TAKEAWAYS FOR WEEK 5

Article on Idaho rape

·      19 year old boy is convicted of statutory rape of a 14 year old girl

·      As part of his sentence, the judge rules that he cannot have sex until he is married

·      Does this infringe on his constitutional rights?

·      Cruel and unusual punishment? Search and seizure? Privacy on intimate relations?

Facial Recognition

·      Biometrics measure a physical or biological trait that is unique to person such as fingerprints, handwriting, iris scans, etc.

·      Identification vs Authentication

o   Identification- Trying to prove that the person is who they say they are. Ex. Facial recognition

o   Authentication- A way to show that you are who you say you are. Ex. Passwords on your computer

·      Next Generation Identification (NGI)

o   Fingerprints of criminals are uploaded on this database

o   FBI wants to replace fingerprints with other biometrics such as facial scans, iris scans, etc.

o   It would hold information of civilians not just criminals

o   Utah among with 18 other states allows FBI to access drivers license pictures

o   Body cameras take pictures of everyone

·      Statewide Information & Analysis Center (SIAC)

o   The purpose is to give intelligence to law enforcement to protect Utah citizens

o   Database where biometric information is accumulated

·      Concerns related to facial recognition

o   Collection- When and how is it being used?

o   Storage- How long is it being used?

o   Usage- How is it used?

o   Access- Who can have access to the information?

o   Data Security- How secure is the information and how confidential is it?

o   Accuracy- How well does this actually work? How is it regulated?

o   Protections against “Big or little brother”- How do we make sure we aren’t being tracked?

·      Collection issues

o   Warrant?

o   Regulations and rules on how information is obtained?

o   Notice required?

o   Consent?

o   Is it continuous or just as needed?

o   Persons or places where collection is categorically permitted or prohibited?

·      Retention and storage issues

o   Where is it stored?

o   How long is it retained?

o   Should there be mandated archiving/destruction procedures?

·      Usage issues

o   Limited to purpose collected?

o   Forensic use?

o   Business purposes?

o   Usage only as a unique identifier?

o   Disclosure/transparency of uses?

·      Access rights

o   Who has access?

o   Why is it being accessed?

o   Subject access?

o   Collector access?

o   Government access?

o   Researchers access?

o   Third party access?

·      Accuracy error issues

o   Right to review or correct by subject?

o   Who pays for corrections?

·      Regulation/Compliance

o   Industry best practices of government regulation?

o   Penalties for violation of practices?

o   Consumer notification requirement for unauthorized access?

·      Protections against big brother & little brother

Question of the week

·      Most of the class agreed that facial recognition can only be used with consent

Case Studies

·      Case 1

o   Super bowl with facial recognition cameras around perimeter

§  Group 1- Put a notice or sign. Implied consent when purchasing ticket.  Keep the footage only for a month and only for security purposes. No selling it to adds and such.  Only use it for security purposes.

§  Group 2- Give notice to attendees by printing warning on ticket. Consent is implied.  Only kept for 24 hrs.  Won’t sell footage.  Kept secure and only security personnel have access. 

§  Group 3- Giving noticed through signs, ticket, and announcement.  Consent is implied.  Information is kept for a month.  Security agencies can request longer storage with reasonable cause.  Known convicts are flagged to be watched.  Connected to law enforcement database.

·      Case 2

o   Beverage kiosk with facial recognition

§  Group 1- Intrusive and hesitant because of social media access.  How do you obtain consent from non-frequent shoppers.  Social media is not necessary or useful.  Accuracy and protection of others privacy.  Information from store is deleted right after use.  Data retention of company? Large invasion of privacy for little gain. Consent on kiosk? Large privacy policy and ways to opt out.  Who has access to this information? Companies have access to bulk data not individuals purchasing patterns.

§  Group 2- Does it save pictures? How long is info stored? Who has access? Parent company, store, or more access?  Can users check their own profile? Does it store private information like prescriptions and such.  Do you lose benefits from opting out? How accurate is scanner? Warnings and notice? Are customers able to give feedback?  Who is information shared with?

§  Group 3- Consent is given by pushing a button.  Frequent shopper allows giving access to what you want the kiosk to access.  Keeps information indefinitely.  Track coupon usage. 

·      Groups full answers are posted on blog

QUESTION OF THE WEEK NO. 4

The commercial use of facial recognition technology for security, access, marketing and customer service is rapidly growing.  Privacy advocates argue that widespread use of the technology will allow businesses to identify and track almost anyone in public without their consent or even knowledge.  Businesses argue that individuals should not expect complete privacy in public and that some loss of privacy is outweighed by the benefits the technology offers consumers and businesses.  Multiple privacy, government and industry organizations have listed best practices regarding the commercial use of biometric technology, but the recommendations often conflict and no consensus has been reached.

Should businesses be required to obtain a person’s consent, express or implied, before using facial recognition technology?

TAKEAWAYS FOR WEEK FOUR

Anonymity

Many founding fathers used pen names to remain anonymous.

US supreme court has recognized that anonymous speech is a right

• Is not an absolute right.

Anonymity can be used

• As a shield
• Without anonymity speech may be chilled such as speech by victims of sexual abuse.
• As a sword
• Used to inflict harm to others without any link to their identity.

