EFFecting Digital Freedom

by Jason Kelley

Who Has Your Face?

Without your knowledge or consent, chances are high that a photo of you is in a government facial recognition database, right now.  That could give access to government agencies like the FBI, Immigration and Customs Enforcement, and local and state law enforcement to compare your photo against photos of people suspected of committing crimes, potentially putting you at risk of being misidentified and invading your privacy.  And perhaps the worst part: right now, it's nearly impossible to know for sure which databases you're in and which agencies can access them.

How did we end up here - and how did you end up in a facial recognition database?  It's a version of the same story that privacy advocates and technologists have been telling for decades, often beginning with the implementation of a fairly unknown technology with supposedly benign intentions.  In this case, DMVs began using facial recognition software, in some states more than a decade ago, ostensibly to catch fraud.  The DMVs initially used the technology to compare photos of new license or ID applicants to those already in the database.  But soon, other agencies came knocking.  Requiring the collection of data on so many people, and implementing a way to search through it to supposedly limit crime, helped open up the door for other agencies to do the same.  This is an important reminder that often all it takes for a technology to endanger a person or a group of people is to change who has access to it - and this is why it's so important to consider who has that access, and who could potentially obtain access in the future.

Fast-forward a decade or so to now and, depending on which state issued your ID, you mayor may not be in one of these facial recognition databases.  Various agencies may have unfettered, direct access to the system itself, or they may submit images and expect the DMV to return potential matches.  And this violation doesn't just happen at DMVs.  Similar types of sharing occur with the photos used for passports and visas as well, and is also planned for trusted traveler programs like TSA's PreCheck.  But because these agencies aren't up front about who they share access to their databases with and because they are all run differently, it's difficult, if not impossible, for the public to review their use.

Georgia's DMV requires only that the agency requesting use of facial recognition be conducting a criminal investigation.  Utah's DMV only requires that agencies provide an official case or report number.  In contrast, Florida's Face Analysis Comparison and Examination System (FACES), the oldest facial recognition system in the country, shares access to at least 273 partner agencies (as of 2019), including 17 federal agencies.  Not all DMVs allow access, and not all DMVs even have the technology: New Hampshire's DMV is prohibited by state law from using facial recognition.  Oklahoma hasn't implemented it either.  Depending on who issued your ID, you may be protected - for now.

To help you figure out where you fall by explaining what happens in each state, and to help put a stop to government use of the technology, EFF has launched two new websites: WhoHasYourFace.org and AboutFaceNow.org.

At WhoHasYourFace.org, you can take a short quiz that will give you a better idea of which agencies may be using your image for facial recognition.  After you figure out who has your face and how they share it, you can visit AboutFaceNow.org to put a stop to government face surveillance in your community.  Working with our partners in the Electronic Frontier Alliance and other local grassroots organizations, we're collecting signatures in towns all across America, and each time a multiple of 100 supporters in your area sign on, we'll deliver the message to your local lawmakers.  If you live outside of the United States, you'll see other information about how U.S. government use of facial recognition may affect you, and learn how you can fight back.

And we must fight back.  As more and more government agencies gain access to these databases, it becomes effortless for them to search through photos of hundreds of millions of innocent people.  Once the collection of biometrics and use of this technology is standardized, it becomes much easier to locate and track someone across all aspects of their life.  The problems with this are serious: this technology can be prone to error and is particularly bad at recognizing women, young people, and people with darker skin.  At a time when public protest is widespread and the federal government is scrutinizing immigrant communities and criminalizing activists, law enforcement and government use of face surveillance chills free speech and threatens First Amendment-protected activity like public protest.  This technology invades the privacy of everyone inside the database, and amplifies historical biases in our criminal system.

But face recognition doesn't just mean you could be mistaken for a suspect after an algorithm claims your face resembles a face in a grainy security photo.  It also means that your government doesn't trust you.  The FBI has scanned these driver's license databases a total of 390,000 times since 2011, according to a report from the Government Accountability Office.  How many times has your face been scanned without your knowledge and despite no evidence of wrong doing?

Thankfully, there are now more bans on government and law enforcement use of facial recognition than ever.  While hundreds of millions of innocent Americans are currently subjected to facial recognition searches without ever having had the chance to opt out, we can fight back.  Visit WhoHasYourFace.org and AboutFaceNow.org to take a stand.