Maine Legislature Enacts Strictest Facial Recognition Limitations In The Country

from the hopefully-there-are-49-competitors-seeking-to-top-this dept

From out of nowhere, the state of Maine has taken the lead in protecting its residents from the steady encroachment of facial recognition technology. A bill [PDF] recently passed by both sides of the state legislature has become law and makes Maine the standard bearer for future facial recognition tech bans.

Maine has enacted the country’s strongest statewide facial recognition law. Maine’s law prohibits the use of facial recognition technology in most areas of government, including in public schools, and for surveillance purposes. It strictly regulates how law enforcement officials may use facial recognition technology.

This law is more restrictive than anything else passed by a state legislature to date. California's ban on facial recognition tech only prevents law enforcement from utilizing the tech in their body cameras, ensuring these tools remain more focused on police accountability, rather than just an extension of existing surveillance programs.

The state of Washington also passed its own ban recently. But that bill -- which was supported by law enforcement agencies -- isn't really a ban or a moratorium. The tech is still permitted to be used. There are new restrictions in place, though. Using it to engage in real-time surveillance now requires a warrant. And if any state agency wants to start using the tech, it needs to provide public notice, hold at least three community meetings to hear objections, and perform a privacy impact assessment before deploying it.

Maine's new regulations have none of those drawbacks or concessions. No government agency at any level is permitted to use or acquire this tech. And use of the tech is limited to a small list of exceptions, which should prevent state and local agencies from asking federal agencies or those in nearby states to launder their facial recognition searches for them.

Here is the single exception to the ban and the stipulations that accompany it.

Under Maine’s rules, law enforcement may request a facial recognition search from the FBI and the state’s Bureau of Motor Vehicles (BMV) if they have probable cause to believe an unidentified person in an image has committed a serious crime. The BMV and the Maine State Police are required to collect data on search requests from law enforcement. The law stipulates that the results of a facial recognition search do not alone constitute probable cause for law enforcement officers to arrest or search a person. Individuals may bring a lawsuit if they believe a government agency or official has violated the law.

And this exception for serious crimes actually means serious crimes, rather than whatever cops want to declare "serious" to access the tech.

I. "Serious crime" means:

(1) A crime under the laws of this State that:

(a) Is punishable by a term of imprisonment of one year or more; or

(b) Is a Class D or Class E crime under the laws of this State that is a violation 18 of Title 17-A, chapter 9, 11, 12, 13 or 35; Title 15, section 1092, if the violation is based on a condition under Title 15, section 1026, subsection 3, paragraph A, subparagraph (5) or (8); or Title 19-A, section 4011…

That list of crimes includes murder, assault, kidnapping, sexual assault, sexual assault of minors, and sex trafficking. Also included: violating protective orders or bail conditions. This should keep cops from pestering the FBI to find who's been shoplifting or whatever. Anything that doesn't comply with this law is de facto unlawful and cannot be used as evidence in prosecutions.

The law also gives residents the right to sue if they feel they've been illegally subjected to this tech.

It's the strongest facial recognition ban in the nation. And it still allows law enforcement to make use of it through a couple of conduits if they're willing to jump through the very reasonable hoops the law has erected.

Filed Under: facial recognition, government, maine, police, privacy, schools

Federal Watchdog Finds Lots Of Facial Recognition Use By Gov't Agencies, Very Little Internal Oversight

from the getting-a-real-'Wild-West'-vibe-from-this dept

Facial recognition tech remains controversial, given its tendency to produce false positives and send cops after the wrong people. Private companies offering even sketchier tech than what's already in use (looking at you, Clearview) have made everything worse.

The upside is this state of affairs has prompted at least one federal government oversight entity to do some actual oversight. The Government Accountability Office (GAO) has released its report [PDF] on federal agencies' use of facial recognition tech and it contains a couple of surprises and, unfortunately, several of the expected disappointments. (via the Washington Post)

For instance, while we expect law enforcement agencies like the FBI, DEA, ATF, and TSA to use facial recognition tech, the report notes that a total of 20 agencies own or use the tech. That list also includes some unexpected agencies, like the IRS, US Postal Service, the FDA, and NASA.

