Computers, Privacy & the Constitution

View   r4  >  r3  >  r2  >  r1
KojiOhtaniFirstPaper 4 - 28 Apr 2022 - Main.KojiOhtani
Line: 1 to 1
 
META TOPICPARENT name="FirstPaper"

Facial recognition technology: Risks and possible regulations

Changed:
<
<
-- By KojiOhtani - 10 Mar 2022 (updated 28 April 2022)
>
>
-- By KojiOhtani - 10 Mar 2022 (Updated 28 April 2022)
 

Introduction


KojiOhtaniFirstPaper 3 - 28 Apr 2022 - Main.KojiOhtani
Line: 1 to 1
 
META TOPICPARENT name="FirstPaper"

Facial recognition technology: Risks and possible regulations

Changed:
<
<
-- By KojiOhtani - 10 Mar 2022
>
>
-- By KojiOhtani - 10 Mar 2022 (updated 28 April 2022)
 

Introduction

Changed:
<
<
Facial recognition technology (FRT), one of the biometrics technologies, is used in many scenes in our society today. It is also true in criminal investigations and counter-terrorism contexts. For example, Clearview AI is adopted by hundreds of law enforcement bodies, including the FBI, and showed its capacity by identifying a suspect of a gun firing incident within 20 minutes (https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html).
>
>
Facial recognition technology (FRT), a biometric technology, is used in many scenes in society today, including criminal investigations. FRT typically involves three steps: (i) collecting facial data to create a searchable database; (ii) obtaining facial data that the user wants to identify; and (iii) matching the data obtained in (ii) with the database created in (i) using pattern recognition to identify the person.
 

Concerns?

Changed:
<
<
Some states and municipal bodies started to forbid or regulate the use of FRT by law enforcement organizations. ACLU initiated a lawsuit against Clearview AI based on Illinois Biometric Information Privacy Act (https://www.nytimes.com/2020/05/28/technology/clearview-ai-privacy-lawsuit.html?searchResultPosition=8). However, it seems that such regulations have not covered all states at this moment. While it is clear that FRT is useful for criminal investigations or counter-terrorism intelligence, FRT entails a severe threat to our privacy. Also, mass surveillance will cause a chilling effect on our activities. Suppose the government can continuously trace our whereabouts using FRT and surveillance facilities in cities. In that case, the government can know what kind of gathering/speech activities we participate in, which causes chilling effects. It is also said that FRT brings about biased output if applied to people of color (Fairness problem). Therefore, I think FRT should be used under certain regulations.
>
>
While FRT is useful, it entails a threat to our privacy. Moreover, mass surveillance will cause a chilling effect on our activities. Suppose the government can continuously trace our whereabouts using FRT. In that case, they will know what kind of gathering or speech activities we participate in(1). Some people are acting to resist the use of FRT. ACLU initiated a lawsuit against Clearview AI based on Illinois Biometric Information Privacy Act (BIPA). This regulation is focused on step (i) above(2). If people suspect that the government abuses FRT like in China, then FRT cannot be trusted and accepted in our society. Therefore, FRT should be used under certain regulations.

Notes

1 : FRT can cause a biased output problem when applied to people of color (fairness problem). I will not discuss it in detail in this draft as this is not a privacy issue. However, it is notable that many ordinances regulating FRT mention this problem.

2 : Clearview AI structures a massive facial database using online sources such as Facebook.


 

How should we regulate FRT?

Added:
>
>

A. Warrant or legislation?

(a) Warrant

If the government collects data from private corporations (e.g., employee/student lists) to structure the database (step (i)), then it may fall under the definition of "seizure." See_ Carpenter v. United States 138 S. Ct. 2206(2018)_.
 
Changed:
<
<

A Require a warrant

The first possible way is to require a warrant to use FRT for every search/incident. However, can we deem the use of FRT "search and seizure" under the Fourth amendment? Suppose the law enforcement body collects the data involuntarily from private corporations (e.g., employee/student list, video data of CCTV in private premises) to structure the database. In that case, it may fall under the definition of "seizure." See Carpenter v. United States 138 S. Ct. 2206 (2018).

