A facial recognition database compiled by the FBI has more than 400 million images to help criminal investigations, but lacks adequate safeguards for accuracy and privacy protection, a congressional audit shows.

The huge database -- which enables investigators to search images to match those of criminal suspects -- "is far greater than had previously been understood" and raises concerns "about the risk of innocent Americans being inadvertently swept up in criminal investigations," said Senator Al Franken, who requested the study.

"I will be asking tough questions about the FBI's use of facial recognition technology," the Minnesota senator said as he released the Government Accountability Office report on Wednesday.

The FBI's database of 411 million photos includes some 30 million criminal mugshots and 140 million images from visa applications by foreign nationals, the GAO found.

It also contains drivers' license pictures from 16 US states and 6.7 million photos from the Defense Department's biometric identification system of individuals detained by US forces abroad, among others.

The system enables the FBI to use pictures of unidentified people to determine if they are being sought in criminal investigations, and can also assist local law enforcement agencies.

But the FBI has failed to adequately assess the system's accuracy for its own images and those held by other agencies, the audit found.

"The FBI should better ensure privacy and accuracy," the report said.

The agency has not done enough to protect against "false positives," which can prompt the authorities to target innocent people, the GAO said.

"FBI officials stated that they have not assessed how often (the system's) face recognition searches erroneously match a person to the database," the report said.

"The accuracy of a system can have a significant impact on individual privacy and civil liberties," it added, saying that the false positive rate should be analyzed "prior to the deployment of the system."

"The report shows that the FBI hasn't done enough to audit its own use of facial recognition technology or that of other law enforcement agencies that partner with the FBI, nor has it taken adequate steps to ensure the technology's accuracy," Franken said.

- Worrisome impact -

Civil liberties advocates said the report was worrisome.

Alvaro Bedoya, who heads the Center on Privacy & Technology at Georgetown University's law school, called the report "startling," saying it revealed that facial recognition is being used on a much larger scale than had been disclosed.

"They've done this without any judicial oversight, without any audits, without any statutes that rein in their work," he said.

"We don't know if it's been misused and the people subject to this don't know they were a part of it. It's a breathtaking exercise of an extraordinarily powerful technology with little to no oversight."

Jennifer Lynch of the Electronic Frontier Foundation agreed.

The report shows the FBI "has access to hundreds of millions more photos than we ever thought -- and the bureau has been hiding this fact from the public, in flagrant violation of federal law and agency policy, for years," she said.

The database contains "an unprecedented number of photographs, most of which are of Americans and foreigners who have committed no crimes," she added.

Jay Stanley of the American Civil Liberties Union said errors "mean random people could be falsely identified as potential criminals and find themselves coming under the FBI's powerful investigatory microscope."

This "could be not only invading people's privacy, but also exposing them to accusations of wrongdoing," he said in a blog post.

The Justice Department, the FBI's parent agency, responded to the report saying the GAO "does not fully appreciate the nature of its face recognition service for investigative leads."

The FBI program "proceeded carefully and deliberately" and followed its privacy guidelines, operating "in strict compliance with state and federal law," it added.

The GAO's report noted that the program -- which became fully operational in April 2015 following a pilot program launched in 2011 -- has already been used to apprehend a bank robbery suspect and helped identify a sex offender who had been a fugitive for nearly 20 years.