London Police Move Forward With Full-Time Deployment Of Facial Recognition Tech That Can't Accurately Recognize Faces

from the don't-let-the-fact-that-it-doesn't-work-stop-you dept

The London Metropolitan Police sure loves its facial recognition tech. But it's an unrequited love. The tech doesn't appear to have done anything for the Met during its past deployments.

Documents obtained by Big Brother Watch in 2018 showed the Met's deployments had rung up a 98% false positive rate in May of that year. Nothing improved as time went on. Subsequent documents showed a false positive rate of 100%. Every "match" was wrong. Not exactly the sort of thing you want to hear about tech capable of scanning 300 faces per second.

This followed an earlier report covering a test run by the South Wales Police at a handful of public events. In comparison, the South Wales tests were a success: a mere 92% of its matches were false positives.

The Met's tech showed some slight improvement in 2019, moving up to a 96% false positive rate. This continued failure to recognize faces -- along with a number of privacy concerns -- prompted a UK Parliamentary Committee to call for an end of the use of facial recognition tech by UK government agencies. This advice was ignored by the Home Office, which apparently believed UK law enforcement would be able to fail upwards towards a brave new world of facial recognition tech worth the money being spent on it.

We've apparently reached that inflection point. Test runs are a thing of the past. It's time for Londoners to put their best face forward.

British police are to start operational use of live facial recognition (LFR) cameras in London, despite warnings over privacy from rights groups and concerns expressed by the government's own surveillance watchdog.

First used in the capital at the Notting Hill carnival in 2016, the cameras will alert police when they spot anyone already on "wanted" lists.

"The use of live facial recognition technology will be intelligence-led and deployed to specific locations in London," the city's Metropolitan Police said in a statement.

"Intelligence-led," says the agency that has so far only managed to incorrectly identify people almost 100% of the time. There's more "intelligence" further on in the article when the Met says the software that's hardly managed to correctly identify people will help "identify and apprehend suspects." Gun and knife crime top the list of things expected to be curtailed by unproven tech, followed by the sexual abuse of children and "protecting the vulnerable."

Also lol a bit at this, which uses a trite phrase made even triter by the abysmal performance of the Met's AI:

Metropolitan Police Assistant Commissioner Nick Ephgrave said in a statement: "We are using a tried-and-tested technology, and have taken a considered and transparent approach in order to arrive at this point."

He's technically correct. It's has been tried and tested. What it hasn't been is accurate and that's what counts most when people's rights and freedoms are on the line. But better an unknown number of innocent people be misidentified than allow a single suspect to go unscanned, I guess.

Filed Under: facial recognition, london, metropolitan police, police

Lawsuit Says Clearview's Facial Recognition App Violates Illinois Privacy Laws

from the OR-DOES-IT-[dramatic-side-eye] dept

Clearview has gathered a whole lot of (negative) attention ever since its exposure by Kashmir Hill for the New York Times. The facial recognition app developed by Hoan Ton-That (whose previous app was a novelty that allowed users to transpose President Trump's distinctive hairdo on their own heads) relies on scraped photos to perform its questionable magic. Rather than limiting themselves to law enforcement databases, cops can upload a photo and search a face against pictures taken from dozens of websites.

The company's marketing materials claim cops have access to 3 billion face photos via Clearview -- all pulled from public accounts linked to names, addresses, and any other personal info millions of unwitting social media users have uploaded to the internet.

Its marketing materials also claims it has been instrumental in solving current crimes and generating suspect lists for cold cases. So far, very few of these claims seem to be based on fact. That's only one of the company's issues. Another is the heat it's drawing from companies like Twitter and Facebook who claim photo scraping violates their terms of service. That's one for the courts and it's only a matter of time before someone sues.

Someone has sued, but it's not an affected service provider. It's some guy from Illinois trying to fire up a class action lawsuit against the company for violating his home state's privacy laws. Here's Catalin Cimpanu of ZDNet with the details:

According to a copy of the complaint obtained by ZDNet, plaintiffs claim Clearview AI broke Illinois privacy laws.

Namely, the New York startup broke the Illinois Biometric Information Privacy Act (BIPA), a law that safeguards state residents from having their biometrics data used without consent.

According to BIPA, companies must obtain explicit consent from Illinois residents before collecting or using any of their biometric information -- such as the facial scans Clearview collected from people's social media photos.

