As San Francisco Bans Facial Recognition Tech By Local Cops, New York City's Legislators Stall On Transparency Reforms

from the rein-it-in-now-or-regret-it-forever dept

Earlier this month, the San Francisco city council passed the first ban on facial recognition tech use by city agencies in the US. While other cities have scaled back government use of surveillance tech by introducing measures requiring public input periods and approval by city legislators, San Francisco is the only one to ban the tech outright. And it did so prior to any deployment by local agencies, managing to be one of the few governments to have ever have closed a barn door while horses were still in the barn.

Elsewhere in the nation, not much is happening. In one of the most-surveilled cities in the United States -- New York City -- bills attempting to rein in the NYPD's enthusiasm for surveillance tech are going nowhere. This is from the New York Times Editorial Board:

New York City’s own bill to regulate the use of this technology languishes in committee.

That legislation, the Public Oversight of Surveillance Technology Act, was first introduced in 2017. It was introduced again last year with the backing of 17 out of 51 council members. Unlike the ordinances in San Francisco and Oakland, the New York City bill requires only that the police disclose basic information about the technology that is being deployed. It does not condition the use of new surveillance technology on the approval of the City Council.

This is a city that loves its cameras and add-ons. Not so much the public, perhaps, but they're not really part of the equation in the largest city in the US. Current mayor Bill de Blasio says public disclosure would just allow the bad guys to win. His predecessor often acted as an extension of the NYPD, opposing any form of transparency or accountability foisted on the department, even if said foisting comes from a federal judge.

There are numerous reasons new surveillance tech should be rolled out carefully and with transparency. Facial recognition tech is unproven. It tends to rack up false positives at an alarming rate and there appears to be very little vetting done by government agencies before they start throwing money at tech companies offering this software.

It's not impossible to hold law enforcement agencies more accountable to the public. You just have to want to do it. There's a roadmap in this post about San Francisco's new ban on facial recognition tech showing it can be done. But in New York City, the council is on the fence and the mayor's openly opposed to it. A city of this size that has been "served" by a self-serving police department for its entire history has an uphill battle ahead of it. But there's no reason legislators should back down. They're supposed to represent the residents of the city, not a single government agency that wields an outsized amount of power.

Filed Under: facial recognition, new york city, san francisco

San Francisco Is The First City In The World To Restrict Government Use Of Facial Recognition Technology. Hopefully It's Not The Last.

from the keep-it-going dept

We welcome the city of San Francisco’s decision to ban the use of AI-enabled facial recognition technology by police and other municipal agencies. Facial recognition technology is prone to misidentification and biased targeting, particularly among members of vulnerable communities. It also opens the door to intrusive surveillance -- beyond the scope of existing technology. Until the technology improves to avoid such harms, its use should be heavily restricted. And even with improvements, the public must confront tough questions about how closely governments should monitor their behavior.

Regrettably, global trends are headed in a reverse direction from San Francisco’s decision. From Azerbaijan to Singapore, governments are enthusiastically embracing facial recognition technology. Led by China, such systems are becoming increasingly ubiquitous. Facial recognition has been incorporated into smart city platforms. Cities are placing them on public lampposts and integrating them into security operations centers. While there is greater public awareness of China’s surveillance strategy – particularly its establishment of artificial intelligence-powered facial recognition repression in Xinjiang -- few realize that numerous other countries are developing facial recognition capabilities as well.

This is particularly problematic in countries that lack basic rule of law protections and are already committing major human rights abuses. In countries such as Kazakhstan, Turkey, and Zimbabwe, facial recognition is a dangerous tool that further augments those governments’ arsenals of digital repression by giving them an enhanced capacity to deploy targeted monitoring in public places, to track and harass dissidents and opposition figures at will, and to suppress democratic political activity.

But even in democracies like the United States, government use of facial recognition technology, in its current form, corrodes civil rights and civil liberties because its errors disproportionately impact vulnerable communities. Astudy published earlier this year by MIT’s Media Lab, for instance, found that Amazon’s facial recognition software, which the company has peddled to police departments and Immigration and Customs Enforcement, more frequently misidentified an individual’s gender if they were female or dark-skinned.

Concerned about such disparities, San Francisco’s decision prohibits municipal agencies from using facial recognition technology except at federal facilities like the airport. Taken under the Stop Secret Surveillance ordinance, municipal agencies must also seek approval for any new surveillance technology they want to acquire. The decision passed 8-1 with overwhelming public support.

