- Email: [email protected]
85 rights groups demand end to Govt facial ID sales
FEATURE/NEWS price-cryptocurrency-hacked-south-koreacoincheck. 5. Joseph Young. ‘$731 Million Stolen from Crypto Exchanges in 2018: Can Hacks be Prevented?’. CCN, 7 April 2018. Accessed February 2019. https://www.ccn.com/731million-stolen-from-crypto-exchanges-in2018-can-hacks-be-prevented/. 6. Juergen Krais. ‘5th EU Anti-Money Laundering Directive published’. Global Compliance News, 16 July 2018. Accessed February 2019. https://globalcompliancenews.com/
eu-5th-anti-money-laundering-directivepublished-20180716/. 7. Allen Scott. ‘These are the World’s Top 10 Bitcoin-Friendly Countries’. Bitcoin. com, 29 March 2016. Accessed February 2019. https://news.bitcoin.com/worlds-top10-bitcoin-friendly-countries/. 8. Pamela N Danziger. ‘Top Shopping Trends Of 2018: Retail Experts Share What To Watch For Next Year’. Forbes, 27 December 2017. Accessed February 2019. https://www.forbes. com/sites/pamdanziger/2017/12/27/
...Continued from page 3 The survey also found that young Americans are more worried about face technology than older people. Some 52% of 18 to 34-year-olds oppose limits on FRT that come at the expense of public safety, compared to 61% of people ages 55 and over. Overall, the results may reveal a gap in perception between the American general public, and privacy campaigners like the ACLU who are calling for an outright ban on police use of FRT systems like Amazon Rekognition (see below). The Center’s director, Daniel Castro, commented: “People are often suspicious of new technologies, but in this case they seem to have warmed up to facial recognition technology quite quickly.” The study also reinforces the view that increasing the accuracy of FRT is a key element in winning over public support. “The survey results suggest that one of the most important ways for police to gain public support for using facial recognition technology in their communities is to use the most accurate tools available,” Castro said. “People are willing to get behind police use of facial recognition technology as long as it is accurate and makes their communities safer.” In terms of FRT’s improving accuracy, recent tests by NIST (the National Institute of Science and Technology) point to a 20-fold improvement in the last four years – just 0.2% of facial recognition database searches failed in 2018, compared to 4% in 2014 (see BTT, last issue).
have been urged by over 85 racial justice, faith and civil rights groups to stop selling their face recognition (FRT) systems to the US Government. The coalition of campaigners, led by the ACLU (American Civil Liberties Union), wrote to each of the vendors on 15 January, telling them that any move to provide face surveillance software to the American Government “threatens the safety of their community members and will also undermine public trust in the vendors’ business”. The campaigners add that: “Face surveillance gives the Government new power to target and single out immigrants, religious minorities and people of colour in our communities” and that “systems built on face surveillance will amplify and exacerbate historical and existing bias”. Commenting on the move, ACLU California technology director Nicole Ozer also criticised the three firms for selling FRT before it is fully reliable. “Companies can’t continue to pretend that the ‘break then fix’ approach works,” she said. But the campaign groups single out Amazon for particular criticism, saying it has recently accelerated its efforts to sell FRT to government – despite repeated criticism from consumers, employees, members of Congress and shareholders. Last year, an ACLU test showed that Amazon Rekognition falsely matched 28 current members of Congress with images in an arrest photo database. Congressional members of colour were disproportionately identified incorrectly, including six members of the Congressional Black Caucus. And in their new letter, the campaigners criticise Amazon CEO Jeff Bezos’s solution of waiting for society to develop an ‘immune response’ to technologies like face surveillance as “wholly irresponsible”. The coalition note that: “Amazon’s inaction in response to widespread concerns about face surveillance stands in contrast to the steps taken by its competitors.” In line with this, they welcome Google’s recent announcement that it will not sell a
privacy
85 rights groups demand end to Govt facial ID sales
B 10
iometric technology suppliers Microsoft, Amazon and Google
Biometric Technology Today
retail-shopping-predictions2018/#7faa824efb33. 9. ‘Revised Payment Services Directive (PSD2)’. Financial Conduct Authority, 19 December 2018. Accessed February 2019. https://www.fca.org.uk/firms/revised-payment-services-directive-psd2. 10. ‘PSD2 in a nutshell’. PriceWaterhouseCoopers, 2016. Accessed February 2019. https://www.pwc.dk/ da/publikationer/2017/strong-customerauthentication-common-secure-communication-psd2-nutshell-4.pdf.
Amazon CEO Jeff Bezos: ACLU claims his solution of waiting for society to develop an ‘immune response’ to face surveillance is “irresponsible”.
