On Wednesday, July 18, 2012 the Senate Committee on the Judiciary held a hearing of the Subcommittee on Privacy, Technology and the Law entitled, “What Facial Recognition Technology Means for Privacy and Civil Liberties.” Sen. Al Franken (D-MN) spoke about the need for tight rules on facial recognition software. He said that the privacy and legal implications surrounding facial recognition technology remain murky. The committee questioned privacy advocates, government officials, academics, industry and law enforcement, and Facebook about how the technology is being used and what privacy issues it raises. The committee focused on potential problems with facial recognition technologies.
One of the concerns regarding facial recognition is its relationship to data aggregation. As companies begin to aggregate data, individual faces could be connected to medical histories, financial records, political involvement, or other details, and Sen. Franken queried the panelists about this.
Panel I
Jerome Pender - Deputy Assistant Director, Criminal Justice Information Services Division, FBI
Maneesha Mithal - Associate Director, Bureau of Consumer Protection, FTC
Jerome Pender said that the FBI is developing what it calls a next-generation identification program, which will allow authorized law enforcement agencies to query a massive database of criminal photos. The program is currently in its pilot phase. Sen. Franken expressed concerns that the technology could enable law enforcement to expand surveillance programs, capturing images of protesters or participants at a political rally. Pender testified repeatedly that the database would only draw on mug shots and not collect images from social-networking sites or other non-criminal repositories.
Maneesha Mithal said that the FTC considered this technology at its first stakeholder privacy workshop, where participants pointed to an array of factors that have converged to push facial recognition toward the mainstream, including improvements in imaging technology and the proliferation of freely available photos people are posting on Facebook and other websites. From the FTC's perspective, companies that use facial recognition technology should offer consumers "clear, simple, concise notices not in legalese," she said.
Panel II
Brian Martin - Director of Biometric Research, MorphoTrust USA
Alessandro Acquisti - Associate Professor, Information Systems and Public Policy, Carnegie Mellon University
Larry Amerson – President, National Sheriffs’ Association
Nita A. Farahany - Professor of Law and Professor of Genome Sciences & Policy, Duke University
Rob Sherman - Manager of Privacy and Public Policy, Facebook
Jennifer Lynch - Staff Attorney, Electronic Frontier Foundation
The focal point of the Committee’s questions for this panel was Facebook, especially for making facial recognition an opt-out rather than an opt-in feature. At one point, Sen. Franken said it takes six clicks to reach a page on Facebook that explicitly says that the company is using facial-recognition technology.
Facebook recently acquired Face.com, an Israeli firm specializing in software that powered Facebook's own tagging suggestions. Sen. Franken suggested that Congress should consider legislation that could clarify the appropriate uses of software like that behind Facebook's tag suggestions, both for commercial purposes and in the hands of law enforcement authorities. The technology is used only to suggest photo tags among people who are already friends on the site, so it does not invade peoples' privacy, Rob Sherman testified.
Franken was also critical of the privacy controls the company makes available to its users, saying at one point that it takes six clicks to navigate to the first page that mentions the term “facial recognition.” Similarly, he suggested that the company has not been as forthcoming as it could be about how much data it collects and how that information is used, a familiar refrain from critics of the social network’s privacy policies.
Sherman testified that Facebook only uses the technology to search a user's friends to "tag" them in a photo, and therefore does not allow identifying strangers in photos. He said the facial profiles are encrypted and work only with proprietary software, and the site shares private information with law enforcement only in certain circumstances.
"The thing people really care about is data aggregation," Nita Farahany testified. "Facial data on its own is not so much the problem for privacy advocates. It's how that information gets combined with other data, who has access to it, and how it's used.” She also said that she did not think that the Supreme Court would find that they use of facial recognition software by law enforcement or the government would be a violation of the Fourth Amendment.
When asked why is facial recognition so sensitive? Prof. Acquisti testified that widespread availability of facial-recognition technology could fundamentally change the nature of privacy and anonymity. He said that photos can be captured remotely without consent and knowledge. For example, his research team was able to identify one in three students it photographed on a college campus.
Larry Amerson, an Alabama sheriff, spoke about using facial recognition technology to identify inmates and criminals in his county. Biometric software takes 3-D snapshots of an individual’s face, each consisting of 40,000 data points. The images are then automatically compared against a database to locate a match.
Brian Martin spoke about the merits of facial recognition technology and played down some of the fears around this type of software.
Jennifer Lynch urged legislators to create laws shaping how facial recognition can be used, maybe in the way that the Wiretap Act of the Video Privacy Protection Act. "Without legal protections in place, it could be easy for government or company to establish database of all Americans," Lynch said.
An archive of the hearing is available here.
EDUCAUSE will continue to monitor and report on this issue.