Real names v. Opaque usernames

• Free speech and Privacy v. Accountability
• Majority of internet users have used an opaque username

Emily Buhler's Blog post

• Internet users have a "ring of Gyges
• Opaque user names.
• Many online sites require users to use a real name in an effort to
• Promote safety
• Face book does not require use of legal name but known name.

It is easy to voice derogatory view about people you will never meet.

• Even with real name derogatory comments would still occur.

What is said anonymously doesn’t have much power.

• The message may still be hurtful whether it is anonymous or not, but its credibility will differ depending on where it comes from.

Trolls seek attention through outrageous comments and will continue to do so even with their real names

Online anonymity is a privilege that should be revoked if abused.

• The deciding forces could be
• The webpage or company
• The readers themselves
• The Government

#Cutforbieber campaign

• Began after photo of Bieber smoking marijuana
• 4chan post made to begin a campaign to post fake pictures of girls cutting themselves for Justin Bieber to stop smoking marijuana to trick girls into cutting themselves
• Campaign turned out to be a hoax

Group activity whether 4chan should post prominent warning and have a real name policy.

• Group 1
• Would allow for prominent warning, but not adopt a real name policy.
• Group 2
• Include prominent warning, and adopt real name policy.
• Would also create an age policy
• Group 3
• Prominent warning
• Require everyone to establish an account but maintain anonymity between users

Question of the Week

• When reporting on allegations of sexual assault against women, most news organizations will identify the alleged perpetrator but will not identify the name of the alleged victim.  Some argue this policy is unfair to the accused and allows women to make false accusations without any accountability.  Others argue that identifying the victim is too privacy-invasive, will discourage women from coming forward, and will essentially victimize the woman a second time.  Do you agree with the policy?
• 9 students said yes
• 8 students said no

Plaintiff sue anonymously

• As a general rule, persons who sue in court must do so using their real names
• Courts will allow plaintiffs to remain anonymous under certain conditions.
• If defendant objects then the plaintiff must demonstrate why their privacy interest outweigh the defendants and the public's.
• Courts use different tests to determine if anonymity is permitted; majority of courts use a balancing test that weighs the competing interests:
• Whether the plaintiff is bringing a suit against governmental action
• Whether the lack of anonymity burdens a plaintiff's ability to file suit
• Whether the plaintiff could suffer mental or physical retaliation
• Whether the plaintiff will be forced to provide information of the "utmost intimacy"
• Whether the plaintiff is a child
• Whether the defendant's rights would be significantly subordinated

A Picture is Worth...

A report done by the Georgetown law school’s Center on Privacy and Technology on the use of facial recognition technology by law enforcement was published in October 2016. The investigation raised concerns about the limited protections for and potential harm toward people’s privacy in regards to rules and regulations (or often rather the lack thereof) for law enforcement’s use of facial recognition technology, which can range from running photos of persons being detained for unlawful behavior to real-time scanning of ordinary, law-abiding citizens.

Summary of the Report

The report raised some troubling questions and problems and proposed some possible solutions:

Accuracy: There is insufficient testing to check accuracy on the software that is used by law enforcement agencies. Also, it has been found that facial recognition software is often less accurate on African Americans, women, and younger people, possibly because the software “learns” how to recognize faces using datasets of photos of largely comprised of Caucasian, older, males. In addition to these concerns, match results returned from databases are not always checked by trained analysts to accurately match faces. Possible solutions to these concerns are to have regular testing of the accuracy of software, “train” the software on more diverse datasets of photos, and ensure that trained analysts check match results.

1^st and 4^th Amendment Rights: Databases of photos used by law enforcement agencies are often comprised of pictures of law-abiding citizens (driver’s license photos, IDs, and mug shots from people who were not convicted of a crime). Another concern is that facial recognition has been used to identify people participating in protests, which may stifle free speech. Facial recognition has not legally been determined by the US government as a “search,” so it is not protected under American’s rights against unreasonable searches. Possible solutions to these concerns are to only allow searches of non-mug shot photos when there is probable cause involving a serious crime and an issued court order and that the use of facial recognition software should have legislative approval with laws to limit its use.

Regulations and Oversight: In many law enforcement agencies, there is insufficient auditing done to protect against the abuse of facial recognition technology. Also, use of this technology is not always made available to the public. Another issue is that some law enforcement agencies do not require probable cause before running a facial recognition search. Possible solutions to these concerns are to have auditing of the use of facial recognition searches, have policies on the use of the technology that are available to the public and have received legislative approval, and, again, require probable cause before making a search.

Legislative Response

After a different report on the use of facial recognition technology by the Baltimore Police Department on a protest in 2015, members of the legislative branch have called for answers to concerns. Senator Al Franken (Ranking Member of the U.S. Senate Judiciary Subcommittee on Privacy, Technology and the Law) said, “Now, I believe that facial recognition can be a very useful tool in the fight against crime — it can in fact help us catch violent offenders and criminals. But I’m also a firm believer that Americans have a fundamental right to privacy. So I want to ensure that this technology is accurate, transparent, and that our use of facial recognition technology appropriately balances privacy and public safety.”

