While limited  occasional direct sharing of DOD and DHS biometrics has occurred, it is  not regularized. However, even within departments, there may not be policies to ensure  that officials in different parts of the organization are aware of or have  access to biometrics data that are collected by others. DOD Collection, Matching, and Sharing of Biometrics Data

During DOD field activities, such as those in Afghanistan and Iraq, U.S.  forces collect biometrics data for a variety of purposes, such as to control  access to U.S. bases in order to protect personnel and to identify and  verify non-U.S. persons that they encounter. DOD Has Issued Limited Guidance for Collecting Biometrics Data

The Biometrics Task Force has not issued guidance specifying a standard  set of biometrics data that would allow for comparison of newly collected  biometrics data with existing biometrics data in the field. Having a  standard set of biometrics data would help ensure consistent identification  and confirmation of an individual’s identity thus allowing forces to  compare data across multiple databases in different commands and to  determine whether individuals should be detained. As a result, some units may collect  fingerprints and facial photos, while others may collect only iris images,  even though they are all using devices that can collect the same types of  biometrics. The lack of comparable data also has implications for broader national  security issues. Thus, military personnel collecting only iris images may be unable to  identify someone who has harmed or attempted to harm U.S. or coalition  forces. Persons through Interagency Agreements, but Some Gaps in Data May Remain

DOD shares biometrics data that it collects on non-U.S. persons with other  federal agencies through a variety of interagency agreements, but some  gaps in data sharing may remain. Despite the sharing agreements, a DHS  memorandum indicates that DHS does not regularly receive certain types  of data from DOD. DHS officials stated that this information could  potentially be used to carry out DHS’s national security mission. Since the events of September 11, 2001, the President and Congress have  issued broad policies that require federal agencies to share  counterterrorism information, and federal agencies have in turn issued  their own policies. A January 2007 Deputy Secretary of Defense  memorandum called for DOD to immediately adopt the practice of sharing  unclassified DOD biometrics data records with other U.S. departments and  agencies that have counterterrorism missions, including data related to  terrorism information defined in the Intelligence Reform and Terrorism  Prevention Act regarding terrorists, detainees, and those individuals or  groups posing a threat to the United States, U.S. persons, or U.S. interests,  but excluding data pertaining to U.S. persons, defined as U.S. citizens and  aliens lawfully admitted for permanent residence. According to DHS,  these data could be used to (1) prohibit individuals from entering the  United States who are determined to be inadmissible based on these data  and other relevant information, (2) detain individuals for law enforcement  reasons if needed, or (3) provide additional information about refugees  and their potential eligibility to enter the United States. Opportunities to reduce gaps in our security  through comprehensive data sharing may be lost unless remaining needs  for biometrics data are appropriately filled. Additionally, we recommend that until a formalized, governmentwide  biometrics data-sharing architecture is implemented, the Secretaries of  Defense and Homeland Security, in consultation with other federal  agencies, such as the FBI and DOS, determine if biometrics information  sharing needs are being met and address, as appropriate, any biometrics  data-sharing gaps that may exist, in accordance with U.S. laws and  regulations and international agreements, as well as information sharing  environment efforts. As such, this public version of the For Official Use  Only report was sent to DOD for comment. Moreover, DOD acknowledges this risk in its comments, stating that DOD  officials want to continue to rely on the commanders’ judgment on the  biometrics to be collected during military operations in the field, including  hostile environments.
Why GAO Did This Study

The events of September 11, 2001, and operations in Afghanistan and Iraq have made it critical for military units to identify individuals they encounter and share this information with other units and federal agencies. Biometrics are unique personal aspects such as fingerprints and iris images used to identify an unfamiliar person. Federal agencies with national security missions, such as the Departments of Homeland Security (DHS) and State (DOS), need access to certain biometrics data gathered by the Department of Defense (DOD). GAO was asked to determine to what extent (1) DOD has guidance on the biometrics data to be collected to support military activities, and (2) there may be gaps in biometrics information shared between DOD and DHS. This is a public version of a For Official Use Only report, GAO-08-430NI , issued in May 2008. GAO examined DOD's guidance for field collection of biometrics data, biometrics sharing agreements, and information on national level efforts to enhance data sharing.

What GAO Found

DOD has issued guidance on the biometrics data collected from individuals who are detained or allowed access to U.S. bases in Iraq, but has not issued guidance on data to be collected during field activities where U.S. forces encounter hostile or questionable individuals such as in Afghanistan and Iraq. DOD has allowed commanders to determine the type of data to collect, such as fingerprints or iris images, during their operations. GAO's analysis showed that allowing for this flexibility results in the collection of different data that are not necessarily comparable to each other. Some units may collect iris images while others collect fingerprints, which are not comparable data. Broader national security implications can arise, such as military personnel's inability to identify someone who has harmed or attempted to harm U.S. or coalition forces. These newly collected data are not necessarily comparable with data collected by other units or with federal databases that store biometrics data, such as the FBI's fingerprint database, DOD's biometric database, or the DHS biometric database. Having a standard set of data would help ensure consistent identification and confirmation of an individual's identity thus allowing forces to compare data across multiple databases in different commands. A standard set of data also would allow for comparison of new biometrics data collected in the field with existing biometrics data. DOD shares biometrics data that it collects on non-U.S. persons with other federal agencies through a variety of inter-agency agreements, but some gaps in data sharing may remain. Since the events of September 11, 2001, the President and Congress have issued policies that require agencies to share counterterrorism information, and agencies have in turn issued their own policies. National efforts to develop policies about such information sharing are still in development. In January 2007, the Deputy Secretary of Defense issued a memo that stated that DOD would immediately adopt the practice of sharing, when asked, unclassified DOD biometrics data records with other U.S. agencies that have counterterrorism missions--this includes data related to terrorism information but excludes data pertaining to U.S. persons. According to a DHS memorandum, DHS is not regularly receiving updates on certain types of DOD biometrics data that it could use. DHS officials told GAO they could use such data in various ways, such as to prohibit individuals from entering the United States who are determined to be inadmissible based on these data and other relevant information. GAO found that DHS officials are consulting with DOD on how to obtain additional biometrics data from DOD. Until national level policies are developed, opportunities to reduce gaps in national security through comprehensive data sharing may be lost unless remaining needs for biometrics data are identified and filled as appropriate and in accordance with U.S. laws and regulations and international agreements.