Another issue concerns the huge amounts of personal data that they gather. A report from the Brennan Center for Justice provides a good summary of how the authorities are accessing that data in order to help them with their work:

The proliferation of connected devices provides expansive opportunities for the government to assemble detailed portraits of people’s lives. Many companies offer entire suites of connected devices: Google sells everything from connected cameras to thermostats and activity trackers to digital assistants, and even offers private security monitoring through its partnership with Brinks. Police can further augment data from connected devices with data collected by their own substantial arsenals of surveillance tools. This type of comprehensive tracking would have been unimaginable before the digital age and eliminates practical limits on surveillance, such as the expense of allocating personnel to engage in 24/7 monitoring.

The increased use of connected devices in people’s lives brings with it a new problem. Where single devices provide only a partial record of a person’s activities, data from multiple Internet of Things systems can be consolidated to provide an extremely detailed picture of what a person is doing, and with whom. This issue will only get worse as more devices are routinely installed in homes.

One of the most troubling aspects of this pervasive surveillance is that it is hard to opt out of it. For example, in some areas, Amazon’s Ring devices watch everything that happens in the locality. Increasingly, that data is available to the local police, sometimes in real time. And yet for the person walking or driving down the street, it is hard to know which houses have Ring devices spying on passers-by, and certainly impossible to avoid being watched where they are. Similarly, if smart speakers are installed in a person’s home, visitors are unavoidably being spied upon, even if it is not evident, and probably not intentional. Overall, this leads to a normalization of surveillance, which becomes a habitual and invisible part of life’s background.

The Brennan Center report runs through the constitutional and statutory protections against such surveillance that are available under US law. In the EU, the GDPR is likely to provide even stronger privacy protections, although this has not yet been tested in the courts. The author of the Brennan Center report, Angel Diaz, has also put together a guide to the use of Internet of Things devices. It includes summaries of how the devices work, who makes them, what kinds of data are collected and how long it is retained. Particularly useful is the listing of possible uses of device data by law enforcement, transparency reports, relevant legal cases, and further reading. Since most readers of this blog will already have a good idea of how such systems work, probably the most valuable part of this resource is the listing of current cases involving Internet of Things devices. One of the most interesting is from 2017, and concerns a Fitbit tracker. As the New York Times reported at the time:

When Connecticut police arrived at the home on the morning of Dec. 23, 2015, Mr. Dabate spoke of a violent struggle with a masked intruder who zip-tied him to a chair, demanded his wallet and credit cards, cut him with a knife and then fatally shot his wife in the basement, according to an arrest warrant.

But over time, the narrative that Mr. Dabate told investigators started to unravel when compared with a timeline pieced together using digital data from the family home, the warrant said. Most importantly, a Fitbit on Ms. Dabate’s waistband recorded that she had walked 1,217 feet around the house during the time her husband said they were being attacked.

It’s clear that Fitbit-like devices provide uniquely valuable information in the case of murder or physical violence against a person. They provide detailed information that can undermine any attempts by a perpetrator to construct alternative explanations of events. The New York Times quotes a prosecutor as saying: “There is far more data out there than we can keep up with.” That’s clearly problematic from a privacy point of view, but it does have one important benefit. It underlines once more why the authorities’ persistent claim that backdoors need to be added to encrypted systems because things are “going dark” is simply untrue. It might even be said that the arrival of the Internet of Things represents a golden age for law enforcement, when they have more data than ever before.

Featured image by Alexei Zverev.

The post Not going dark: personal data from the Internet of Things ushers in a golden age for law enforcement appeared first on Privacy News Online by Private Internet Access VPN.

“the latest drone technology — mirroring technology that powers self-driving cars — has the power to transform everyday policing, just as it can transform package delivery, building inspections and military reconnaissance. Rather than spending tens of millions of dollars on large helicopters and pilots, even small police forces could operate tiny autonomous drones for a relative pittance.

For example, one drone system deployed by police in California is able to negotiate obstacles in a landscape completely on its own, where traditional drones would either be unable to pass, or would run the risk of crashing because of the challenging terrain. Another system is capable of following a particular person or vehicle autonomously. Here’s an example of the powerful new features some autonomous drones now have:

Shield AI, a start-up in San Diego that has worked with police departments, has developed a drone that can fly into a building and inspect the length and breadth of the premises on its own, with no pilot, in the dark as well as in daylight.

