FBI and ICE Using Drivers License Photos for Facial Recognition Scans
Well, of course they are.
The discovery that federal law enforcement agencies are using state drivers license databanks to augment their ability to identify suspects is drawing criticism. Should it?
Agents with the Federal Bureau of Investigation and Immigration and Customs Enforcement have turned state driver’s license databases into a facial-recognition gold mine, scanning through millions of Americans’ photos without their knowledge or consent, newly released documents show.
Thousands of facial-recognition requests, internal documents and emails over the past five years, obtained through public-records requests by Georgetown Law researchers and provided to The Washington Post, reveal that federal investigators have turned state departments of motor vehicles databases into the bedrock of an unprecedented surveillance infrastructure.
Police have long had access to fingerprints, DNA and other “biometric data” taken from criminal suspects. But the DMV records contain the photos of a vast majority of a state’s residents, most of whom have never been charged with a crime.
—Washington Post, “FBI, ICE find state driver’s license photos are a gold mine for facial-recognition searches“
I’m more worried about government intrusion into citizens’ privacy and abuse of authority by law enforcement than most. But my immediate reaction to this news is: So?
It’s hardly a shocking revelation that the government has my photo. After all, I went to a government office, waited around for a considerable period of time, posed for said photo, and then gave them money in exchange for a license. I’ve actually done that multiple times over the last four decades and change—several military dependent ID cards, military ID cards, contractor and DOD civilian ID cards, passports, etc. I’m not a criminal and they have several sets of my fingerprints going back to college, too, because it’s part of the security clearance process.
So, the question is: to what legitimate aims may those be put?
If my fingerprints were found at the scene of the crime, would it be legitimate to scan the database to identity me? I should think so.
What if I were caught on video at a crime scene and police wanted me for questioning? Would it be proper to use my photo to identify me? I can’t think of a good reason to object.
So . . . what’s the counterargument?
“Law enforcement’s access of state databases,” particularly DMV databases, is “often done in the shadows with no consent,” House Oversight Committee Chairman Elijah E. Cummings (D-Md.) said in a statement to The Post.
Rep. Jim Jordan (Ohio), the House Oversight Committee’s ranking Republican, seemed particularly incensed during a hearing into the technology last month at the use of driver’s license photos in federal facial-recognition searches without the approval of state legislators or individual license holders.
“They’ve just given access to that to the FBI,” he said. “No individual signed off on that when they renewed their driver’s license, got their driver’s licenses. They didn’t sign any waiver saying, ‘Oh, it’s okay to turn my information, my photo, over to the FBI.’ No elected officials voted for that to happen.”
Again, I ask, So?
The 4th Amendment to the Constitution protects me against unreasonable searches and seizures, and requires police to obtain a search warrant from the judicial branch in most instances when they’re entering my property or another space where I have an expectation of privacy.
Now, technology has blurred some lines. I would expect police to get a warrant before getting access to my phone records, for example, as I think I have a reasonable expectation of privacy as to whom I communicate on my private device. Ditto, high-tech listening or surveillance devices that allowed them to spy on me from outside my property.
But my expectation of privacy as to a government photo of my face is extraordinarily low. If Virginia were putting the photos on the web as public domain for people to use as they wish, I’d feel violated. But allowing federal law enforcement agencies to scan them against criminal suspects or aliens who have overstayed their visa? I’m okay with that.
Despite those doubts, federal investigators have turned facial recognition into a routine investigative tool. Since 2011, the FBI has logged more than 390,000 facial-recognition searches of federal and local databases, including state DMV databases, the Government Accountability Office said last month, and the records show that federal investigators have forged daily working relationships with DMV officials. In Utah, FBI and ICE agents logged more than 1,000 facial-recognition searches between 2015 and 2017, the records show. Names and other details are hidden, though dozens of the searches are marked as having returned a “possible match.”
[…]
The records show the technology already is tightly woven into the fabric of modern law enforcement. They detailed the regular use of facial recognition to track down suspects in low-level crimes, including cashing a stolen check and petty theft. And searches are often executed with nothing more formal than an email from a federal agent to a local contact, the records show.
