Facial Recognition Technology: Is a Ban on Federal Agency Use Feasible?

Background

As facial recognition technology achieves a healthy state of use in society, there are rising concerns over individual privacy as companies and government agencies collect, store, and use this data. Awareness of this technology is widespread; a 2019 Pew Research poll states 86% of Americans are at least a little aware of facial recognition technology. Most of the adults surveyed also believe the technology is at least somewhat effective at determining race, gender, and ultimately identifying someone.

Alongside federal databases, there are private entities that have developed their own. The most infamous is Clearview, which amassed over 3 billion public social media photos and sold access to the information to law enforcement agencies, and whoever could afford it. The discovery of the company’s breadth of data increased privacy concerns after the New York Times reported on the company. There have been calls from privacy advocates to ban federal agencies from using this technology, specifically out of fear of eroding First and Fourth Amendment Rights.

States and cities have banned their agencies from purchasing or using the technology. Some are trying to convince the federal government to suspend its use of the technology. While citizens’ privacy rights must be upheld, banning the federal government from using technology presents difficult challenges that must be addressed.

Current Bans

City-Wide Ban on Use by Local Government Agencies

After surveying all seven active bans on all government agency use, located in Table 1, a trend of similar traits was discovered. Each bill contained the following characteristics: 1) if already existing, inclusion within the surveillance technology definition, 2) a ban on agencies from obtaining, retaining, requesting, accessing, or using facial recognition technology or information derived from the technology, 3) and ensuring inadvertent or unintentional receipt of the information would not be a violation of the ordinance. Northampton and Somerville are exceptions to characteristic three. The cities have a small loophole, when explicitly stated, which allows outside entities to send their agencies information unsolicited, but only if the agencies report its receipt and use.

These government agency bans, as written, are ineffective in its goal of protecting citizen’s rights. While other laws address some privacy issues related to data, including biometric identifying information, the bans do not discuss personal or private sector collection, storage, and use. Barring local government agencies does not prevent state or federal authorities from conducting the surveillance in association with crimes conducted in the local city.

 Moratoriums

In line with the local bans seen in a few cities in California, the state passed legislation in October 2019 banning the use of “any biometric surveillance system” in association with a body camera. The specific wording of this ban keeps it narrow to any law enforcement agency of California or California municipalities. Private security is not included, allowing companies still to conduct this type of surveillance on their property. It does not preclude law enforcement from purchasing or using vendor databases.

After the New York Times reported on the use of Clearview nationwide, including police officers, New Jersey District Attorney barred police agencies within the state from using the application. This moratorium did not affect the use of any other facial recognition technologies. There was no opposition to the use of technology. No punishment for violating the moratorium was reported.

Violating Bans

The punishments for violations range from termination to receiving damages from a successful court case. However, there is no criminal ordinance related to unlawful use. None of the proposed bans include criminal statutes either, leaving redress for citizens in civil courts. If the violation is determined to be an injury within the law, the punitive costs are at least $1,000 plus court and attorney fees in damages. While the bans can prevent a system from being developed for use by the respective government agencies, it does little to disincentivize one-off requests by law enforcement.

Do Bans do Anything?

The bans do a couple of things. The legislation, for the time being, prevents specific government agencies from directly participating in the creation, development, and use of a government database of identifying information. In theory, this protects individual privacy and allows them to live with a presumption of innocence in daily life. Police officers, for example, will have to have someone’s I.D. card to verify their identity and if they have any warrants or outstanding tickets.

Legislation, in most of the cases, does not prevent facial recognition evidence from being used in criminal investigations if the information is unsolicited from the owner of the data. It is unclear if a generic statement, such as “if you have any information regarding this specific case, please reach out” will qualify as a request. Until the use is challenged, evidence obtained via this method could be admissible.

Federal Agency Use

Department of Housing and Urban Development

Some public housing agencies have started using the technology, in conjunction with local police, to provide additional evidence in criminal investigations around their facilities. The use of it prompts fears of bias, loss of privacy, and law-abiding citizens being tracked by the police. In Detroit, the system has expanded to several impoverished neighborhoods as well. Individuals who live there have no means of opting out of facial recognition. They must contend with constant surveillance of their activities, unlike citizens who do not live in public housing. Location metadata, which typically does not identify a person on its own, can be combined with a face data pulled from the cameras. Police can then develop historical trends of a specific phone’s location, attached to a person.

The HUD currently has no regulations over the use of facial recognition technology at public housing. It does not know the extent of the technology’s use either. There are no plans to regulate it at any location which receives federal funds.

Department of Justice

The Department of Justice is the most prominent government user of facial recognition technology, with other agencies also operating databases. The FBI’s system, known as the Interstate Photo System (IPS), is a searchable database of 30 million criminal and civil photos. As of 2016, they have access to the DoD’s biometric I.D. system, DoS’s Consular Consolidated Database of Visa Applications, and 16 state driver license databases totaling 412 million photographs. Law enforcement use of these databases is permitted by various state and federal law, without requiring a warrant or consent of the individual.

