The use of facial recognition to identify criminal suspects has been the subject of debate in several countries for some time. The discussion focuses on the fine line between advances in public security and the restriction of citizens’ freedom and privacy. In the midst of this, doubts remain about how data is stored and how efficient the systems adopted by authorities are.
In Brazil, the subject has gained strength as more cities and states adopt the technology. Even without a specific regulation for the use of facial recognition in public security, it is possible to find several cases of security agencies that implement systems to compare photos of suspects with records from databases.
The cases range from Rio de Janeiro, which began testing an instant recognition system in 2018, to Ceará, where police have applications that perform the recognition of unidentified suspects. Despite the advances in tools, experts in digital law warn of the risks that they can bring to the population.
One involves processing citizens’ data. In general, security agencies offer few details about how information is stored and managed. There is also a concern with the accuracy of the systems, which, in other countries, have shown that errors are not so rare. To understand how technology advances in Brazil, we can start with the most populous state in the country.
Facial recognition in São Paulo
One of the main facial recognition systems for public security in Brazil is that of São Paulo. Adopted by the Civil Police, it compares images from cameras with a database with more than 30 million RGs issued in the state. The solution was developed by Thales Gemalto, who had been offering a tool to compare fingerprints for some years.
O Tecnoblog talked about the system with Ricardo Abboud, sales manager for identity and biometry solutions at Thales Gemalto. According to him, the São Paulo tool will grow with the issuance of new RGs and is prepared to receive up to 90 million records. He also explained that the comparison between images from cameras and documents does not happen automatically.
Instead, Civil Police officers need to have access to images captured by devices on public roads or even on witness cell phones and compare them with the RGs database, known as the Automated Biometric Identification System (ABIS). in English). The company informs that it has certifications that guarantee a high degree of efficiency.
“Each and every comparison system, be it facial biometrics or fingerprint, has two important points: one is the quality of the database, where the search will be made. This database needs to have an adequate quality of the photos and fingerprints ”, explains Abboud.
“The second important point is the image that you are going to get from this database. The better the photo, the better the light condition, the amount of pixels between the eyes and everything, the better the assertiveness of facial recognition and fingerprint ”.
Thales Gemalto says its systems use photos that follow the standards of the International Civil Aviation Organization (ICAO), which sets rules for photographs in documents such as passports. He predicts that the image should have an adequate positioning, a white background and an amount of pixels between the eyes, which helps facial recognition tools to be more accurate.
Also according to Abboud, the company’s system uses machine learning and manages to improve the identification of faces as it is more exposed to them. The executive says that, unlike tools that are more inaccurate in identifying black people, Thales Gemalto’s solution has no difference between ethnic groups because it has already been tested globally.
“The system doesn’t recognize color, it doesn’t recognize hair, it doesn’t recognize any of that. If you submit a photo in black and white or even in infrared, it is even better because it is not based on this type of thing that he will learn ”, he explains.
In addition to the state of São Paulo, the company offers services to countries such as France, Germany, Spain, China, India, Saudi Arabia, Argentina, Peru, Mexico, Morocco and the Ivory Coast. However, it is the United States that draws the most attention. There, the Department of Homeland Security uses a biometric system with more than 700 million people registered in ports, airports and embassies.
The São Paulo Civil Police carries out the identification of suspects through the Biometric Identification Laboratory, present at the Ricardo Gumbleton Daunt Identification Institute (IIRGD). The space was opened in early 2020 with 102 research stations and can communicate with equivalents from other locations in the country.
Facial recognition in other states
In Brazil, the state of Bahia adopted facial recognition for public security purposes in December 2018. In September 2020, the Bahian government reported that the tool had already assisted in the arrest of 194 wanted people. The system, however, has already recorded cases of false positives. Just over a year ago, a young man had a gun aimed at his head after being mistaken for a wanted person for assault.
The mistakes also happened in Rio de Janeiro, which began testing real-time recognition technology in 2018. One such case occurred in Copacabana, where a woman was taken to the police station after being incorrectly identified as a convicted murderer. The woman who committed the crime was on the wanted list, but was actually already in prison.
In Ceará, police officers have had an application since 2019 that allows them to search the face of individuals who are not identified during approaches. The facial recognition systems were also adopted by some municipal governments, such as those in Vitória, João Pessoa, São José dos Campos (SP), Guarujá (SP), Mesquita (RJ), Blumenau (SC) and Pilar (AL).
