, countries have also individually moved to regulate FRT. Countries around the world have also taken regulatory or other action on FRT (see Chapter 4).

___________________

¹⁴ See Chapter 4 for additional details about such efforts.

¹⁵ State of Illinois Biometric Information Privacy Act of 2008, Public Act 095-0994, 740 ILCS 14, effective October 3, 2008, https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57.

¹⁶ See City and County of San Francisco, 2019, “Board of Supervisors Approval of Surveillance Technology Policy,” Admin Code Section 19B.2(d), https://sfbos.org/sites/default/files/o0286-19.pdf.

¹⁷ B. Wolford, ed., n.d., “What Is GDPR, the EU’s New Data Protection Law,” Proton Technologies AG, https://gdpr.eu/what-is-gdpr, accessed November 17, 2023.

¹⁸ European Commission, “Data Protection in the EU,” https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en, accessed November 17, 2023.

Non-Legislative Governance Approaches

Many organizations have produced documents that recommend non-legislative governance approaches to the regulation of FRT. Such approaches often promote or identify norms, principles, or best practices that are encapsulated in, for example, codes of conduct, declarations, or guidelines. They may also take the form of directives.

In 2012, the U.S. Federal Trade Commission published a report titled Facing Facts: Best Practices for Common Uses of Facial Recognition Technologies.¹⁹ The report detailed conversations that occurred during a 2011 workshop and coupled these with public commentary collected after the event.²⁰ The report identifies several best practices for FRT system design: (1) maintain reasonable data protection of consumers’ face images and associated biometric data, (2) protect online face images from unauthorized collection, and (3) adopt appropriate retention and disposal practices for images of faces and other biometric data, and consider the sensitivity of information being collected or the sensitivity of the environment in which it is being collected. The report emphasizes transparency and affirmative consent as key factors in enabling consumers to make informed decisions about their data.

In 2017, the National Telecommunications and Information Administration released a report on the best privacy practices for commercial use of FRT.²¹ Recognizing the growing use of the technology, the report emphasized the need for foundational guidelines to govern the use of FRT and application-specific best practices. It called for greater transparency about how and where FRT is being used and for policies to govern the collection, use, and storage of facial template data. In addition, the report offers principles to help organizations design policies to appropriately limit the use of face image data, implement adequate security safeguards, ensure image quality standards for their FRT systems, and develop appropriate procedures for problem resolution and redress.

As FRTs are widely used for criminal intelligence and investigations, in 2017, the National Criminal Intelligence Resource Center created, as part of a collaborative effort with multiple jurisdictions of law enforcement and civil liberties–focused actors, a template for FRT policy creation that focuses on privacy, civil rights, and civil liberties protection.²² The template targets the collection, use, access, management, and destruction of FRT-related data and includes guidelines for accountability and enforcement.

___________________

¹⁹ Federal Trade Commission, 2012, “Facing Facts: Best Practices for Common Uses of Facial Recognition Technologies,” https://www.ftc.gov/sites/default/files/documents/reports/facing-facts-best-practices-common-uses-facial-recognition-technologies/121022facialtechrpt.pdf.

²⁰ Ibid.

²¹ National Telecommunications and Information Administration, 2017, “Privacy Best Practices for Commercial Facial Recognition Use,” https://www.ntia.doc.gov/files/ntia/publications/privacy_best_practices_recommendations_for_commercial_use_of_facial_recogntion.pdf.

²² National Criminal Intelligence Resource Center, 2017, “Face Recognition Policy Template for State, Local, and Tribal Criminal Intelligence and Investigative Activities,” https://bja.ojp.gov/sites/g/files/xyckuh186/files/Publications/Face-Recognition-Policy-Development-Template-508-compliant.pdf.

The template offers clear guidelines to help law enforcement in treating issues related to privacy, civil rights, and civil liberties through policy development and routine evaluation, training, review, and auditing. The effort aims to optimize FRT performance while emphasizing the need for careful and informed human oversight in cases that could particularly impact an individual’s civil liberties.