"Plaintiff and the Illinois Class retain a significant interest in ensuring that their biometric identifiers and information, which remain in Defendant Clearview's possession, are protected from hacks and further unlawful sales and use," the lawsuit reads.

Hmm. This doesn't seem to have much going for it. And, believe it or not, it's not a pro se lawsuit. Whether it's possible to violate a privacy law by scraping public photos remains to be litigated, but it would seem the word "public" is pretty integral here. Unless Clearview found some way to scrape photos not published publicly, the lawsuit is dead in the water.

It shouldn't take too long for a judge to declare public and private legally contradictory. This lawsuit was composed by a member of the bar, but it reads more like a Facebook note the lawyer published accidentally. From the lawsuit [PDF]:

Without obtaining any consent and without notice, Defendant Clearview used the internet to covertly gather information on millions of American citizens, collecting approximately three billion pictures of them, without any reason to suspect any of them of having done anything wrong, ever.

Wat? Just because Clearview is aggressively pitching LEOs doesn't mean Clearview can only scrape photos of people it suspects of wrongdoing. Yes, it's disturbing Clearview has decided to make its stalker-enabling AI available to people who can hurt, maim, jail, and kill you, but there's nothing on any law book that says collecting pictures of faces can only be done if the people are probably criminals -- even if the targeted end users of this software are people who go after criminals.

Putting it in a sworn document doesn't make it any less ridiculous. But it does get more ridiculous.

[A]lmost none of the citizens in the database has ever been arrested, much less been convicted. Yet these criminal investigatory records are being maintained on them, and provide government almost instantaneous access to almost every aspect of their digital lives.

Facebook is collecting photos of people, almost none of which have been criminally charged. They reside in Facebook's database. Facebook is publicly searchable, and public profiles can be searched for photos, even by law enforcement officers. Is Facebook breaking state law by "collecting" photos of innocent people? No rational person would argue that it is. And yet, this is the same argument and it's no less stupid just because an actual lawyer is involved.

Look, I also don't want Clearview pushing this "product," much less to people with the power to do incredible amounts of damage to anyone the AI mistakes for a criminal. But this isn't going to fix anything. The lawsuit makes better points about Clearview's end of the deal, which makes it easier for it to look over law enforcement's shoulder. Since Clearview hosts all the pictures on its own servers, it can see what cops are looking for and do its own digging into the personal lives of anyone cops might be thinking about targeting. That's an ugly byproduct of this service and Clearview hasn't said anything about siloing itself off from government queries.

The claims in this suit are almost certain to fail. Clearview streamlines processes cops can perform on their own, like reverse image searches and browsing of social media accounts. Actions you can perform one person at a time without violating the Constitution (or state law), you can most likely do in bulk. For now. A more realistic approach would be to take edge cases to the Supreme Court, which has been more receptive to expanding the boundaries of citizens' expectations of privacy in the digital era. This lawsuit may raise limited awareness about Clearview (and discovery could be very interesting) but it's not going to end Clearview's scraping or deter law enforcement from using it. And it's certainly not going to earn a payout for the plaintiff.

Filed Under: facial recognition, illinois, privacy, privacy law
Companies: clearview, clearview ai

Facial Recognition Company Clearview Lied About Its Crime-Solving Power In Pitches To Law Enforcement Agencies

from the just-the-alternative-facts,-ma'am dept

A very questionable facial recognition tool being offered to law enforcement was recently exposed by Kashmir Hill for the New York Times. Clearview -- created by a developer previously best known for an app that let people put Trump's "hair" on their own photos -- is being pitched to law enforcement agencies as a better AI solution for all their "who TF is this guy" problems.

Clearview doesn't limit itself to law enforcement databases -- ones (partially) filled with known criminals and arrestees. Instead of using known quantities, Clearview scrapes the internet for people's photos. With the click of an app button, officers are connected to Clearview's stash of 3 billion photos pulled from public feeds on Twitter, LinkedIn, and Facebook.

Most of the scrapees have already objected to being scraped. While this may violate terms of service, it's not completely settled that scraping content from public feeds is actually illegal. However, peeved companies can attempt to shut off their firehoses, which is what Twitter is in the process of doing.