There's also a surprising number of Clearview users among federal agencies, which seems unwise given the company's history for being sued, investigated, exposed as dishonest, and just kind of terrible in every way. Of the 20 agencies that admitted using this tech, ten have used or have contracts with Clearview, outpacing other third-party offerings by a 2-to-1 margin.

What are these agencies using this tech for? Mainly criminal investigations.

According to the FBI, the system has been used for investigations of violent crimes, credit card and identity fraud, missing persons, and bank robberies, among others. The Department of Homeland Security’s Office of Biometric Identity Management offers a similar service to its partners (e.g., U.S. Immigration and Customs Enforcement). Specifically, the agency’s Automated Biometric Identification System can be used to search a photo of an unknown individual and provide potential matches (i.e., generate leads) to support criminal investigations. Federal agencies also reported using state, local, and non-government systems to support criminal investigations.

This includes people who may have committed criminal acts during last summer's nationwide anti-police violence protests. One of the agencies on this list is the US Postal Inspection Service, which used Clearview to identify suspects who damaged USPS property or stole mail. The US Capitol Police also used Clearview to "generate leads" following the January 6th attack on the US Capitol.

That's what's known. There's a lot that's unknown, thanks to federal agencies apparently not caring who's doing what with whatever facial recognition tech they have access to.

Thirteen federal agencies do not have awareness of what non-federal systems with facial recognition technology are used by employees. These agencies have therefore not fully assessed the potential risks of using these systems, such as risks related to privacy and accuracy. Most federal agencies that reported using non-federal systems did not own systems. Thus, employees were relying on systems owned by other entities, including non-federal entities, to support their operations.

Yay! Your federal tax dollars at work putting citizens at risk of being misidentified right into holding cells or deportation or whatever. The less you know, I guess. Some agencies had to "poll" employees to figure out how often this tech had been used, something that relies on honest self-reporting for accuracy. Literally any other system would provide better data, including the old standby "making some shit up."

Then there's mind-boggling stuff like this:

Officials from another agency initially told us that its employees did not use non-federal systems; however, after conducting a poll, the agency learned that its employees had used a non-federal system to conduct more than 1,000 facial recognition searches.

The line between "we don't do this" and "we do this pretty much nonstop" is finer than I thought.

The CBP, which has used this tech for years, says it's still "in the process of implementing a mechanism to track" use of non-federal facial recognition systems for employees. So far, the CBP has come up with nothing better than hanging up a couple of clipboards.

According to U.S. Immigration and Customs Enforcement officials, in November 2020 they were in the process of developing a list of approved facial recognition technologies that employees can use. In addition, log-in sheets will be made available to employees, allowing supervisors to monitor employee use of the technologies.

Behold the awesome power of the CBP, utilizing its billions in budget to send someone to Office Depot with a $20 bill and telling them to bring back change and a receipt.

In addition to being careless and cavalier about the use and deployment of unproven tech, the sullen shrugs of these thirteen government agencies are also possibly admissions of criminal activity.

When agencies use facial recognition technology without first assessing the privacy implications and applicability of privacy requirements, there is a risk that they will not adhere to privacy-related laws, regulations, and policies. There is also a risk that non-federal system owners will share sensitive information (e.g. photo of a suspect) about an ongoing investigation with the public or others.

The GAO closes its depressing report with 26 recommendations -- thirteen of them being "start tracking this stuff, you dolts." The second -- which makes two recommendations per failing federal agency -- is to assess the risks of the tech, including possible violations of privacy laws and the negative side effects of these systems misidentifying people.

There's no good news in this report. Agencies are using unproven, sometimes completely unvetted tech without internal or external oversight. They've rolled out these programs well ahead of required Privacy Impact Assessments or internal tracking/reporting measures in place. The only pleasant surprise is that this hasn't resulted in more false arrests and detainments. But that definitely can't be attributed to the care and diligence of agencies using this tech because the GAO really wasn't able to find much evidence of that. But this does put the issue on the radar of Congress members who haven't been paying much attention to this tech's drift towards ubiquity.

