Facial recognition: the case for and against 'total surveillance'

by Asher Moses.

FOR • identify criminals using grainy CCTV or mobile footage
 • automatically pick people on terror watchlist
 • proactive crime fighting and monitoring
 • quicker and better Customs checks at airports
 • check multiple identities simultaneously
 • richer online services (Facebook, Google)

AGAINST
 • false positives
 • risk for total surveillance
 • potential for abuse
 • people don't necessarily know they're being watched
 • the evidence on its own won't hold up in court
 • can't change face if "hacked"

Is it the most significant policing technology since DNA testing or the next privacy disaster waiting to happen, setting us on the path towards, as The Guardian's editor puts it, "total surveillance"?

The battle lines have been drawn over face recognition technology, development of which Australia is at the forefront.

While NSW Police is keeping mum, the Australian Federal Police called face recognition a "potent tool" for linking criminals to crime while Customs said it could allow airport security clearances to be carried out in a more seamless fashion.
Private companies such as Google, Facebook and Apple are also investing heavily in face recognition.

University of Queensland professor Brian Lovell, project leader at federal government body NICTA's advanced surveillance project, earlier this month won a global Asia-Pacific ICT Alliance award for his team's five-year project, which he says solved the "holy grail" problem of face recognition.

For the first time, Lovell says he and his team have been able to use grainy, low quality CCTV video footage to identify individuals from databases and even find and track people as they move around an area.

"Our 'face search' is like a Google search in that we can search through very large databases very fast," said Lovell.

"We do recognition in real-time so you walk up to a system and you're recognised; it can search a database of 10,000 or 50,000 instantaneously and do the matching."

You won't know you're being watched
But further to that, the technology doesn't even need to have people looking into the camera for it to work, which is a current limitation of the SmartGate technology at airports.

"What we specialise in is non-cooperative surveillance, that means the person doesn't have to be aware that they are being photographed to be recognised," said Lovell.

Lovell said movies had given the false impression that police have long been able to do face recognition but in reality they can only do it when the image quality is extremely high and on a very limited basis.

"We're working with police ... we're in Canberra at the moment – virtually all the local agencies that you'd be thinking of we're probably talking to them," he said.

Lovell, who wouldn't give specifics about formal trials in Australia, said that for example if there was an assault on a taxi driver the police could use low quality footage from the surveillance camera inside the cab to match against its photo database and identify the assailant.

It could also be used by police for automated pro-active policing rather than checking CCTV footage after a crime has been committed or getting humans to monitor footage in real time.

'Privacy disaster waiting to happen'
Privacy advocates are already up in arms while the Australian Privacy Commissioner, Timothy Pilgrim, has expressed concerns.

"Face recognition is the next personal information security and privacy disaster waiting to happen," said David Vaile, executive director of the UNSW Cyberspace Law and Policy Centre, adding that once your face has been hacked there is nothing you can do.

"The extra dimension of face recognition is that it is a form of biometric identifier. Unlike passwords or credit cards, they cannot be 'revoked' and replaced if hacked – see the surgery Tom Cruise needed in Minority Report when the baddies were after him."

Both Vaile and the head of the Australian Privacy Foundation, Roger Clarke, expressed concerns surrounding the accuracy of face recognition including the potential for significant "false positives".

But Lovell said he recently conducted a trial at an unnamed airport and out of 4000 passengers from all over the world, his technology was able to pick out 11 of 12 persons of interest.

He said performance of the system depended largely on capture conditions; in airports it could obtain "close to 100 per cent" accuracy but at night performance would be lower. "At CeBit Sydney we had virtually no errors in three days of testing and demonstration," said Lovell.

He said his technology was the natural progression of the SmartGate system at Australian airports but in addition to keeping a lookout for people on a watchlist it could also be used by airports to track how long it takes passengers to move through the terminal.

Google is one of the largest technology industry players working on face recognition and related technologies. This year it acquired face recognition firm PittPatt and it has previously bought another similar biometric firm, Neven Vision.

Already, Google Images allows people to search using photos, including images of people; however Google says this is not true face recognition. Additionally, the latest version of Google Android allows people to use their face to unlock their phone but users have already tricked the security tool using photographs.

Google executive chairman Eric Schmidt remarked recently that face recognition technology now had "surprising accuracy" but such accuracy was "very concerning" due to the privacy implications.

'Formidable infrastructure for total surveillance'
The editor-in-chief of The Guardian, Alan Rusbridger, in his 2011 Orwell lecture earlier this month, revealed that he had a conversation with a "senior Google figure" who was musing about the potential of Google face recognition software, "whose effects are so far reaching the company can't quite yet decide what to do with it".

Rusbridger said the Google exec told him the software could match a face to a name with any images sitting anywhere on the web, as long as one match had been made.