Utah Law Enforcement

There is facial recognition technology set up at the StatewideInformation & Analysis Center in Sandy, UT. It is used only when there is an active criminal investigation, except for its use to protect against identity fraud when someone gets a new driver’s license or ID photo.  The center does have human analysts check the results that are returned by the technology to try to eliminate false positives.

What Should Utah Law Enforcement Do With This Technology?

Utah Law Enforcement should be allowed to use facial recognition technology, but only under certain conditions. Searches of mug-shots should only be allowed when there is probably cause. Large scale surveillance should only be allowed in the case that there is an emergency where the public at large is in serious danger.

Utah is one of 16 states that allows the FBI to access their database of driver’s license photos and IDs. They should ensure that these  and any accesses are only used in the case of protecting against identity fraud and when there is a serious emergency.

Wide scale use of facial recognition software and constant surveillance may be able to help prevent and solve crimes. However, these benefits need to be weighed and balanced against the harm to people’s privacy. We shouldn’t become a police state. Law-abiding citizens shouldn’t be subjected to constant monitoring and being a part of a “perpetual line-up.” 

I Spy with My Biometric Eye

Summary of United States Government Accountability Office’s: “Face Recognition Technology”

The FBI’s Facial Analysis, Comparison and Evaluation (FACE) department has access to the Next Generation Identification-Interstate Photo System (NGI-IPS), Department of State’s Facial Recognition on Demand, Department of Defense’s Automated Biometric Identification System and 16 state face recognition systems.

The FBI’s NGI-IPS stores about 30 million photos (mugshots and photos submitted for licensing, immigration, volunteering, security clearance, and military service) from across the nation. Fingerprints are stored in the database as well, and linked to the image(s) of an individual, marking their unique identity. These are referred to as “known persons.” In the event of a criminal investigation, agencies may submit a photo of an unknown person to the database. Images captured through video surveillance may be submitted. Once a photo is submitted, the database provides 2 - 50 “candidates” or potential matches. There is then a manual process to determine which identity is the match.

The FBI and some state law enforcement agencies have access to NGI-IPS. Law enforcement agencies may submit photos of incarcerated individuals to the system for storage and later searches. Law enforcement agencies may also request that images be removed from the database. Individuals may have the images expunged (along with their criminal records) depending on the circumstances and the state which submitted their information. The FBI claims that civilian photos are stored but not used in criminal searches unless those images have been previously connected to a criminal identity. Some states have access to search NGI-IPS and some do not. The FBI is still navigating the relationship between state law enforcement agencies and NGI-IPS. Utah submits driver’s license photos, mugshot photos, and correction photos to the database.

Two important laws concerning facial recognition are the Privacy Act of 1974 and the privacy provisions E-Government Act of 2002. The Privacy Act concerns existing technology and the E-Government Act of 2002 provisions concern future or updated technology. The Department of Justice’s policy is to follow the Fair Information Practice Principles which is meant to consider a balance between personal privacy and public interest.

Problems the GAO Report Found Concerning the FBI’s Use of Facial Recognition Technology

Transparency

The FBI lied about how long they were using the FACE program and the NGI-IPS system. In discord with the E-Government Act of 2002, the FBI did not publish privacy impact assessments (PIA) before the database was implemented or update information and PIA’s as new developments in the software occurred. The FBI collected, stored, and used information without explaining to the public what was being stored and how it was being used. Updates to the system were not announced in a timely manner in violation of the Privacy Act of 1974.

Access

The FACE services PIA states that photos in the database capture activities, dates, times, and identifying information. The GAO report urges the FBI to conduct more audits into how people with access use facial recognition services.

Accuracy

The FBI conducted tests on the NGI-IPS system, but they did not release the results on inaccurate conclusions and only tested for candidate lists of 50, even though people searching the database can search lists of 2 – 50 candidates. The FBI claimed the detection rate is 84%, but this is primarily based on the 50 candidate list search. The false positive rates (when the system positively matched an image with the wrong identity) were not released, which leads to questions about the true efficacy of the system. The FBI also did not test the accuracy of facial recognition systems external to the agency which they access (these include civilian photos).

Benefits of Facial Recognition Systems

Eyewitness line-ups can be biased or inaccurate, resulting in wrongful convictions. According to an article in Forensic Magazine, facial recognition “allows people to be identified, even when it is not possible to take fingerprints for physical or legal reasons” and “the workload involved in the verification process is reduced and the efficiency and accuracy of the process increases.” Access to vast facial recognition databases has resulted in quicker identification of suspects. Facial recognition can also be used for prevention by recognizing whether a person is on a sex offender, watch list, etc.

Should Utah Law Enforcement Use Facial Recognition?

Facial recognition technology is unregulated which results in misconduct, confusion, and fear. I don’t believe that Utah law enforcement should use facial recognition technologies until there are more regulations and these regulations are strictly followed. The public is not given information about what is being collected and who it is being collected from. The technology itself doesn’t have to comply to a set standard of detection because no one is enforcing they do so. Tests on accuracy of varying list sizes and how race affects results have not been realized. The risks seem to outweigh the rewards.