Filed Under: 4th amendment, accountability, facial recognition, federal government, gao, oversight, surveillance

Facial Recognition's Latest Failure Is Keeping People From Accessing Their Unemployment Benefits

from the would-be-fixed-instantly-if-the-CEO-had-to-use-the-system-to-get-paid dept

Is there anything facial recognition tech can't do?

The answer appears to be "yes." Or maybe it's "no." The list of things it can't do well flows from the only thing it's asked to do and can't: recognize faces.

It can't allow you to board a plane at certain airports if it decides you're not the person you actually are. It can't keep you from being arrested if it decides you're someone you're not. And it can't let you on the property if it's deployed by any number of cameras watching any number of private establishments.

The latest thing it can't do is keep unemployed people connected with their unemployment assistance. A private contractor acting as a fraud-fighting middleman is apparently fighting fraud by keeping legitimate recipients of assistance from receiving any assistance. Todd Feathers has more information at Motherboard.

Unemployment recipients have been complaining for months about the identity verification service ID.me, which uses a combination of biometric information and official documents to confirm that applicants are who they claim to be. The complaints reached another crescendo this week after Axios published a “deep dive” article about the threat of unemployment fraud based on statistics provided to the outlet by ID.me.

Some unemployment applicants have said that ID.me’s facial recognition models fail to properly identify them (generally speaking, facial recognition technology is notoriously less accurate for women and people of color). And after their applications were put on hold because their identity couldn’t be verified, many should-be beneficiaries have had to wait days or weeks to reach an ID.me “trusted referee” who could confirm what the technology couldn’t.

Months-worth of complaints can easily be found on Twitter. A steady stream of angry tweets in ID.me's direction undercuts the company's assurances that everything is working fine or, in the event that it isn't, it's all the end users' fault.

In his statement to Motherboard, [IDme CEO Blake] Hall said that facial recognition failures are not a problem with the technology but with the people using it to verify their identity. “For example, if someone uploads a selfie that only shows half their face.”

“We are unaware of eligible individuals who have not been able to verify their identity with ID.me,” he said, and “the wait time for a live video chat session right now is less than five minutes and it has been consistently under 30 minutes all week.”

Hmm. Perhaps Hall should take a scroll through Twitter and try to square his statement with actual users' experiences. Multiple complainants have noted the supposed 24/7 chat is anything but 24/7 and trying to reach someone by phone is even more futile than trying to utilize the seemingly all-but-abandoned online chat service.

While the backend goes neglected, CEO Blake Hall is pushing for more states to utilize ID.me to combat unemployment fraud. The service is currently used by 21 states but ID.me would obviously like that number to be higher. To push that number higher, Hall appears to be pushing other numbers higher. As Feathers points out in his report, Hall's estimate of money lost to unemployment fraud leapt from $200 million in February to $400 million by the time he was approached by Axios earlier this month as it compiled its "deep dive" into the company. While this kind of growth is to be expected over time, the best source for fraud estimates isn't a company that has a financial interest in portraying fraud as a bigger problem than it may actually be.

This is the latest frontier of facial recognition failure. And it will get worse before… well, there's no way of telling if it will ever get better. More automation of services is inevitable. And efforts put in place to prevent abuse of those services will inevitably involve verification processes like these. But if the government is going to rely on third-party tech with this many known problems, it needs to make sure it contractors and its agencies have the people and processes in place to backstop AI decisions and head off more of the (also inevitable) failures.

Filed Under: facial recognition, unemployment benefits

Clearview Forbids Users From Scraping Its Database Of Images It Scraped From Thousands Of Websites

from the don't-scrape-me-bro dept

Clearview continues to dominate the "Most Hated" category in the facial recognition tech games. And with Amazon tossing aside its "Rekognition" program for the time being (it's spelled with a K because the AI tried to spell "recognition" correctly and failed), Clearview has opened up what could be an insurmountable lead.