Traditionally, drones have only been useful outdoors, where they have plenty of space to move around. These new systems would allow surveillance and pursuit to move seamlessly between the outside world and indoors, depending on how the latter were laid out. For more complex buildings, it is easy to envisage drones being paired with the walking robot systems such as those from Boston Dynamics, recently bought by Hyundai Motor Group. A video released in 2018 showed a Boston Dynamics robot opening a closed door. Given the rapid progress in both hardware and software since then, it seems likely that systems able to cope with even more complex situations inside a building are under development, and will soon be available.

As the New York Times article points out, these new capabilities of drones (and robots) bring with them serious concerns about their effect on people’s privacy. Drones in particular are troubling, because they can carry out surveillance over extended periods, often without being noticed by those being watched.

That was certainly the case with a related kind of high-altitude surveillance that has been carried out in Baltimore this year. There, a spy plane rather than a drone has been operating, but more powerful drones capable of longer, higher flights could also be used for this purpose. The surveillance program is a partnership between the Baltimore police and the Ohio-based company Persistent Surveillance Systems, which owns the spy planes and employs the analysts who examine the footage when a police department makes a request. As an article in Vice reports, the local police were less than honest about what they were up to:

The Baltimore Police Department told the public and a federal appeals court that the surveillance images would only be stored for 45 days, that the planes would only be used for limited tracking of individuals to and from known crime scenes, and that the Aerial Investigation Research (AIR) program couldn’t be used to gather identifying information like license plate numbers.

The Baltimore Police Department was lying, according to an audit from independent evaluators hired by the city.

Baltimore police were using the imagery to track individuals over multiple days – in one case across three days and 11 different locations. The police stated that the imagery could not be used to determine characteristics about suspects, such as their ethnicity, clothing, or their vehicle’s license plate number. However, Persistent Surveillance Systems analysts have access to the city’s network of CCTV cameras and Automated License Plate Readers. They can combine them with AIR images to allow the Baltimore police to identify people and track them over long periods of time.

That’s a particularly troubling aspect, because it hints at what is to come. In the future, drones with extended flight capabilities could routinely sweep over cities, gathering data that is fed into a central monitoring system to create a complete, near real-time picture of everything that is happening on the ground. This data would be combined with rich information from other surveillance systems, such as CCTV, to provide more granular tracking in the urban space. Autonomous drones could be deployed to follow particular individuals or vehicles more closely, watching their every move, and capturing the details of their activities as video – something that today’s systems are already able to do, according to the New York Times article.

This is such a new area that the laws governing this kind of surveillance are still unclear. As mentioned above, France is already bringing in new legislation that will allow precisely this kind of routine police use of drones. Other countries will doubtless do the same. Privacy advocates need to start drawing up the kind of governance frameworks they would like to see for this new kind of surveillance before it becomes routine and it is too late to do anything about it.

Featured image by Josh Sorenson.

The post Should we worry about the possibility of police surveillance using autonomous drones with added AI ? Too late: it’s already here appeared first on Privacy News Online by Private Internet Access VPN.

Pending legislation in France’s parliament would create a new criminal offense for publishing images of police officers with intent to cause them harm. Offenders would face a maximum penalty of up to one year in prison and a 45,000-euro ($53,000) fine.

The French government says the measure is to protect police officers from online calls for violence. But critics point out that it would hinder the legitimate work of journalists reporting on police brutality, and would also discourage members of the public from filming the police committing crimes. These are particularly relevant concerns given two recent cases of police brutality in France. In July, three police officers were charged with the manslaughter of a man of North African heritage, in part thanks to a video recorded by a member of the public. More recently, a video was posted of French police officers beating a black music producer in and outside his studio.

Clearly taken aback by the 100,000 who demonstrated against the law this weekend, the French government has just announced that it is rewriting the current Article 24. It has said that it will be submitting a new version for legislative approval, so it evidently still intends to bring in some kind of ban on filming the police. Although Article 24 has caused the greatest public concern, the Global Security Law contains many other equally troubling elements, which have been largely overlooked so far. It would allow the police to use mobile cameras to stream images in real time to police centers. The fear is that automated facial recognition could be applied to these streams, something that other police forces around the world are already exploring. This would allow the identity to be established of people taking part in demonstrations, for example. The current text also gives the police easier access to CCTV cameras in private buildings, and allows a wider range of people to view surveillance videos of public roads.

Another important part of the new law is a push to use drones for police surveillance purposes. A White Paper from the French government on Homeland Security contains some striking statistics about the use of drones by the police in France. The report found that in July 2019 the National Police had 30 drones and 23 pilots. In November 2020, this had risen to 235 drones and 146 pilots. In April 2020, the Ministry of the Interior published a call for tenders to acquire 650 more drones. All of these moves were before the relevant laws authorizing their use had been passed. The proposed Global Security Law could open the floodgates for police forces across France to use drones to carry out aerial surveillance routinely.

The same White Paper provides fascinating insights into the thinking of the French government as regards the future development of its surveillance capabilities, of which the Global Security Law is merely the first step. As the French digital rights organization La Quadrature du Net explains (via Google Translate, original in French):

This book provides a multitude of projects, each more delusional and frightening than the last. It offers an automated analysis of social networks (page 221), connected vests for the police (page 227), or even augmented glasses or helmets (page 227). Finally, the White Paper stresses the importance of biometrics for the police. Between proposal for the interconnection of biometric files (TAJ, FNAEG, FAED, etc.) (page 256), the use of fingerprints as an identification tool during identity checks and the equipment of police and gendarme tablets (NEO and NEOGEND) of contactless fingerprint reader (page 258), to do more research on voice and odor recognition (!) (page 260) or finally to urge the legislator to be able to experiment with facial recognition in the public space (page 263).

France’s lower chamber, the National Assembly, has passed the bill with amendments, and the text now goes to the French Senate. As well as the street demonstrations against the Global Security Law, national and international bodies have expressed concern about its measures. These include the UN High Commissioner to Human Rights, the Defender of Rights, the National Consultative Commission on Human Rights, the League of Human Rights, the Journalist National Unions, Amnesty International, Reporters without Borders, Greenpeace plus a collective of 65 organizations.

This new law certainly has many troubling aspects. It was rushed through the lower house of the French parliament extremely rapidly, which means that it was not subjected to proper scrutiny. That’s bad enough for any law, but for one with such far-reaching implications for privacy and freedom of speech, it is particularly egregious. It’s also worrying that it seems to be part of a much wider agenda that aims to strengthen the powers of what the French government’s White Paper calls the “internal security continuum”: the National Police, the municipal police, the gendarmerie and private security agents. Finally, if passed in anything like its present form, the new law would also set a terrible precedent for other countries around the world. Many of them are already thinking along similar lines when it comes to granting police more powers, and strengthening surveillance, particularly the kinds that involve the latest technology like drones. Given its historical love for liberty, it’s disappointing that France seems intent on damaging it in so many ways.

Feature image by Domenjod.

The post France rocked again by demonstrations against the new “Global Security Law”, which includes mass surveillance by police drones appeared first on Privacy News Online by Private Internet Access VPN.

An investigation by the Electronic Frontier Foundation (EFF) found that the Ring doorbell app for Android was “packed with third-party trackers sending out a plethora of customers’ personally identifiable information”. The EFF’s research discovered that four main analytics and marketing companies were receiving information from the app that included things such as the names, private IP addresses, mobile network carriers, persistent identifiers, and sensor data on the devices of paying customers. Also potentially concerning is the fact that Amazon keeps records of every motion detected by its Ring doorbells, as well as the exact time they are logged down to the millisecond. Conscious of the growing concerns about privacy, Amazon has improved account security and privacy control, although not significantly.

The police connection is even more problematic. A number of articles have explored whether the partnerships with local law enforcement have produced any results in terms of catching criminals and reducing local crime. According to an NBC news investigation, Ring claims that an installation of its doorbell cameras reduces burglaries by more than 50 percent. But after interviewing 40 law enforcement agencies in eight states that have partnered with Ring for at least three months, NBC News found “there is little concrete evidence to support the claim.” Another investigation by Cnet reached the same conclusion. It looked at property crime statistics from three of Ring’s earliest police partners, and compared the situation before and after working with Ring. The investigation found “minimal impact from the technology“.

One of the principal concerns with the police use of Ring systems is that this could lead to routine facial recognition techniques being deployed. Earlier this year, the journalist Cyrus Farivar found a video from Ring that appears to be a sales pitch to police departments. It includes a statement that future versions of Ring will include “person recognition“. But in response to Farivar’s questions, Ring’s spokesperson said: “The features described are not in development or in use, and Ring does not use facial recognition technology…” At the same time, Ring is clearly considering that option, as an article in Ars Technica noted:

Ring last week distributed a confidential survey to beta testers weighing sentiment and demand for several potential new features in future versions of its software. According to screenshots shared with Ars, potential new features for Ring include options for enabling or disabling the camera both physically and remotely, both visual and audible alarms to ward off “would-be criminals,” and potential object, facial, and license plate detection.

In any case, there is evidence that some police forces are keen to apply their own facial recognition capabilities to data from Ring cameras. This is particularly troubling given another idea police are exploring in the US:

Police in Jackson, Mississippi, have started a pilot program that would allow Ring owners to patch the camera streams from their front doors directly to a police Real Time Crime Center. The footage from your front door includes you coming and going from your house, your neighbors taking out the trash, and the dog walkers and delivery people who do their jobs in your street. In Jackson, this footage can now be live streamed directly onto a dozen monitors scrutinized by police around the clock. Even if you refuse to allow your footage to be used that way, your neighbor’s camera pointed at your house may still be transmitting directly to the police.

Nor is this is a matter of basic facial recognition. The EFF found in some recent research that more than 35 law enforcement agencies use advanced video analytics technology that brings a range of capabilities to the police forces applying them to video streams. These include searching through hours of footage from cameras at different locations in order to home in on a particular face or a specific colored backpack, for example. “Unusual motions” can be detected in scenes, and searches conducted that pick out clothing based on color, accessories or hair. Other advanced capabilities includes proximity detection, and skin temperature.

All of those tools require multiple feeds of video data. That is precisely what Ring doorbells provide. As more people install them and make some or all of their data available to law enforcement, the possibilities that flow from linking them together using advanced analytics become richer. Moreover, as computers become cheaper, and software more powerful, these kind of capabilities will inevitably seem even more attractive to police departments constantly under pressure to do better. We can expect this kind of blanket urban surveillance, conducted not by the authorities directly, but using millions of Ring video streams from private homes, to become increasingly common. Now would be a good time to ask whether that’s really a good thing.

Featured image by Ring.

The post Amazon’s Ring moves even closer to becoming the perfect urban police surveillance system appeared first on Privacy News Online by Private Internet Access VPN.

“a powerful technology that allows police to extract a full copy of data from a cellphone — all emails, texts, photos, location, app data, and more — which can then be programmatically searched.”

What’s more, most police departments do not have policies on what happens to the datta once it has been siphoned. It’s entirely possible that the data cloned from your smartphone can end up in a surveillance database. The report’s authors elaborated:

“Absent specific prohibitions, law enforcement could copy data from someone’s phone — say, their contact list — and add that information into a far-reaching police surveillance database.”

Police have conducted hundreds of thousands of device searches without a warrant

Since 2015, police have conducted hundreds of thousands of smartphone searches using MDFTs and the majority of these were done without a warrant. Running afoul of a police phone copying attack doesn’t even require a particularly heinous crime. The report’s authors wrote:

“Law enforcement use these tools to investigate not only cases involving major harm, but also for graffiti, shoplifting, marijuana possession, prostitution, vandalism, car crashes, parole violations, petty theft, public intoxication, and the full gamut of drug-related offenses. Given how routine these searches are today, together with racist policing policies and practices, it’s more than likely that these technologies disparately affect and are used against communities of color.”

This use is prevalent across the countries: In big cities and small towns alike. The price for access to these MDFTs often runs police departments a mid-five figure bill – which has been paid by police departments in cities as small as 100,000 people. In fact, many of these purchases were made with financial aid provided by federal grants. This hyperlocal violation of our privacy rights is absolutely encouraged at the federal level by the lack of clear interpretations of our constitutional rights when it comes to privacy.

A in-depth look at uses of MDFTs in Harris County, Texas highlighted that only 47% of device searches were conducted with a search warrant. The other 53% of device searches were “allowed” by consent which effectively waived the constitutional right. Until the point that law enforcement is forced to recognize that the Fourth Amendment protects citizens from this type of activity – and citizens are aware and willing to exercise that right without fear of retaliation, carrying a digital version of life in a smartphone in your pocket will continue to be a risk.

The post Police across America can break into locked phones, and often do so without a warrant appeared first on Privacy News Online by Private Internet Access VPN.

Featured: Privacy News Online – Week of October 16th, 2020

Survey finds 85% of smartphone users believe they’re being spied on by a mobile app

A new survey by WhistleOut asked users if they believe an app on their phone spies on them, and if so… which app or apps? And the results are in. Only 15% didn’t think an app was spying on them. In terms of pointing out which app survey respondents think is the spy… 68% fingered Facebook, 53% tattled on TikTok, 45% ogled at Google, and 43% instigated Instagram. Other apps that made the list include Amazon, Snapchat, Twitter, YouTube, Apple, and LinkedIn.

IRS being investigated for tracking American location data without a warrant

The oversight body over the Internal Revenue Service is formally investigating the tax agency for buying location data from a firm called Venntel. The investigation was opened after Senators Ron Wyden and Elizabeth Warren loudly requested it after news came out that the IRS had obtained location data on taxpayers without a warrant. Location data shouldn’t be accessible to government agencies without a warrant thanks to a 2017 Supreme Court ruling.

Google gives IP addresses to police of people who have searched particular keywords or addresses

Court documents from an arson case have revealed that Google regularly gives information to law enforcement on anyone who has searched a particular keyword, including physical addresses. In this case, Google gave police a list of IP addresses that had searched for a particular address in the timeframe leading up to the arson.These types of keyword warrants are similar to reverse location warrants, which have been ruled unconstitutional under the Fourth Amendment and it sure seems like the Fourth Amendment should apply here, as well.

More Privacy News This Week:

Court seeks IP address from Twitter for account allegedly linked to Seth Rich conspiracy

A US Magistrate Judge has ruled in a defamation suit that Twitter must provide information on the since deleted Twitter account @whyspertech. The account has been linked to the spread of the Seth Rich conspiracy and Twitter has until October 20th to give up the IP address and initial account registration information to the court.

Top court rules again that EU laws may not require general and indiscriminate data retention, but then muddies the privacy waters

The Court of Justice of the European Union has issued some important clarifications to the EU’s view on the data retention laws of member nations. The Court reaffirmed that national level laws cannot force communication companies to indiscriminately send all information to national security agencies. Additionally, nations can’t force companies to store logs as a preventative measure. The law does permit targeted data retention; however, the law is clear that general and indiscriminate data retention is not permitted.

Europol Names Privacy Wallets, Coins, Open Marketplaces as ‘Top Threats’ in Internet Crime Report

Europol’s latest Internet Organized Crime Threat Assessment lists specific privacy enhancing software as a top threat to international police efforts. Besides privacy focused cryptocurrency wallets like Samurai and Wasabi, Europol also called out OpenBazaar and open marketplaces a threat. At the same time, the report noted that most dark web purchases are still being made with Bitcoin, not Zcash, Dash, or Monero.

T2 security chip inside every recent Mac has an unpatchable vulnerability

Apple’s T2 coprocessor can be jailbroken using exploits that have previously been used to jailbreak iPhones. An attacker with physical access to a Mac can brute-force the FileVault drive encryption password, inject rootkits, and more. Since the attack requires physical access, I guess if you’re worried about this… don’t ever let your Mac out of your sight??

Brought to you by Private Internet Access

Privacy News Online is brought to you by Private Internet Access, the world’s most trusted VPN service.

Special thanks to Intego

Thank you to Josh Long, our cybersecurity correspondent from Intego, makers of award-winning security software.

The post Privacy News Online | Weekly Review: October 16, 2020 appeared first on Privacy News Online by Private Internet Access VPN.

Confidence in GEDmatch was not enhanced when it was announced that it was to be operated by Verogen, a company formed to market next-generation DNA sequencing technology to crime labs. Just this month, it emerged that security breaches of the GEDmatch site had caused user permissions to be reset, making all profiles visible to all users, and the entire DNA database available for police searches, regardless of whether people had opted out from that use.

Although most of the news in this area has concerned GEDmatch, the largest provider of DNA services is Ancestry.com, which has 18 million people in its AncestryDNA network. Scrutiny of the latter is likely to increase following the recently-announced acquisition of the company by Blackstone, for $4.7 billion. David Kestnbaum, a Blackstone senior managing director, said in a statement: “We believe Ancestry has significant runway for further growth as people of all ages and backgrounds become increasingly interested in learning more about their family histories and themselves.” The question is how it will do that, and how well privacy will be protected. In 2018, Blackstone’s Motel 6 hotel chain had to pay out millions of dollars to Hispanic customers to settle a proposed class-action law suit that claimed “it violated their privacy by regularly providing guest lists to U.S. Immigration and Customs Enforcement (ICE) agents.”

Those might be termed “traditional” threats to privacy arising out of the creation of massive DNA databases. But the Covid-19 epidemic is bringing with it a new problem in this area. At the heart of the global response to the new coronavirus lies testing, which allows infected individuals to be identified, and their contacts investigated. The global demand for tests is a huge opportunity for companies that can supply them. One of the leading players here is BGI Group. As its name implies – BGI stands for “Beijing Genomics Institute” – it is a Chinese company, and one of the scientific leaders in the world of genomics. A special report on the company from Reuters explains:

BGI Group, described in one 2015 study as “Goliath” in the fast-growing field of genomics research, is using an opening created by the pandemic to expand its footprint globally. In the past six months, it says it has sold 35 million rapid COVID-19 testing kits to 180 countries and built 58 labs in 18 countries. Some of the equipment has been donated by BGI’s philanthropic arm, promoted by China’s embassies in an extension of China’s virus diplomacy.

The problem is that Covid-19 test kits often collect the DNA of the person being tested. A concern is that BGI Group’s move into testing could allow it to gather genomic information about millions of people. It already does this for the Chinese government in the troubled region of Xinjiang:

BGI has engaged in gene sequencing of Xinjiang residents and has announced it would build a gene bank and a “judicial collaboration” center in Xinjiang, Axios has found, a region where authorities are seeking to build up genetics-based surveillance capabilities targeting ethnic minorities.

The Chinese authorities have a history of illegally obtaining vast amounts of personal information about US citizens, as this blog reported earlier this year. It is quite plausible that BGI Group would try to use its central position in coronavirus testing for covert DNA testing of citizens in other countries. Israel’s largest medical insurance group has already said that it won’t work with the Chinese company because of exactly this concern.

BGI Group is one of three Chinese companies that will be carrying out large-scale Covid-19 testing in Hong Kong. Given the increasingly fraught relations between Hong Kong and mainland China, some people are concerned that the Chinese government will use the testing program as a means of gathering DNA about Hong Kong citizens. The Chief Executive of Hong Kong, Carrie Lam, who generally satisfies Beijing’s wishes, was questioned on this issue. The journalist Xinqi Su reported her response:

Asked about people’s concern of their DNA samples’ security, #CarrieLam smirked and said, “It’s impossible for any one to be interested in these samples and DNA.” Lam said the lab workers won’t know the persons behind the samples and negative samples would be destroyed ASAP in HK

The developments outlined above suggest that many companies and governments will by interested in the DNA that could easily be extracted from these samples at the same time as the Covid-19 tests are conducted. Identifying individuals becomes easier the more DNA data you collect, because of the way people and their DNA are related. Covid-19 testing is a vital tool for combating the pandemic, but it would be naive to assume that there are no associated privacy risks.

Featured image by Governor Tom Wolf.

The post As privacy problems continue to pile up for DNA databases, Covid-19 introduces a major new risk appeared first on Privacy News Online by Private Internet Access VPN.

In May 2019, Ed Bridges from Wales began a crowdfunded legal action against the police force in South Wales for what he claimed was an unlawful violation of his privacy because he was subject to facial recognition scanning by the police. He said it breached data protection and equality laws. Initially, he was unsuccessful – the lower court threw out his claim for a judicial review. Bridges had said that automated facial recognition was not compatible with the right to respect for private life under Article 8 of the European Convention on Human rights (ECHR). But he then appealed to the UK’s Court of Appeal, on five grounds. The higher court has now ruled that three of those grounds are valid.

The first problem with the South Wales Police use of automated facial recognition is that there was no clear guidance where it could be used, or who could be put on the watch lists. The Court of Appeal said this failed to meet the standard required by Article 8 of the ECHR. The judges also agreed with a more technical point that the South Wales Police had failed to provide an adequate “data protection impact assessment“, as required under the UK’s Data Protection Act. The final reason the court agreed with the appeal is that the South Wales Police had failed to comply with something called the Public Sector Equality Duty (“PSED”):

The Court held that the purpose of the PSED was to ensure that public authorities give thought to whether a policy will have a discriminatory potential impact. [South Wales Police] erred by not taking reasonable steps to make enquiries about whether the [automated facial recognition] Locate software had bias on racial or sex grounds. The Court did note, however, that there was no clear evidence that [automated facial recognition] Locate software was in fact biased on the grounds of race and/or sex.

This is an important general point. It is now well recognized that AI systems are not automatically neutral, and may even be extremely discriminatory in the way they work. As the New York Times reported two years ago:

Research has shown that automated systems that are used to inform decisions about sentencing produce results that are biased against black people and that those used for selecting the targets of online advertising can discriminate based on race and gender.

That real risk of bias is problematic in the UK because of the PSED, which requires public authorities in the country to take proactive steps against precisely this problem – something that South Wales Police failed to carry out. In part, that is because it is currently hard to do, and more work is needed in order to come up with frameworks to allow AI-based systems to be checked readily for bias of any kind. At the moment, the black box approach to AI design makes it impossible to know how exactly these systems work – an unacceptable state of affairs for a technology that can have such a major impact on people’s lives, not least when deployed by police forces. The Appeal Court ruling now makes implementing ways of allowing routine scrutiny an urgent task.

The challenge to the use of automated facial recognition technology was brought on behalf of the Bridges by Liberty, a UK human rights organization. Liberty described the Appeal Court’s decision as “a huge step against [an] oppressive surveillance tool“. It is certainly a win, and one that the South Wales police has said it will not appeal against. However, it is by means the end of police use of facial recognition technologies in the UK. That will continue, but subject to the constraints and conditions introduced by the Court of Appeal’s ruling.

