House Democrats eye limits on mobile biometric surveillance apps for DHS

The Department of Homeland Security would need to follow stricter guidelines when using mobile biometric applications under legislation introduced Thursday by the ranking member of the House Homeland Security Committee and other Democrats. The Realigning Mobile Phone Biometrics for American Privacy Protection Act seeks to prohibit the use of such technology except for identification at ports of entry, bars DHS from sharing the apps with non-law enforcement agencies, and implements a 12-hour storage limit on data in the apps. The legislation points to the DHS app Mobile Fortify, other mobile identification apps and potential successor apps as the prime targets. If the bill gains ground, DHS would need to remove the technology from any non-DHS IT systems and workflows outside the ports of entry. Mississippi’s Bennie Thompson, the top Democrat on the Homeland Security Committee, said in a press release accompanying the bill’s introduction: “DHS should not be conducting surveillance by experimenting with Americans’ faces and fingerprints in the field — especially with unproven and biased technology. We can secure the Homeland and respect the rights and privacy of Americans at the same time.” The bill’s other co-sponsors are Democratic Reps. Lou Correa of California, Shri Thanedar of Michigan, Yvette Clarke of New York, Grace Meng of New York, and Adriano Espaillat of New York. In written statements, members pointed to concerns around privacy, constitutional violations, civil liberties and the technology’s potential deficiencies. The Army’s top civilian leader said that the service will “kill NIPR” at multiple locations — likely starting next month — in an experiment to see if commercial internet solutions would be more effective. Speaking to soldiers at a town hall at Fort Drum, New York, on Monday, Army Secretary Dan Driscoll said “we’re going to bring you down to the commercial internet and we think it will solve all sorts of problems.” If the evaluation is successful, the Army will scale it across the service, he added. NIPR, which stands for Non-classified Internet Protocol Router, is the military’s communication network for unclassified information. Defense Department personnel can access commercial browsers or email through NIPR, for example, but the network is owned and secured by the military. An Army spokesperson told DefenseScoop that the service is evaluating “a shift” from NIPR to a commercial solution that can handle data at Impact Level 5. IL5 includes Controlled Unclassified Information, according to the Defense Information Systems Agency, which is considered sensitive and necessary to protect, but does not meet criteria for classification. The spokesperson said that the evaluation is intended to “cut costs, boost performance and enhance cybersecurity.” They added that the effort was in coordination with the Pentagon’s Office of the Chief Information Officer, DISA and other military services. The Daily Scoop Podcast is available every Monday-Friday afternoon. If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.