Lack of data impairs assessment
Experts point out that, in addition to the lack of information on how data is managed, Brazilian security agencies do not offer information on the efficiency of these systems. In England, for example, a survey commissioned by the London police and carried out by researchers at the University of Essex found that 81% of the alerts made by the local tool were incorrect.
The political scientist and member of the Center for Studies on Security and Citizenship (CESeC), Pablo Nunes, considers that the most important thing is to understand how Brazilian police are evaluating facial recognition systems. “In the case of Rio de Janeiro, we asked for access to data on the number of prisons, approaches and false positives for us to make an assessment of the system’s efficiency. And they said they don’t produce that data, ”he said in an interview with Tecnoblog.
For him, the absence of this information prevents more detailed analysis of the tools of different governments. “We cannot assess what is the best way or which produces the most damage to society because they really do not [os dados]. Public security in Brazil is known for its lack of data and the low importance it attaches to the issue of qualified data ”.
Pablo also states that the question about the efficiency of the tools is not being followed up with due importance. “These mistakes that have already happened are being treated as side effects or as something minor, which already reveals many questions, especially when we look at who are the people who are suffering from these mistakes, black people, young people, who are already the targets of public security policy and police violence ”.
Does LGPD regulate facial recognition?
The General Data Protection Law (LGPD), which defines rules for the treatment of personal data by public agencies and companies, came into force in September 2020, but it will not affect the functioning of these facial recognition systems. This is because your text has an exception if the treatment takes place exclusively for public security purposes.
“The LGPD makes it clear in Article 4 that its regulations and parameters will not be placed in relation to public security, so it left a vacuum there. It is obvious that we have other constitutional guarantees, but I believe that it was a mistake not to produce a very clear regulation on the use of these data for public security ”, analyzes Pablo.
In the same excerpt, the law determines that the processing of data for public security and other purposes included in the exception “will be governed by specific legislation, which should provide for proportional measures and strictly necessary to serve the public interest”.
The policy coordinator and researcher at the Reference Institute for Internet and Society (IRIS-BH), Gustavo Rodrigues, explained that the new standard will need to be conceptually aligned with the LGPD and its general principles.
“In the Brazilian case, there is a peculiarity because the design of our General Data Protection Law is very much inspired by the design of European law, GDPR. But in Europe, they enacted the GDPR and soon enacted a law on data processing for the purposes of these exceptions, public security, etc. Not here in Brazil. We passed the LGPD, but that other law was for later ”, explains Gustavo.
The Brazilian regulation on facial recognition in security may be inspired by a proposal by the Legislative Chamber of the Federal District. Approved in October 2020 and awaiting sanction from the governor of the Federal District, the article establishes, among other points, a ban on the continuous surveillance of citizens and a restriction on the use of facial recognition for equipment in public spaces.
Risks in technology adoption
Still according to Gustavo, the adoption of facial recognition has been viewed with concern because of the risks that technology can bring. “It can hurt the presumption of innocence if it is used to keep an eye on those who frequent certain public spaces with the premise that everyone there is suspect rather than assuming that everyone is innocent,” he explains.
“There is a risk of discrimination that is immense because there are current studies that indicate that systems of this type are more prone to false positives when analyzing black people compared to white people,” he continues. “There is a risk to freedom of expression and to the freedoms of association and assembly that are also stated in the Constitution. Because a person who knows is being watched changes his behavior so as not to express himself fully ”.
He explains that this can cause, for example, people to decide not to participate in political demonstrations for fear of possible persecution after data collection. This risk is the main challenge for actions that call for a ban on facial recognition for security in countries like the United States and Argentina. In places like San Francisco and Sommerville, USA, the use of technology for this purpose has already been banned.
“This movement is interesting because it shows that a debate is taking place, that is, that society has not taken the view that the implementation of this technology is inevitable and that we have to accept it”, says Gustavo. “Society is treating this as something that has profound repercussions on people’s rights and on democracy itself, that is, something that demands debate.”
In Brazil, the Chamber of Deputies has a commission of lawyers with the task of drafting a draft law on the processing of personal data in cases not provided for in the LGPD, such as public security, national defense and investigations of criminal offenses. The result of the group’s work should guide the parliamentarians’ discussions on future regulation.