Clearview has made some bold statements about its effectiveness -- statements that haven't been independently confirmed. Clearview did not submit its software to NIST's recent roundup of facial recognition AI, but it most likely would not have fared well. Even more established software performed poorly, misidentifying minorities almost 100 times more often than it did white males.

The company claims it finds matches 75% of the time. That doesn't actually mean it finds the right person 75% of the time. It only means the software finds someone that matches submitted photos three-quarters of the time. Clearview has provided no stats on its false positive rate. That hasn't stopped it from lying about its software and its use by law enforcement agencies.

A BuzzFeed report based on public records requests and conversations with the law enforcement agencies says the company's sales pitches are about 75% bullshit.

Clearview AI, a facial recognition company that says it’s amassed a database of billions of photos, has a fantastic selling point it offers up to police departments nationwide: It cracked a case of alleged terrorism in a New York City subway station last August in a matter of seconds. “How a Terrorism Suspect Was Instantly Identified With Clearview,” read the subject line of a November email sent to law enforcement agencies across all 50 states through a crime alert service, suggesting its technology was integral to the arrest.

Here's what the NYPD had to say about Clearview's claims in its marketing materials:

“The NYPD did not use Clearview technology to identify the suspect in the August 16th rice cooker incident,” a department spokesperson told BuzzFeed News. “The NYPD identified the suspect using the Department’s facial recognition practice where a still image from a surveillance video was compared to a pool of lawfully possessed arrest photos.”

The NYPD also said it had no "institutional relationship" with Clearview, contradicting the company's sales pitch insinuations. The NYPD was not alone in its rejection of Clearview's claims.

Clearview also claimed to be instrumental in apprehending a suspect wanted for assault. In reality, the suspect turned himself in to the NYPD. The PD again pointed out Clearview played no role in this investigation. It also had nothing to do with solving a subway groping case (the tip that resulted in an arrest was provided to the NYPD by the Guardian Angels) or an alleged "40 cold cases solved" by the NYPD.

The company says it is "working with" over 600 police departments. But BuzzFeed's investigation has uncovered at least two cases where "working with" simply meant submitting a lead to a PD tip line. Most likely, this is only the tip of the iceberg. As more requested documents roll in, there's a very good chance this "working with" BS won't just be a two-off.

Clearview's background appears to be as shady as its public claims. In addition to its founder's links to far right groups (first uncovered by Kashmir Hill), its founder pumped up the company's reputation by deploying a bunch of sock puppets.

Ton-That set up fake LinkedIn profiles to run ads about Clearview, boasting that police officers could search over 1 billion faces in less than a second.

These are definitely not the ethics you want to see from a company pitching dubious facial recognition software to law enforcement agencies. Some agencies may perform enough due diligence to move forward with a more trustworthy company, but others will be impressed with the lower cost and the massive amount of photos in Clearview's database and move forward with unproven software created by a company that appears to be willing to exaggerate its ability to help cops catch crooks.

If it can't tell the truth about its contribution to law enforcement agencies, it's probably not telling the truth about the software's effectiveness. If cops buy into Clearview's PR pitches, the collateral damage will be innocent people's freedom.

Filed Under: ai, facial recognition, law enforcement, lies, scraping
Companies: clearview, clearview ai

Leaked Document Suggests Possible Facial Recognition Ban In Europe

from the an-unlikely-outcome-but-we-can-hope dept

Bans of facial recognition tech are popping up across the United States. Facial recognition tech use by law enforcement is currently banned in the state of California and a few cities in Massachusetts have blocked local government agencies from deploying the tech.

Given the tech's relative inability to do its job, along with a host of other concerns including built-in biases that make it far more likely minorities will suffer the effects of false positives, lawmakers are finally putting the brakes on approving facial recognition use by government agencies.

A white paper leaked to Euractiv appears to indicate the biggest ban so far is under consideration in Europe -- one that would affect most of the continent.

The European Commission is considering measures to impose a temporary ban on facial recognition technologies used by both public and private actors, according to a draft white paper on Artificial Intelligence obtained by EURACTIV.

If implemented, the plans could throw current AI projects off course in some EU countries, including Germany’s wish to roll out automatic facial recognition at 134 railway stations and 14 airports. France also has plans to establish a legal framework permitting video surveillance systems to be embedded with facial recognition technologies.