Even for a state like California that prides itself on trailblazing legislation (among many ‘firsts’, California led the way in requiring that corporate boards include women and enacting a greenhouse gas cap-and-trade program), San Francisco’s decision is extraordinary. Most of the current commentary points out that San Francisco is the first American city to ban government use of facial recognition technology. However to our knowledge, it’s not just the first American city to do so-- it’s the first city in the world; a feat made only more remarkable by the city’s position as the seat of technological innovation -- a rare instance of Silicon Valley putting values ahead of profits.

San Francisco’s decision also has important international implications. Facial recognition surveillance remains relatively nascent in most countries. While governments are interested in expanding their use of it, few states are deploying facial recognition at scale…yet. The world still has an opportunity to institute global safeguards and norms to shape how governments use facial recognition.

San Francisco’s ban is receiving widespread attention. We sincerely hope that this attention will lead to technological innovations that fix facial recognition’s bias problem and, notwithstanding such improvements, a healthy public discourse about facial recognition’s repressive potential.

Charlotte Stanton is a fellow in the technology and international affairs program and the director of the Silicon Valley office of the Carnegie Endowment for International Peace. Steven Feldstein is a non-resident fellow in Carnegie’s democracy, conflict, and governance program and the Frank and Bethine Church Chair of Public Affairs and Associate Professor in the School of Public Service at Boise State University.

Filed Under: bans, facial recognition, police, privacy, san francisco, searches

City Of San Francisco Bans Use Of Facial Recognition Tech By Government Agencies

from the FaceBlock dept

San Francisco is getting out ahead of the tech curve. Instead of waiting until after law enforcement had already deployed a suite of surveillance tools, city legislators have passed a ban on facial recognition tech by government agencies.

San Francisco, long at the heart of the technology revolution, took a stand against potential abuse on Tuesday by banning the use of facial recognition software by the police and other agencies.

The action, which came in an 8-to-1 vote by the Board of Supervisors, makes San Francisco the first major American city to block a tool that many police forces are turning to in the search for both small-time criminal suspects and perpetrators of mass carnage.

This move is being applauded by privacy and rights activists. Obviously, it has it critics as well. But the argument made here is pretty much a non-starter.

“It is ridiculous to deny the value of this technology in securing airports and border installations,” said Jonathan Turley, a constitutional law expert at George Washington University. “It is hard to deny that there is a public safety value to this technology.”

The ban doesn't affect federal agencies so the borders and airports will be just as protected as they ever were by software known mostly for its false positive rates. And in San Francisco, the use of facial recognition tech by law enforcement is -- and apparently will remain -- theoretical. To date, no local law enforcement agency has deployed facial recognition tech in San Francisco.

But the ban [PDF] also prevents local cops from pulling info from outside databases compiled using facial recognition tech, which means there won't be any backdoor searches for faces. This whole package of preemptives isn't popular with local cops… or at least not with their union representation.

[T]he San Francisco Police Officers Association, an officers’ union, said the ban would hinder their members’ efforts to investigate crime.

“Although we understand that it’s not a 100 percent accurate technology yet, it’s still evolving,” said Tony Montoya, the president of the association. “I think it has been successful in at least providing leads to criminal investigators.”

Upon information but mostly belief, the SFPOA touts the success of a tool it's never used and backs it with facts not in evidence. Undeniably, facial recognition software has been used to capture criminals. But there's little suggesting it's a regular occurrence, much less one that offsets citizens' long-held beliefs that their commutes in public should not become the tech equivalent of being tailed by police officers at all times.

Bells are easier to ring than un-ring. The city's decision to ring the ban bell before the deployment of facial recognition tech by local agencies shoves the burden on law enforcement to show it can be trusted with the surveillance tech it already has before it starts asking for this ban to be rolled back. Government agencies know better than most how much of an uphill battle repeals are. The SFPD lost before it even knew it was playing.

Filed Under: facial recognition, law enforcement, san francisco

Another Day, Another Company Scraping Photos To Train Facial Recognition AI

from the ALL-YOUR-FACE-ARE-BELONG-TO-US dept

If your face can be found online, chances are it's now part of a facial recognition database. These aren't the ones being utilized by law enforcement, although those are bad enough. The ones used by law enforcement are littered with millions of noncriminals, all part of a system that works worse than advertised 100% of the time.

