All We Need is Your Face

In this episode

Automated facial recognition systems: the bad, the very bad, and what you can do to resist them (if you like). A special collaborative episode with Ella Hillström.

Transcript

Geraint

Keep communities safe. Keep industry and commerce secure. Help combat crime and fraud. Promote justice. Protect victims. Protect the public. Protect fundamental freedoms and human rights. All we need to achieve this is … your face.

Chris

Hello, and welcome to Vulnerable By Design with me, Chris Onrust. Today we have a special collaborative episode with Ella Hillström — hi, Ella!

Ella

Hi!

Chris

… who is a researcher in social anthropology based at Stockholm. What are we talking about? Automated facial recognition systems. The bad, the very bad, and what you can do to resist them.

Let’s start with some questions.

Ella

Have you ever used your face to: unlock your phone? Go through customs? Get access to a building? Pay for a veggie burger?

Chris

Nice.

Ella

And have you ever, simply by walking down the street, taking a bus or going to work or school, had your face captured and ran through a giant database to match that cheeky visage of yours to your personal info, your name and address—linking it to a tidy list of locations you previously visited, plus all the things you’ve ever posted online? More difficult to answer is it?

Because most likely you wouldn’t even know when that’s been done to you. Today, in many places worldwide, your likeness is regularly being captured without anyone telling you and without you really having a say in the matter.

Chris

Pfff.

Let’s talk some stats. Last year, the website Comparitech found that, in a survey of the 100 most populous countries on earth, 70% of governments of the countries surveyed were using facial recognition technologies on a large scale basis. That could include facial recognition linked to on-street cameras, passport processing, or even as a precondition to access services.

For example, in the United Arab Emirates, facial recognition is used—supposedly—to speed up processes. In China facial recognition technologies are used invasively, including to publicly try to humiliate people who are caught on CCTV leaving their homes inappropriately dressed. Read: wearing their pyjamas. And in Russia facial recognition is now being used to detain people who protest against the ongoing war on Ukraine, or who seek to evade the partial military draft.

Ella

Some more stats. Of the surveyed countries, facial recognition was also used by police forces (in around 70% of them), in banks (around 80%), and in airports (60%). And it’s used in stores, on buses, trains and metro systems of around 20 to 30% of the countries. Spain, for example, logs the faces of all of the roughly 20 million visitors who pass through Madrid South bus terminal and checks them against their criminal database. While in Kazakhstan and China faces are valid payment methods to cover your bus fare.

Workplaces use facial recognition to monitor workers and in nearly one in five of the countries in the survey, facial recognition is used on children in schools to monitor their attendance, or even whether the little tots are paying attention in class—which may affect their grades. Do you remember being in school? Is this how you would have liked to be treated?

Only six out of 100 countries surveyed showed no evidence of using facial recognition at all. So in case you’d like to keep your face to yourself, these are: Cuba, Haiti, Syria, South Sudan and Madagascar.

Chris

Prefer to talk money? Globally, in 2020, the market for facial recognition software was estimated to be worth roughly €3.7 billion. That’s about the size of the entire GDP of Suriname for that entire year. It looks like those who can are throwing around a lot of dosh just to be able to identify you, track you, monitor your location or even your facial expression. But how does facial recognition actually work?

Ella

Expectably, facial recognition all starts with your face. And with ‘your face’, we’re generally talking about human faces. Although I think something similar has also been tried on dogs. Yep, dogs.

How each system works will of course vary. But broadly, a facial recognition system takes an incoming image—sometimes called a ‘query image’, because it’s used to query who’s in the frame. This image then gets processed. First, to detect whether there’s a face on the picture at all. I mean, it could also be just plants, or food? My food does occasionally get identified as people. And next, if the system does detect a face, it processes the image further to extract so-called ‘facial features’.

Chris

More specifically, it will try to identify things such as: Where are the eyes? What’s the shape of the nose? How about the chin then? And how are all of these facial features positioned towards one another? Once it’s figured this out, the system will produce a vector, which is something like a mathematical map of the key features of a particular face. This map sometimes is also called a ‘face print’, similar to the idea of a fingerprint.

Ella

Good. Once the system has your face print, then the serious identification business starts. Once it has your face print, the system will dive into a potentially massive database with other face prints that have already been extracted from other images. And ask: Does a face map of this new query image I’ve got right here, match one or more of the face prints already in the database? If not, then tough luck. But if a match does turn up, it will generally be expressed not as a gotcha! But more in terms of a degree of similarity between two face prints. So it might respond: Match found! It’s Chris (70% similarity).

Chris

Well, I can hear you thinking: Where do all of these images come from? I am very glad you asked. For the input image, basically, all bets are off. It could have come from anywhere. Your face must have been digitally captured at some point or other. Perhaps a video on TikTok? Local CCTV systems? Or maybe you dropped off a package at the neighbours’ and got caught on their doorbell snoop cam?

And as for the reference database—that my friends might well be the facial recognition industry’s dirty secret. Because while some of those pictures come from official government databases, such as passports or driver’s licenses, much of what is in these reference databases is just scraped from the internet.

For example, Clearview AI is one of the biggest players in the facial recognition field. Clearview AI has built up a database of over 10 billion images of people’s faces. That is more than one picture for every single living person on earth. Clearview says that the images it fetched were ‘publicly available’. In plain speak, ‘publicly available’ just means that it was scraped from lots and lots of websites, including from Instagram, Facebook, YouTube, Twitter, and the mobile payment app Venmo. Happily violating the terms of service of most of these platforms.

Plus, when it comes to Europe, Clearview AI also happily ignored the EU’s General Data Protection Regulation—or GDPR for short—which as a default explicitly forbids gathering personal data, including biometric facial data from EU citizens without their knowledge or consent. So yeah, that’s the space of players we are dealing with here.

Ella

By and large facial recognition systems themselves are discriminatory—you know, the racist, sexist sort of kind. How so? Well, let’s look at error rates, which is when face recognition systems get things wrong. Here are three known limitations. First, non-detection. The system might simply not recognize your face as a face. Which, problematically, can easily happen when you’ve got melanin-rich skin. Who’s looking forward to self-driving cars eh?

Second, misidentification. Which is when the system says that you’re somebody else, or that somebody else is you. And finally, what you call ‘mislabeling’. Which is where a system is wrong about facial traits, for example, whether your eyes are open or closed, because it’s only trained on a very limited range of facial features.

Chris

Studies show that systems were much more likely to misidentify you if you are a Black woman. And in general, the systems performed worse on people with dark skin, compared to light-skinned people. Worse on women, compared to men. And worse on older people and children, compared to people in other age groups. So let’s just call that what it is: tech-enabled racist, sexist, ageist discrimination.

Ella

Errors have consequences. Faulty matches and mismatches can mean that you can get stopped and questioned about things you’ve had no involvement with whatsoever. You might even get arrested if a facial recognition system says that you look quite like someone who may have done something or other. Because the computer is always right, isn’t it?

But of course, it’s not about the errors as Dr. Joy Buolamwini, founder of the Algorithmic Justice League, says: facial recognition tech threatens civil rights and liberties. Even when it works as intended. If you wanted to increase discrimination in society, facial recognition systems are your friends. These systems are often first used on people who