Facial recognition is fundamentally different from other types of searches, the authors contend—and not just because it makes it easy for police to track people by their physical features, rather than by keeping an eye on their possessions and technology, like a smartphone, a house, or a car.

For one, it allows officers to track large groups of people who aren’t necessarily suspected of committing a crime. Courts haven’t determined whether facial recognition constitutes a “search,” which would limit its use under the Fourth Amendment, so many departments use it on the public indiscriminately. (This is true also for technologies that track a smartphone’s location, for example.)

What’s more, in order for a facial-recognition system to work, there needs to be a database for it to check against. If a police agency wants to know that the guy caught holding up a bank in a surveillance photo is John Doe, it needs to already have a photo of John on file. If the surveillance footage is good enough, the recognition algorithm can then determine the probability that the face in the photo is the same as the one in John’s driver's license portrait.

For it to be possible to identify people this way requires importing many millions of ID photos of innocent people into lookup databases. According to the report, 80 percent of the photos that appear in the FBI’s facial-recognition network are of non-criminals. Only 8 percent show known criminals.

“Never before has federal law enforcement created a biometric database—or network of databases—that is primarily made up of law-abiding Americans,” the report says.

Many of the various local and state police departments that have access to these databases have few checks on how they use them. Only five states have any laws that touch on how law enforcement can use facial recognition, and none of them take on more than one aspect of the issue, the report found.

That means that some departments have gotten away with patently absurd uses of the technology: In Maricopa County, Arizona, the sheriff’s office—led by a famously combative and anti-immigrant sheriff—downloaded every driver’s license and mugshot from every resident of Honduras, provided by the Honduran government, to its facial-recognition database.

Departments that use the technology in a more straightforward way can still be stymied by the inaccuracies and biases that often plague facial-recognition algorithms. They’ve been found to perform more poorly on African-American faces than on other races, which can make it more likely that a system will misidentify an innocent black person as a suspect. And because African-Americans are disproportionately likely to be arrested—and thus show up in mug-shot databases—systems that use booking photos will be more likely to flag an African-American face than a caucasian one.