ICE's Face Scan App Made a Mistake. Twice

When authorities used Immigration and Customs Enforcement’s (ICE) facial recognition app on a detained woman in an attempt to learn her identity and immigration status, it returned two different and incorrect names, raising serious questions about the accuracy of the app ICE is using to determine who should be removed from the United States, according to testimony from a Customs and Border Protection (CBP) official obtained by 404 Media.

ICE has told lawmakers the app, called Mobile Fortify, provides a “definitive” determination of someone’s immigration status, and should be trusted over a birth certificate. The incident, which happened last year in Oregon, casts doubt on that claim.

“ICE has treated Mobile Fortify like it’s a 100% accurate record retrieval system of everybody’s immigration status for the entire population of the U.S. when this is obviously not true, and could never be true from a technical perspective,” Cooper Quintin, a security researcher and senior public interest technologist at the Electronic Frontier Foundation, told 404 Media. “It is sickening that ICE is using this flawed app and unacceptable invasion of biometric privacy to supposedly determine whether someone is undocumented and deport them or even worse.”

SPONSORED

Take Your Private Info Off The Market Right now, hundreds of data brokers are profiting from your private life—selling your home address, phone number, and family details to anyone with a credit card. This isn't just an invasion of privacy; it's a security roadmap for stalkers, scammers, and identity thieves. It is time to fight back with DeleteMe. We don't just "monitor" the problem; our privacy experts manually oversee the removal of your data from the web’s most intrusive people-search sites. While brokers spend 24/7 trying to expose you, DeleteMe spends 24/7 scrubbing your digital footprint to ensure your information stays off the search results for good. Stop being a product for data brokers. Protect your family from doxxing, harassment, and relentless spam. Use code 404Media for 20% off DeleteMe. Get 20% off here

The incident involved a 45-year-old woman who court records call MJMA. She was detained with more than 30 other people during a raid in Woodburn after authorities smashed a van’s driver side window and pulled her from the vehicle. MJMA is now suing ICE and being represented by attorneys from the Innovation Law Lab.

Oregon Live briefly mentioned the face scan in a December report. 404 Media has now obtained the CBP official’s full testimony.

The CBP official, called MK in the transcript, said she was trying to determine the woman’s immigration status. MJMA was refusing to answer questions.

“So then, in order to [...] to use another tool that I had to identify her, I took my government cell phone out of my pocket. It has the little facial recognition mobile query for CBP. And I took a photo [...] I tried to take a photo of her face, and she looked down,” MK said. Another part of the transcript specifically names Mobile Fortify.

“So then I remember I moved her shoulder back. And she complained because I did forget she had handcuffs on and [...] like, behind her back. And she kind of, like, yelped, like if I had caused pain, like a lot of pain. So then I apologized. I said (speaking Spanish), which is 'I'm sorry,' (speaking Spanish),” she continued.

MK said she explained to the woman she needed to take her photo. “So I took her photo, where she kind of looked at me. And then when I looked down at my mobile query, it came up to a very [...] like, a similar person. I wasn't sure if it was her or not.”

A screenshot of the testimony.

The first name the app returned was Maria, according to the testimony. “It matched to someone [...] I remember saying, ‘Maria? Like, is this Maria?’ And then at that point there was other ICE agents around me. So they were like ‘Maria, Maria,’ to see if she would respond because, again, she was refusing to talk to us, which is her right.”

After MJMA did not respond, either verbally or nonverbally with a change in her face, the CBP official scanned her face again. This time, Mobile Fortify gave a different name.

“And then I tried taking her photo again, and this time it came up to someone else. I can't recall the name, but we used that name as well, ‘Are you this person?’ She looked at us. Like, I remember her eyebrows kind of like [...] like, ‘Who are you talking about?’ She gave us that look,” MK testified.

MJMA again didn’t respond verbally, and instead crunched her eyebrows, according to the testimony. “And so then we were like, ‘Well, I don’t know. Possible.’,” the CBP official said.

A screenshot of the testimony.

Stephen Manning, executive director at Innovation Law Lab, told 404 Media both of the names Mobile Fortify returned were incorrect. 

“The app returning different names for the same individual shows that it’s not reliable or accurate and shouldn’t be used in the field,” Homeland Security Ranking Member Rep. Bennie G. Thompson told 404 Media in a statement. 

Oregon Live reported that after authorities moved MJMA to an ICE detention center in Tacoma, they released her the next day without any conditions. She is suing to assert her Constitutional rights, according to Innovation Law Lab. In her own testimony, MJMA said she was issued a B-2 visa, which is a tourism visa, and last entered the U.S. with it last January. Manning said that MJMA is seeking asylum.

“My job is to give people digital security advice and there is no advice I can give on this because you can’t change your face, and if you don’t submit to their demands ICE has demonstrated that they are willing to shoot you,” Quintin added.

404 Media first revealed the existence of Mobile Fortify in June based on leaked ICE emails. Since then 404 Media has obtained a user guide for the tool which explained the databases and images it uses; showed that both ICE and CBP officials are using the app around the country; and found the Department of Homeland Security (DHS) launched a version of the app for local law enforcement called Mobile Identify. That app was taken down from the Google Play Store in December.

Mobile Fortify uses CBP systems ordinarily used to verify travelers as they enter the U.S., according to the leaked material. The app turned the capability inwards onto American streets. In partnership with Reveal, 404 Media reported the app has been used against U.S. citizens.

404 Media previously obtained an internal DHS document under the Freedom of Information Act which showed ICE does not let people decline to be scanned by Mobile Fortify.

Last week a group of Democratic lawmakers introduced legislation, written by Rep. Thompson, that aims to rein in Mobile Fortify. That legislation would essentially kill the local law enforcement version of the app, restrict use of Mobile Fortify to points of entry into the U.S., and force DHS to delete images of U.S. citizens after 12 hours.

Rep. Thompson previously told 404 Media, “ICE officials have told us that an apparent biometric match by Mobile Fortify is a ‘definitive’ determination of a person’s status and that an ICE officer may ignore evidence of American citizenship—including a birth certificate—if the app says the person is an alien.”

Inaccuracy has long been a concern of facial recognition systems, and mistakes have led to innocent people being detained or charged with crimes. When facial recognition tools do make mistakes, it is often against people of color. 

“For over a decade, researchers have shown that facial recognition is a flawed technology that performs particularly poorly on women of color. Using it to determine a person’s status is inviting misidentifications and false positives,” Chris Gilliard, a privacy researcher, told 404 Media. “The willful use of such an error-prone technology suggests that the appearance of a process is more important than accuracy or fairness.”

“This is the logical extension of a landscape that promotes facial recognition as a tool for seemingly harmless purposes like fast food drive throughs or unlocking your phone,” he added.

CBP acknowledged a request for comment but did not provide a response in time for publication.

In another piece of testimony, this time from an ICE deportation officer called DR in the court records, the judge asked “what’s the rate of identification with Mobile Fortify?”

DK replied, “I [...] I can’t speak to that number.”