EFF and Eight Other Privacy Orgs Back Out of NTIA Face Recognition Talks

https://www.eff.org/deeplinks/2015/06/eff-and-eight-other-privacy-organizations-back-out-ntia-face-recognition-multi

by jdp23 • 11 years ago

131 73 11 years ago

kefka6• 11 years ago

Yes, and?

With OpenCV, I already have face detection, face recognition, eye detection, cascade creation (for detection of any feature I wish), a retinal model in conjunction with retinal scanning via webcam, and other power tools in that bag.

And it's all open source. It's easy enough, I made it myself: https://github.com/jwcrawley/uWHo

therobot244• 11 years ago

a retinal model in conjunction with retinal scanning via webcam

You probably mean iris. The retina is the back of the eye, very few if any real biometric systems use this. The iris is the colored area of the eye that surrounds the pupil. It's very texture rich and less invasive to obtain.

kefka6• 11 years ago

Acccording to the documentation, OpenCV contrib indicates a retinal model.

http://docs.opencv.org/modules/contrib/doc/retina/index.html

forgottenpass3• 11 years ago

Who cares if it's easy or not? Consumer/passerby protection rules are not going to stop you, a person with nothing to lose. This is about the use of such technology in a commercial setting.

It's a bit like my pirate radio station. I have it, I broadcast to a very limited distance, whatever, I don't really worry about the white vans. If I put a 400 kW TV transmitter on top of a mountain, that's a very different story.

kefka6• 11 years ago

Lets take the same analogy...

So, if I buy/build a 1GP camera array, and drive it around the city, capturing all the data, "that's a very different story"?

Your example is in violation of the FCC. Mine violates nothing.

CONTRARlAN2• 11 years ago

That it's easy to do is all the more reason to try to establish controls to prevent abuse.

It's trivially easy to sell customer data for profit at the expense of their privacy. It's easy to store personal information without securing it. It's easy to take credit cards without using SSL certs.

It's also easy to lock someone up and deny them due process, or to enter someone's home and seize their effects without a warrant, or to set absurdly high bail.

Etc. Again, it's because this is such an easy thing to do–and it's only going to become easier to collect, store, and analyze this data-that it makes sense to establish definitions of what constitutes fair use, and what constitutes abuse, and to do so sooner, rather than later.

kefka6• 11 years ago

So, what is the responsibility for capturing faces for recognition purposes when in a public setting? It's already established that members of the public can record events like arrests legally, thanks to 1st amendment defense.

But above is in public. What about "my" property? Or the supermarket? We already have cameras everywhere. Just look up. So what does it matter that they run software on the back end? The hardware is already there.

Walking in gives implicit permission that "you agree to be recorded or leave". Vandalization of cameras is criminal. Many places insist you not wear masks, or they call the cops.

tikhonj• 11 years ago

This isn't about face recognition technology, it's about face recognition data. The EFF and friends want to come up with standards for storing, securing and sharing face-recognition data between companies and government entities. These standards make sense—and need some minimum level of scrutiny—regardless of how easy facial recognition technology is to implement.

Writing software that parses Social Security numbers into lists is even easier than face recognition, and yet we still want standards around handling the information!

Okay, that was a slightly facetious example, but the point stands: it's a question of securing data, not technology.

arca_vorago• 11 years ago

This brings up something I've been wondering about for a while, the legality of masks and other devices for identity protection. Supposedly due to protests and anon activity I have heard of an increasingly push to make publicly wearing masks illegal, but I think it's a slippery slope to go down. If in a few years time I have to assume that if I'm in public my face is being input into recognition systems, why should I not have the right to wear a mask or something similar?

Of course the knee-jerk argument is that wearing masks (both digitally in offline) creates a different personality which is more willing to engage in illegal activity, but for me, a staunch Constitutionalist, that still doesn't justify making it illegal.

This is, at the bottom line, about the reduction of anonymity equally in the real world as in the digital.

One more tool of control in the belt of the oligarchy.

happyscrappy4• 11 years ago

Isn't it better to work on having a government you can trust rather than fooling yourself by building a castle made of sand in the path of an incoming tide?

cracell3• 11 years ago

Why not both?

We should retain the right to conceal our identity in reasonable ways and governments should enact laws that protect their citizens privacy from biometric recognition technologies.

mordocai• 11 years ago

Due to the very nature of government, I don't believe it is possible to have a government that I completely trust.