Clearview has been sued, investigated, banned by law enforcement agencies, and suffered numerous self-inflicted wounds. Underneath Clearview's untried and untested AI lies an underbedding composed of the internet. The ~4 billion images in Clearview's database have been scraped from public posts and accounts hosted by thousands of websites and dozens of social media platforms.

There's nothing inherently wrong with scraping sites to make use of information hosted there. In fact, this often controversial power can sometimes be used for good. The last thing we need is Clearview's questionable tech convincing legislators, prosecutors, and courts that scraping sites is something only criminals do.

Clearview called out Google's apparent hypocrisy on the subject of site scraping when Google sent a cease-and-desist demanding it stop harvesting images and data from Google's online possessions. But Clearview is apparently unable to recognize its own hypocrisy. While it's cool with site scraping when it can benefit from it, it frowns upon others perpetrating this "harm" on its own databases.

Eerily reminiscent of Disney's take on the public domain (good when Disney uses it, bad when Disney's copyrights are set to expire) is Clearview's take on site scraping. Its user agreement [PDF] with the Evansville, Indiana police department (obtained by MuckRock user J Ader) contains this paragraph:

The use of automated systems or software to extract the whole or any part of the Service or Website, the Information or data on or within the Service or the Website, including image search results or source code, for any purposes (including uses commonly known as “scraping”) is strictly prohibited.

Pretty sure a bunch of the sites scraped by Clearview have similar clauses in their terms of use. And if Clearview doesn't believe those terms should be honored, it shouldn't expect others to give it the respect it refuses to extend to others. I don't think anyone else should necessarily be in possession of everything in Clearview's facial recognition database but I do think someone needs to scrape the shit out of it on sheer principle.

Also bundled in this package of public records is Clearview's laughable "accuracy" test. It compares itself to Rekognition and its highly publicized failure. When Amazon's tech was tested, it misidentified several DC legislators as criminals, especially those that weren't white and male.

Clearview touts its own success in this document [PDF], which covers a non-independent test of its AI performed in 2019. Here are the results:

The test compared the headshots from all three legislative bodies against Clearview’s proprietary database of 2.8 billion images (112,000 times the size of the database used by the ACLU). The Panel determined that Clearview rated 100% accurate, producing instant and accurate matches for every one of the 834 federal and state legislators in the test cohort.

LOL. This is proof of nothing. Anyone with access to a reverse image search could perform this test with the same accuracy. While Amazon's AI was tested against arrestees' mugshots, Clearview's was tested against photos and info scraped from social media profiles and public websites. Of course it was able to positively identify politicians, most of whom maintain multiple social media accounts and websites. It would only be notable if the AI had failed to perform this simple task given the wealth of information it had to work with.

In conclusion, Clearview sucks. Its tech is unproven and its policy on scraping is the apex of hypocrisy. On the other hand, the company seems to be harvesting criticism as fast as its harvesting web content, so the prognosis on its continued survival remains refreshingly bleak.

Filed Under: facial recognition, hypocrisy, scraping
Companies: clearview

DOJ Asks DC Court To Compel Decryption Of Device Seized In A Capitol Raid Case

from the be-careful-what-you-ask-for dept

The DOJ is testing some waters it may not want to be troubling, not with hundreds of prosecutions stemming from the January 6 Capitol raid on the docket. It has asked the DC court to compel a defendant to decrypt his laptop so the FBI can search it for evidence. (h/t Marcy Wheeler)

The government is seeking an All Writs Act order [PDF] forcing the alleged device owner to unlock the device using either his face or his passcode.

The government respectfully moves for an order compelling the defendant to produce a critical piece of evidence – his Microsoft Surface Pro laptop computer – in an unencrypted state. The government proposes a two-step process: First, the defendant should be ordered to place his face in front of the computer’s camera, so that the computer can be biometrically unlocked. Second, if the biometric attempt does not unlock the computer, the defendant should be ordered to type his passcode or PIN into the computer.

