Audit · 01

DHS/USSS/PIA-034 — “HELIX”

The Secret Service published a privacy assessment for a facial recognition system that operates around the White House and on adjacent public sidewalks. I read all sixteen pages. Here is what does not hold together, what does, and what I could not determine.

Six findings

1. The one risk rated fully “mitigated” is contradicted by the document’s own technical pages

Page 14“This risk is mitigated. All facial recognition occurs within HELIX. Facial recognition is only performed based on known persons of interest.”

Page 6“Facial image templates created from surveillance video or uploaded photographs.”

Page 3“HELIX includes facial recognition capabilities that convert facial images into templates, compare those templates against U.S. Secret Service image galleries.”

Page 14 reads as a limit on whose face is scanned. Page 3 describes the direction of the comparison: the template is made from the video, and the gallery is what it is measured against. On that description the person-of-interest list is the reference set, not the gate.

The document never states which faces in a frame are converted into templates, or what becomes of a template belonging to someone who matches nothing. Page 8 assigns biometric data a one-year retention and draws no distinction between templates that matched and templates that did not.

Whether your face becomes a biometric record when you walk down a public sidewalk is the single most consequential fact about this system, and the document answers it two different ways.

2. “Strictly limited (30 days)” rests on a schedule containing two other numbers

Page 13“Video retention is strictly limited (30 days) and biometric data retention is limited (1 year), with automatic overwrite, so persistent tracking is constrained by design.”

Page 8“… unless there is a designated protective event need, litigation hold, or investigative activity warranting further record retention … Records of people of interest will be maintained as long as required.”

Page 8 cites the governing authority by number: National Archives schedule DAA-0087-2014-0001. That schedule is public. It provides:

• Raw camera feed — “Destroy immediately after 30 days by overwriting with new data.” The 30-day figure is real, authorized, and correctly described.
• Recordings relevant to an investigative inquiry — destroy “3 years after the date the specific event or occurrence was first recorded; or when no longer needed … whichever is later.”
• Recordings associated with a highly unusual incident — final disposition: Permanent.

Thirty days is the branch that applies when nobody is looking at you. The other two branches are reachable only by opening a schedule the document cites by number and does not link.

3. DHS wrote the audit question and left most of it unanswered

Page 12 — the question, as printed on their form“How does the Component ensure that personally identifiable information is used appropriately? (Include whether the project conducts self-audits, third party audits, reviews and if there may be automated tools to indicate when information is possibly being misused.)”

Page 12 — the answer, in full on this point“The U.S. Secret Service uses a combination of policy, training, access controls, and system auditing… System activity in HELIX, such as user logins and certain data access or export actions, is logged and subject to review.”

The words “third party” appear nowhere in the answer and nowhere in the fifteen printed pages. No cadence, no owning office, no count of reviews, no named misuse-detection tool.

This is not an outside standard imposed on DHS. Their own template asked the question.

4. The notice credited with disclosing facial recognition never uses the word

Page 9“This Privacy Impact Assessment and the applicable System of Records Notice (DHS/USSS-004…) inform the public that the U.S. Secret Service uses video surveillance, facial recognition, license plate reader technology…”

That notice is public — 85 FR 64519, October 13, 2020. Its biometrics entry reads: “biometric identifiers and profiles based on biometric attributes to include fingerprint and voiceprint.”

Search that notice for “facial.” Zero. “Template.” Zero. Anyone can repeat this in a browser in under a minute.

Stated narrowly, because the list says “to include” and is therefore not closed, and because page 11 refers to other notices “as appropriate” without naming them. The point is only that the notice DHS credits does not name the capability.

5. No vendor, no algorithm, no country of origin, no error rate

Page 14“The U.S. Secret Service configures thresholds, galleries, and use parameters for facial recognition and analytics and approves all software used in HELIX prior to operational deployment.”

So a threshold exists and an approval gate exists. Across sixteen pages neither the threshold value, the vendor’s name, its country of incorporation, the algorithm version, nor any NIST Face Recognition Technology Evaluation result appears. The document’s only performance claim is that HELIX identifies threats “more… accurately” (page 8). That is quantified nowhere.

Operational security plainly covers a threshold number. It does not cover who wrote the software or where they are incorporated.

6. The remedy for a false match expires eleven months before the false match does

Page 14“Video itself remains an unaltered factual record; analytic outputs can be reassessed against the underlying footage if questions arise.”

Page 8“HELIX retains video records for thirty (30) days and biometric data for one (1) year.”