The faces aren't in those databases (yet!), but they're being used to train facial recognition AI with an eye on selling it to law enforcement and other government agencies. Another photo storage company has been caught using users' photos to fine tune facial recognition software… all without obtaining consent from those whose faces became fodder for the tech mill.

“Make memories”: That’s the slogan on the website for the photo storage app Ever, accompanied by a cursive logo and an example album titled “Weekend with Grandpa.”

Everything about Ever’s branding is warm and fuzzy, about sharing your “best moments” while freeing up space on your phone.

What isn’t obvious on Ever’s website or app — except for a brief reference that was added to the privacy policy after NBC News reached out to the company in April — is that the photos people share are used to train the company’s facial recognition system, and that Ever then offers to sell that technology to private companies, law enforcement and the military.

This has been 2019's theme for the first five months of the year. Users of popular photo apps and services are being notified belatedly -- and not by the companies performing the harvesting -- that their faces are an integral part of law enforcement machinery and/or the military-industrial complex.

Ever's oh-shit-we-got-caught statement doesn't offer much mollification.

Doug Aley, Ever’s CEO, told NBC News that Ever AI does not share the photos or any identifying information about users with its facial recognition customers.

Lots of people would rather not be participants in creating surveillance tech. Most never seek employment at companies crafting products for law enforcement, intelligence agencies, and the US military. Without being informed, the photos they thought they were harmlessly sharing with family and friends have been used to make surveillance easier and more pervasive, if not actually any better.

Ever is just the latest. Prior to this, Flickr photos were swept up in a facial recognition data set compiled by IBM.

The photo is undeniably cute: a mom and a dad — he with a stubbly beard and rimless glasses, she with choppy brown hair and a wide grin — goofing around and eating ice cream with their two toddler daughters.

The picture, which was uploaded to photo-sharing site Flickr in 2013, isn't just adorable; with a bunch of different faces in various positions, it's also useful for training facial-recognition systems, which use artificial intelligence to identify people in photos and videos. It was among a million images that IBM harnessed for a new project that aims to help researchers study fairness and accuracy in facial recognition, called Diversity in Faces.

IBM also apologized for using people's photos for its data set without their permission. It said users were welcome to opt out at any time, but did not give users tools to find out whether their photos had been used. Nor is there any way to expeditiously remove found photos other than by handing over your Flickr ID to IBM.

And if it's not a tech company harvesting photos to run AI tests, it's random internet users showing just how easy it is to compile a data set using other people's photos.

Tinder users have many motives for uploading their likeness to the dating app. But contributing a facial biometric to a downloadable data set for training convolutional neural networks probably wasn’t top of their list when they signed up to swipe.

A user of Kaggle, a platform for machine learning and data science competitions which was recently acquired by Google, has uploaded a facial data set he says was created by exploiting Tinder’s API to scrape 40,000 profile photos from Bay Area users of the dating app — 20,000 apiece from profiles of each gender.

The data set, called People of Tinder, consists of six downloadable zip files, with four containing around 10,000 profile photos each and two files with sample sets of around 500 images per gender.

Tinder's reaction was to call this a violation of its Terms of Service. But this determination doesn't undo the damage nor make it impossible for someone else to do the same thing. Tinder users spoken to by TechCrunch weren't happy their photos -- some of which have never been uploaded outside of the app -- are being used by a person they don't know to perform research.

It's not that there's no legitimate uses for publicly-available photos. But transparency is the key and no one harvesting photos to train AI systems or perform research seems too concerned about being upfront with the people whose photos they're using. It's even worse in the case of Ever, where the app company itself is the one developing facial recognition software on the side, which should make users question the intent of the app developers. Did they really want to offer another photo service or were they just using this to gather faces for their real moneymaker?

Filed Under: ai, facial recognition, photos, social media
Companies: ever

New Data On London Metro Police Facial Recognition Tech Shows It's Still Wrong 96 Percent Of The Time

from the targeting-violent-criminals-with-a-four-percent-success-rate dept

Is this good news or bad news? It's tough to say. The London Metro Police are proud of their many cameras and their cameras' many features, but there doesn't appear to be any improvement in the facial recognition tech its deploying.

Three Freedom of Information requests sent to the Metro Police last year returned documents showing its tech was reporting nothing but false positives. The first response reported a 98% failure rate. A follow-up request generated an admission of a 100% failure rate by the Metro's tech. Now another set of FOI requests has gathered more data from the Metro Police and it appears past reports of consistent failure were pretty indicative of future results.