FRT product until the technology’s dangers are addressed. But they still call on Google to fully commit to not releasing a face ID product that could be used by government. Likewise, the collation welcome Microsoft president Brad Smith’s recent promise to act internally to address the potential risks associated with face surveillance. But they add: “Microsoft has a responsibility to do more than speak about ethical principles, it must also act in accordance with those principles.” • The ACLU-led call for change has been echoed by a group of Amazon shareholders, who together have invested over $1.3bn in the company. On 17 January, the group filed a resolution asking Amazon to prohibit sales of Rekognition to government agencies – unless the company’s Board concludes that the technology does not pose actual or potential civil and human rights risk. The resolution was organised by Open MIC, a non-profit agency that fosters shareholder
February 2019
NEWS engagement at leading tech companies. Its executive director Michael Connor commented: “It’s a familiar pattern, a leading tech company marketing what is hailed as breakthrough technology without understanding or assessing the many real and potential harms of that product. Sales of Rekognition to government represent considerable risk for the company and investors. That’s why it’s imperative those sales be halted immediately.”
The Illinois court ruled that a teenager whose thumbprint was scanned is an “aggrieved person” though he suffered no actual harm.
justice
Illinois court case could open floodgate of claims
T
he case doesn’t sound that significant. On 25 January, the Illinois Supreme Court ruled that an amusement park called Six Flags Great America was wrong to collect the thumbprint of a 14 year-old-boy to put on his entry pass to the park. Yet commentators are suggesting this verdict could have multi-million dollar consequences for any company that’s careless about how it collects consumers’ biometric data. The Illinois judges decided by a crushing 7-0 margin that the teenager whose thumbprint was scanned and stored, Alexander Rosenbach, was an “aggrieved person” even though he suffered no actual harm. They ruled that Six Flags breached a law known as the Biometric Information Privacy Act (BIPA) for the simple sin of collecting the biometric without the boy’s written consent. And the verdict means Alexander, and his mother Stacy who brought the case, could receive thousands of dollars in damages.
Justin Kay: “Court’s decision creates a very expensive trap for those who use biometrics for any purpose without careful review of the programme beforehand.”
February 2019
The decision, delivered on 25 January by Illinois chief justice Karmeier was unequivocal: “An individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages.” Privacy campaigners have welcomed the decision, which they see as a test case for tech companies like Facebook, Google and Snapchat over their use of face-capture systems. The Electronic Frontier Foundation (EFF) campaign group called it a “victory” that has “important ramifications” for Facebook – which is embroiled in another ongoing BIPA-related court battle (Patel vs Facebook) sparked by its Tag Suggestions project launched in 2010. Tag Suggestions used facial recognition technology to scan photos uploaded by Facebook users, identified the individuals appearing in those photos if possible, suggested their names and prompted users to tag those people. The plaintiffs in this case – Nimesh Patel, Adam Pezen and Carlo Licata – say that Facebook collected the biometric data secretly and without consent and should be sued. And the financial implications of this for Facebook could be huge, given it has over 1 billion active users worldwide. Facebook is currently arguing its innocence before an appeal court in California, saying that – like the Rosenbach case – a loss of statutory biometric privacy rights is not enough to sue a company: the plaintiff must also show additional harm. But in a 25 January blog, EFF surveillance litigation director Jennifer Lynch and senior staff attorney Adam Schwartz said the latest case could silence Facebook’s claims. “We’re hopeful the Rosenbach ruling shuts down this argument once and for all. The Illinois Court cited the California Facebook case with approval and quoted from it extensively.”
The EFF points out that individuals have filed BIPA lawsuits against Google and Snapchat, as well as Facebook, alleging the companies applied face recognition to their uploaded photographs without their consent. Also commenting on the Illinois verdict in a 28 January blog, Justin Kay, a partner at US law firm Drinker Biddle, pointed to the wider implications for other firms. He said the “much-anticipated decision” effectively means: “The Illinois Supreme Court holds that the Biometric Information Privacy Act is a very expensive trap for the unwary. The court’s decision creates a very expensive trap for those who use biometrics for any purpose without careful review of the programme beforehand.” Kay added: “This establishment of such a low bar for filing suit will have a significant impact on the many BIPA lawsuits already pending and spur additional BIPA lawsuits. It will influence ongoing efforts in other US States to enact biometrics-related legislation and impact broader discussions regarding the enactment of comprehensive federal privacy regulations.” Looking at the broader impact, the EFF concluded: “Biometric surveillance is a growing menace to our privacy. Our biometric information can be harvested at a distance and without our knowledge, and we often have no ability as individuals to effectively shield ourselves from this grave privacy intrusion. “More businesses than ever are capturing and monetising our biometric information. Retailers use face recognition to surveill shoppers’ behaviour as they move about the store, and to identify potential shoplifters. Employers use fingerprints, iris scans and face recognition to manage employee access to company phones and computers. “As biometric collection, use and sharing become more widespread and invasive every year, it only becomes more important that private citizens can sue under laws like BIPA to protect their privacy.”