"What made this so troubling he said, is that digital spiders could then crawl the web and find every picture in the public domain and match it with an identity," he said.

"So the moment one match is made it would be possible to scan every street or crowd scene over several decades to see where a particular individual was. Link that to the sort of all-pervasive CCTV systems we have in this country [Britain] and you have a formidable infrastructure – current, but also historical – for total surveillance."

Google refused to comment on this.

Facebook is also working heavily on face recognition and uses the technology in its "Tag Suggest" feature, which is able to automatically tag friends in photos that users upload. And last year, Apple bought Swedish face recognition firm Polar Rose.

Former cyber cop turned private security consultant Nigel Phair said there were "lots of good national security and law enforcement reasons" for adopting face recognition but the private sector should be careful, pointing out that Google learned the hard way via several Street View court cases that business interests did not outweigh the rights of individuals over their own image.

"The concept obviously does not sit well with civil liberties as personally identifying information (a person's face) is being captured, analysed, matched and retained against their knowledge," said Phair.

Significant privacy impacts: Privacy Commissioner
The Australian Privacy Commissioner, Timothy Pilgrim, said biometric technology including facial recognition was a "rapidly evolving area that may have significant privacy impacts, particularly when combined with CCTV and other public surveillance technology".

Pilgrim said privacy was not an absolute right and needed to be balanced against other considerations including national security and law enforcement.

"However, given the potential for facial recognition technology to be privacy invasive, I believe that the adoption of this technology by government agencies or organisations must be carefully considered," said

Pilgrim added that he expected agencies and organisations to conduct "privacy impact assessments" before rolling out face recognition. Customers should be informed with full details about any surveillance done.

NSW Deputy Privacy Commissioner John McAteer, who oversees NSW public sector agency privacy matters, said law enforcement bodies like the NSW Police were broadly exempt from NSW privacy law and state law already provided broad police powers when it came to surveillance.

He did not have a problem with state agencies using face recognition for specific crime fighting or other purposes (i.e. to look into a suspect after a crime has been committed). A similar tool, automatic numberplate recognition, was now widely used in NSW.

"However to run an application against the general populace (without their knowledge or consent) which identifies the individual person where they are in effect being investigated across the world wide web (unless they are a suspect in a matter), would appear contrary to the general functions of police or law enforcement bodies," said McAteer.

"Collecting broad criminal intelligence is one thing, but manipulating a huge information database to match it to random individuals (or large sectors or groups of the populace) not under investigation would offend the basic principles of privacy and privacy law."

Lovell said he was talking to agencies in Australia, including airports, but he expected his face recognition technology to be rolled out overseas first, pointing to significant demand for use at events like the 2012 London Olympics.

"In terms of international deployments I'm expecting two airports within the next few months, maybe 10 airports in the next 12 months," he said.

He swatted away privacy concerns, saying people did not have the right to privacy in places such as airports. Further, he said places like the Middle East and Northern Ireland and the West in general could actually use it to increase people's freedoms.

"If you want to just go about your business without being bothered surveillance is a much kinder technology than anything else – the alternative is basically having guards everywhere who are checking your records making sure you are who you say you are," said Lovell, adding that places like Britain were safer at night largely due to surveillance.

Lovell said people would struggle to find abuses of surveillance systems in Western societies. He said anything could be abused, pointing to the Nazis' use of technology in death camps.

"It's up to the government and the people running these things to use the technology sensibly," he said.

A 'potent tool' for investigations
A Customs and Border Protection spokesman said it was interested in all technologies relevant to its role on the border including emerging technologies such as "face-in-the-crowd" and "face-on-the-fly".

"These types of technology could potentially allow certain border clearance processes to be conducted as the traveler is moving through the airport while continuing to maintain the security of the border," the spokesman said.

However, Customs said it had not yet bedded down plans to trial or implement face recognition.

Asked whether face recognition technology was as significant for policing as the introduction of DNA testing, the Australian Federal Police said it was one of many tools that could enhance its investigations but performed a different function to DNA.

The AFP noted that while DNA could provide definitive proof of an individual's identity, facial recognition could merely "assist" this process.

"Facial recognition is a potent tool for investigations and intelligence to detect and investigate criminals," said the AFP.

"Its capabilities enable improved detection of criminals, linking of criminals to multiple crimes such as cold cases where only a facial image exists associated with the crime, and identification of aliases and false identities.

However, the AFP said face recognition technology could not be relied on in court as it "does not have the same power of identification" as fingerprinting and DNA.

"It does however assist in finding images to guide and inform an investigation to which experts or witnesses can then provide the requisite level of forensic identification," the AFP said.

The AFP said it had already developed its own facial recognition system to assist with identity crime investigations but refused to comment further due to the "risk of revealing police methodology".