Facial recognition technology used by London’s Metropolitan Police incorrectly identified members of the public in 96 per cent of matches made between 2016 and 2018.

Biometric photos of members of the public were wrongly identified as potential criminals during eight incidents across the two-year period, Freedom of Information (FoI) requests have revealed.

This may be a small sample size, but it was enough to subject a 14-year-old student to a police stop after the facial recognition software mistook him for a criminal.

The Metro Police are continuing to use the tech despite its relative uselessness. The Met does claim its deployments over the last couple of years have led to eight arrests, but it needs far more than that to offset the system's apparent desire to see the innocent punished.

As the Metro Police continues beta testing its tech on the general public, it's continuing to amass a collection of non-criminal faces in its facial recognition database. This has drawn some attention from Parliament members who have called this "unacceptable." There has been some improvement in one area since the last time the Metro Police were queried about its facial recognition tech. It used to hold onto all images for a year. Now, it only holds watchlist images for 30 days and deletes all non-hit images immediately.

Unfortunately, this spectacular run of failure hasn't moved Parliament to, you know, discourage use of the tech. And it appears those who publicly refuse the privilege of being misidentified as a criminal will have their complaints addressed by being turned into criminals.

In one incident, a 14 year-old black child in school uniform was stopped and fingerprinted by police after being misidentified by the technology, while a man was fined for objecting to his face being scanned on a separate occasion.

Problem solved. The system is only interested in criminals and only criminals would object to having their faces scanned by the Metro's faulty tech. Self-fulfilling prophecies are just another undocumented feature.

Filed Under: facial recognition, false positives, london metro, london metro police, the tube

Student Files $1 Billion Lawsuit Against Apple Over Supposedly Faulty Facial Recognition Tech That Falsely Accused Him Of Theft

from the probably-something-low-tech-going-on-here dept

An 18-year-old resident of New York City is suing Apple for $1 billion. His lawsuit alleges Apple uses facial recognition technology as part of its stores' security systems and that this led directly to him being accused of multiple thefts across a handful of states… despite him bearing zero resemblance to the thief caught on tape.

Ousmane Bah's lawsuit [PDF] alleges Apple failed in its duty of care by attributing all these thefts to him, despite him not being the thief, resulting in numerous harms and injuries.

As a result of this action, Defendant’s facial recognition technology associated the face of the perpetrator of multiple crimes with Mr. Bah’s name and address. This led to Mr. Bah being charged with multiple crimes of larceny across a number of states.

Mr. Bah has been undoubtedly harmed by Defendant’s wrongful actions. He has been forced to travel to multiple states, including Massachusetts, New Jersey, and Delaware. He has also been subject to a shocking and traumatic arrest made by the NYPD at his home at four o’clock in the morning.

Mr. Bah’s education has also been negatively affected due to Defendant’s actions. He has been forced to miss multiple days of school in order to travel in response to charges wrongfully made against him. Additionally, on the day that he was arrested in New York, he was supposed to take a midterm exam. His grade was negatively affected.

But while the lawsuit leans into the facial recognition theory, Apple has stated it does not use this tech in its store security systems -- ones run by Security Industry Specialists, Inc., which is the other defendant named in Bah's lawsuit.

While facial recognition tech is definitely in Apple's wheelhouse, to date it's only used as a biometric security feature. Phone owners can unlock their phones using their faces -- something that's definitely handy, if not of much help when Constitutional rights are at stake.

Bah's lawsuit leans into this theory, peppering it with links to Face ID articles and footnotes expressing concern about facial recognition tech's notorious unreliability. But Bah's lawsuit narrative seems to undercut his claims about facial recognition tech and the damage done.

There's a far more reasonable explanation for what happened here, and it's all in the narrative and allegations. This seems to be an old school case of mistaken identity, rather than unproven tech fingering the wrong suspect.

Bah had recently applied for a New York driver's license. He had a photoless paper permit to tide him over until his actual ID was mailed to him. He lost this permit, which then apparently made its way into the thief's hands and, ultimately, into the hands of Apple's security people.

This information was delivered to him by an NYPD detective's educated guesses about the source of theft claims against Bah.