>
>
If the government uses data from the police's CCTV in public spaces (for step (ii)) or pictures posted on Facebook (for step (i)), which anybody can see, there will be a gray area. Our privacy expectations are generally low in such situations. However, before FRT developed, we did not expect that our appearance in public spaces would cause such a threat to our privacy. We should be afforded stronger protection when our faces are processed by FRT(step (iii)). This understanding could be supported by precedents such as Kyllo v. United States 533 US 27(2001).
 
Changed:
<
<
On the other hand, if they use data from the police's CCTV in public space or pictures posted on Facebook publicly, there will be a gray area. Anybody can see our faces in public spaces or on our Facebook pages open to the public, so our privacy expectations are generally low in such situations. Having said that, before FRT developed, we did not expect that our appearance in public space would cause such a threat to our privacy. In that sense, we should be afforded stronger protection when our faces are processed by FRT. This understanding could be supported by precedents such as Kyllo v. United States 533 US 27 (2001), where the Supreme Court said the use of a thermal scanner from a public street to detect the temperature in the suspect's garage required a warrant.
>
>

(b) Legislation

 
Changed:
<
<
Even if we require a warrant to use FRT, there are a few practical issues. For example, how and when the government should show the warrant to the persons whose face data is processed.
>
>
Another possibility is to legislate a new law/ordinance to regulate the use of FRT wholistically. One way is to prohibit the use of FRT for law enforcement purposes altogether. For example, EU published its draft regulation, which in principle prohibits the use of remote biometric identification systems, including FRT, in public spaces for law enforcement purposes. Many ordinances recently made put broad prohibitions by regulating step (iii) above (e.g., San Francisco, Boston).
 
Changed:
<
<

B Legislate a specific law to regulate the use of FRT

>
>
Another way is to allow the use of FRT under certain restrictions. Washington State requires law enforcement bodies to observe specific procedural requirements (e.g., observation of data management policy, periodical submission of accountability report).
 
Changed:
<
<
Another possibility is to legislate a new law to regulate the use of FRT wholistically. One way is to prohibit the use of FRT for law enforcement purposes altogether. For example, San Francisco prohibits the use of FRT by the city government comprehensively. EU published its draft regulation, which in principle prohibits the use of remote biometric identification systems, including FRT, in public space for law enforcement purposes (https://digital-strategy.ec.europa.eu/en/library/communication-fostering-european-approach-artificial-intelligence). At this moment, it is not clear what kind of exception will be allowed and how rigid the process for the exception will be.
>
>

(c) Which way should we take?

 
Changed:
<
<
Another way is to allow the use of FRT under certain restrictions. Washington State requires law enforcement bodies to observe specific procedural requirements (e.g., training of operators of the systems, observation of data management policy, creating plans to mitigate the impact on minorities, periodical submission of accountability report).
>
>
As discussed, steps in FRT use may amount to "search and seizure", but it would take time for the Court to create a rule regarding FRT(3). Also, legislative rulemaking is more fitful in establishing detailed requirements and periodic audit practices. Therefore, legislation that specifically covers the requirements for the lawful operation of FRT would be better.

Notes

3 : There are still other practical issues, for instance, how and when the government should show the warrant to the persons whose face data is processed.


 
Changed:
<
<

C Which way should we take?

>
>
If we focus on privacy, comprehensive prohibition would be preferred. However, if used appropriately, FRT's usefulness is obvious. The government needs to utilize it to cope with criminals or espionage who use more complicated technics. For instance, if there is a kidnapping case or immediate threat of a terrorist attack, FRT would enable the police to find the victim/suspect swiftly with limited resources. Therefore, legislation should leave some room to use FRT on the condition that authorities follow the legislation's requirements and are subject to audit under it.
 
Changed:
<
<
If we focus on privacy, comprehensive prohibition would be the best option. However, I think such a measure is too much. If used appropriately, FRT's usefulness is obvious. To cope with criminals or espionage who use more complicated technics with limited resources, the government also needs to utilize the newly developed technologies. For instance, there is a kidnapping case or immediate threat of terrorist attack by a known terrorist, FRT would enable the police to find the victim/suspect swiftly.
>
>

B. Should the US seek a nationwide and uniform regulation?

 
Changed:
<
<
As discussed, there could be a form of use of FRT that may amount to "search and seizure" under the fourth amendment that should require a warrant, but it would take time for the Court to create a rule regarding FRT. Even if the Court establishes a rule, the rapid development of technology will bring about new issues.
>
>
If we regulate FRT with legislation, should it be based on federal or state laws and ordinances? Justice Brandeis stated in his opinion in New State Ice Co. v. Liebmann, 285 U.S. 262(1932) that the state may serve as a laboratory of democracy to try novel social and economic experiments without risk to the rest of the country. As he predicted, states and municipal bodies legislate various statutes and ordinances as mentioned above. For example, while many ordinances prohibit government authorities from using FRT, Portland's ordinance prevents private entities from using FRT in public facilities to provide more privacy protection. On the other hand, Washington State's BIPA, unlike Illinoi's, limits the scope of the biometric identifier and does not stipulate citizens' rights to bring a suit. It is said that this is because of Microsoft's lobbying to leave the possibility for FRT's study and business.
 
Changed:
<
<
In order to properly regulate rapidly developing FRT, we should create legislation that specifically covers the requirements for the lawful operation of FRT. I think the rule should at least include (i) the types of incidents/situations, (ii) keeping a record of access to the system, (iii) periodical audit by independent auditors or committees. The audit is essential and should be conducted monthly or bi-monthly so that most cases will be reviewed timely.
>
>
A uniform regulation in one market is better to attract investment from other countries and take the lead in rulemaking from the international perspective as the EU did with the GDPR. The US approach can seem inefficient(4). However, it would be reasonable that local governments create regulations with their people's initiative, which brings more accountability, and promptly try regulations considering the area's situation. Also, the US federal system's flexibility to let states keep relaxed regulation intentionally (like Washington State) is attractive for innovation. Therefore, States/municipal bodies should lead in this movement.

Notes

4 : Suspect would flee to a jurisdiction where FRT regulation is strict.


 

Conclusion

Deleted:
<
<
FRT is a strong weapon for criminal and counter-terrorism investigations. However, if it is misused or if people doubt that the government abuses it like in China, FRT cannot be trusted and accepted in our society. Therefore, governments should create rules to operate the system safely and transparently as soon as possible.

I think there are two different, independent routes to an improved essay.

First, I think it would be good to discuss facial recognition technology in this paper. Your FRT is not the same thing at all. By not actually discussing the technology all the law and politics go wrong.

Software can match a face acquired in "the field" against large databases containing other faces. The target face is "recognized" with some degree of confidence among the larger collection.

This pseudo-cognitive process—just pattern-matching, a staple of software since the beginning, and grandiosely but incorrectly called "artificial intelligence"—poses none of the legal problems described here. There are problems with face-acquisition (e.g., how should government be required to behave in order to acquire particular faces from its own or others' cameras?) and database collection (Clearview AI admits building its collection of faces to search by scraping faces publicly accessible on platforms where neither the platform operator nor individual posters and subjects of photos have given permission for this use. Hence the lawsuits.)

If there are issues that arise from the recognition process itself, you don't idsolate them here.

Second, I think it would be valuable to ask what "We" is supposed to regulate "facial recognition" by whom. It is obvious from your Googling that municipalities and states are taking various administrative steps, enacting local ordinances, considering and sometimes passing state legislation. This is the process of chemical experimentation that Brandeis said went on in the "laboratories of the States," one of the most important positive features of US federalism. What value is there is choosing among approaches at the initial instant of the phenomenon (better described as "cameras acquiring faces everywhere," I think, than as "another instance of people running pattern-matching software on data") when we can allow the variable timings and interests at different layers of government to respond to changes in social uses of technology more organically? (Or should we say, in a holistic fashion?)


You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.

 \ No newline at end of file
Added:
>
>
FRT is a strong weapon for law enforcement and has a lot of business potential. However, to secure trust from people and prevent abusive use, the local governments should take the lead in creating rules to operate the system safely and transparently as soon as possible.
 \ No newline at end of file

KojiOhtaniFirstPaper 2 - 02 Apr 2022 - Main.EbenMoglen
Line: 1 to 1
 
META TOPICPARENT name="FirstPaper"
Deleted:
<
<
 
Deleted:
<
<
It is strongly recommended that you include your outline in the body of your essay by using the outline as section titles. The headings below are there to remind you how section and subsection titles are formatted.
 

Facial recognition technology: Risks and possible regulations

Line: 46 to 44
 FRT is a strong weapon for criminal and counter-terrorism investigations. However, if it is misused or if people doubt that the government abuses it like in China, FRT cannot be trusted and accepted in our society. Therefore, governments should create rules to operate the system safely and transparently as soon as possible.
Added:
>
>
I think there are two different, independent routes to an improved essay.

First, I think it would be good to discuss facial recognition technology in this paper. Your FRT is not the same thing at all. By not actually discussing the technology all the law and politics go wrong.

Software can match a face acquired in "the field" against large databases containing other faces. The target face is "recognized" with some degree of confidence among the larger collection.

This pseudo-cognitive process—just pattern-matching, a staple of software since the beginning, and grandiosely but incorrectly called "artificial intelligence"—poses none of the legal problems described here. There are problems with face-acquisition (e.g., how should government be required to behave in order to acquire particular faces from its own or others' cameras?) and database collection (Clearview AI admits building its collection of faces to search by scraping faces publicly accessible on platforms where neither the platform operator nor individual posters and subjects of photos have given permission for this use. Hence the lawsuits.)

If there are issues that arise from the recognition process itself, you don't idsolate them here.

Second, I think it would be valuable to ask what "We" is supposed to regulate "facial recognition" by whom. It is obvious from your Googling that municipalities and states are taking various administrative steps, enacting local ordinances, considering and sometimes passing state legislation. This is the process of chemical experimentation that Brandeis said went on in the "laboratories of the States," one of the most important positive features of US federalism. What value is there is choosing among approaches at the initial instant of the phenomenon (better described as "cameras acquiring faces everywhere," I think, than as "another instance of people running pattern-matching software on data") when we can allow the variable timings and interests at different layers of government to respond to changes in social uses of technology more organically? (Or should we say, in a holistic fashion?)

 
You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

KojiOhtaniFirstPaper 1 - 11 Mar 2022 - Main.KojiOhtani
Line: 1 to 1
Added:
>
>
META TOPICPARENT name="FirstPaper"

It is strongly recommended that you include your outline in the body of your essay by using the outline as section titles. The headings below are there to remind you how section and subsection titles are formatted.

Facial recognition technology: Risks and possible regulations

-- By KojiOhtani - 10 Mar 2022

Introduction

Facial recognition technology (FRT), one of the biometrics technologies, is used in many scenes in our society today. It is also true in criminal investigations and counter-terrorism contexts. For example, Clearview AI is adopted by hundreds of law enforcement bodies, including the FBI, and showed its capacity by identifying a suspect of a gun firing incident within 20 minutes (https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html).

Concerns?

Some states and municipal bodies started to forbid or regulate the use of FRT by law enforcement organizations. ACLU initiated a lawsuit against Clearview AI based on Illinois Biometric Information Privacy Act (https://www.nytimes.com/2020/05/28/technology/clearview-ai-privacy-lawsuit.html?searchResultPosition=8). However, it seems that such regulations have not covered all states at this moment. While it is clear that FRT is useful for criminal investigations or counter-terrorism intelligence, FRT entails a severe threat to our privacy. Also, mass surveillance will cause a chilling effect on our activities. Suppose the government can continuously trace our whereabouts using FRT and surveillance facilities in cities. In that case, the government can know what kind of gathering/speech activities we participate in, which causes chilling effects. It is also said that FRT brings about biased output if applied to people of color (Fairness problem). Therefore, I think FRT should be used under certain regulations.

