42 U.S.C. § 18934 — Biometrics research and testing

(a) In general. The Secretary, acting through the Director, must run a program to support measurement research informing best practices, benchmarks, methods, procedures, and voluntary, consensus-based technical standards for biometric identification systems, including facial recognition, to assess and improve their performance. In running this program, the Director may: (1) conduct measurement research supporting efforts to improve biometric systems, including conformity assessment, image quality and interoperability, contactless capture technologies, and human-in-the-loop identification processes; (2) work with stakeholders to establish common definitions and descriptions for biometric systems, which may cover accuracy, fairness, bias, privacy, consent, and other properties, considering relevant international technical standards and publications; (3) research and test a range of biometric modalities, such as fingerprints, voice, iris, face, vein, behavioral biometrics, genetics, multimodal biometrics, and emerging applications; (4) study privacy-enhancing technologies and other technical protective controls that could help provide access to public data sets for biometric research; (5) reach out to and coordinate with relevant industry and non-industry stakeholders and standards organizations to help them develop best practices and voluntary technical standards; and (6) develop standard reference artifacts the Director determines are needed to further those voluntary technical standards. (b) Biometrics test program. (1) The Secretary, acting through the Director, must run a test program giving biometrics vendors the chance to test their identification technologies across a range of modalities. (2) In running this program, the Director must: (A) conduct research and regular testing to improve and benchmark the accuracy, effectiveness, and bias of these technologies, which may include testing across demographic variations, capture devices, spoofing detection, partially occluded or computer-generated images, privacy and security controls, template protection, de-identification, and comparisons of algorithm, human, and combined algorithm-human performance; (B) develop an approach for testing software and cloud-based biometrics applications, including remote systems, at Institute test facilities; (C) establish reference use cases for these technologies and performance criteria, including accuracy, effectiveness, and bias metrics, for assessing each one; (D) publish public-facing reports of testing findings for a general audience; (E) develop policies and procedures addressing the legal and social implications of working with a "foreign entity of concern," as defined in section 19221 of this title; (F) set procedures to prioritize testing of biometric technologies developed by entities headquartered in the United States; and (G) carry out any other activities the Director determines necessary. (c) GAO report to Congress. Within 18 months of August 9, 2022, the Comptroller General must submit a detailed report to Congress on how biometric identification technologies affect historically marginalized communities, including low-income communities and minority religious, racial, and ethnic groups. This report must be made public online.