There are different degrees of trust though, and I would like one with a higher degree of trust earned.

pavel_lishin• 11 years ago

A government I can trust can get voted out of office tomorrow.

the_ancient4• 11 years ago

Your fooling yourself if you think you can ever trust government....

boling11• 11 years ago

What does that even look like? It seems like a stretch to believe that we can create a government that we'll always be able to trust.

higherpurpose• 11 years ago

The problem is by then it might be too late to fight it. They'll get so used to identifying everyone in real time at all times, that someone wearing a mask or trying to hide from the "system" in any way will look very suspicious and will need further tracking through other means. And the government from the police to the FBI will get very used to it because "how could ever catch the child kidnappers without that ability?!"

cracell3• 11 years ago

The problem is by then it might be too late to fight it.

It is never too late to fight something. Everything changes with time. It might be too late for an easy victory but if you study how things change and evolve over decades you'll see that's just a self-fulfilling prophecy. Many things that people say are "inevitable" have failed and many existing trends get reversed. For a couple of recent technological ones just look at the failing of the "inevitable" SOPA, the Comcast and Time Warner merger, and net neutrality actually becoming the regulation instead of being destroyed.

If you believe you can change something you often can, if you don't believe you can change it then you definitely won't.

drpgq2• 11 years ago

I'm a researcher at a face recognition company. A big pair of dark sunglasses still does a pretty good job of obscuring your identity (although obviously not as good as a mask). Adding a hat with a brim pulled low helps out even more.

therobot244• 11 years ago

Don't forget that NIR cameras (often used for iris recognition) can still see through those glasses. But i agree, stuff similar to the challenges in the AR face dataset [1] will usually stump most employed systems.

[1] http://www2.ece.ohio-state.edu/~aleix/ARdatabase.html

protomyth• 11 years ago

First, if it is illegal then we should work at getting the law changed.

Wear a surgical mask, that seems acceptable in this day and age.

rev_bird• 11 years ago

if it is illegal then we should work at getting the law changed

It seems like most of the privacy issues at hand today are already against the law -- the problem is enforcement.

nintendo18892• 11 years ago

What about antivirus/pathogen masks?

beedogs• 11 years ago

This brings up something I've been wondering about for a while, the legality of masks and other devices for identity protection.

Canada just recently criminalised the act of wearing a mask at a protest. 10 years maximum sentence. For wearing a mask. Seriously! (Nice democracy they've got goin' up there.)

inanutshellus• 11 years ago

In my town, street performers cannot wear masks. It was originally created as a law to help arrest KKK demonstrators here in the south. But yeah, I wouldn't get too high-falutin' at the expense of Canadian democracies. Granted, we did drop the case against Spider-Man...

http://www.knoxnews.com/news/knoxville-drops-spider-mans-mas...

nintendo18892• 11 years ago

What about viruses?

nosuchthing• 11 years ago

CV Dazzle [1] was an art project for confusing and evading facial recognition software algorithms, inspired by the WWI / WWII camouflage designs [2] ~

[1] http://cvdazzle.com

[2] https://en.wikipedia.org/wiki/Dazzle_camouflage

mVChr3• 11 years ago

Communities such as San Diego, California are using mobile biometric readers to take pictures of people on the street or in their homes and immediately identify them and enroll them in face recognition databases.

In their homes? I'm pretty sure this is illegal. Or is it not if they are visible from a public area?

abandonliberty• 11 years ago

Correct - they have an expectation of privacy in their homes. Same deal applies if you use a creeper telephoto lens.

mVChr3• 11 years ago

That's good to know.

Just out of curiosity, do you know how that interacts with indecency laws? Like for example if someone is having sex in their home but someone is able to see it from the sidewalk through a crack in the curtains? This is purely hypothetical of course.

astrobe_2• 11 years ago

Doesn't matter. In their homes, or in their gardens, or when they are going out and have one foot on the street.

Illegal collection can't reliably be prevented. Get a photograph, extract the biometric data, enter them in your database, delete the photograph. Job done.

Maybe the only way to get control back on this is to require that these databases to be open source (or publicly available) and make it illegal to hide those databases. Citizens must also have the right to be removed from those databases.

xahrepap• 11 years ago

Then you will still need a reliable auditing system to audit what they're deploying is what's in the open source repository. The government would solve that by creating the "Open Source Auditing Department" or somesuch. And at that point, who trusts them anyway?