Having failed to obtain consent, the government is now hoping to achieve this by force. This isn't a particularly wise idea considering how many cases it's currently juggling in this circuit. If the court decides this violates the Fifth Amendment, it may negatively affect other prosecutions involving secured devices.

The government argues there's no Fifth Amendment issue here.

The requested relief would not violate the defendant’s Fourth or Fifth Amendment rights. With respect to the Fourth Amendment, there is only minimal intrusion on the defendant’s privacy, and there is probable cause that the defendant’s face can unlock the Subject Device (and lead to the recovery of relevant evidence). With respect to the Fifth Amendment, Reffitt’s entering his password into the Subject Device does not violate his privilege against self-incrimination, because his act of production would not be testimonial, since the only potentially testimonial component implicit in his act of producing the unlocked/unencrypted device is a foregone conclusion.

This will come down to what the court feels the phrase "foregone conclusion" actually means. While the act itself (either presenting biometrics or providing a passcode) isn't necessarily testimonial, it does give the government access to evidence that might be used against the person being compelled to grant access to this information. At least one court has found that entering passwords and providing evidence are basically the same thing, since the first naturally leads to the latter. The government has no interest in the password, even though that's what it is seeking to compel. It's interested in what having that password entered will provide.

If the only foregone conclusion the government needs to have in its possession is who owns the computer, obviously compelled decryption will help establish ownership. The government appears to know whose computer it is. The Surface Pro targeted by the proposed order displays the name of the defendant (Guy Reffitt) on the screen when opened. And, despite Reffitt (initially) telling investigators otherwise, one of Reffitt's family members confirmed it belonged to the defendant.

Having that much information on hand might be enough to compel decryption if the court decides the only foregone conclusion the government needs to reach is the most likely owner of the device it's seeking to unlock. But if the foregone conclusion bar is set higher -- a likely source of criminal evidence -- things will get much more difficult for the government.

The government is basing this request on the theory that recordings captured at the Capitol by the suspect's helmet-mounted camera were moved to the laptop for storage prior to their deletion from the camera. However, the government seized multiple devices from the defendant's home, including three phones, two other laptops, and one desktop computer. Most of those have been searched already and determined they don't hold any relevant data.

The government is assuming -- based on statements by family members who viewed recordings on that device -- that's where the recordings it is seeking are now located. But it won't know this until after it performs a search. And it can't perform a search until the device is unlocked. This assumption is credible, but the files could have been uploaded to the cloud and viewed on the device, which means the files the government concludes (in a foregone way) must reside on the laptop possibly aren't actually there.

If the court decides the government doesn't have more than a hunch at this point, it may deny this order. And it may decide to lay down some Fifth Amendment ground rules that eliminate compelled production as an option. This is a roll of the Constitutional dice the government may later regret -- a rerun of its failure to compel decryption assistance in the San Bernardino case. But if it goes the other way, it will become that much easier for the government to pursue prosecutions in a district that handles an outsized portion of the DOJ's cases.

Filed Under: 4th amendment, 5th amendment, all writs act, decryption, doj, encryption, facial recognition, january 6th, unlocking

Canadian Privacy Commissioner Says RCMP Broke The Law By Doing Business With Clearview

from the nice-work,-law-enforcers dept

Since its unceremonious exposure by the New York Times, internet-scraping facial recognition tech company Clearview has been the subject of nothing but negative press, lawsuits, and law enforcement denials of its self-proclaimed crime fighting abilities. Apparently to the surprise of Clearview, few people were receptive to the idea of having their personal info scraped from the web by the company and served up to law enforcement officers, private companies security personnel, and any billionaire wondering about what to throw their money at.

The dubious legality of its efforts has seen Clearview exit certain markets in the United States. It has also exited an entire nation, pulling the plug in Canada while under investigation by the country's Privacy Commissioner.

Earlier this year, the Privacy Commissioner released part of its report, finding that Clearview's offering was mass surveillance that was illegal under federal and provincial laws. The second half of its investigation deals with the Royal Canadian Mounted Police and its use of Clearview during investigations. The Commissioner's conclusion? The RCMP also broke the law.