Detective Reinhold of the NYPD soon realized that Mr. Bah was wrongfully arrested and that he was not the suspect of the crimes perpetrated against Defendant. Detective Reinhold stated that he had viewed the surveillance video from the Manhattan store and concluded that the suspect “looked nothing like” Mr. Bah.

At that point, Detective Reinhold also explained that Defendant’s security technology identifies suspects of theft using facial recognition technology. Further, he suspected that the person who had committed the crimes must have presented Mr. Bah’s interim permit as identification during one of his multiple offenses against Defendant which took place over many months and in multiple states.

Detective Reinhold's speculation about facial recognition tech may be faulty, but the fact that the suspect presented a photoless ID identifying himself as Ousmane Bah likely explains why Apple reported the faux Bah to the police. When the suspect stole things from other stores, security personnel saw it was the same person they only knew as Bah from the ID the suspect had presented to them.

Since Apple didn't have a photo to cross-reference with its camera footage, the Bah seen in the recordings was the only Bah it knew, even if it wasn't actually Ousmane Bah, upstanding citizen and recent high school graduate. Fortunately for the real Bah, charges have been dropped in all but one case. New Jersey is the sole holdout but those charges will likely follow the rest into the prosecutor's trash can.

Unfortunately for Bah, bogus charges result in real hardships, real reputational damage, and one very real 4 a.m. arrest. But is that $1 billion-worth of damages? It's highly unlikely Bah will walk away with anything approaching this amount. In fact, Apple's good faith efforts to catch a thief known only as "Ousmane Bah" don't really show the company acting negligently. It was working with the information it had. The information may have been bad, but Apple didn't have any way of knowing that when it turned over information to law enforcement.

Simply saying something does not make it so -- which is definitely going to get pointed out by a judge when they reach this part of Bah's arguments:

The identification of Mr. Bah and subsequent charges filed against him, as well as the traumatic arrest which took place at his home, were completely preventable by Defendant. All of these events were caused by Defendant’s negligent acceptance of an interim permit, which did not contain a photo, did not properly describe the suspect presenting it, and clearly stated that it could not be used for identification purposes, as a valid form of identification.

Additionally, had Defendant taken action to correct their error after it had become aware that its facial recognition technology had continuously wrongfully implicated Mr. Bah, further injury could easily have been avoided.

It's tough to "easily avoid" something Apple wasn't aware of until after Bah's arrest by the NYPD. Only after this arrest occurred did information begin to circulate that Bah wasn't the thief in the security videos -- information that first made its way to the Boston PD, not to Apple's security team.

Bah claims Apple kept "prosecuting" these charges even after it might have been aware it had misidentified the suspect. But Apple doesn't prosecute charges. Prosecutors do. There's nothing on the record at this point indicating Apple security was approached by law enforcement with information showing the wrong person had been named as a suspect but chose to continue pressing charges against Bah.

In the end, this appears to be a very unfortunate situation in which everyone did what they could but still ended up harming a teen with a clean criminal record. Apple worked with the information it had, aided in part by Bah never reporting his interim ID card going missing. The officers who did handle Bah's cases discovered he was the wrong person, passed that information on to others, and had prosecutors drop the charges. Facial recognition tech was dragged into this lawsuit via speculation from an NYPD detective, but Bah's narrative is just as speculative, accusing Apple of using faulty tech when it most likely used tech -- CCTV -- everyone's been using for years.

Filed Under: apple stores, face recognition, facial recognition, ousmane bah, security
Companies: apple

A Seamless Journey Awaits You On The Outbound Flights: All You Have To Give Up Is Your Face

from the say-cheese,-citizens dept

The DHS's airport panopticon is rolling out slowly, but surely. And of course it's being done with as little oversight or guidance as possible. Major international airports are already turning your face into your ID, giving travelers little option but to get their faces out if they don't want to receive extra questioning.

If you're worried about adding your face to the government's extra-large bin o' biometrics, you're welcome to opt out. The easiest way to avoid this is to not travel at all, which is exactly what the DHS suggests. There are other options, but by the time you know they're available, you've likely already had your face scanned and matched against the DHS database by software known mostly for its failure rate.

This happened to a JetBlue flier who noticed her face had been scanned and matched against… something… before she was able to board her international flight. She reached out to JetBlue via Twitter and got some not-very-enlightening answers and a couple of disturbing clarifications.

I just boarded an international @JetBlue flight. Instead of scanning my boarding pass or handing over my passport, I looked into a camera before being allowed down the jet bridge. Did facial recognition replace boarding passes, unbeknownst to me? Did I consent to this?