Adlai2• 11 years ago

At what point do we stop trying to prevent unpreventable illegal activity, and try to put systems in place for dealing with its undeniable existence?

I'm not certain how such systems would look in this case (everybody wears Guy Fawkes masks in public?), but this debate reminds me of prohibition vs. harm reduction in the War on [People Using] Drugs.

sbarre• 11 years ago

So imagine a scenario where a delivery company outfits their delivery people with body cameras "for safety" (a legitimate concern) but then sells access to their feeds to a biometrics company as an additional revenue stream and lets them extract data from that video..

They know the address being delivered to, and now they can map the presence of specific biometric data to that location and time.

ChuckMcM• 11 years ago

Hmm, an alternative strategy might be to start an EFF program to photograph and add to a facial recognition database every law enforcement officer. Have volunteers take pictures of people showing up at the police academy, and people in uniform doing their job, and people going into and out of employee only entrances to law enforcement facilities. They can make this data base for DefCon 'spot the fed' sessions and for other interested parties.

That will certainly keep the conversation going although in a less civilized way. Perhaps it could bring enough pressure to bare on NTIA to get them to reconsider basic privacy safeguards.

click1702• 11 years ago

I would volunteer my time to that program.

What really bothers me is that nobody outside of our bubble will take this seriously until someone hacks in and downloads a copy of the database and posts it online for all to see. Only then will most people realize what's wrong with having your face in that database despite the absence of a conviction.

fweespeech• 11 years ago

I would volunteer my time but honestly, I'd expect extremely hostile reactions and quick and quiet legislation at the city level to make it stop.

coleca• 11 years ago

I believe the EFF and the other consumer groups are grandstanding to get some publicity in this case. I have listened to almost all of these sessions that the NTIA facilitated, and the company I work for even presented at one of them last year. I think it's important to get some points out which I haven't seen in any of the other comments:

1. The process led by the NTIA, unlike the bulk of the EFF's post, has nothing to do with the government's collection and use of facial recognition data. This process was designed to come up with a voluntary guideline that commercial facial recognition companies could choose to adhere to or not. I agree that limits need to be set for government uses, but this process from the beginning was never about that. The NTIA did not have jurisdiction for anything involving the federal government, law enforcement, military, etc. This is more akin to the voluntary privacy standards that companies on the web will agree to on their own. Once they do, if they violate their own policy they are subject to sanction by the FTC. The guidelines coming out of this process were intended to be voluntary, so companies would not have to comply if they didn't want to. However, the idea was that the working group would come up with something that the industry would volunteer for and by doing so give some level of protection to consumers.

2. The industry representation was not opposed to opt-in on some scenarios, but they were opposed to mandatory positive opt-in across the board without exception. There are a number of scenarios where opt-in doesn't make sense. For example, imagine a system that used facial recognition in a retail setting to detect shoplifters and alert management to their presence. If you had been caught stealing in the store in the past, you would be enrolled into the system by the retailer. Each person entering the store (as seen on their already existing surveillance systems) would be checked against that database of shoplifters. How realistic would it be for the retailer to get written opt-in consent from the criminal?

3. Previous sessions the consumer advocates had agreed that facial detection was out of scope, but facial recognition and facial analysis were in scope for the guideline. At the last session, they changed their position and wanted to bring face detection in scope. The difference being, face detection is just finding a face in an image, like your smartphone does in the camera app vs face recognition which would be finding the identity of a face in a picture (Who is this? or is this Bob?). Can you imagine getting opt-in consent to draw this little yellow box around the faces in the camera app?

4. The NTIA did an outstanding job in an attempt to bring this process together. They organized the sessions and brought in numerous speakers from both sides (consumer and industry) as well as from the education and research sectors. We even had representation from Canada that spoke to a similar process they went through there. The NTIA wasn't forcing any standards on anyone, they simply offered their services to organize and facilitate it as they have done in other similar multi-stakeholder initiatives. The process went on far longer than the NTIA (and any of the participants) had expected, but it was making slow progress.

I don't know if this process is now dead or not. I suspect it will go on, just now the consumer groups won't have a voice in shaping this (by their own choice), which is a shame. It's also possible that the show of force by the consumer advocates will push the industry to bend more in their favor, either way it would be good for consumers to get some kind of guideline out there. It could always evolve and be revisited in the future as the technology changes.

click1702• 11 years ago

We even had representation from Canada that spoke to a similar process they went through there.