[O]ur most recent investigation has concluded that the RCMP contravened the federal public sector law, the Privacy Act, when it collected information from Clearview. In our view, a government institution simply cannot collect personal information from a third party agent if that third party’s collection was unlawful in the first place.

According to the Privacy Commissioner, RCMP violated the Privacy Act by using Clearview to search for information about citizens. It doesn't matter that the database used to perform these searches was owned and maintained by a private company. If Clearview violated Canadian laws collecting and providing access to this data, the RCMP similarly broke the law when it accessed it.

The Commissioner notes the RCMP still does not believe it did anything wrong.

The RCMP is no longer using Clearview AI as the company ceased to offer its services in Canada in July 2020 in the wake of our then ongoing investigation. However, we remain concerned that the RCMP did not agree with our conclusion that it contravened the Privacy Act. The RCMP argued section 4 of the Privacy Act does not expressly impose a duty to confirm the legal basis for the collection of personal information by its private sector partners. Requiring the RCMP to ensure a third party’s legal compliance with PIPEDA would create an unreasonable obligation on the RCMP, the RCMP maintained.

That's a pretty interesting counterpoint by the RCMP. It basically argues it should be able to do business with outside vendors that break the law. Despite its spicy take on the legalities of paying third parties to break the law for it, the RCMP has agreed to revamp its policies and procedures to provide more control and direct oversight of tech use by its investigators and officers.

But if the RCMP was so sure it was in the right, one has to wonder why it attempted to downplay its use of Clearview to mislead the Commission's investigators.

We were also concerned that the RCMP at first erroneously told our office it was not using Clearview AI. When it later acknowledged its use, it said publicly it had only used the company’s technology in a limited way, primarily for identifying, locating and rescuing children who have been, or are, victims of online sexual abuse.

However, our investigation found the RCMP did not satisfactorily account for the vast majority of the searches it made.

These don't appear to be the actions of an agency that firmly believes it's in the clear, legally speaking. The most generous take is that the RCMP wasn't tracking use of Clearview by its employees, which is its own problem and one hopefully addressed by the recommendations of the Commission. But more realistically it suggests the RCMP knew it probably shouldn't be using the highly questionable facial recognition product and tried to cover up how often it had actually been used.

Most damning of all is the undeniable fact that the RCMP continued to use Clearview while it was under investigation by the government. It only stopped because Clearview decided to exit the Canadian market rather than risk any additional scrutiny of its software and site scraping efforts.  

Filed Under: canada, facial recognition, privacy, rcmp
Companies: clearview

US Postal Service's Social Media Surveillance Program Uses Clearview's Facial Recognition Tech

from the bad-idea-with-even-worse-execution dept

Late last month, it was discovered the United States Postal Service was operating a social media surveillance program. The "why" of this was never explained. Apparently, the USPS has time and money to blow, so it has something called an "Internet Covert Operations Program" (iCOP) which it uses to investigate crimes that definitely are not of a postal nature.

According to the two-page bulletin first reported on by Yahoo News, iCOP was trawling social media looking for "threats." And the "threats" observed in the report shared with the DHS and its many, many (mostly useless) "Fusion Centers" was that the threats weren't credible.

Great, I guess, but why is the Postal Service surveilling communications that aren't being sent through the mail? I'm sorry if it feels a bit left out by the move to email and other electronic communication methods, but wandering around Twitter and Facebook looking for crimes seems to be both a waste of its limited resources and something that really isn't covered by the directives of the Post Office's investigative wing.

Well, there's even worse news to report. Again, Yahoo News is on top of it. It appears the iCOP program makes use of facial recognition tech. And not just any facial recognition tech. It uses the worst, most questionable offering out there at the moment.

Among the tools used by the analysts is Clearview AI, a facial recognition software that scrapes images off public websites, a practice that has raised the ire of privacy advocates. The U.S. Postal Inspection Service uses Clearview’s facial recognition database of over 3 billion images “to help identify unknown targets in an investigation or locate additional social media accounts for known individuals,” according to materials reviewed by Yahoo News.

