IDENT stores,  searches, matches, and shares fingerprints. DOD  recognized the importance of such interoperability and directed adherence  to internationally accepted biometric standards. As a result, DOD is unable  to automatically transmit information collected by this device, which is  about 13 percent of approximately 4.8 million biometric records  maintained by DOD, to federal agencies, such as the FBI. Third, DOD has not fully defined roles  and responsibilities that specify accountability needed to ensure its  collection devices meet new or updated standards. DOD Has Not Taken Certain Actions Needed to Help Ensure New and Updated Standards Are Implemented

DOD has not taken certain actions necessary to help ensure that its  collection devices adhere to new and updated standards, including not  having an effective process, procedure, or timeline for implementing  updated standards, not routinely testing collection devices at sufficient  levels of detail for conformance to these standards, and not fully defining  roles and responsibilities to ensure accountability. DOD Is Sharing Biometric Information but Sharing Is Limited by the Absence of an Agreement with DHS and DOD’s System Capacity

DOD is sharing its biometric information and has an agreement to share  biometric information with DOJ, which allows for direct connectivity and  the automated sharing of biometric information between their biometric  systems. However, DOD’s ability to optimize sharing is limited by not  having a finalized sharing agreement with DHS, and its capacity to  process biometric information. Currently, DOD and DHS do not have a  finalized agreement in place to allow direct connectivity between their  biometric systems, due to the need for additional reviews of the proposed  agreement by certain DHS officials, among others. DOD is working with  DHS to develop a memorandum of understanding to share biometric  information now scheduled for completion in May 2011; however, without  the agreement, it is unclear whether direct connectivity will be established  between DOD and DHS, which affects response times to search queries. Moreover, the  advancements other agencies make in their biometric systems may  continue to overwhelm DOD’s efforts as it works to identify its long-term  biometric system capability needs and associated costs. DOD’s Biometric System Is Limited in Meeting Demands from Key Federal Agencies’ Biometric Systems

To enable agencies to meet the demand for searching stored biometric  information on their systems, agencies’ biometric systems have varying  system capacities based on their mission needs, which affects their ability  to similarly process each other’s queries for biometric information. DOD officials do not believe that they need to match other agencies’  biometric system capacities because they do not anticipate receiving the  same number of queries given differences in mission. However, DOD and  other agency officials have expressed concern that DOD’s biometric  system is limited in its ability to maximize sharing of biometric  information. For example, DOD has adopted  standards for the collection of biometrics to enhance interoperability with  other key federal agencies’ biometric systems, but at least one DOD device  responsible for the collection of over 600,000 biometric records, does not  meet DOD adopted standards, such as a handheld biometric collection  device used by the Army. Recommendations for Executive Action

To improve DOD’s ability to collect and help ensure that federal agencies  are sharing biometric information on individuals who pose a threat to  national security to the fullest extent possible, we recommend that the  Secretary of Defense direct the Under Secretary of Defense for  Acquisition, Technology, and Logistics, as the Principal Staff Assistant  responsible for the oversight of DOD biometrics, to take the following five  actions in collaboration with other key federal agencies and internal DOD  stakeholders, including BIMA, U.S. Army, U.S. Navy, U.S. Marines, and  U.S. Air Force:  Implement a process for updating collection devices to adopted standards  to help ensure that all DOD systems related to biometrics, including  collection devices, conform to adopted standards. We contacted and obtained information from officials and entities  associated with the collection, storage, use, and sharing of biometric  information across the Department of Defense (DOD), as well as other key  federal agencies, including the Department of Justice (DOJ)/Federal  Bureau of Investigation (FBI), Department of State (State), and the  Department of Homeland Security (DHS).
Why GAO Did This Study

Biometrics technologies that collect and facilitate the sharing of fingerprint records, and other identity data, are important to national security and federal agencies recognize the need to share such information. The Department of Defense (DOD) plans to spend $3.5 billion for fiscal years 2007 to 2015 on biometrics. GAO was asked to examine the extent to which DOD has (1) adopted standards and taken actions to facilitate the collection of biometrics that are interoperable with other key federal agencies, and (2) shares biometric information across key federal agencies. To address these objectives, GAO reviewed documents including those related to standards for collection, storage, and sharing of biometrics; visited selected facilities that analyze and store such information; and interviewed key federal officials.

What GAO Found

DOD has adopted a standard for the collection of biometric information to facilitate sharing of that information with other federal agencies. DOD recognized the importance of interoperability and directed adherence to internationally accepted biometric standards. DOD applied adopted standards in some but not all of its collection devices. Specifically, a collection device used primarily by the Army does not meet DOD adopted standards. As a result, DOD is unable to automatically transmit biometric information collected to federal agencies, such as the Federal Bureau of Investigation (FBI). For example, this device is responsible for 13 percent of the records maintained by DOD--the largest number of submissions collected by a handheld device, according to DOD. Further, this constitutes approximately 630,000 DOD biometric records that cannot be searched automatically against FBI's approximately 94 million. DOD has not taken certain actions that would likely improve its adherence to standards, all of which are based on criteria from the Standard for Program Management, the National Science and Technology Council, and the Office of Management and Budget guidance, respectively. First, DOD does not have an effective process, procedure, or timeline for implementing updated standards. Second, DOD does not routinely test at sufficient levels of detail for conformance to these standards. Third, DOD has not fully defined roles and responsibilities specifying accountability needed to ensure its collection devices meet new and updated standards. DOD is sharing its biometric information and has an agreement to share biometric information with the Department of Justice, which allows for direct connectivity and the automated sharing of biometric information between their biometric systems. DOD's ability to optimize sharing is limited by not having a finalized sharing agreement with DHS, and its capacity to process biometric information. Currently, DOD and DHS do not have a finalized agreement in place to allow direct connectivity between their biometric systems. DOD is working with DHS to develop a memorandum of understanding to share biometric information now scheduled for completion in May 2011; however, without the agreement, it is unclear whether direct connectivity will be established between DOD and DHS, which affects response times to search queries. Further, agencies' biometric systems have varying system capacities based on their mission needs, which affects their ability to similarly process each other's queries for biometric information. As a result, DOD and other agency officials have expressed concern that DOD's biometric system may be unable to meet the search demands from their other biometric systems over the long-term. DOD officials do not believe that they need to match other agencies' biometric system capacities because they do not anticipate receiving the same number of queries given differences in mission. However, the advancements other agencies make in their biometric systems may continue to overwhelm DOD's efforts as it works to identify its long-term biometric system capability needs and associated costs.

What GAO Recommends

To improve DOD's ability to collect and share information, GAO recommends that DOD implement processes for updating and testing biometric collection devices to adopted standards; fully define and clarify the roles and responsibilities for all biometric stakeholders; finalize an agreement with the Department of Homeland Security (DHS); and identify its long-term biometric system capability needs. DOD agreed with all of GAO's recommendations.