Noting that the GDPR requires certain information disclosures by companies and agencies deploying the tech, the white paper [PDF] suggests going live with facial recognition tech might be unworkable, given that every person passing by an AI-enabled cam would have to consent to data collection. It suggests a moratorium might be the best solution until all the regulatory kinks can be worked out.

Building on these existing provisions, the future regulatory framework could go further and include a time-limited ban on the use of facial recognition technology in public spaces. This would mean that the use of facial recognition technology by private or public actors in public spaces would be prohibited for a definite period (e.g. 3-5 years) during which a sound methodology for assessing the impacts of this technology and possible risk management measures could be identified and developed.

That's just one of the five options being considered by the European Commission. Unfortunately, it doesn't appear to be one of its favorites. The paper says the most likely approach the Commission will take is a combination of options 3, 4, and 5. The ban is option 2.

But the GDPR definitely causes problems for the rollout of facial recognition tech in public places -- something the government agencies itching to deploy it don't appear to have considered seriously. It's pretty much unworkable unless the governments rolling these out are going to claim that being in a public place waives GDPR protections.

The desire to subject citizens to biometric collections may result in a rewrite of the GDPR or a blanket exception for collections in public places. This will only make a bad law worse.

But overall, the paper makes it clear the tech will be subject to tight regulation and much more oversight than we've seen deployed in the United States. Amendments to safety and liability laws are being considered that would allow tech companies to be held responsible for data breaches or misuse of collected biometric information. There would also be some sort of "trusted vendor" program put in place that would push companies to meet certain standards before they can be considered for government applications.

The ban is a long shot but it's still in the running. Given the number of changes that may need to be made to make facial recognition tech comply with existing European privacy laws, a temporary moratorium might be the best call to make. Clearly, the legal atmosphere in Europe isn't exactly welcoming for new data collection tech. But the narrative that more surveillance = safer countries will always have powerful proponents, which may override the privacy concerns of millions of European citizens and subject them to mass surveillance.

Filed Under: eu, europe, facial recognition

Law Enforcement's New Facial Recognition Toy Scrapes Photos From Websites, Serves Up 'Matches' In Seconds

from the be-your-own-worst-enemy dept

The biggest collection of biometric data isn't housed by any government agency. In fact, it's not owned by any single private company in the world. It's the internet itself, which houses multiple billions of face photographs that one company is using to give law enforcement perhaps its sketchiest facial recognition tool yet. Kashmir Hill has the full report for the New York Times.

Until recently, Hoan Ton-That’s greatest hits included an obscure iPhone game and an app that let people put Donald Trump’s distinctive yellow hair on their own photos.

[...]

His tiny company, Clearview AI, devised a groundbreaking facial recognition app. You take a picture of a person, upload it and get to see public photos of that person, along with links to where those photos appeared. The system — whose backbone is a database of more than three billion images that Clearview claims to have scraped from Facebook, YouTube, Venmo and millions of other websites — goes far beyond anything ever constructed by the United States government or Silicon Valley giants.

The scraping of photos presumably continues. There's a market for this -- a growing market filled with law enforcement agencies that like the billions of images and the lower cost of Clearview. They're no longer limited to government databases or required to sign MOUs with other agencies to obtain access.

The law enforcement agencies that have used it love it. But that ends the list of the app's fans. Certainly no one concerned about the unreliability of facial recognition tech is going to be pleased there's an unproven upstart matching faces against the Internet. The multiple sites scraped by Ton-That's software aren't happy either, claiming the scraping violates their many Terms of Service.

But that's something for the courts to decide! (Badly, most likely.) Until the CFAA suits start rolling in, Clearview is capitalizing on the success stories being passed around by law enforcement agencies. Not bad for an app first conceived as a way to vet babysitters or allow hotels to greet guests by name.

In February, the Indiana State Police started experimenting with Clearview. They solved a case within 20 minutes of using the app. Two men had gotten into a fight in a park, and it ended when one shot the other in the stomach. A bystander recorded the crime on a phone, so the police had a still of the gunman’s face to run through Clearview’s app.

They immediately got a match: The man appeared in a video that someone had posted on social media, and his name was included in a caption on the video. “He did not have a driver’s license and hadn’t been arrested as an adult, so he wasn’t in government databases,” said Chuck Cohen, an Indiana State Police captain at the time.

This is just one example. There are many more in Kashmir Hill's article. Clearview's pitch to cop shops talks about identifying sex offenders, John Doe corpses, and identity fraud suspects. The Gainesville, Florida police department ran cold cases against the app and came up with more than 30 suspects.

