<https://www.wired.com/story/europe-police-facial-recognition-prum/>
Lawmakers advance proposals to let police forces across the EU link
their photo databases—which include millions of pictures of people’s faces.
For the past 15 years, police forces searching for criminals in Europe
have been able to share fingerprints, DNA data, and details of vehicle
owners with each other. If officials in France suspect someone they are
looking for is in Spain, they can ask Spanish authorities to check
fingerprints against their database. Now European lawmakers are set to
include millions of photos of people’s faces in this system—and allow
facial recognition to be used on an unprecedented scale.
The expansion of facial recognition across Europe is included in wider
plans to “modernize” policing across the continent, and it comes under
the Prüm II data-sharing proposals. The details were first announced in
December, but criticism from European data regulators has gotten louder
in recent weeks, as the full impact of the plans have been understood.
“What you are creating is the most extensive biometric surveillance
infrastructure that I think we will ever have seen in the world,” says
Ella Jakubowska, a policy adviser at the civil rights NGO European
Digital Rights (EDRi). Documents obtained by EDRi under freedom of
information laws and shared with WIRED reveal how nations pushed for
facial recognition to be included in the international policing agreement.
The first iteration of Prüm was signed by seven European
countries—Belgium, Germany, Spain, France, Luxembourg, the Netherlands,
and Austria—back in 2005 and allows nations to share data to tackle
international crime. Since Prüm was introduced, take-up by Europe's 27
countries has been mixed.
Prüm II plans to significantly expand the amount of information that can
be shared, potentially including photos and information from driving
licenses. The proposals from the European Commission also say police
will have greater “automated” access to information that’s shared.
Lawmakers say this means police across Europe will be able to cooperate
closely, and the European law enforcement agency Europol will have a
“stronger role.”
The inclusion of facial images and the ability to run facial recognition
algorithms against them are among the biggest planned changes in Prüm
II. Facial recognition technology has faced significant pushback in
recent years as police forces have increasingly adopted it, and it has
misidentified people and derailed lives. Dozens of cities in the US have
gone as far as banning police forces from using the technology. The EU
is debating a ban on the police use of facial recognition in public
places as part of its AI Act.
However, Prüm II allows the use of retrospective facial recognition.
This means police forces can compare still images from CCTV cameras,
photos from social media, or those on a victim’s phone against mug shots
held on a police database. The technology is different from live facial
recognition systems, which are often connected to cameras in public
spaces; these have faced the most criticism.
The European proposals allow a nation to compare a photo against the
databases of other countries and find out if there are
matches—essentially creating one of the largest facial recognition
systems in existence. One document obtained by EDRi says the number of
potential matches could range from between 10 and 100 faces, although
this figure needs to be finalized by politicians. A European Commission
spokesperson says that a human will review the potential matches and
decide if any of them are correct, before any further action is taken.
“In a significant number of cases, a facial image of a suspect is
available,” France’s interior minister said in the documents. It claimed
to have solved burglary and child sexual abuse cases using its facial
recongition system.
The Prüm II documents, dated from April 2021, when the plans were first
being discussed, show the huge number of face photos that countries
hold. Hungary has 30 million photos, Italy 17 million, France 6 million,
and Germany 5.5 million, the documents show. These images can include
suspects, those convicted of crimes, asylum seekers, and “unidentified
dead bodies,” and they come from multiple sources in each country.
Jakubowska says that while criticism of facial recognition systems has
mostly focused on real-time systems, those that identify people at a
later date are still problematic. “When you are applying facial
recognition to footage or images retrospectively, sometimes the harms
can be even greater, because of the capacity to look back at, say, a
protest from three years ago, or to see who I met five years ago,
because I'm now a political opponent,” she says. “Only facial images of
suspects or convicted criminals can be exchanged,” the European
Commission spokesperson says, citing a guide on how the system will
work. “There will be no matching of facial images to the general
population.”
Pictures of people’s faces shouldn’t be combined in one giant central
database, the official proposal says, but police forces will be linked
together through a “central router.” This router won’t store any data,
the European Commission spokesperson says, adding that it will “only act
as a message broker” between nations. This decentralized approach makes
Prüm II more straightforward: Police wanting to compare fingerprints
under the current system must connect to other police forces
individually. Under the new infrastructure, countries only need one
connection to the central router and it will be easier to “add
additional data categories to the system,” the documents obtained by
EDRi say.
The European data protection superviser (EDPS), who oversees how EU
bodies use data under GDPR, has criticized the planned expansion of
Prüm, which could take several years. “Automated searching of facial
images is not limited only to serious crimes but could be carried out
for the prevention, detection, and investigation of any criminal
offenses, even a petty one,” Wojciech Wiewiórowski, the EDPS, said in
early March. Wiewiórowski said more safeguards should be written into
the proposals to make sure people’s privacy rights are protected. The
European Commission spokesperson says the body has taken “good note” of
the EDPS opinion and the thoughts will be taken into account as the
European Parliament and Council discuss the legislation.
See What’s Next in Tech With the Fast Forward Newsletter
From artificial intelligence and self-driving cars to transformed
cities and new startups, sign up for the latest news.
During the development of the plans, Slovenia has been one key country
pushing for the expansion—including asking for people’s driving license
data to be included. Domen Savič, the CEO of Slovenian digital rights
group Državljan D, says there are significant concerns about the
differences between police databases and who is included. “I haven't
heard enough to be convinced that all of this data gathered by
individual police forces is sanitized in the same way,'' Savič says.
Police databases are often poorly put together. In July 2021, police in
the Netherlands deleted 218,000 photos it wrongly included in its facial
recognition database. In the UK, more than a thousand young Black men
were removed from a “gangs database” in February 2021. “You could have
databases that have completely different backgrounds in terms of how
this data was collected, where it was sourced, how it was exchanged, and
who approved what,” Savič says. Slovenia has already faced similar
problems. “And this could lead to misidentification.”
One of the biggest problems for Jakubowska is how Prüm II could
normalize the use of facial recognition by police forces across Europe.
“What really concerns us is how much this Prüm II proposal could
incentivize the creation of facial image databases and the application
of algorithms to these databases to perform facial recognition,” she
says. The EU will pay for the cost of connecting databases to Prüm II,
the proposal says, and this includes the cost of creating new national
facial images databases. Sixty years after being invented, facial
recognition is still just getting started.
_______________________________________________
nexa mailing list
[email protected]
https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa
