Meanwhile, in America: Half of adults' faces are in police databases
'It is out of control,' think tank thinks
Images representing 117 million American adults – almost half the grownups in the country – can be found in the facial recognition databases maintained by US law enforcement agencies, according to a study conducted by the Center on Privacy and Technology at Georgetown Law School.
That figure is expected to grow as facial recognition technology becomes more capable and more commonplace. Yet such systems have very little oversight.
"A few agencies have instituted meaningful protections to prevent the misuse of the technology," the study says. "In many more cases, it is out of control."
In a phone interview with The Register, Jonathan Frankle, staff technologist for the Center on Privacy and Technology, said the issue with the rising use of facial recognition technology is that it's happening without much input from the public or regulators.
"Transparency makes a lot of the problems we've noticed easier to detect," said Frankle.
Some of these problems include: the disproportionate representation of African Americans in US law enforcement databases; the potentially chilling effect of facial recognition on free speech; lack of reliable information on the accuracy of facial recognition systems; and unsettled questions about the circumstances under which facial recognition might violate Fourth Amendment protections against unreasonable searches.
The study does not seek to outlaw the technology, stating that police use of facial recognition is inevitable. Rather, it proposes a framework for considering the privacy and civil liberties risks posed by facial tracking, in order to create sound regulations.
"Putting myself in the shoes of law enforcement, I would be very enthusiastic about the technology," said Frankle. "It has the promise to save a lot of very tedious labor."
But as the CPT study suggests, police departments have been a bit too enthusiastic about facial recognition. One in four American law enforcement agencies across federal, state, and local levels use facial recognition technology, the study estimates. And now some US police departments have begun deploying real-time facial recognition systems.
The study says that contract documents indicate at least five major police departments in US cities – including Chicago, Dallas, and Los Angeles – either run real-time facial recognition using street surveillance cameras, have bought the technology, or have expressed the intent to do so.
At the same time, the utility of the technology remains open to question. Where public data about the efficacy of facial recognition searches exists, it's not particularly compelling. "Of the FBI’s 36,420 searches of state license photo and mug shot databases, only 210 (0.6 per cent) yielded likely candidates for further investigations," the study says. "Overall, 8,590 (4 per cent) of the FBI’s 214,920 searches yielded likely matches."
What's more, reliable metrics for the accuracy of facial recognition systems are scarce. For example, FaceFirst, facial recognition vendor, advertises "an identification rate above 95 per cent." The CPT study claims this is misleading and cites a 2015 contract with the San Diego Association of Governments that disclaims any specific success rate: "FaceFirst makes no representations or warranties as to the accuracy and reliability of the product in the performance of its facial recognition capabilities."
Frankle said the accuracy of facial recognition technology depends upon the conditions in which it is used. Presented with mugshots taken in perfect lighting, such systems can be highly accurate, he said, but in dim light or at night, the systems may struggle.
The study cites a facial recognition test conducted with real-time video in Mainz, Germany, from 2006 to 2007, where accuracy was 60 per cent during the day and 10 to 20 per cent at night.
Accuracy issues can be compounded by human involvement – rather than automatically presenting a match, facial recognition systems often present a list of likely matches to an operator for approval. Citing algorithm accuracy ranging from 80 per cent to 90 per cent among the top ten vendors, a separate study published last year found that human participation in the process reduced the accuracy of facial recognition systems by 50 per cent.
While a determination on the constitutionality of facial recognition will have to wait for an appropriate court challenge, the CPT study calls for legislators to place limits on the use of the technology, for law enforcement agencies to be subject to public reporting requirements, and for technology vendors to vet their algorithms for racial, age, and gender bias.
"Face recognition can and should be used to respond to serious crimes and public emergencies," the study concludes. "It should not be used to scan the face of any person, at any time, for any crime." ®
- Advanced persistent threat
- Black Hat
- Bug Bounty
- Common Vulnerability Scoring System
- Cybersecurity and Infrastructure Security Agency
- Cybersecurity Information Sharing Act
- Data Breach
- Data Protection
- Data Theft
- Digital certificate
- Identity Theft
- Kenna Security
- NSO Group
- Palo Alto Networks
- Privacy Sandbox
- Quantum key distribution
- Remote Access Trojan
- RSA Conference
- SQL Server
- Trusted Platform Module
- Zero trust