Clearview's accuracy is still unproven. That a detective ran the app and created a list of 30 suspects does not mean the Gainesville PD is any closer to solving these cases. But it may be much closer to rounding up innocent people and trying to put them behind bars. Clearview's AI was not tested by the National Institute of Standards and Technology in its recent examination of facial recognition tech, but that's probably a good thing. It would only have made the average results worse.

[T]he company said its tool finds matches up to 75 percent of the time. But it is unclear how often the tool delivers false matches, because it has not been tested by an independent party…

Some of that unpredictability comes from Clearview's unique "database:" images scraped from all over the internet and "matched" using an unknown set of constraints. With enough pushback from the sites "donating" their users' images to Clearview, the app would become useless -- no better than cops running reverse image searches from security camera footage and hoping for the best. This statement of confidence from the app's developer is less than reassuring.

“A lot of people are doing it [scraping sites],” Mr. Ton-That shrugged. “Facebook knows.”

Yep. And some of the scrapees might take steps to prevent future scraping. Or any number of competitors can scrape the same sites, dump it into some serviceable AI software, and tell cops they've just identified the guy wanted for an unsolved murder from three decades ago. Whether or not that pans out, the cops at least have someone they can talk to, rather than a dusty file no one's bothered to look at for the last two decades.

Clearview is just another step towards the elimination of privacy in public. And it's being fed unwittingly by sites and services that offer a way for people to connect. Even Clearview's CEO seems taken aback by the implications of the software he's selling to government agencies. But it's not enough to stop him from doing it.

Filed Under: ai, facial recognition, hoan thon-that, law enforcement, peter thiel, scraping
Companies: clearview ai

California's Ban Of Facial Recognition Tech Killed Off San Diego's Mostly Useless Biometric Program

from the nothing-of-value-was-lost dept

California's ban on use of facial recognition tech by law enforcement showed the state's government is willing to get out ahead of potential privacy issues. The tech is as popular as it is unproven. Law enforcement agencies strongly believe facial recognition will help it apprehend criminals more efficiently, but the available data simply doesn't back up this belief.

The tech is still pretty lousy at recognizing faces, kicking out false positives at an alarming rate. This also means it's not recognizing faces it should be recognizing -- the criminals and terrorists government agencies are convinced it will catch. They're also prone to bias, more likely to misidentify minorities, which results in increased targeting of demographics already heavily over-represented in most law enforcement agencies' paperwork.

California's new ban affects mobile tech used by state agencies. This includes body cameras, smartphones, and tablets. That was enough to kill the San Diego's multiple facial recognition programs. The San Diego PD used 1,300 cameras to build a database of 65,000 images over the course of seven years. These images were matched against a much larger database run by the San Diego Sheriff's Department

The program went into effect without the public being informed.

Introduced in 2012 by the countywide San Diego Association of Governments (SANDAG) without any public hearing or notice, the Tactical Identification System (TACIDS) gave law enforcement officials access to software that focuses on unique textures and patterns in the face—ear shape, hair, skin color—using the distance between the eyes as a baseline. In less than two seconds, the software compares those unique identifiers to a mugshot database of 1.8 million images collected by the San Diego County Sheriff’s office.

The San Diego PD used this database more frequently than any other agency with access to it, which included federal agencies like ICE. According to the PD, its increased access rate was mostly altruistic.

[T]he department used facial recognition scans more than 8,000 times in 2018, almost double the number in 2016, which it says was largely due to the formation of a new division, Neighborhood Policing Division (formed in March of 2018), aimed at addressing the issue of homelessness. SDPD equipped officers in the new division with TACIDS devices to help identify homeless people, who often do not have identification.

The SDPD did not say whether this use of the database actually resulted in correctly-identified homeless people. But the statement it did give Fast Company suggests its thousands of queries were mostly dead ends.

“While facial recognition could be a useful tool, we do not foresee the three-year moratorium on mobile face recognition use by law enforcement as having much of an impact on our department,” says Lieutenant Justin White, media relations director for the San Diego County Sheriff’s Department.

