Study: Face Recognition Systems Threaten the Privacy of Millions

A broad coalition of over 50 civil liberties groups delivered a letter to the Justice Department’s civil rights division Tuesday calling for an investigation into the expanding use of face recognition technology by police. “Safeguards to ensure this technology is being used fairly and responsibly appear to be virtually nonexistent,” the letter stated. The routine unsupervised use of face recognition systems, according to the dozens of signatories, threatens the privacy and civil liberties of millions — especially those of immigrants and people of color.

These civil rights groups were provided with advance copies of a watershed 150-page report detailing — in many cases for the first time — how local police departments across the country have been using facial recognition technology. Titled “The Perpetual Lineup,” the report, published Tuesday morning by the Georgetown Center on Privacy & Technology, reveals that police deploy face recognition technology in ways that are more widespread, advanced, and unregulated than anyone has previously reported.

“Face recognition is a powerful technology that requires strict oversight. But those controls by and large don’t exist today,” said Clare Garvie, one of the report’s co-authors. “With only a few exceptions, there are no laws governing police use of the technology, no standards ensuring its accuracy, and no systems checking for bias. It’s a wild west.”

Of the 52 agencies that acknowledged using face recognition in response to 106 records requests, the authors found that only one had obtained legislative approval before doing so. Government reports have long confirmed that millions of images of citizens are collected and stored in federal face recognition databases. Since at least 2002, civil liberties advocates have raised concerns that millions of drivers license photos of Americans who have never been arrested are being subject to facial searches — a practice that amounts to a perpetual digital lineup. This report augments such fears, demonstrating that at least one in four state or local law enforcement agencies have access to face recognition systems.

Among its findings, the report provides the most fine-grained detail to date on how exactly these face recognition systems might disproportionately impact African-Americans. “Face recognition systems are powerful — but they can also be biased,” the coalition’s letter explains. While one in two American adults have face images stored in at least one database, African-Americans are more likely than others to have their images captured and searched by face recognition systems.

In Virginia, for instance, the report shows how state police can search a mug shot database disproportionately populated with African-Americans, who are twice as likely to be arrested in the state. Not only are African-Americans more likely to be subject to searches, according to the report, but this overrepresentation puts them at greatest risk for a false match.

These errors could be compounded by the fact that some face recognition algorithms have been shown to misidentify African-Americans, women, and young people at unusually high rates. In a 2012 study co-authored by FBI experts, three algorithms that were tested performed between 5 and 10 percent worse on black faces than on white faces. And the overall accuracy of systems has been shown to decrease as a dataset expands. The Georgetown report interviewed two major facial recognition vendors which said that they did not test for racial basis, despite the fact that systems have been shown to be far from “race-blind.”

A slideshow on San Diego’s privacy policy obtained by the researchers reveals that people of color in the county are between 1.5 and 2.5 more likely to be targeted by its surveillance systems. San Diego County uses a mugshot-only system, and repeated studies have shown that African-Americans are twice as likely as white people to be arrested and searched by police.

First Amendment Concerns

The Georgetown report shows for the first time that at least five major police departments have “run real-time face recognition off of street cameras, bought technology that can do so, or expressed a written interest in buying it.” They warn that such real-time surveillance tracking could have serious implications for the right to associate privately.

“This is the ability to conduct a real time digital manhunt on the street by putting people on a watchlist,” explained Alvaro Bedoya, the executive director of the Georgetown Center and one of the report’s co-authors. “Now suddenly everyone is a suspect.” Real-time recognition, he added, could have a chilling effect on people engaging in civil conduct. “It would be totally legal to take picture of people obstructing traffic and identify them.”

Indeed, as the ACLU revealed last week, face recognition systems were used to track Black Lives Matter protesters in Baltimore. “There’s a question of who is being subjected to this kind of facial recognition search in the first place,” David Rocah, a staff attorney at the ACLU of Maryland, told the Baltimore Sun. “Is it only Black Lives Matter demonstrators who get this treatment? Are they drawing those circles only in certain neighborhoods? The context in which it’s described here seems quintessentially improper.”

Bedoya pointed out that these systems in Baltimore uploaded social media photographs of protestors into these systems to conduct real-time street surveillance. “It turns the premise of the Fourth Amendment on its head,” he added.

The Georgetown report shows that some departmental policies allow for face recognition algorithms to be used in the absence of an individualized suspicion, which means the technology could conceivably be used to identify anyone. At least three agencies, according to the report, allow face recognition searches to identify witnesses of a crime in addition to criminal suspects.

