Your tattoo could help police put you in prison and violate your privacy. Here's how.

Imagine a police officer arrests someone with a tattoo. The officer pulls out an iPhone, snaps a photo of the tat, and uploads it to an app. A few seconds later, he has at his fingerprints a database of every other inmate arrested with the same ink, or surveillance video that caught a glimpse of a similar tattoo.

That’s not science fiction. A government-funded research project has developed algorithms capable of identifying and matching tattoos with success rates exceeding 95%, and it’s raising tough questions about privacy and research ethics.

The two-year-long study, which was funded by the FBI, was detailed in a report released today by the Electronic Frontier Foundation, a civil rights advocacy group. The National Institute of Standards and Technology—a research agency that’s part of the federal government—used a dataset of 15,000 images of prisoners’ tattoos to help develop algorithms that can sort through tattoos to glean investigative leads.

About one in five American adults have a tattoo, according to Pew Research Center. “Tattoos are like fingerprints and faces, they’re unique to the person,” Dave Maass, a researcher with the EFF who wrote about the program, told me. They’re also a form of speech and expression.

While technologies that quickly scan, identify, and match images of tattoos may make law enforcement investigations more efficient, they have the potential of profiling innocent tattooed people. Like other “smart policing” tech that tries to predict where crime occurs, the way these algorithms are used could violate defendants’ rights. The presence of a certain tattoo could be seen an indicator of guilt.

The way the research was conducted is also concerning. The 15,000 images of tattoos came from prisoners and arrestees who—as far as we know—never gave their consent. Some of the tests specifically focused on religious tattoos, like crosses. And researchers apparently only received approval to use the inmate images retroactively.

Now, the agency is planning to start a new phase of the project with 100,000 tattoo images.

The project, which began in 2014, started with the tattoo database from the FBI. Then the NIST shared the database with 19 organizations: five research institutions, six universities, and eight private companies. The groups were invited to fine-tune algorithms that could turn the database into findings that law enforcement investigations could use.

Some algorithms match a tattoo to a person. If security camera footage caught a robbery suspect wearing a mask, his tattoo might identify him. Other algorithms matched tattoos of multiple people, helping show associations between them. This could be used to identify gang members with the same tat. Many of the algorithms developed had over 90% success rates.

But if used in actual investigations, it could lead to profiling and false positives. Just because someone has a tattoo that is similar to ones worn by certain gang members doesn’t mean that they’re also a gang member, or that they’ve committed any crime. Already in California, tattoos are one factor that has led people to be erroneously added to a database of gang members.

Tattoos have also been a factor in immigration decisions. Several Mexican immigrants to the U.S. have said their applications for visas were denied because they had what the State Department believed were gang-related tattoos.

The methodology of the NIST research program also raises ethical questions. It’s unlikely researchers were granted permission from the inmates, and there was no documentation in any of the materials the EFF reviewed, publicly or through freedom of information requests. “They really are treating prisoners like they’re an exploitable database,” Maass said.

While the database was stripped of personal information like inmates’ names, the images themselves seem to contain personal data. One photographed tattoo was an inmate’s child’s name and date of birth, while another was the inmate’s mother’s face and her full name.

Another concern with the technology—especially as it is developed by private companies—is that it might be sold to oppressive governments around the world. In countries where Christians are persecuted, for example, officials could run a database of tattoo photos through an algorithm to create a list of all inmates who have tattoos of crosses or the Virgin Mary. Then they could give the Christians selective punishments.

One of the private companies involved in the research, MorphoTrack, put out a press release touting its success in the competition. “Prior to MorphoTrak’s work in this area, investigators had to rely on text keywords to find tattoos that were similar in appearance,” the company’s president, Celeste Thomasson, said in the release. “Our continuously improving tattoo recognition algorithm takes the criminal justice, forensic investigation, and public security communities one step closer to a high-performance automated tattoo recognition solution.”

NIST spokesperson Gail Porter defended the program. “The goal of the NIST project is to help ensure tattoo matching technologies are evaluated using sound measurement science to improve accuracy and minimize mismatches,” she said in a statement. “The database contains images only, with no accompanying information on the individuals whose tattoos were photographed.”

The organization has argued in the past that the technology won’t just be used to lock people up. One online report about the project notes that tattoos “are potentially valuable in supporting identification of victims of mass casualties such as tsunamis and earthquakes.”

In the next phase of its tattoo research project, which will begin this summer, NIST investigators will test algorithms on more than 100,000 images of tattoos collected from inmates of three jurisdictions: the Pinellas County Sheriff’s Department in Florida, Michigan State Police, and the Tennessee Department of Corrections.

Maass and the EFF say the next phase of the project should be shut down before it begins, due to the ethical questions that have already come up.

“This technology isn’t hypothetical, it exists and it’s in use,” Maass said.