JetBlue responded to Mackenzie Fegan with the sort of apology one offers on Twitter: I'm sorry this made you feel [x]. The option no one at JetBlue will point out to you remains an option.

You're able to opt out of this procedure, MacKenzie. Sorry if this made you feel uncomfortable.

Note that it's "this" and not "we." This is how a corporate entity absolves itself of responsibility while nominally offering an apology. Good stuff.

Fegan's follow-up question was more on point:

Presumably these facial recognition scanners are matching my image to something in order to verify my identity. How does @JetBlue know what I look like?

JetBlue's response was not very comforting:

The information is provided by the United States Department of Homeland Security from existing holdings.

Oh. "Exisiting holdings." Awesome. But where did this "existing holding" get its backstock of facial photos? Well, some may have come from passports. Some likely came from state driver's license databases. The DHS has a number of sources for people's photos: mugshots, government employee records, biometric info collected from various state and federal agencies charged with vetting volunteers and applicants for certain forms of employment (day care, elder care, any job the government feels you need a license to perform…), and any place else the government may have acquired a photo of you (or someone who somewhat resembles you).

The process works nearly instantaneously. It's seamless and slick and all the work is done behind the scenes. Just smile and move forward. Sure, you can opt out -- or so JetBlue says -- but the link JetBlue provided explains nothing but its fervent belief that more facial recognition databases can only be a boon for airline passengers.

Since the program’s launch in 2017, more than 50,000 customers have participated in biometric boarding on 500+ flights across all four cities. There is no pre-registration required. Customers can simply step up to the camera for a photo match and make their way onto the aircraft.

“The success of JetBlue’s biometric boarding program is a testament to the airline’s ongoing work to create a personal, helpful and simple experience,” said Ian Deason, senior vice president of customer experience, JetBlue. “The boarding touchpoint is an area that needs innovation and we feel biometrics will change the future of air travel as we look to create a more seamless journey throughout the airport."

Opting in is as simple as putting your face in front of the cameras the DHS and JetBlue nudge travelers toward. Opting out, however, doesn't appear to be a process anyone -- the DHS or JetBlue -- are willing to talk about openly. The DHS just says, "Don't fly." JetBlue says, "Why would anyone want to make their 'journey' less 'seamless?'"

Flying has always been something the government has taken great interest in. The pitch is passenger safety, but the more the government knows about where and when you travel, the more secure it feels. It doesn't do much for the security of passengers but it eases the government's mind when its freely-moving citizens can still be tracked. Grabbing faces at checkpoints to ensure "seamless journeys" is just another step down the path the government's been traveling for awhile now, which includes allowing the CBP and DEA to warrantlessly peruse traveler data to find people it wants to track… or to shake down for cash.

The tech is finally catching up with the government's post-9/11 desires. It has asked repeatedly for us to trade privacy and personal security for a nebulous greater good. And it's gone ahead and made those tradeoffs no matter what the answer has been.

Filed Under: boarding pass, dhs, facial recognition, flights, homeland security
Companies: jetblue

Facial Recognition Tech Now Capable Of Getting You Kicked Out Of The Mall

from the remember-malls,-bart? dept

Facial recognition tech continues it kudzu-like growth. It's not just government contractors providing tech for law enforcement and security agencies. It's also making inroads in the private sector -- a place where there's even less oversight of its use.

Cameras everywhere have long been part of retailers' operations. But retailers are now adding third party facial recognition software to the mix, further increasing the chance innocent people will be punished for software screw-ups.

[W]ith facial recognition, getting caught in one store could mean a digital record of your face is shared across the country. Stores are already using the technology for security purposes and can share that data -- meaning that if one store considers you a threat, every business in that network could come to the same conclusion.

One mistake could mean never being able to shop again.

Kogniz, the company behind one strain of shopper-oriented facial recognition tech, says no retailers are currently sharing data and recordings with other retailers. At this point (if Kogniz is to be believed), retailers are still operating within their own silos. But that could change. And it could change without notice. There's nothing in place legislation-wise that regulates this market. The government isn't keeping an eye on these developments, leaving it up to companies to self-regulate. They've responded by doing nothing.

Without any legal restrictions, companies can use facial recognition without limits. That means being able to log people's faces without telling customers their data is being collected.