I'd like to learn more about the process Canada went through. This is one of the top search results, is this it?

This is the Privacy Impact Assessment Report from Passport Canada. http://www.ppt.gc.ca/publications/facial.aspx?lang=eng

belorn• 11 years ago

Facial recognition software provides a probability that a record and a image is of the same person and that process will without exception create false positives. A anti-shoplifter system would thus have to have several safety features in order to not turn into a no-fly list.

How would that system work in a fair society government by law? Would suspects not found guilty in a court of law be there? How should false positives, that is people who the computer incorrectly predict as someone else, get a chance to clear their name (face) and get compensation when it happens? Should criminals that have served their time still be locked-out for-life and denied entry to stores that share the system?

Like vigilantes, I have a hard time seeing a way which such system can be created without massive abuse. Let assume that 1% of scanned people will be false positives, and say 5% of records will be falsely added by clerks (they are not trained to be cops or judges, and some will abuse the system to intentional hurt people they know). How many people would be hurt by this system if it was shared by the majority of stores in a large town?

the_ancient4• 11 years ago

>The industry representation was not opposed to opt-in on some scenarios, but they were opposed to mandatory positive opt-in across the board without exception. There are a number of scenarios where opt-in doesn't make sense. For example, imagine a system that used facial recognition in a retail setting to detect shoplifters and alert management to their presence. If you had been caught stealing in the store in the past, you would be enrolled into the system by the retailer. Each person entering the store (as seen on their already existing surveillance systems) would be checked against that database of shoplifters. How realistic would it be for the retailer to get written opt-in consent from the criminal?

I agree with the EFF is opposing this type of system, Retailers should not be allowed to "enroll" people in a Scarlet Letter system. The Credit System is already fucked up enough with very limited recourse for people that abuse it to extort consumers.

Retailers should not have that kind of power...

teacup50• 11 years ago

The faceprint shoplifting example is, when duly considered, a frightening example straight from dystopian cyberpunk -- individuals automatically banned from jobs, stores, private facilities, public spaces -- forever, automatically, under an opaque corporate controlled consumer identification / credit system.

Your employer and industry are so far on the wrong side of the ethical divide that there's simply no way to reconcile ethical standards and what you see as justified non-opt-in faceprint collection.

forgottenpass3• 11 years ago

The process led by the NTIA, unlike the bulk of the EFF's post, has nothing to do with the government's collection and use of facial recognition data.

If you're calling out the EFF's hypothetical wost-case like this, you certainly wouldn't use the hypothetical best-case of shoplifter recognition to provide argumentative cover for other no-opt-in products like your company's IRL analytics offering, would you?

The guidelines coming out of this process were intended to be voluntary, so companies would not have to comply if they didn't want to.

If they're voluntary, what is the purpose of complying with them? Why would anyone in industry adopt the standards? Seriously. What good will they do? Why didn't businesses voluntarily walk away from the table first? Should I believe they're honestly negotiating to voluntarily give up on existing/potential products to make the EFF happy?

What reason at all do I have to believe the industry isn't just seeking a set of milquetoast "consumer protections" they can make a big deal out of living up to, while not providing any real consumer protection?

I don't know if this process is now dead or not. I suspect it will go on, just now the consumer groups won't have a voice in shaping this (by their own choice), which is a shame.

So the industry couldn't steamroll the consumer protection groups and get a set of flimsy set of standards. And now it's those group's fault when consumers aren't protected?

Shame on you for pretending like they're choosing not to have their voice heard. It was heard, then industry saw money and decided to ignore them.

either way it would be good for consumers to get some kind of guideline out there

No, if the guidelines are weak they're worth less than nothing. The industry will have a standard they can "live up to" without impacting their business model. Then when consumers complain, they'll wave around the standards as if the boundaries of acceptable use of facial recognition are already settled and protect consumers.

tl;dr lulz @ "The NTIA did an outstanding job in an attempt to bring this process together"

socceroos• 11 years ago

I'm on board. It's all fun and games until it's turned back on them.

rlvesco7• 11 years ago

Who are the companies that are pushing this? The article, surprisingly, doesn't say.

stox• 11 years ago

Actually, you can change the dimensions of your face. It is very painful, and I do not recommend it to anyone voluntarily.

EFF and Eight Other Privacy Orgs Back Out of NTIA Face Recognition Talks

Related Stories