The judgment only applies to the UK, but the point raised about the need to ensure that black box systems do not hide biased rules is something that privacy activists in other jurisdictions are also raising with increasing urgency. It is part of a larger question about algorithmic transparency that is likely to be of relevance to every country. The UK judgment in itself is unlikely to change things much outside the UK, but does at least add to the pressure for AI systems to respect human rights such as privacy, and for that to be demonstrable through formal code inspection, not just vaguely assumed on the basis of manufacturer’s optimistic claims.

Featured image by South Wales Police.

The post Court finds UK police use of facial recognition technology breaches privacy rights, data protection laws and equality laws appeared first on Privacy News Online by Private Internet Access VPN.

Against that background, it’s rather remarkable that in the last couple of weeks, major suppliers of facial recognition technology to police forces have voluntarily halted sales. First to move was IBM. Its CEO sent a letter to US Congress on racial justice reform. One of the things Arvind Krishna wrote is the following:

IBM no longer offers general purpose IBM facial recognition or analysis software. IBM firmly opposes and will not condone uses of any technology, including facial recognition technology offered by other vendors, for mass surveillance, racial profiling, violations of basic human rights and freedoms, or any purpose which is not consistent with our values and Principles of Trust and Transparency.

Two days later, Amazon announced that it was implementing a one-year moratorium on the police use of Rekognition, its facial recognition technology. The next day, Microsoft joined the club, reported here by TechCrunch: “we’ve decided that we will not sell facial recognition technology to police departments in the United States until we have a national law in place, grounded in human rights, that will govern this technology.”

Back in 2018, Microsoft had already called for facial recognition technologies to be regulated by the government. In its own announcement, Amazon too noted that “We’ve advocated that governments should put in place stronger regulations to govern the ethical use of facial recognition technology”. Similarly, one of the first companies to limit the availability of its technology on ethical grounds, Google, wrote back in 2018: “Google Cloud has chosen not to offer general-purpose facial recognition APIs before working through important technology and policy questions.”

As for IBM’s apparently stronger statement, an article on Fast Company points out that it isn’t quite what it seems. Deb Raji wrote in a tweet that IBM had already removed face analysis and detection capabilities back in September last year. However, she speculates that the company was perhaps still selling systems privately, and that the latest announcement is about stopping that too. In any case, IBM’s statement has loopholes. For example, it talks about “general purpose” software, leaving open the possibility that it might still provide specialized systems. It also says it is fine with uses that are “consistent with our values and Principles of Trust and Transparency”, which is quite vague.

An important question is whether IBM, Amazon, Microsoft or Google will sell facial recognition systems to US intelligence agencies. Their use of these technologies is arguably just as problematic for privacy as police use: it’s just that the latter is more visible, because it is generally less covert. That’s why calls for bans on facial recognition technologies need to be much broader. Here, for example is what Amnesty International wants to see:

We are proud to stand with organizations like the Algorithmic Justice League, the ACLU, the Electronic Frontier Foundation and others who have highlighted the dangers of [facial recognition technology]. Amnesty calls for a ban on the use, development, production, sale and export of facial recognition technology for mass surveillance purposes by the police and other state agencies.

The recent moves by US tech giants at least offer the hope that such a ban might be considered. Unfortunately, even if it comes into operation, it will have only a limited, local impact. The problem is that facial recognition technology is seen as a key strategic sector in China. Chinese AI startups have flourished thanks to generous surveillance contracts from the Chinese government. As the Los Angeles Times reported at the end of last year, these companies are now doing good business overseas:

Chinese facial recognition companies have taken the lead in serving this growing international market not least because of the advantage they have over peers in other countries: a massive domestic market and an authoritarian system where privacy often takes a back seat. According to IHS Markit, China accounted for nearly half of the global facial recognition business in 2018.

Chinese companies offering facial recognition systems are well-placed to export their systems around the world, and are able to count on Chinese government support during trade deal negotiations. Authoritarian regimes in particular are more than happy to adopt the latest Chinese technology, which is extremely effective for surveillance, albeit deeply harmful to privacy.

The situation could become even worse. According to a report in the Financial Times in December 2019, Chinese technology companies are trying to shape facial recognition standards at the UN’s International Telecommunication Union. This would not only legitimize the use of intrusive facial recognition techniques for video monitoring, city and vehicle surveillance. It would also provide Chinese companies with a competitive edge in this key sector, since their products would already be well aligned with the proposed rules, if adopted.