This statement is far more telling. While certain California law enforcement officials are bemoaning the ban, the San Diego PD must have already known the tech was over-hyped. If it worked as advertised, the local law enforcement agencies would have delivered a steady stream of success stories. But when something is a constant disappointment -- and you've decided you're going to use it anyway -- you avoid creating a paper trail.

Lieutenant White of the San Diego County Sheriff’s Department said they have not been tracking TACIDS successes in arrests and prosecutions, so they do not have any statistics. Neither does the SDPD, according to spokesperson Lieutenant Shawn Takeuchi.

That's the burial of bad news. There's no reason to give critics of sketchy surveillance programs any more ammunition than they already have to work with. The moratorium will have almost no effect on law enforcement in the state -- something that few agencies are willing to publicly acknowledge. They want the tech even though it has proven -- over the course of seven years -- to have added nothing to their ability to do their job.

Filed Under: biometrics, california, facial recognition, san diego, surveillance

NYC's Transportation Authority Says It's Doesn't Use Facial Recognition Tech; Activists Say 'Prove It' With Public Records Lawsuit

from the as-evidence-of-our-claim,-we-are-withholding-all-documents dept

Like pretty much everyone else, New York City's Metropolitan Transportation Authority (MTA) is using facial recognition software. Like pretty much everyone else, it doesn't really have any success stories to share.

According to the [MTA] email, the “initial period for the proof of concept testing at the (Robert F. Kennedy Bridge connecting Manhattan, the Bronx and Queens) for facial recognition has been completed and failed with no faces (0%) being detected within acceptable parameters.”

Besides the RFK Bridge, the MTA is testing the technology at the Throgs Neck and Whitestone bridges, as well as at the Midtown and Hugh L. Carey tunnels.

Unceremoniously ushered to the exit by its failure to recognize faces, the pilot program was shelved until tech catches up to the MTA's surveillance desires.

But does that mean the MTA isn't utilizing the tech elsewhere? That's what New Yorkers wanted to know earlier this year, when a Twitter user noticed the little yellow squares being placed around commuters' faces as they went through the turnstiles.

In a statement given to The Verge, the MTA denied these squares signified anything.

The New York Metropolitan Transportation Authority has denied suggestions that it’s putting facial recognition cameras in the subway, saying that a trick designed to scare fare-dodgers was misinterpreted. “There is no capability to recognize or identify individuals and absolutely no plan” to do so with NYC subway cameras, says MTA spokesperson Maxwell Young.

It scared more than fare-dodgers. Lots of people who never dodged a fare were possibly being recorded and routed through unproven facial recognition tech. The words from MTA were reassuring but they were only words. And they came from MTA, which had already field-testing facial recognition tech elsewhere.

Beyond that, the monitors used by MTA bore the name of Wisenet, a company that is very proud of its facial recognition tech. Just saying you don't have the capability now doesn't mean you can't silently add it later without having to replace any hardware.

Since MTA has only been straightforward about its facial recognition tech use after being caught using it, the Surveillance Technology Oversight Project (STOP) sent a FOIL request to MTA asking for copies of any of its facial recognition tech documents. So far, MTA has refused to release anything to STOP about its Wisenet hardware and its capabilities.

It forwarded the request to New York City Transit, which has now spent nearly eight months not responding. STOP has now sued, hoping to force NYCT into action. The lawsuit [PDF] asks the court to compel production of these documents ASAP as well as make the government agencies pay STOP's expenses for having to litigate this in the first place.

If the MTA really wants to reassure New Yorkers about its facial recognition plans, it needs to release documents backing up its public statements. If it prefers commuters to continue to not trust it, it can keep doing what it's doing: stonewalling public records requests from privacy activists.

Filed Under: facial recognition, mta, nyc

NIST Study Of 189 Facial Recognition Algorithms Finds Minorities Are Misidentified Almost 100 Times More Often Than White Men

from the white-dudes-score-another-unearned-perk dept

The development and deployment of facial recognition tech continues steadily, but the algorithms involved don't seem to be getting much better at recognizing faces. Recognizing faces is pretty much the only thing it's expected to do and it can't seem to get the job done well enough to entrust with it things like determining whether or not a person is going to be detained or arrested.

That critical failure hasn't slowed down deployment by government agencies. There are a handful of facial recognition tech bans in place around the nation, but for the most part, questions about the tech are being ignored in favor of the potential benefits touted by government contractors.

