With absent laws, face tracking proliferates

Data compiled by digital rights advocacy body the Internet Freedom Foundation (IFF) through right-to-information (RTI) filings showed that authorities had deployed 124 facial recognition systems in India as of August. Until last November, that number was just 75, according to IFF.

But the rapid spread of the new but unproven technology has alarmed critics and civil liberty advocates, especially because India lacks a data protection law.

“There has been a rise in the use of facial recognition technology (FRT), especially in the past two years. It has come more into the limelight after Delhi Police used it in anti-CAA (Citizenship Amendment Act) protests,” said Anushka Jain, associate policy counsel (surveillance and transparency) at the IFF.

The rush to deploy such intrusive technologies without adequate protection is seen as a troubling sign by experts. In China, for instance, the Communist Party is using them at airports, streets and railway stations to crush dissent and enforce what it deems good behaviour. The Chinese government uses facial recognition to monitor the behaviour of its citizens through a social credit system. Like credit scores, a person with a low social score can be punished by restricting travel or access to the internet.

Facial recognition technology uses machine learning algorithms to extract data points from a person’s face to create a digital signature. This signature is then compared with an existing database to find possible matches. The system uses a network of cameras enabled with computer vision (that allows computers to derive information from digital images and videos). It can identify a wanted person in a crowd and alert the police.

However, the technology is far from proven and has been found in studies to provide misleading results. These studies have found that facial recognition algorithms have misidentified people and, more alarmingly, discovered that different algorithms provided significantly different results when analysing the same photos.

These facial recognition systems are being widely used across government branches in India. Police in several states use it for surveillance, while the railways ministry, Telangana State Road Transport Authority and government schools in Gujarat are using it to authenticate people. In addition, several so-called smart cities, such as Gandhinagar, plan to use the technology for surveillance.

According to Project Panoptic, an initiative run by the IFF around the deployment of facial recognition technology in India, Maharashtra has the highest number of such systems (12), followed by Telangana (8), Gujarat (8), Andhra Pradesh (7), and Tamil Nadu (7). The central government is working on 13 such systems. However, in the absence of specific laws or frameworks, privacy experts said facial recognition could be misused or used arbitrarily.

The ministry of electronics and information technology (Meity) released the Draft India Data Accessibility and Use Policy 2022 paper for public consultation in February, but the country still lacks a comprehensive data protection framework.

This poses a major concern. For instance, as part of its response to IFF’s RTI, Delhi Police in July said, “all matches above 80% similarity are treated as positive results while matches below 80% similarity are treated as false positive results, which require additional corroborative evidence.”

Privacy experts find this disturbing. “While 80% may sound like high accuracy, it is considered by today’s standards to be quite low. It leaves a significant room for false positives,” said Pam Dixon, founder and executive director of the World Privacy Forum, a global public interest research group. Dixon pointed out that most algorithms in the FRT field have accuracy rates of 97 to 99%, but that is also subject to multiple factors such as skin tone. “For deeper skins, the accuracy falls to unacceptable rates,” she warned. Even systems with higher cutoffs for accuracy have resulted in false positives in other countries. Several African-American men in the US have been wrongfully arrested and spent time in jail in the past 1-2 years due to flawed facial recognition software, according to The New York Times.

Though several cities in the US, including Portland and San Francisco, have banned police from using facial recognition, the technology is making a comeback in law enforcement. For instance, in July, New Orleans lifted the ban on the use by police with certain protections such as the requirement of permission from senior officials for investigating violent crimes. In August, The Guardian reported that the UK Home Office plans to use FRT to monitor migrant offenders. “Even if it is a 100% match, there is still some scope for technology to be incorrect,” said IFF’s Jain.

Big tech companies such as Microsoft and Amazon have refused to sell their facial recognition software to the police. Microsoft said it would not allow it until a federal law regulates its use. Currently, no laws in any jurisdiction regulate the use of face recognition. In April 2021, the European Union released a draft proposal for regulating artificial intelligence and its usage.

The technology for most facial recognition systems deployed in India doesn’t involve big tech companies. Instead, they are implemented by government agencies such as the National e-Governance Division and NEC Technologies India Pvt. Ltd. Some of the systems are supplied by startups such as Gurugram-based Staqu Technologies or the Portugal-based Vision Box.

Public officials and police believe facial recognition can make a meaningful difference. “It is very useful in spotting suspects and criminals. We are also exploring ways to use it for prevention and detection of crime,” said Triveni Singh, superintendent of police, cybercrime, UP Police. Singh, however, acknowledged the problem of false positives. He emphasized that the technology can learn and the accuracy will improve gradually. Singh further explains that face recognition is a form of biometric data that falls under sensitive personal data. “The Information Technology Act says that if you are dealing with sensitive personal data, you must use security measures to protect it.”

Legal experts said specific laws around facial recognition are still required to ensure it is used fairly. “Specific or special laws to govern the use of facial recognition is essential to enable its usage and curb misuse,” said N.S. Nappinai, a Supreme Court advocate and founder of Cyber Saathi.

Nappinai added, “data principles to limit collection, usage and most importantly retention; permissibility for use in developing artificial intelligence; the threshold for acceptance are just some of the issues that would be required to be addressed.”

First article