Two facial recognition providers told CNET that they don't check on their customers to make sure they're using the data properly. There are no laws requiring them to.

This means there's no baseline for accuracy and no limits on sharing or retention. This also means law enforcement can ask to be added to the "sharing" list without running afoul of legal restrictions. False positives could result in bans and/or visits from local law enforcement. One Kogniz client is already sharing its login with local law enforcement, ensuring the government gets pinged every time the system registers a hit.

Even the companies providing this tech directly to government agencies are unconcerned about how it's used.

Gemalto, a digital security company, has been providing facial recognition to the Department of Homeland Security, which uses it at US exits to log foreign visitors leaving the country.

[...]

"Once the customer has it, they're going to operate with the standards that they define," said Neville Pattinson, Gemalto's senior vice president for government programs. "It's not our responsibility to have involvement past the point of delivery."

Fair enough. But the federal government has also decided they need to do almost nothing. Self-regulation isn't working any better in the public sector. That's why the EFF and ACLU are pushing for someone -- anyone -- to start acting like the adults in the room. Fortunately, a handful of local governments are stepping into the legislative void.

In late January, San Francisco supervisor Aaron Peskin proposed legislation to completely ban the city's government agencies from using facial recognition. State lawmakers across the US have suggested similar legislation, like in Washington and Massachusetts.

This is a good step forward, if extremely geographically-limited. Tech development has always moved faster than the government. But that excuse is pretty hollow when it comes to facial recognition tech. The government has been an aggressive early adopter. The legislators are late to the party, but at least they're finally starting to arrive.

Filed Under: facial recognition, privacy
Companies: gemalto, kogniz

FOIA Documents Detail DHS/CBP's Rules-Free Rollout Of Biometric Scanning Program

from the where-we're-going-we-don't-need-rules dept

The push is on to implement biometric screening at major US airports. The DHS has been pushing this for awhile, telling concerned travelers all they need to do to opt out is not travel. The pilot programs don't seem to have produced anything in the way of actionable results, but the administration's insistence that the US is surrounded by terrorists has dropped a lead foot on the DHS's gas pedal, resulting in an accelerated process that ignores both concerns about biometric scanning tech and the concerns of the traveling public that will be subjected to it.

EPIC's numerous FOIAs have resulted in an impressive stash of documents detailing the DHS's biometric scanning surge.

According to 346 pages of documents obtained by the nonprofit research organization Electronic Privacy Information Center — shared exclusively with BuzzFeed News and made public on Monday as part of Sunshine Week — US Customs and Border Protection is scrambling to implement this “biometric entry-exit system,” with the goal of using facial recognition technology on travelers aboard 16,300 flights per week — or more than 100 million passengers traveling on international flights out of the United States — in as little as two years, to meet Trump's accelerated timeline for a biometric system that had initially been signed into law by the Obama administration. This, despite questionable biometric confirmation rates and few, if any, legal guardrails.

The documents contain little that suggests the DHS will be addressing the numerous concerns that have resulted from its biometric scanning rollout. Nothing delivered by the CBP shows any limits placed on partnerships with the private companies supplying the tech, including their use of the wealth of data supplied by travelers. Data-sharing appears to be part of the CBP's plan, and there's nothing in the paperwork suggesting the government will deter private companies from exploiting the biometric data their scanners collect.

What little the CBP did have to say about its biometric scanning program is that it's definitely going to happen and it's definitely going to keep expanding. And it's going to do this under the cover of darkness as the CBP moves forward with the program it sells as a "convenience for travelers."

The documents also suggest that CBP skipped portions of a critical “rulemaking process,” which requires the agency to solicit public feedback before adopting technology intended to be broadly used on civilians, something privacy advocates back up.

Minimal oversight meets minimal transparency. It's the sort of officious brushoff we've come to expect from terrorism-related government programs. The less the public knows, the less likely it is to express its concerns in actionable ways. The rollout also has the advantage of operating in a legal vacuum. There's not a lot of casework on the suspicionless gathering of biometric data. It could be argued someone's face has no privacy expectations when it's being worn out in public, but it doesn't necessarily follow that the government should be able to collect this data en masse and hold onto it for an indefinite period of time.

So far, data shows facial recognition tech isn't the miracle proponents believe it is. Deployed systems have tended to produce a large number of false positives. And if they're kicking out false positives on a regular basis, they're also likely missing the people the systems are supposed to identify and remove from circulation. The government's refusal to discuss the limitations and use of this tech publicly only adds to the problem. The public's best source of info comes from documents sued out of the agency's hands. Forced transparency isn't really transparency.

