Where and how to deploy facial recognition.

Fight against facial recognition hits wall across the West

The result is an impasse that has left tech companies largely in control of where and how to deploy facial recognition.

By JANOSCH DELCKER and CRISTIANO LIMA

Face-scanning technology is inspiring a wave of privacy fears as the software creeps into every corner of life in the United States and Europe — at border crossings, on police vehicles and in stadiums, airports and high schools. But efforts to check its spread are hitting a wall of resistance on both sides of the Atlantic.

One big reason: Western governments are embracing this technology for their own use, valuing security and data collection over privacy and civil liberties. And in Washington, President Donald Trump’s impeachment and the death of a key civil rights and privacy champion have snarled expectations for a congressional drive to enact restrictions.

The result is an impasse that has left tech companies largely in control of where and how to deploy facial recognition, which they have sold to police agencies and embedded in consumers’ apps and smartphones. The stalemate has persisted even in Europe’s most privacy-minded countries, such as Germany, and despite a bipartisan U.S. alliance of civil-libertarian Democrats and Republicans.

Advocates for tighter regulations point to China as an example of the technology’s nightmare potential, amid reports authorities are using it to indiscriminately track citizens in public, identify pro-democracy protesters in Hong Kong and oppress millions of Muslim Uighurs in Xinjiang. Current implementations of the software also perpetuate racial bias by misidentifying people of color far more frequently than white people, according to a U.S. government study released just before Congress left town for Christmas.

“Facial recognition needs to be stopped before a fait accompli is established,” Patrick Breyer, a member of the European Parliament for the Pirate Party Germany, told POLITICO.

"The use of facial recognition technology poses a staggering threat to Americans’ privacy," Sen. Ed Markey (D-Mass.), who is prepping legislation to crack down on the software, said in June.

But police and security forces across the West are still rapidly testing or rolling out the technology, adopting it as an inexpensive way to keep tabs on large groups of people. Cameras and artificial intelligence that can identify people based on their facial features are also showing up at border crossings, on police vehicles, at the entrances to stadiums and even in some high schools in the U.S. and Europe, where they are used to identify students. Such examples far outnumber the facial recognition bans enacted in San Francisco and some other U.S. cities.

In Washington, a once-promising bipartisan push in the House of Representatives to limit the federal government's use of facial recognition has stalled for unrelated reasons, including the death of former House Oversight Chairman Elijah Cummings (D-Md.) and acrimony over impeachment. And in the Senate, more limited proposals to rein in federal agencies' use of the technology have been slow to pick up support.

But privacy activists are drawing a broader lesson from governments’ failure to check the technology’s spread, saying it is eroding the differences between the way Western governments and China approach public surveillance.

“There is growing evidence that the U.S. is increasingly using AI in oppressive and harmful ways that echo China’s use,” AI Now, a research group at New York University, wrote in a report published this month that underscored the spread of "invasive" artificial intelligence technology.

'Fundamental rights'

In both the U.S. and Europe, the stuttering progress of efforts to regulate facial recognition stems from a blend of reluctance by security-obsessed governments and setbacks that have stymied lawmakers’ focus.

The latter obstacles have included the death in October of Cummings, whose panel had seemed poised to craft bipartisan legislation restricting face-scanning by federal agencies. Several top Democrats and Republicans on the committee have also been embroiled in the monthslong dispute over Trump's impeachment and upcoming Senate trial.

Democratic and Republican lawmakers alike acknowledged in interviews with POLITICO that the effort has stalled.

"Unfortunately impeachment has sucked all the energy out of the room," Rep. Stephen Lynch (D-Mass.), who chairs the Oversight National Security Subcommittee, said this month.

"There hasn't been anything that's happened right now. … Elijah's death put that on hold," said Rep. Mark Meadows of North Carolina, the top Republican on the Oversight Government Operations Subcommittee.

In the European Union, meanwhile, calls by top leaders for quick action on regulating artificial intelligence aren’t guaranteed to result in any binding EU-wide restrictions.

Even the strict limits on gathering of “sensitive data" in the EU’s premier privacy rule, the General Data Protection Regulation, contain a broad carve-out for public authorities that can collect sensitive biometric data if they can justify it. That loophole has allowed facial recognition technology to pop up in locations such as a major Berlin train station, where an experimental project by the authorities has scanned tens of thousands of passersby.

Even so, Breyer said he is confident Europe will ultimately end up with stricter limits on facial recognition than the United States. The lawmaker argues that the EU’s Charter of Fundamental Rights, which grants every European citizen “the right to the protection of personal data concerning him or her,” will protect Europeans from indiscriminate use of facial recognition, while the U.S. Constitution says nothing to that effect, and will not.

“In the U.S., if you’re moving around public spaces, there essentially is no right to privacy,” said Breyer, who was trained as a lawyer.

“Here, it’s the other way around: There is a basic right to data protection and informational self-determination, which means that every piece of data that’s collected and processed about us means an intrusion into our basic rights, and [law enforcement agencies] can only do that on a legal basis, and after being granted permission.”

Tech industry leaders are meanwhile seizing on the opportunity to shape any global rules that may emerge. In December 2018, Microsoft President Brad Smith unveiled principles for facial recognition regulations in a rare call to action from a leading industry figure. Amazon Web Services' public policy chief, Michael Punke, urged lawmakers to enact legislation that would both "protect civil rights while also allowing for continued innovation and practical application of the technology."