“It’s really a surveillance-first, ask-permission-later system,” said Jake Laperruque, a senior counsel at the watchdog group Project on Government Oversight. “People think this is something coming way off in the future, but these [facial-recognition] searches are happening very frequently today. The FBI alone does 4,000 searches every month, and a lot of them go through state DMVs.”
So, are we okay with people cashing stolen checks and committing petty theft? If so, we should change our laws.
Otherwise, I see no legal or moral distinction between using available databases to track down those suspected of petty crimes vice, say, suspected murderers, rapists, and terrorists. Either it’s a “search” that requires a judicial warrant or it isn’t.
Or, let’s move from drivers license databases, entry into which is essentially mandatory for those who live outside the most densely-packed urban centers, to law enforcement databases. According to the most recent available FBI data, “Nationwide, law enforcement made an estimated 10,554,985 arrests in 2017.” From that, I’ll wildly extrapolate to guestimate that there are roughly 100 million photos of criminal suspects in possession of state, local, and federal authorities. Presumably, a substantial percentage of them were never charged and many others were found not guilty. Is it okay to use those photos? The only difference is that they were originally collected for law enforcement purposes. (And done under coercion rather than voluntarily.)
Beyond that, in what way is utilizing these databases “surveillance”?
Now, if the objection is to the proliferation of video cameras in public spaces, I’m actually much more sympathetic. While the courts have mostly ruled that we have next to no expectation of privacy while out in public, they have in some instances cracked down on video and electronic surveillance.
But the concern being expressed here seems to be with pairing that surveillance with photos that enable accurate identification. I personally want law enforcement to be able to accurately identify persons of interest in cases where they’re legitimately investigating.
Admittedly, the situation gets slightly murkier in the case of immigration enforcement:
The records also underscore the conflicts between the laws of some states and the federal push to find and deport undocumented immigrants. Though Utah, Vermont and Washington allow undocumented immigrants to obtain full driver’s licenses or more-limited permits known as driving privilege cards, ICE agents have run facial-recognition searches on those DMV databases.
More than a dozen states, including New York, as well as the District of Columbia, allow undocumented immigrants to drive legally with full licenses or driving privilege cards, as long as they submit proof of in-state residency and pass the states’ driving-proficiency tests.
Lawmakers in Florida, Texas and other states have introduced bills this year that would extend driving privileges to undocumented immigrants. Some of those states already allow the FBI to scan driver’s license photos, while others, such as Florida and New York, are negotiating with the FBI over access, according to the GAO.
“The state has told [undocumented immigrants], has encouraged them, to submit that information. To me, it’s an insane breach of trust to then turn around and allow ICE access to that,” said Clare Garvie, a senior associate with Georgetown Law’s Center on Privacy and Technology, who led the research.
I’d argue, however, that the main issue here is the conflict between competing priorities. On the one hand, we want people to obey our immigration laws. On the other, we have recognized that millions of people are here illegally and compounding that by driving on our roads illegally. States and localities, not unreasonably, want them to do so safely and in accordance with our traffic laws, be insured, be accountable for parking and moving violations, etc. Those goals are zero-sum.
Otherwise, I see this in the same way I do other petty crimes: either we want to enforce our laws or we don’t. If we’re okay with the use of facial recognition for more serious crimes, there’s no obvious moral or legal objection to doing so for minor crimes or violation of our immigration laws.
Now, all of this is based on the premise that the pairing of surveillance footage and photo databases produces good results. That’s actually an open question:
The FBI said its system is 86 percent accurate at finding the right person if a search is able to generate a list of 50 possible matches, according to the GAO. But the FBI has not tested its system’s accuracy under conditions that are closer to normal, such as when a facial search returns only a few possible matches.
Civil rights advocates have said the inaccuracies of facial recognition pose a heightened danger of misidentification and false arrests. The software’s precision is highly dependent on a number of factors, including the lighting of a subject’s face and the quality of the image, and research has shown that the technology performs less accurately on people with darker skin.