Biometric Technology Today
11
eu-5th-anti-money-laundering-directivepublished-20180716/. 7. Allen Scott. ‘These are the World’s Top 10 Bitcoin-Friendly Countries’. Bitcoin. com, 29 March 2016. Accessed February 2019. https://news.bitcoin.com/worlds-top10-bitcoin-friendly-countries/. 8. Pamela N Danziger. ‘Top Shopping Trends Of 2018: Retail Experts Share What To Watch For Next Year’. Forbes, 27 December 2017. Accessed February 2019. https://www.forbes. com/sites/pamdanziger/2017/12/27/
...Continued from page 3 The survey also found that young Americans are more worried about face technology than older people. Some 52% of 18 to 34-year-olds oppose limits on FRT that come at the expense of public safety, compared to 61% of people ages 55 and over. Overall, the results may reveal a gap in perception between the American general public, and privacy campaigners like the ACLU who are calling for an outright ban on police use of FRT systems like Amazon Rekognition (see below). The Center’s director, Daniel Castro, commented: “People are often suspicious of new technologies, but in this case they seem to have warmed up to facial recognition technology quite quickly.” The study also reinforces the view that increasing the accuracy of FRT is a key element in winning over public support. “The survey results suggest that one of the most important ways for police to gain public support for using facial recognition technology in their communities is to use the most accurate tools available,” Castro said. “People are willing to get behind police use of facial recognition technology as long as it is accurate and makes their communities safer.” In terms of FRT’s improving accuracy, recent tests by NIST (the National Institute of Science and Technology) point to a 20-fold improvement in the last four years – just 0.2% of facial recognition database searches failed in 2018, compared to 4% in 2014 (see BTT, last issue).
have been urged by over 85 racial justice, faith and civil rights groups to stop selling their face recognition (FRT) systems to the US Government. The coalition of campaigners, led by the ACLU (American Civil Liberties Union), wrote to each of the vendors on 15 January, telling them that any move to provide face surveillance software to the American Government “threatens the safety of their community members and will also undermine public trust in the vendors’ business”. The campaigners add that: “Face surveillance gives the Government new power to target and single out immigrants, religious minorities and people of colour in our communities” and that “systems built on face surveillance will amplify and exacerbate historical and existing bias”. Commenting on the move, ACLU California technology director Nicole Ozer also criticised the three firms for selling FRT before it is fully reliable. “Companies can’t continue to pretend that the ‘break then fix’ approach works,” she said. But the campaign groups single out Amazon for particular criticism, saying it has recently accelerated its efforts to sell FRT to government – despite repeated criticism from consumers, employees, members of Congress and shareholders. Last year, an ACLU test showed that Amazon Rekognition falsely matched 28 current members of Congress with images in an arrest photo database. Congressional members of colour were disproportionately identified incorrectly, including six members of the Congressional Black Caucus. And in their new letter, the campaigners criticise Amazon CEO Jeff Bezos’s solution of waiting for society to develop an ‘immune response’ to technologies like face surveillance as “wholly irresponsible”. The coalition note that: “Amazon’s inaction in response to widespread concerns about face surveillance stands in contrast to the steps taken by its competitors.” In line with this, they welcome Google’s recent announcement that it will not sell a
privacy
85 rights groups demand end to Govt facial ID sales
B 10
iometric technology suppliers Microsoft, Amazon and Google
Biometric Technology Today
retail-shopping-predictions2018/#7faa824efb33. 9. ‘Revised Payment Services Directive (PSD2)’. Financial Conduct Authority, 19 December 2018. Accessed February 2019. https://www.fca.org.uk/firms/revised-payment-services-directive-psd2. 10. ‘PSD2 in a nutshell’. PriceWaterhouseCoopers, 2016. Accessed February 2019. https://www.pwc.dk/ da/publikationer/2017/strong-customerauthentication-common-secure-communication-psd2-nutshell-4.pdf.
Amazon CEO Jeff Bezos: ACLU claims his solution of waiting for society to develop an ‘immune response’ to face surveillance is “irresponsible”.