The FBI also facial recognition services provided by vendors, despite having this database available. They were listed in a New York Times report as a client of Clearview A.I. alongside the Department of Homeland Security. The extent of its use is vaguely understood to be in child trafficking and similar cases. No other public information about the contract is available.

Internal procedures dictate how the FBI’s system can be accessed and what is stored. Alongside photos, the database could use other personally identifying information, such as date of birth, address, and name, to narrow the search. This system has similar privacy risks as private-sector databases.

Current Legislation and Legal Considerations

 Proposed Ban on Federal Use

There is only one bill that was introduced to ban the federal use of facial recognition technology, H.R. 3875. It states no federal funds may be used for the purchase or use of facial recognition technology. It is unlikely to be successful for several reasons. The legislation, as written, would make it difficult for the government to develop future standards for commercial use or track the utilization of the technology in the country. The federal government also loses a useful tool to investigate a crime.

Ceasing federal funding for purchasing or using facial recognition technology does not solve the privacy problem. State and local law enforcement can still track individuals, conduct surveillance, and voluntarily provide that information to federal agencies. A ban creates an extra step, where the FBI must request the data and analysis from outside the agency. Privacy rights are still impacted by technology.

Other Proposed Legislation

Of those that have heard about facial recognition technology, there is little concern about specific law enforcement use. A majority of the American public finds law enforcement to use facial recognition technology to assess security threats in public spaces acceptable. In a similar vein, a plurality finds companies tracking employees an unacceptable use of the technology. The survey shows that the public is more concerned with commercial use than law enforcement.

Some bills attempt to regulate technology more effectively. S.2878 requires a warrant to utilize facial recognition technology for ongoing surveillance. The bill puts limitations on federal agency use that falls in line with maintaining the privacy of individuals in their daily lives. It does not limit the current usage of the database by requiring warrants.

A house bill similar to S.2878 is HR 4021, which would require a warrant to apply facial recognition technology to photos owned by a state or the federal government, or any photograph that is possessed by either. It also bars sharing the information with anyone that does not have permission via a court order. The bill draws comparisons to the CLOUD Act, which requires warrants to request data from companies, regardless of the location of the server. This bill is another example of limitations on an investigative tool by requiring a warrant.

Court Precedence

There is one current court case regarding the use of facial recognition technology by federal law enforcement. The ACLU is pursuing the FBI, DEA, and the Justice Department in court to comply with a FOIA request for the use of facial recognition technology. The result of the case will mean more information becomes available to determine the extent of the technology’s use by two federal law enforcement agencies. It is not challenging its use; therefore, there are no current cases from which the constitutionality of the technology that could reach the Supreme Court.

The Supreme Court has no precedence of barring technology from law enforcement use. However, there is precedence for requiring warrants to use technology or to gather specific data. The Supreme Court ruling for Kyllo v. United States, questioning the warrant requirement of thermal imagers to detect heat in a house, found that the technology’s use requires a court order. The concern over warrantless use came down to the government’s ability to surveil individuals in their homes as sense-enhancing technology continued to advance. There was no consideration to ban the use of

Riley v. California challenged the legality of searching a cellphone under the Chimel Rule, which allows police to conduct a warrantless search of a person and the area in their immediate reach after a lawful arrest. The Supreme Court ruled the data on a cellphone is not subject to a warrantless search because of the immense amount of personal data on the device, which would not have been on their person in hard-copy form in the pre-digital era. In this case, the courts determined that police had to obtain a warrant to access the wealth of data.

A new precedent was set in Carpenter v. United States when the court declared that obtaining specific location information records from wireless carriers is classified as a search and thus protected by the Fourth Amendment. In the Opinion of the Court, society’s expectation of privacy regarding physical movement, considering law enforcement could not monitor a person’s every move, was upheld once again.

Should There Be a Ban?

Based on established precedence, “A person does not surrender all Fourth Amendment protection by venturing into the public sphere; this applies to facial recognition technology. By utilizing surveillance cameras, law enforcement can track a person’s movements by matching their facial data to a plethora of pictures available from any available database or commercial vendor. Unlike cellphone location records or thermal imagery, it is legal for them to use the information without a warrant.

However, the federal government has no reason to pass legislation to bar itself from using technologies that could improve its ability to conduct criminal investigations, or combat fraud, if it does not violate citizens’ rights. If they do, State governments would still have the power to collect, store, and use facial data in their investigations without requiring warrants. Local law enforcement and private security firms could do the same. A ban leaves federal agencies in a lower position of power over the information, giving agencies, even at the local level, and commercial entities more ability to track a person than their federal counterparts.

Despite some political support, banning the technology would not be feasible for the United States Government to pursue as a policy. Based on court precedence, commercial vendor availability, and the thousands of law enforcement agencies that could still use the technology, the federal government would be able to find a workaround of the ban in some fashion that could satisfy court challenges. Absent Congress passing a new law, the Department of Justice should require warrants for facial data use in ongoing surveillance and in searching for potential identities in their database. Warrants are a step towards controlling the use of facial recognition technology and protecting the rights of Americans from improper surveillance. It’s a limit law enforcement is used to operating under, and one the public will accept. With the widespread use of facial recognition, warrants will ensure the trust of the people in their law enforcement to use it properly remains well into the future.