If a similarity score misidentifies someone, the footage that would resolve it can be gone on day 31 while the score persists for a year. Page 10 states individuals receive no individualized notice. Page 11 states law enforcement exemptions may block access and amendment.

What this document gets right

Five questions, each answerable with a document or a number

1. Vendor and provenance. Identify by vendor name, product name and algorithm version every facial recognition and video analytics product operating in HELIX; the vendor’s country of incorporation and the country the algorithm was developed in; the contract number and USASpending award identifier; and whether each algorithm has been submitted to the NIST Face Recognition Technology Evaluation. If never submitted, state that.
2. Threshold and measured accuracy. State the similarity-score threshold used to generate a candidate list, when it was last changed, and who approves a change. Provide true-match and false-match rates for HELIX as deployed, disaggregated by skin tone, sex and age band. If no such testing has been done on the deployed configuration, state that plainly.
3. The Question 14 gap. Has any entity outside the Secret Service — DHS OIG, GAO, the DHS Privacy Office, a contracted assessor — audited HELIX’s facial recognition use or its access logs? Provide report numbers and dates, the access-log review cadence and owning office, the number of reviews completed, and how many produced a misuse referral. Name any automated misuse-detection tool; if none, state that.
4. How many faces are templated. Does HELIX generate a facial template for every detectable face in ingested video, or only for faces matching a gallery entry? Provide the number of templates generated in the most recent full calendar month, the number of individuals in the person-of-interest gallery, the number of candidate lists produced, and how many led to a corroborated identification. State what happens to a template that matches nothing, and how long it is kept.
5. Retention past day 30, and recipients. State the volume of HELIX video retained beyond 30 days, broken out by which exception was invoked. Question 9 checks only “Within the Component/Office” while pages 7, 12 and 13 each describe disclosure outside the Secret Service — provide the number of external disclosures since the system became operational, by recipient category, citing the routine use relied on for each. If no such disclosures have occurred, state that.

What I checked that turned out to be nothing

Publishing the misses is the point. A finding list without a kill list is advocacy, not an audit. Each of these looked like something and was not:

• “DHS conceals that it films public streets.” False — disclosed directly at pages 6 and 7.
• “DHS claims the risks are solved.” False — four of five are “partially mitigated”; three say full mitigation is impossible.
• “No retention authority is cited.” False — five schedules by number, with footnote links. I opened them.
• “The Federal Register citation is wrong or the link is broken.” False — 85 FR 64519 is correct; I retrieved the notice.
• “The National Archives URLs are dead or fabricated.” False — every printed URL resolves.
• “‘Automatic overwrite’ is an unsupported technical claim.” False — the schedule says exactly that.
• “HELIX captures audio or Social Security numbers.” False — expressly denied three times.
• “Facial recognition output can trigger enforcement on its own.” False — the document affirmatively forbids it.
• “The statute on restricted buildings does not cover drones.” False — 18 U.S.C. 1752 does, and the document describes it accurately.
• “DHS says the Privacy Act does not apply to HELIX.” Overstated and dropped. The document says video is generally not retrieved by personal identifier, and concedes coverage once outputs are collated into records that are. Whether a facial template is an “identifying particular assigned to the individual” under 5 U.S.C. 552a is a contestable legal question, not a contradiction, and it is put as question 4 above rather than asserted here.
• Case-law citations initially drafted in support of the Privacy Act point were removed unverified. The statutory text was confirmed from two sources; the judicial gloss was not. That is the same standard this campaign asks of everyone else.

What this audit cannot establish

1. I audited a description, not a system. Every fact here is DHS’s own account of DHS’s own system. No access to code, configuration, galleries, logs or contracts. If the document is inaccurate about HELIX, nothing here would reveal it — and if HELIX is better governed than the document conveys, nothing here would reveal that either.
2. A contradiction proves a drafting failure, not an operational one. That pages 6 and 14 disagree about whose face is templated establishes the document cannot answer the question. It does not establish which answer is true.
3. Nothing here is measured. No accuracy rate, no false-match rate, no demographic differential, no volume retained past day 30, no count of disclosures. Those numbers would settle most of these findings and none are public. That is why the section above is questions rather than conclusions.
4. Absence in a privacy assessment is not absence in the government. There may be FISMA assessments, an authorization package, or Inspector General work that no assessment of this kind would list. The finding is that the public cannot tell — not that no oversight exists.
5. This is one document, dated July 29, 2026. A revised notice or a later report would change several findings.

This is not a new position. It is P-09, adopted before I opened this file: AI systems used in public programs get audited by an auditor the public pays — state-auditor style, not one the vendor selects.