What was first just confounding is now also stupidly dangerous. Clearview's tech has never been independently tested. Multiple law enforcement agencies have tried out the product and most feel it's mostly useless, prone to generating false positives or just a wealth of irrelevant information.

Adding a questionable tool to a questionable surveillance program sounds exactly like the sort of thing you'd get when you ask the people in charge of the snail mail to get online. Yahoo reports other tools are in the mix as well, including software that uses keyword searches to dip into the social media firehose. And there's one that lets investigators pretend to be people they aren't while extremely online.

It also uses Nfusion, another software program, to create and maintain anonymous, untraceable email and social media accounts.

For what? So far, all we've seen is a lot of time, money, and wtf-ness produce a determination that some threats weren't actually threats. That doesn't exactly build confidence in a surveillance program no one outside of the federal government believes the USPS should be engaged in.

Yahoo's report notes the program dates back to 2018, when the USPS got more involved in tracking criminal activity on the dark web. It apparently expanded its purview to the regular web. According to a USPS statement, surveilling social media platforms and users is essential to protecting postal workers from dangerous situations and threats. But there's no evidence this program has ever accomplished that goal. All it appears to have accomplished at this point is the surveillance.

And that surveillance is being used unwisely.

Beginning last spring, following the death of George Floyd, iCOP analysts began monitoring social media to track potential violence at racial justice protests. After the Jan. 6 riot at the Capitol by Trump supporters, the analysts turned their attention to right-wing accounts, according to documents, including an intelligence bulletin previously obtained and published by Yahoo News.

There's your First Amendment concerns. I'm sure the USPS expected its covert surveillance operations to remain covert and it would never have to address this publicly. But the program is now public knowledge and the USPS needs a better explanation than "we're just being careful." Any number of federal and local law enforcement agencies engage in the same surveillance. We may not like that, but at least they've got some jurisdiction and justification for doing so. Erecting an NSA-lite in USPS data centers makes zero sense when you're the entity in charge of handling physical mail.

Filed Under: facial recognition, icop, surveillance, usps
Companies: clearview

Time Magazine Lauds Clearview AI Despite Its Sketchy Facial Recognition Tech

from the but-why? dept

Time Magazine released its inaugural list of the 100 Most Influential Companies, featuring an array of large and small corporations that “are helping to chart an essential path forward.” Disturbingly, among its choices of “disruptors” is Clearview AI, the controversial facial recognition start-up known for illicitly scraping Americans’ images and demographic information from social media and selling the data to law enforcement. By celebrating a company that engages in illegal mass surveillance, Time is complicit in the degradation of our privacy and our civil liberties.

Even cursory scrutiny by Time would have uncovered Clearview AI’s disreputable practices. Perhaps Time was satisfied with the vague explanation from Clearview AI’s CEO, Hoan Ton-That, that the company is “working with law enforcement to balance privacy and security.” But it’s hard to understand why, after substantial reporting by other members of the media, Time chose to accept Ton-That’s word when there is conclusive evidence that Clearview AI continues to violate civil liberties by supplying law enforcement agencies, private banks and sports teams with billions of illegally collected images.

Widespread concern about facial recognition technology’s threats to civil liberties and its propensity for inaccuracy and racial bias fueled the public outcry that ensued after the New York Times first broke news about Clearview AI. Amid calls from civil rights advocates for lawmakers to ban the use of facial recognition technology, members of Congress questioned Clearview AI about its technology and its potential for abuse against First Amendment-protected activity. Since then, a growing list of U.S. cities have banned police use of the technology.

Despite the bans and lawsuits, both locally and internationally, against Clearview AI, the company’s indiscriminate collection of Americans’ personal data without specific links to criminality continues unabated. Clearview AI’s troubling history and ongoing illegal activity should have dissuaded Time from elevating it in the public sphere. Yet the outlet only vaguely summarizes serious concerns about Clearview AI in its profile, mentioning briefly that “civil rights advocates fear abuses” of its technology despite reports of both the company and its clients misleading the public. Without evidence, Time also credits Clearview AI for assisting in the arrest of individuals connected to the breach of the U.S. Capitol earlier this year, while sweeping aside Clearview AI’s ties to misinformation.