As privacy organizations have previously noted, the FBI’s federal database includes and simultaneously searches photographic images of U.S. citizens who are neither criminals or suspects. The Georgetown report likewise shows that some state databases include mug shots, while others include both mug shots and driver’s license photos.

In a landmark Supreme Court decision on privacy, in which the justices unanimously concluded that the prolonged use of an unwarranted GPS device violated the Fourth Amendment, Justice Sotomayor wondered whether “people reasonably expect that their movements will be recorded and aggregated in a manner that enables the government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on.”

Of the 52 agencies found by the report to have used face recognition, however, only one department’s policy explicitly prohibited officers from “using face recognition to track individuals engaging in political, religious, or other protected free speech.”

Apart from some news stories focusing on the policies of specific departments, most notably those of San Diego County, reporting on law enforcement’s use of face recognition technology has been scarce. Departments themselves have not been forthcoming about their use of the technology to identify suspects on the streets and to secure convictions. And many of the documents obtained by privacy organizations about face recognition programs largely date to 2011, prior to the federal face program’s full implementation.

No Oversight, Little Data

This is partly due to how little information is available. There is no national database of departments using these programs, how they work, what policies govern them, who can access them, and how the passive information is being collected and queried. The Georgetown report, compiling tens of thousands of records produced in response to Freedom of Information requests sent to fifty of the largest police departments across the country, provides the most comprehensive snapshot to date of how and on whom face recognition systems are used — and what policies constrain their use, if any. But even this picture continues to be partial, given the continued lack of transparency of several large law enforcement agencies with some of the most advanced systems.

The researchers state that despite several news articles and descriptions of the New York Police Department’s face recognition program, the NYPD denied their records request entirely, arguing that the records fell under a “non-routine techniques and procedures” exemption. Likewise, while the Los Angeles Police Department has claimed to use real-time, continuous face recognition and has made decades of public statements about the technology, the department found “no records responsive to [their] request” for information about this or any other face recognition system. “We followed up with a number emails and calls inquiring what that meant,” Garvie said. “The final word was that they found no records responsive.”

Of the 52 agencies that did provide responsive records to the researchers, at least 24 did not provide a face recognition use policy. Four of those two dozen agencies admitted that they expressly lacked any policy whatsoever to govern their face recognition systems.

Civil rights groups have long described the difficulties of calling for greater oversight for a system whose contours, uses, and abuses are unknown. The amount of up-to-date public records collected by the Georgetown researchers has the potential to change this and spark a national conversation on oversight, Bedoya said.

“I genuinely hope that more and more of the American public has a chance to see what’s at stake here,” Bedoya said, describing face recognition as “an extraordinarily powerful tool.” “It doesn’t just track our phones or computers. It tracks our flesh and our bones. This is a tracking technology unlike anything our society has ever seen. You don’t even need to touch anything.”

No national guidelines, laws, or polices currently regulate law enforcement’s use of face recognition technology. To fill this gap, the Georgetown report proposes protective legislation for civil liberties, limits on the amount and types of data stored, and a push for independent oversight and public notice procedures.

Among their recommendations, the Georgetown researchers advise that mug shots, rather than driver’s license and ID photos, be used to populate photo databases for face recognition, and for those images to be “periodically scrubbed to eliminate the innocent.” They also suggest that financing for police face recognition systems be contingent “on public reporting, accuracy and bias tests, legislative approval—and public posting—of a face recognition use policy.”

In Seattle, where a face recognition program was funded by a $1.64 million grant from the Department of Homeland Security, some of these model guidelines are already in place. Only specially trained officers use the software, real-time use is banned, and the software’s use is limited to scanning suspicious subjects only.

The ACLU, when it first investigated nascent uses of face recognition technology back in 2002, presciently warned that the “worst-case scenario … would be if police continue to utilize facial recognition systems despite their ineffectiveness because they become invested in them, attached to government or industry grants that support them, or begin to discover additional, even more frightening uses for the technology.”

The Georgetown report offers a glimpse into this worst-case scenario, but Bedoya is hopeful that the Model Face Recognition Act proposed by the report and endorsed by the letter’s signatories provides a “deeply reasonable” solution. He pointed to the fact that state legislatures have previously passed laws to limit geolocation technology by police, automatic license plate readers, drones, wiretaps and other surveillance tools. “This is very feasible. It’s not about protecting criminals. It’s about protecting our values.”

Top photo: A facial recognition program is demonstrated during the Biometrics 2004 exhibition and conference on October 14, 2004, in London.