FRT product until the technology’s dangers are addressed. But they still call on Google to fully commit to not releasing a face ID product that could be used by government. Likewise, the collation welcome Microsoft president Brad Smith’s recent promise to act internally to address the potential risks associated with face surveillance. But they add: “Microsoft has a responsibility to do more than speak about ethical principles, it must also act in accordance with those principles.” • The ACLU-led call for change has been echoed by a group of Amazon shareholders, who together have invested over $1.3bn in the company. On 17 January, the group filed a resolution asking Amazon to prohibit sales of Rekognition to government agencies – unless the company’s Board concludes that the technology does not pose actual or potential civil and human rights risk. The resolution was organised by Open MIC, a non-profit agency that fosters shareholder
February 2019
NEWS engagement at leading tech companies. Its executive director Michael Connor commented: “It’s a familiar pattern, a leading tech company marketing what is hailed as breakthrough technology without understanding or assessing the many real and potential harms of that product. Sales of Rekognition to government represent considerable risk for the company and investors. That’s why it’s imperative those sales be halted immediately.”
The Illinois court ruled that a teenager whose thumbprint was scanned is an “aggrieved person” though he suffered no actual harm.
justice
Illinois court case could open floodgate of claims
T
he case doesn’t sound that significant. On 25 January, the Illinois Supreme Court ruled that an amusement park called Six Flags Great America was wrong to collect the thumbprint of a 14 year-old-boy to put on his entry pass to the park. Yet commentators are suggesting this verdict could have multi-million dollar consequences for any company that’s careless about how it collects consumers’ biometric data. The Illinois judges decided by a crushing 7-0 margin that the teenager whose thumbprint was scanned and stored, Alexander Rosenbach, was an “aggrieved person” even though he suffered no actual harm. They ruled that Six Flags breached a law known as the Biometric Information Privacy Act (BIPA) for the simple sin of collecting the biometric without the boy’s written consent. And the verdict means Alexander, and his mother Stacy who brought the case, could receive thousands of dollars in damages.
Justin Kay: “Court’s decision creates a very expensive trap for those who use biometrics for any purpose without careful review of the programme beforehand.”
February 2019
The decision, delivered on 25 January by Illinois chief justice Karmeier was unequivocal: “An individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages.” Privacy campaigners have welcomed the decision, which they see as a test case for tech companies like Facebook, Google and Snapchat over their use of face-capture systems. The Electronic Frontier Foundation (EFF) campaign group called it a “victory” that has “important ramifications” for Facebook – which is embroiled in another ongoing BIPA-related court battle (Patel vs Facebook) sparked by its Tag Suggestions project launched in 2010. Tag Suggestions used facial recognition technology to scan photos uploaded by Facebook users, identified the individuals appearing in those photos if possible, suggested their names and prompted users to tag those people. The plaintiffs in this case – Nimesh Patel, Adam Pezen and Carlo Licata – say that Facebook collected the biometric data secretly and without consent and should be sued. And the financial implications of this for Facebook could be huge, given it has over 1 billion active users worldwide. Facebook is currently arguing its innocence before an appeal court in California, saying that – like the Rosenbach case – a loss of statutory biometric privacy rights is not enough to sue a company: the plaintiff must also show additional harm. But in a 25 January blog, EFF surveillance litigation director Jennifer Lynch and senior staff attorney Adam Schwartz said the latest case could silence Facebook’s claims. “We’re hopeful the Rosenbach ruling shuts down this argument once and for all. The Illinois Court cited the California Facebook case with approval and quoted from it extensively.”
The EFF points out that individuals have filed BIPA lawsuits against Google and Snapchat, as well as Facebook, alleging the companies applied face recognition to their uploaded photographs without their consent. Also commenting on the Illinois verdict in a 28 January blog, Justin Kay, a partner at US law firm Drinker Biddle, pointed to the wider implications for other firms. He said the “much-anticipated decision” effectively means: “The Illinois Supreme Court holds that the Biometric Information Privacy Act is a very expensive trap for the unwary. The court’s decision creates a very expensive trap for those who use biometrics for any purpose without careful review of the programme beforehand.” Kay added: “This establishment of such a low bar for filing suit will have a significant impact on the many BIPA lawsuits already pending and spur additional BIPA lawsuits. It will influence ongoing efforts in other US States to enact biometrics-related legislation and impact broader discussions regarding the enactment of comprehensive federal privacy regulations.” Looking at the broader impact, the EFF concluded: “Biometric surveillance is a growing menace to our privacy. Our biometric information can be harvested at a distance and without our knowledge, and we often have no ability as individuals to effectively shield ourselves from this grave privacy intrusion. “More businesses than ever are capturing and monetising our biometric information. Retailers use face recognition to surveill shoppers’ behaviour as they move about the store, and to identify potential shoplifters. Employers use fingerprints, iris scans and face recognition to manage employee access to company phones and computers. “As biometric collection, use and sharing become more widespread and invasive every year, it only becomes more important that private citizens can sue under laws like BIPA to protect their privacy.”
Biometric Technology Today
11