Clearview AI’s secretive practices that Time lauds as “influential” and “disruptive” represent a dangerous disregard for our social norms and expectations of privacy. We have come to expect to certain tradeoffs with technology providers: we share some demographic information in exchange for the ease, convenience and connectivity their products bring to our daily lives. However, any marginal benefits of Clearview AI do not hold up against its significant potential for harm, and Time should have acknowledged that. The company’s technology paves the way to a dystopian future devoid of privacy and anonymity, both online and offline. Clearview AI is creating an environment where anyone - an ICE agent, a stalker or an individual bad actor within government – can take a photo of an individual anywhere and automatically pull up that person’s Instagram, TikTok, blog, or other personal information without their knowledge or consent.

It is a future civil society advocates have long warned about and will continue to fight against. Time should acknowledge these warnings in its report, especially since its readers are among Clearview AI’s targets. As an iconic publication that has been a part of America’s media and social landscape for almost 100 years, Time has effectively chronicled the struggle for civil liberties over the decades. It is a disgrace that when it came to covering today’s most influential companies, Time instead chose to endorse a company that is distinguished only for its unrelenting commitment to destroying those same liberties.

Freddy Martinez is a policy analyst at Open The Government.

Filed Under: biometrics, disinformation, facial recognition, innovation, privacy
Companies: clearview

Putin's Crackdown On Demonstrators Adds A Sadistic Twist: Using Surveillance Cameras To Identify People, But To Arrest Them Only Days Or Months Later

from the waiting-for-the-knock-on-the-door dept

It's hardly news that Vladimir Putin is cracking down on supporters of Alexey Navalny, or on the journalists who are brave enough to report on the wave of protests in support of the imprisoned opposition leader. But there are some interesting wrinkles to how this is happening. For example, in a move that will not surprise Techdirt readers, Moscow's massive facial recognition camera network -- supposedly set up to enforce quarantine restrictions, and to catch criminals -- has been re-purposed, as Bloomberg reports:

Police tapped the surveillance system to identify and detain dozens of people who attended last week's protests in the Russian capital in support of jailed Kremlin foe Alexey Navalny. More than 50 were picked up over the following days, including several journalists, according to OVD-Info, an independent human-rights monitoring group that gathers information on detentions.

Nothing too surprising there, perhaps. But the RFERL.org site points out an important shift in the Russian authorities' tactics. In the past, the police detained thousands of people who had participated in unsanctioned demonstrations. This time, a token two to three percent of the protesters at a rally were arrested, apparently allowing the rest to go free. However, this is actually part of a new, and even more cruel approach:

in recent days, Russian police have unveiled a new strategy, using surveillance-camera footage and other techniques to identify demonstrators and track them down, days after the event.

The opposition politician and political analyst Leonid Gozman explains:

"Now we have a different situation," he continued. "They are signaling to everyone: 'Go ahead and march, guys, but a year from now you can expect we'll come, expect a knock at your door. And we'll come or not as we wish....' Now they have placed everyone in that position."

It's a clever approach. It means anyone coming away from attending a demo is unsure whether they have been identified there. The absence of any immediate action by the authorities no longer means protesters have escaped notice. Instead, a kind of digital sword of Damocles hangs over them, waiting to fall at some future, unknown date. The painful uncertainty this generates will probably be enough to dissuade many people from taking part in future demos -- a big win for the authorities, obtained at very low cost.

This cat-and-mouse game with protesters is only possible thanks to Moscow's blanket surveillance cameras and advanced facial recognition systems. Where, in the past, police could only arrest people at a demonstration on the spot, because there was no sure way to find them afterwards, now their faces on CCTV are enough. Once photographed and identified, there is no need to arrest them immediately, which allows the authorities to create this new and debilitating anxiety among protestors that one day there will be that dreaded knock on the door.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: cameras, facial recognition, free speech, protests, russia, surveillance