Filed Under: airports, biometric scanning, cbp, dhs, facial recognition, homeland security, surveillance, travel

Federal Judge Says Compelling People To Unlock Phones With Their Fingerprints/Faces Violates The 5th Amendment

from the surprising-turn-of-events dept

The advent of biometric "passcodes" -- fingerprints and facial recognition -- appear to be leaving those who choose these methods with fewer Fifth Amendment protections. A handful of courts have ruled fingerprints and faces aren't "testimony." Much as officers can collect fingerprints and mugshots without a warrant following an arrest, they can also apply fingers and faces to locked phones to get to the data inside.

But it's not as simple as some court decisions make it appear. Even passwords can be considered testimonial, as they may indicate ownership of a locked device or compel production of evidence to be used against the device's owner. The passcode argument has gone both ways in court, which usually comes down to the individual judge's definition of "foregone conclusion." Does the foregone conclusion refer to the device's ownership or the evidence contained in it? The latter is harder to prove, and raising the burden of proof to this level tends to result in courts finding the compelled production of passwords to be a Fifth Amendment violation.

Via Thomas Brewster at Forbes, there's finally some good news on the biometric security front. A federal judge in California has ruled forcing people to unlock phones using biometric measures is a Fifth Amendment violation.

[I]n a more significant part of the ruling, Judge Westmore declared that the government did not have the right, even with a warrant, to force suspects to incriminate themselves by unlocking their devices with their biological features.

As the court points out [PDF], when the fingerprint IS the password, the Fifth Amendment is implicated despite these features normally being considered non-testimonial.

The Court finds that utilizing a biometric feature to unlock an electronic device is not akin to submitting to fingerprinting or a DNA swab, because it differs in two fundamental ways. First, the Government concedes that a finger, thumb, or other biometric feature may be used to unlock a device in lieu of a passcode. In this context, biometric features serve the same purpose of a passcode, which is to secure the owner's content, pragmatically rendering them functionally equivalent.

The court notes law enforcement is well aware of jurisprudence surrounding device security. In this case, the more time that passed between the seizure of the devices and their compelled unlocking, the less likely law enforcement would be able to evade the Fifth Amendment. Judge Westmore doesn't find this reasoning acceptable.

[A] passcode is generally required "when a device has been restarted, inactive, or has not been unlocked for a certain period of time." This is, no doubt, a security feature to ensure that someone without the passcode cannot readily access the contents of the phone. Indeed, the Government expresses some urgency with the need to compel the use of the biometric features to bypass the need to enter a passcode. This urgency appears to be rooted in the Government's inability to compel the production of the passcode under the current jurisprudence. It follows, however, that if a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one's finger, thumb, iris, face, or other biometric feature to unlock that same device.

The court goes on to say the government had other options to access messages -- like approaching Facebook with a warrant -- rather than intrude on the Fifth Amendment (and the Fourth Amendment -- more on that in a moment), but it chose to do it this way. Just because it's easier and faster to do it via compelled production doesn't make it right. In fact, in the court's eyes, all this effort did was violate the Constitution in multiple ways.

An attempted assault on the Fourth Amendment also occurred in this case. Investigators looking for evidence of extortion via Facebook sought to have every device and person at a residence seized and searched, with every resident compelled to unlock devices found during the search. As the judge points out in the rejection of the search warrant application, the Fourth Amendment requires far more specificity.

This request is overbroad. There are two suspects identified in the affidavit, but the request is neither limited to a particular person nor a particular device.

Thus, the Court finds that the Application does not establish sufficient probable cause to compel any person who happens to be at the Subject Premises at the time of the search to provide a finger, thumb or other biometric feature to potentially unlock any unspecified digital device that may be seized during the otherwise lawful search.

This is a far better answer to this sort of request than others we've seen. Searching someone's home and digging through their electronics is one of the scariest powers the government has. The Fourth Amendment is in place to limit these exercises of immense government power to those that are justifiable and necessary. When judges grant overbroad orders, they're doing more than failing to act as a check against government abuse. They're normalizing abuse of citizens' rights via judicial precedent.

Filed Under: 5th amendment, compelled speech, facial recognition, fingerprints, locked phones, passwords, testimony, unlocking phones