You can't refuse to be scanned by ICE's facial recognition app: DHS document