A similar concern for safeguarding privacy, civil rights, and civil liberties motivated the White House Office of Science and Technology Policy to release a “Blueprint for an AI Bill of Rights in 2022.”²³ The blueprint sets forth principles for the use of automated systems (including FRT): safe and effective systems; protection from algorithmic discrimination, data privacy, notice and explanation; and human alternatives, consideration, and fallback. For each principle, the blueprint sets forth baseline expectations for citizens and offers best practices to ensure that an automated system lives up to the vision of the AI Bill of Rights.

A report published by the Security Industry Association (SIA) builds on previous assemblages of FRT best practices,²⁴ emphasizing transparency, clearly stated purpose of use, human oversight, security, training for users and consumers, and privacy by design. The report offers guidelines for public-sector, private-sector, and law enforcement use of FRTs. It suggests that best practice requires that the best-performing FRT is used, proposing that, in addition to meeting standards set by organizations such as the National Institute of Standards and Technology, FRT users must mitigate against performance variability by employing the best current technology. The report emphasizes the importance of using FRT in a manner that does not discriminate, suggesting that the current highest-performing FRTs have been shown to have equal performance across demographic groups.

The Department of Homeland Security (DHS) recently issued Directive Number 026-11, titled Use of Face Recognition and Face Capture Technologies. The directive reiterates that FRT is “only authorized for use for DHS missions, in accordance with DHS’ lawful authorities” and that it is critical that DHS only use FRT “in a manner that includes safeguards for privacy, civil rights, and civil liberties.” It requires, among other things, that FRT be independently tested and evaluated; that, when FRT is used for verification for non-law-enforcement-related actions or investigations, an opt-out and alternative processing is available; that alternative processing is available to resolve match or no match outcomes; and that FRT “used for identification may not be used as the sole basis for law or civil enforcement related actions, especially when used as investigative leads.”

___________________

²³ Office of Science and Technology Policy, n.d., “Blueprint for an AI Bill of Rights: Making Automated Systems Work for the American People,” https://www.whitehouse.gov/ostp/ai-bill-of-rights, accessed May 23, 2023.

²⁴ Security Industry Association, 2020, “SIA Principles for the Responsible and Effective Use of Facial Recognition Technology,” https://www.securityindustry.org/report/sia-principles-for-the-responsible-and-effective-use-of-facial-recognition-technology.

Furthermore, “any potential matches or results from the use of” FRT are to be “manually reviewed by human face examiners prior to any law or civil enforcement action.”²⁵

ABOUT THIS REPORT

Mindful of the potential uses of FRTs and the associated potential concerns outlined in this chapter, DHS’s Office of Biometric Identity Management and the Federal Bureau of Investigation commissioned this report to assess current capabilities, future possibilities, societal implications, and governance of FRTs. The study committee appointed by the National Academies of Sciences, Engineering, and Medicine, which wrote this report, was tasked with reviewing current use cases; explaining how FRTs operate; and considering the legal, social, and ethical issues implicated by their use. See Appendix A for the full statement of task.

The remainder of this report addresses these issues.

Chapter 2 looks at the current state of FRT, placing today’s state-of-the-art systems in historical context and explaining the relationship of FRT to other emerging technologies such as AI and providing an overview of performance measurement and trends.

Chapter 3 provides an overview of major use cases of the technology. It uses brief vignettes to illustrate both current and potential use cases and some of the potential benefits and concerns they present.

Chapter 4 reviews concerns raised by the use of FRT, particularly with regard to equity, privacy, and civil rights, and examines how these concerns affect the governance of FRT.

Chapter 5 describes policy options and presents the committee’s conclusions and recommendations along with an initial sketch of a risk management framework designed to help organizations think through best practices for different types of use cases.

___________________

²⁵ Department of Homeland Security, 2023, “Use of Facial Recognition and Face Capture Technologies,” https://www.dhs.gov/sites/default/files/2023-09/23_0913_mgmt_026-11-use-face-recognition-face-capture-technologies.pdf.