For now, though, face-scanning tools are rapidly becoming commonplace, embraced by the public and private sector alike.

Say goodbye to anonymity

At the same time, companies like Facebook, Apple and Google have built facial recognition into their most popular devices, for instance as a means of unlocking phones or automatically tagging friends in photos. Amazon has emerged as a top supplier of easy-to-use facial recognition systems, whose customers have included police departments and U.S. government agencies.

Among public authorities, the appetite for facial recognition systems seems to know no bounds. Across the United States, federal, state and local agencies have been conducting so-called experiments for years, with the Transportation Security Administration and U.S. Customs and Border Protection both use facial recognition at select points of entry. On the state and local levels, police departments in Florida, Colorado and Oregon have begun to adopt the technology, with others exploring its use.

The situation is no different in Europe. In the U.K., two police forces have been testing facial recognition technology to identify passersby in real time with street cameras. The French government has rolled out a facial-recognition-enabled ID card over protests from digital rights groups. Meanwhile, Hungary’s interior ministry is installing 35,000 cameras across its capital, Budapest, and the rest of the country to capture both facial images and license plates.

Facial recognition is already up and running at some European airports from Lisbon to Prague, where passengers from the EU and Switzerland can skip long lines by opting for an automated border control system scanning their faces.

"That’s worrying," said Matthias Monroy, a civil liberties activist who works for the leftist Die Linke party in the German parliament. Paired with the power of artificial intelligence and high-powered computing, such technology may soon “make it impossible to move around anonymously in a public space," he added.

‘Virtually unrestricted’

In the U.S., the debate around facial recognition has focused mainly on government's use of the technology. After the American Civil Liberties Union issued a report on Amazon's sale of its Rekognition software to police departments, San Francisco became the first city in the world to ban local agencies from using the technology, in a blueprint that activists hope will be replicated elsewhere.

That cause has also found a following in Washington, where a coalition of congressional Democrats and libertarian-leaning Republicans, worried about the implications of unchecked government surveillance, wants to restrict the use of facial recognition by federal agencies like the FBI, TSA and Immigration and Customs Enforcement. Leaders of the House Oversight Committee have explored a bill that would block funding for any new use or expanded use of the technology by the federal government, the panel’s top Republican told POLITICO in August.

“We don’t want any more money being used, no money used to expand what we have or to purchase any new ability to impact or use this technology,” Rep. Jim Jordan (R-Ohio) told POLITICO at the time. A “vast majority” of House Oversight Republicans still favor a federal timeout, Jordan said more recently, though he conceded that “I’ve been all focused all on impeachment.”

Before his death, then-committee chairman Cummings warned at a hearing last spring that under current law, the government can use the technology to “monitor you without your knowledge and enter your face into a database that could be used in virtually unrestricted ways.” He later called the issue “one of the few things that everybody, Democrats and Republicans, seem to agree on.”

The committee’s new chairwoman, Rep. Carolyn Maloney (D-N.Y.), has expressed a desire to revisit the issue but has not committed to pushing for a moratorium on federal use.

And even if such a proposal were to advance in the Democratic-controlled House, it would likely face opposition in the GOP-controlled Senate from moderate Republicans, many of whom see the emerging technology as a crucial law enforcement tool.

"I think that is unlikely to gain support in the Senate," Sen. Chris Coons (D-Del.) told POLITICO this month when asked about the prospects of a moratorium.

Coons in November partnered with Sen. Mike Lee of Utah, a libertarian-leaning Republican, to introduce legislation requiring that federal agencies obtain a warrant before using facial recognition for targeted surveillance. But even more narrow proposals such as that bill, which has yet to pick up any additional co-sponsors, have failed to gain traction in the chamber to this point.

In Brussels, new European Commission leader Ursula von der Leyen has promised to take on facial recognition as part of a pledge to write binding rules for artificial intelligence during the first 100 days of her term in office, which started on Dec. 1.

That call coincides with a series of rulings from data protection authorities in various EU states, which have called for caution in deploying mainly "live" facial recognition and urged public authorities to draft legislation around its use. In the past few weeks, privacy watchdogs in Sweden, France and the United Kingdom have all issued position papers on the subject, with the French and Swedish regulators halting efforts to deploy facial recognition at the entrances to high schools.

However, the Commission’s road map for AI does does not necessarily mean any EU-wide rules on facial recognition will ever see the light of day. Despite promises to encode accepted practices in law, European officials have voiced a cacophony of opinions on what exactly the law on AI should contain, with high-ranking bureaucrats hinting that it may skew toward guiding principles instead of hard rules.

That is why it's likely that courts and data protection watchdogs will write those rules in Europe. In late August, a British court rejected the first major attempt to curtail police use of facial recognition, saying security benefits outweighed the risk to privacy and individual freedoms.

Legal experts expect European rules for facial recognition in law enforcement to come in the form of what’s known as “ex post” regulation: First, law enforcement will take advantage of existing legal gray zones and start deploying the technology — until either a judge or a data protection authority will restrict or stop that use, or rule that it conforms with existing law. Cases that could set such precedent are underway.