How should we regulate FRT?

A Require a warrant

The first possible way is to require a warrant to use FRT for every search/incident. However, can we deem the use of FRT "search and seizure" under the Fourth amendment? Suppose the law enforcement body collects the data involuntarily from private corporations (e.g., employee/student list, video data of CCTV in private premises) to structure the database. In that case, it may fall under the definition of "seizure." See Carpenter v. United States 138 S. Ct. 2206 (2018).

On the other hand, if they use data from the police's CCTV in public space or pictures posted on Facebook publicly, there will be a gray area. Anybody can see our faces in public spaces or on our Facebook pages open to the public, so our privacy expectations are generally low in such situations. Having said that, before FRT developed, we did not expect that our appearance in public space would cause such a threat to our privacy. In that sense, we should be afforded stronger protection when our faces are processed by FRT. This understanding could be supported by precedents such as Kyllo v. United States 533 US 27 (2001), where the Supreme Court said the use of a thermal scanner from a public street to detect the temperature in the suspect's garage required a warrant.

Even if we require a warrant to use FRT, there are a few practical issues. For example, how and when the government should show the warrant to the persons whose face data is processed.

B Legislate a specific law to regulate the use of FRT

Another possibility is to legislate a new law to regulate the use of FRT wholistically. One way is to prohibit the use of FRT for law enforcement purposes altogether. For example, San Francisco prohibits the use of FRT by the city government comprehensively. EU published its draft regulation, which in principle prohibits the use of remote biometric identification systems, including FRT, in public space for law enforcement purposes (https://digital-strategy.ec.europa.eu/en/library/communication-fostering-european-approach-artificial-intelligence). At this moment, it is not clear what kind of exception will be allowed and how rigid the process for the exception will be.

Another way is to allow the use of FRT under certain restrictions. Washington State requires law enforcement bodies to observe specific procedural requirements (e.g., training of operators of the systems, observation of data management policy, creating plans to mitigate the impact on minorities, periodical submission of accountability report).

C Which way should we take?

If we focus on privacy, comprehensive prohibition would be the best option. However, I think such a measure is too much. If used appropriately, FRT's usefulness is obvious. To cope with criminals or espionage who use more complicated technics with limited resources, the government also needs to utilize the newly developed technologies. For instance, there is a kidnapping case or immediate threat of terrorist attack by a known terrorist, FRT would enable the police to find the victim/suspect swiftly.

As discussed, there could be a form of use of FRT that may amount to "search and seizure" under the fourth amendment that should require a warrant, but it would take time for the Court to create a rule regarding FRT. Even if the Court establishes a rule, the rapid development of technology will bring about new issues.

In order to properly regulate rapidly developing FRT, we should create legislation that specifically covers the requirements for the lawful operation of FRT. I think the rule should at least include (i) the types of incidents/situations, (ii) keeping a record of access to the system, (iii) periodical audit by independent auditors or committees. The audit is essential and should be conducted monthly or bi-monthly so that most cases will be reviewed timely.

Conclusion

FRT is a strong weapon for criminal and counter-terrorism investigations. However, if it is misused or if people doubt that the government abuses it like in China, FRT cannot be trusted and accepted in our society. Therefore, governments should create rules to operate the system safely and transparently as soon as possible.


You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.


Revision 4r4 - 28 Apr 2022 - 20:30:45 - KojiOhtani
Revision 3r3 - 28 Apr 2022 - 17:30:34 - KojiOhtani
Revision 2r2 - 02 Apr 2022 - 14:47:36 - EbenMoglen
Revision 1r1 - 11 Mar 2022 - 00:58:12 - KojiOhtani
This site is powered by the TWiki collaboration platform.
All material on this collaboration platform is the property of the contributing authors.
All material marked as authored by Eben Moglen is available under the license terms CC-BY-SA version 4.
Syndicate this site RSSATOM