Last year, members of Congress started demanding answers from Amazon after its "Rekogition" tech said 28 lawmakers were criminals. Amazon's response was: you're using the software wrong. That didn't really answer the questions raised by this experiment -- especially questions about the tech's disproportionate selection of minorities as potential perps.

This has been a problem with facial recognition tech for years now. Biases introduced into the system by developers become amplified when the systems attempt to match faces to stored photos. A recent study by the National Institute of Standards and Technology (NIST) found that multiple facial recognition programs all suffer from the same issue: an inordinate number of false positives targeting people of color.

Asian and African American people were up to 100 times more likely to be misidentified than white men, depending on the particular algorithm and type of search. Native Americans had the highest false-positive rate of all ethnicities, according to the study, which found that systems varied widely in their accuracy.

The faces of African American women were falsely identified more often in the kinds of searches used by police investigators where an image is compared to thousands or millions of others in hopes of identifying a suspect.

As usual, the group most likely to be accurately assessed by facial recognition tech is also the group that most often promotes and deploys facial recognition systems.

Middle-aged white men generally benefited from the highest accuracy rates.

That this study was performed by NIST makes it a lot tougher to ignore. While other studies could be brushed off as anomalies or biased themselves (when performed by civil rights activist groups), a federal study of 189 different facial recognition algorithms submitted by 99 companies isn't as easy to wave away as unsound.

One of the more adamant critics of facial recognition tech critics is Amazon. It's the company that told the ACLU it was using the system wrong after the rights group took the system for a spin last year and netted 28 false positives using Congressional reps' photos. Amazon had a chance to prove its system was far more accurate than the ACLU's tests showed it was but it chose to sit out the NIST trials.

The problems found by NIST exist in both "one-to-one" and "one-to-many" matching. False positives for "one-to-one" matching allows unauthorized access of devices, systems, or areas secured with biometric scanners. "One-to-many" mismatches are even more problematic, as they can result in detentions, arrests, and other infringements on people's freedoms.

The number of participants show this problem can't be solved simply by switching service providers. It's everywhere and it doesn't appear to be improving. The DHS wants to subject all travelers in international airports to this tech as soon as possible, which means we'll be seeing the collateral damage soon enough. A few lawmakers want to slow down deployment, but they remain a minority, surrounded by far too many legislators who feel US citizens should beta test facial recognition tech in a live environment with real-world consequences.

Filed Under: bias, facial recognition, minorities, nist

San Francisco Amends Facial Recognition Ban After Realizing City Employees Could No Longer Use Smartphones

from the just-as-long-as-the-only-exceptions-are-cameras-pointed-at-city-employees dept

In May, San Francisco became the first city in the United States to ban facial recognition tech by city agencies. Being on the cutting edge has its drawbacks, as the city has now found out several months later. Tom Simonite and Gregory Barber of Wired report the city's legislation inadvertently nuked many of its employees' devices.

After San Francisco in May placed new controls, including a ban on facial recognition, on municipal surveillance, city employees began taking stock of what technology agencies already owned. They quickly learned that the city owned a lot of facial recognition technology—much of it in workers’ pockets.

City-issued iPhones equipped with Apple’s signature unlock feature, Face ID, were now illegal—even if the feature was turned off, says Lee Hepner, an aide to supervisor Aaron Peskin, the member of the local Board of Supervisors who spearheaded the ban

The law forbids the use of facial recognition tech, even if all it's doing is allowing employees to use their own faces to unlock their phones. An untold number of devices were rendered useless by the ban, but it's probably safe to assume the law was broken repeatedly until its very quiet amendment last week. Municipal agencies are once again allowed to procure devices that utilize facial recognition tech as long as they're "critically necessary" and there are no other alternatives.

This does not mean agencies can continue to purchase facial recognition tech that does anything more than secure employees' devices. And it also means the San Francisco Police Department had to give up one of its toys -- one city leadership apparently knew nothing about.

Around the same time, police department staffers scurried to disable a facial recognition system for searching mug shots that was unknown to the public or Peskin’s office. The department called South Carolina’s DataWorks Plus and asked it to disable facial recognition software the city had acquired from the company, according to company vice president Todd Pastorini.

