An investigation by the Electronic Frontier Foundation has shed new light on an experimental tattoo recognition program run by the Federal Bureau of Investigation, and raised serious questions about the privacy safeguards in place.

The FBI first began developing tattoo recognition systems in 2014, as part of a collaboration with the National Institute of Standards and Technology, but the program is poised to expand dramatically this year. Over the course of the summer, NIST and the FBI will enter a new phase of the project that will test the current tattoo recognition systems at a much broader scale, hoping to compile as many as 100,000 tattoo images from the Michigan State Police, Tennessee Department of Corrections, and Pinellas County Sheriff's Office in Florida.

The tattoo project has two potential uses. A simple recognition system can use individual tattoos to identify specific suspects over time, supplementing fingerprints and simple facial photos. But more sophisticated systems will also be able to identify tattoo patterns that may suggest particular criminal affiliations. Law enforcement agencies already catalog specific tattoos associated with Russian mafia and white supremacist groups, and the FBI believes an automated system might help uncover previously unrecorded associations. "Tattoos provide valuable information on an individual’s affiliations or beliefs and can support identity verification of an individual," one researcher wrote in a NIST whitepaper.

It's that second use case that EFF finds most concerning, potentially standing as a threat to free expression. "Tattoos are free speech that we wear on our skin," the group writes. "Our tattoos express who we were, who we are, and who we hope to be. But when law enforcement looks at our tattoos, they see unique biometric identifiers and a shortcut to learning our personal beliefs and our social connections." If enough criminals have a tattoo of the same symbol, the Tatt-E system might automatically classify that symbol as a gang affiliation, regardless of the cultural meaning behind it.

There are also concerns over how broadly the data is being shared. The EFF's investigation found that more than 15,000 inmate tattoo images were handed over to third-party contractors as a demonstration sample, with little or no restriction on how those photos could be used. The decision was only submitted for external ethical review after the information had already been shared. The result left inmates' tattoos largely unprotected, a situation the EFF describes as "treating inmates as a bottomless pool of free data."