The recent announcements by big US tech companies in this area are welcome, but they represent only a minor skirmish in the privacy wars. The real battles are taking place in anonymous conference rooms where decisions about global facial recognition standards are being discussed and set. The outcome there is unlikely to be so favorable for strong data protection, or for human rights.

Featured image by Laitr Keiows.

The post Top suppliers halt sales of facial recognition technology to the police – how much of a win is that really? appeared first on Privacy News Online by Private Internet Access VPN.

The United States’ main immigration enforcement agency, the Department of Justice, retailers including Best Buy and Macy’s, and a sovereign wealth fund in the United Arab Emirates are among the thousands of government entities and private businesses around the world listed as clients

And it seems that investors in the company, as well as its clients and general friends, had access to the tool as it was being developed, which they sometimes used for debatable purposes:

Those with Clearview logins used facial recognition at parties, on dates and at business gatherings, giving demonstrations of its power for fun or using it to identify people whose names they didn’t know or couldn’t recall.

If nothing else, that’s a chilling reminder of how this technology could be used by those already wielding power in society to bolster their position by secretly spying on rivals and possible threats. The more powerful the technology, the more attractive it will be for those people, and the greater the potential harm it can cause.

According to one report, Clearview aims to build on its database – and perhaps on its current notoriety – by developing surveillance cameras and augmented reality glasses that draw on its software. At least people can now use California’s Consumer Privacy Act to see what information Clearview holds on them. The EU’s GDPR should allow the same access to details for EU citizens, although no one has reported successfully doing so yet. In another interesting development, the state of Vermont has sued Clearview, accusing the company of illegally collecting photos of the state’s residents in order to build a “dystopian surveillance database“.

Unfortunately, it’s not just Clearview we need to worry about. OneZero has a report about a company called Wolfcom, which is developing live facial recognition for US police body cameras. It’s a significant move, because Axon, the largest company producing body cameras in the US, stated last year that it wouldn’t add facial recognition to its systems. It may be that Wolfcom’s announcement will push Axon to follow suit, and facial recognition will become the norm for police body cameras in the US. That’s a classic ratchet effect whereby groundbreaking moves by one player can pull the whole industry after them. In the context of the erosion of privacy, that’s bad news.

In the EU, a leaked report showed that police forces there are keen for the creation of a pan-European network of facial recognition databases. This might not be quite on the scale of Clearview’s alleged 3 billion faces, but would nonetheless be a large-scale and powerful system. If created, it is also likely to encourage police forces across the EU to use it routinely, since it will be a major official EU resource. This will normalize the application of facial recognition by the police in Europe.

A few weeks ago, there was a tantalizing report that the EU would go the other way, and ban facial recognition in public spaces. But when the region’s AI strategy was published, it omitted any such commitment. More generally, the EU paper “On Artificial Intelligence – A European approach to excellence and trust“, avoids talking about facial recognition in depth, even though it is arguably the most problematic application of AI today. Taken together, those seem to indicate that the European Commission is planning to allow facial recognition deployment in public spaces. There will presumably be “safeguards”, but once permission has been granted, abuse is more likely.

The UK government has no qualms about openly supporting facial recognition projects, as Privacy International noted. For example:

FACER2VM is a five-year research programme aimed at making face recognition ubiquitous by 2020.

The project will develop unconstrained face recognition technology for a broad spectrum of applications. The approach adopted will endeavour to devise novel machine learning solutions, which combine the technique of deep learning with sophisticated prior information conveyed by 3D face models.

London’s Metropolitan Police is already rolling out real-time facial recognition. That’s despite the dismal results its latest test deployments have produced. At one site, facial recognition captured 8,600 faces, and checked them against a watchlist of 7,292 people. The system flagged up eight alerts; seven were false positives, and only one was a true positive.

As a reminder of potential pitfalls, here’s a story from Argentina, where the wrong man was detained in July 2019 for a robbery that happened three years before that, in a city about 400 miles away. It turns out the robber was someone with the same name, but the facial recognition system had flagged him up, and the police acted on that information. Instead of admitting their mistake immediately, the police held the man for six days before releasing him. This highlights the danger of using “intelligent” systems incorporating facial recognition: they can encourage law enforcement to act in a less-than-intelligent fashion, simply because of an unjustified faith in the abilities of AI-based systems. We can expect to see more of these problems as police forces around the world embrace real-time facial recognition as an apparently “easy” way to boost their ability to spot people of interest.

Featured image by vero66braud.

The post Police forces around the world continue to push for routine – and real-time – facial recognition capabilities appeared first on Privacy News Online by Private Internet Access VPN.