This surveillance tool went unacknowledged during the city's institution of a facial recognition ban. As Wired reports, San Francisco claimed it had stopped testing facial recognition software in 2017. This denial sidestepped the untested (I guess) acquisition of DataWorks facial recognition tech with a contract that was originally due to run through 2020. According to documents obtained by Wired, the SFPD "dismantled" its DataWorks servers and allowed the contract to lapse after its 90-day trial period. That apparently ended in January before the law took effect.

Even so, it's not exactly comforting that the SFPD was able to secure and test drive facial recognition tech with zero public notice. City legislators made no mention of this tech or the SFPD's prior exploration of facial recognition when they began moving forward with the legislation earlier this year.

The other concern is a new one: the SF legislature has already amended its ban to allow city use of smartphones with biometric security features. While this may have been necessary to ensure employees could use city-issued devices, it also shows the city can be talked into punching holes in its brand new legislation. The city may hold firm in the future, but there's a good chance it will create other loopholes if the arguments are persuasive enough. It all depends on the definition of "critically necessary" -- terms that can become especially malleable following a mass tragedy or an uptick in violent crime, for example.

But for now, the ban holds, minus the inadvertent collateral damage. The city's government should still be applauded for its willingness to put its citizens above its own interests with this legislation, but any further requests for exceptions should be greeted with an overabundance of caution.

Filed Under: face id, face recognition, facial recognition, iphones, san francisco, sfpd
Companies: dataworks

DHS Wanted To Add US Citizens To The Long List Of People Subjected To Mandatory Face Scans At Airports... But Has Backed Down For Now

from the smile-like-you-want-to-travel,-citizen dept

We knew the DHS would get to this point eventually. Since the beginning of its biometric scanning program rollout, the DHS has planned on adding US citizens to the list of people forced to trade their faces for air travel privileges. So far, the program has been limited to suspicious foreigners (which is all of them, including those here on visas), but a recent filing -- caught by Zack Whittaker at TechCrunch -- says flying in the United States would soon require adding yourself to the government's facial recognition databases.

Homeland Security wants to expand facial recognition checks for travelers arriving to and departing from the U.S. to also include citizens, which had previously been exempt from the mandatory checks.

In a filing, the department has proposed that all travelers, and not just foreign nationals or visitors, will have to complete a facial recognition check before they are allowed to enter the U.S., but also to leave the country.

The Department of Homeland Security's excuse for subjecting US citizens to mandatory face scans is the homeland's security. Here's the DHS in its own words:

To facilitate the implementation of a seamless biometric entry-exit system that uses facial recognition and to help prevent persons attempting to fraudulently use U.S. travel documents and identify criminals and known or suspected terrorists, DHS is proposing to amend the regulations to provide that all travelers, including U.S. citizens, may be required to be photographed upon entry and/or departure.

"May be required" should actually read "will be required." The DHS's privacy assessment of its biometric scanning efforts noted that opting out of biometric scanning means never leaving the country:

[T]he only way for an individual to ensure he or she is not subject to collection of biometric information when traveling internationally is to refrain from traveling…

The government would like to get to know its legal residents better, it would appear. It hopes to be able to put faces to names with an acceptable degree of accuracy. What's acceptable to the DHS probably won't be acceptable to travelers, but travelers aren't making the rules. Travelers are only subjected to them.

The only thing preventing this program from becoming China is the DHS's inefficiency -- or a massive public outcry. After this story started making news this week, DHS suddenly decided to put it on pause for the time being. Of course, it still has until next year to roll out biometric scanning to the 20 largest airports in the country. It's been working on this for a few years now and has yet to roll this out completely to its test markets. Whatever gains are made in facial recognition accuracy will hopefully arrive in time to keep the lowest bidders from endangering the freedoms of travelers just looking to exit or enter their home country. Even if DHS is backing down on scanning Americans, it's not clear it's backing down on its overall commitment to facial scanning technology.

The weak promise the DHS gave months ago about keeping Americans out of this was quickly broken to better facilitate the treatment of citizens and visa holders as terrorists every time they board a flight that crosses US borders -- so I wouldn't put much faith in its latest promise not to go there any more. The DHS and its large adult son, the TSA, have done very little to make traveling more secure. But when there's billions of budgetary dollars at stake, you can't be too careful. The money must be spent and those who firmly believe something must be done to secure the nation will see some things being done. Whatever collateral damage this does to Americans and their trust in the federal government is apparently acceptable.

Filed Under: biometrics, cbp, dhs, facial recognition, facial scanning, tsa