The Federal Bureau of Investigation has access to as many as 411.9 million images as part of its face-recognition database. The bulk of those images are photographs of people who have committed no crime, according to a new report from the Government Accountability Office (GAO).

The report says the bureau's Facial Analysis, Comparison, and Evaluation Services Unit contains not only 30 million mug shots, but also has access to driver license photos from 16 states, the State Department's visa and passport database, and the biometric database maintained by the Defense Department.

The GAO report, titled "FACE RECOGNITION TECHNOLOGY: FBI Should Better Ensure Privacy and Accuracy," comes nearly two years after the bureau said its facial recognition project graduated from a pilot project to "full operational capability." The facial recognition project is combined with a fingerprint database. Here's how the GAO report summarized the program:

The Department of Justice’s (DOJ) Federal Bureau of Investigation (FBI) operates the Next Generation Identification-Interstate Photo System (NGI-IPS)—a face recognition service that allows law enforcement agencies to search a database of over 30 million photos to support criminal investigations. NGI-IPS users include the FBI and selected state and local law enforcement agencies, which can submit search requests to help identify an unknown person using, for example, a photo from a surveillance camera. When a state or local agency submits such a photo, NGI-IPS uses an automated process to return a list of 2 to 50 possible candidate photos from the database, depending on the user’s specification. As of December 2015, the FBI has agreements with seven states to search NGI-IPS and is working with more states to grant access. In addition to the NGI-IPS, the FBI has an internal unit called Facial Analysis, Comparison, and Evaluation (FACE) Services that provides face recognition capabilities, among other things, to support active FBI investigations. FACE Services not only has access to NGI-IPS, but can search or request to search databases owned by the Departments of State and Defense and 16 states, which use their own face recognition systems. Biometric analysts manually review photos before returning at most the top 1 or 2 photos as investigative leads to FBI agents.

The report, provided to Congress last month but released days ago publicly, faulted the FBI for being lax about privacy and the accuracy of the photos in its database. According to the GAO:

The FBI has entered into agreements to search and access external databases—including millions of U.S. citizens’ drivers’ license and passport photos—but until FBI officials can assure themselves that the data they receive from external partners are reasonably accurate and reliable, it is unclear whether such agreements are beneficial to the FBI and do not unnecessarily include photos of innocent people as investigative leads.

The report, which provided only a few examples of the database solving crime, said that the database was used in investigations involving credit card and identity fraud, bank robberies, violent crime, and other felonies. The GAO report noted a complaint made by Electronic Frontier Foundation in 2012 about the billion-dollar program.

Specifically, according to a July 2012 Electronic Frontier Foundation hearing statement, false positives can alter the traditional presumption of innocence in criminal cases by placing more of a burden on the defendant to show he is not who the system identifies him to be. The Electronic Frontier Foundation argues that this is true even if a face recognition system such as NGI-IPS provides several matches instead of one, because each of the potentially innocent individuals identified could be brought in for questioning. In addition, if false positives are returned at a higher than acceptable rate, law enforcement users may waste time and resources pursuing unnecessary investigative leads. By conducting tests to verify that NGI-IPS is sufficiently accurate for all allowable candidate list sizes—including ensuring that the detection and false positive rates are identified—the FBI would have reasonable assurance that NGI-IPS provides investigative leads that help enhance, rather than hinder or overly burden, criminal investigation work. Even more, the FBI would help ensure that it is sufficiently protecting the privacy and civil liberties of U.S. citizens enrolled in the database.

Jennifer Lynch, an EFF attorney, noted in a blog post that "many of the 411.9 million face images to which FBI has access—like driver’s license and passport and visa photos—were never collected for criminal or national security purposes."

And facial recognition is no crime-fighting panacea, either. It's been found to be biased against African-Americans, and utterly failed in the Boston bombing manhunt.

The FBI, in its reply to the GAO report, said the bureau "has established practices that protect privacy and civil liberties beyond the requirements of the law.

"The FBI fully recognizes that the automated nature of face recognition technology and the sheer number of photos now available for searching raise important privacy and civil liberties considerations. For that reason, the FBI has made privacy and civil liberties integral to every decision from the inception regarding its use of face recognition technology," the bureau added.