Table 1

ENTITYBANEXCEPTION
Berkeley, CA [1]Notwithstanding any other provision of this Chapter, it shall be a
violation of this Ordinance for the City Manager or any person acting on the City Manager’s behalf to obtain, retain, request, access, or use: i) any Face Recognition Technology; or ii) any
information obtained from Face Recognition Technology, except
for personal communication devices as defined by Section 2.99.020 or section 2.99.030(4).
Evidence received to the investigation of a specific crime that may have been generated from Face Recognition Technology but was not intentionally solicited shall not be a violation of this Ordinance. The inadvertent or unintentional receipt, access to, or use of any information obtained from Face Recognition Technology shall not be a violation of this subsection provided that the City Manager or any person acting on the City Manager’s behalf does not request or solicit the receipt, access to, or use of such information, and all copies of the information are promptly destroyed upon discovery of the information, and the information is not used for any purpose.
Brookline, MA [2]It shall be unlawful for Brookline or any Brookline official to:
a. obtain, possess, access, or use (i) any face surveillance system, or
(ii) information derived from a face surveillance system;
b. enter into a contract or other agreement with any third party for the purpose of obtaining, possessing, accessing, or using, by or on behalf of Brookline or any Brookline official, (i) any face surveillance
system, or (ii) data derived from a face surveillance system; or
c. issue any permit or enter into a contract or other agreement that authorizes any third party to obtain, possess, access, or use (i) any face surveillance system, or (ii) information derived from a face
surveillance system.
No exceptions explicitly stated.
Cambridge, MA [3]Notwithstanding any other provision of this Chapter 2.128, it shall be unlawful for the City or any City staff to obtain, retain, request,
access, or use: 1) Face Recognition Technology; or 2) Information obtained from Face Recognition Technology.
City staff’s inadvertent or unintentional receipt, access
of, or use of any information obtained from Face
Recognition Technology shall not be a violation of this
Section 2.128.075 provided that: 1) City staff did not
request or solicit the receipt, access of, or use of such
information; and 2) City staff logs such receipt, access,
or use in its Annual Surveillance Report as referenced
by Section 2.128.075. Such report shall not include any
personally identifiable information or other information
the release of which is prohibited by law.
Northampton, MA [4]It shall be unlawful for any city official to expend any city resources to obtain, retain, access, or use any face surveillance system.N/A
Oakland, CA [5]Notwithstanding any other provision of this Chapter (9.64) it shall
be unlawful for the City or any City staff to obtain, retain, request,
access, or use: 1. Face Recognition Technology; or 2. Information obtained from Face Recognition Technology.
City staff’s inadvertent or unintentional receipt, access of or use of any information obtained from Face Recognition Technology shall not be a violation of this
Section 9.64.045 provided that: 1. City staff did not request or solicit the receipt, access of, or use of such information; and 2. City staff logs such receipt, access, or use in its Annual Surveillance Report as referenced by Section 9.64.040. Such report shall not include any
personally identifiable information or other information the release of which is prohibited by law.
San Francisco, CA [6](d) Notwithstanding the provisions of this Chapter 19B, it shall be
unlawful for any Department to obtain, retain, access, or use: 1) any Face Recognition Technology; or 2) any information obtained from Face Recognition Technology.
A Department’s inadvertent or unintentional receipt,
retention access to, or use of any information obtained from Face Recognition Technology shall not be a violation of this subsection (b), provided that:(1) The
Department does not request or solicit its receipt, access to, or use of such information; and (2) The Department logs such receipt, access to, or use in its Annual Surveillance Report.
Sommerville, MA [7]SECTION 2. Ban on Government Use of Face Surveillance.
(A) It shall be unlawful for Somerville or any Somerville official to
obtain, retain, access, or use: (1) Any face surveillance system; or (2) Any information obtained from a face surveillance system.
N/A

Sourced from:

  1. “Ordinance Amending Berkeley Municipal Code Chapter 2.99 to Prohibit City Use of Face Recognition Technology,” Berkeley, CA City Council (2019)
  2. “Article 25 Ban on Town Use of Face Surveillance,” Brookline Town Meeting (2019).
  3. “Amend Chapter 2.128 Surveillance Technology Ordinance by adding in “2.128.020 Definitions”,” Cambridge, MA City Council (2019)
  4. “19.176 An Ordinance Prohibiting the Use of Face Surveillance Systems,” Northampton, MA City Council (2019)
  5. “Ordinance Amending Oakland Municipal Code Chapter 9.64 to Prohibit the City of Oakland from Acquiring and/or using Face Recognition Technology,” Oakland, CA City Council (2019)
  6. “Stop Secret Surveillance Ordinance,” San Francisco Administrative Code (2019)
  7. “Ordinance 2019-016: Ban on Facial Recognition Technology,” Somerville, MA City Council (2019)