“The public doesn’t have a way of controlling what information the government has on them,” said Jacinta González, a senior organizer for the advocacy group Mijente who was particularly concerned about how ICE and other agencies could use the scans to track down immigrants. “And now there’s this rapidly advancing technology, with very few guidelines and protections for people, putting all of this information at their fingertips in a very scary way.”
If the technology produces a lot of false positives and particularly inconveniences people of color, that’s a problem. But, of course, most longstanding investigative techniques (police line-ups come to mind) and, hell, eyewitness accounts have those flaws.
I’m persuadable that this is indeed a problem. But the objections brought to bear in this article have not succeeded.
The concern I have here is the extent to which something like this can be used for surveillance as easily as it can be used as part of a legitimate criminal investigation.
I’m fairly strict when it comes to 4th Amendment issues, and fairly liberal in terms of defining what a “reasonable expectation of privacy” is in the digital age when so much information is available and technology like this exists. Nonetheless, like you I don’t have a significant problem with using this technology in connection with a legitimate criminal investigation — say, for example, if there was an assault in a given area covered by surveillance cameras and policy are trying to uncover the identity of a suspect or potential witnesses — but my opinion would be very different if this technology were tied into state databases and being used to track a person’s movements for reasons unrelated to a criminal investigation.
The solution here is for state legislatures and Congress to step in with legislation that limits how law enforcement can use this technology.
@Doug Mataconis:
Oh, absolutely. But I think there are already rather significant limits on that practice. I’m happy to tighten those up further, as I think being followed around by police is a sufficient intrusion that it ought to require a warrant.
I need to read more on this, however, the first concern I have with this is how bad facial recognition is — especially when you are working with large open data sets with little accompanying meta data (the reason Facebook facial recognition works is that they already have training data about who is most likely in your pictures due to the links you’ve already formed — without out that data to confine searches, success rates are absolutely abysmal).
So the amount of false positives a system like this can generate are absolutely staggering.
@mattbernius: Yes, I touch on that at the end and the piece just doesn’t give enough information on it—and I lack the technical expertise—for me to make a strong judgment on that point.
I saw that (and promptly forgot to acknowledge that James). To that point, this study, from the UK — which has been working with this sort of facial recognition technology for years — is particularly sobering:
BTW, I think you are right to be specifically concerned about matching on POC. Imaging/facial recognition technology success rates drop as the darkness of skin increases.
As an aside, a lot of us who work in the space are concerned that people see the relatively high success rate of facial identification on our personal devices and social media (not to mention media representations of the technology) and think that people are getting trained to believe that these are highly reliable technologies.
James: “So, are we okay with people cashing stolen checks and committing petty theft? If so, we should change our laws.”
If you wish to convince us, perhaps honest arguments would work better.
@Barry:
It’s an honest argument when put into context. The very next sentence:
Put another way: we should either be okay with the use of these photos to catch criminal suspects or not. If it depends on the seriousness of the crime, we’re either using the ends to justify the means or we’re criminalizing something we shouldn’t.
I’m more concerned about who is watching the watcher. When was the last time government/law enforcement was given a tool that was not abused? If there is independent / open data verification of its use then great, but that’s not how these things usually go.
I think the deeper question is just what sort of society do we wish to live in? And based on that, what laws to we need? Honestly, so much is changing so quickly that I have no ready answer. I do feel that part of the “live free or die” mentality with which I grew up will need to move into the 21st century. On the other hand, trust in government is so low that people should know what is being collected, to what ends it is being put, and just how Joe Citizen can be affected by it all. Frankly, I don’t wish to live in a country where fines are automatically mailed out the moment someone jaywalks, or the IRS knows the moment I pay a babysitter without filing the proper declaration. Yes, I will have broken the law, but the cure feels more troublesome than the disease.
In a word, I want the government to inform citizens about what they are doing. With that information, we can all decide on what the limits are.
The “so what” is that the executive branch has taken it upon itself to decide that data collected for one purpose authorized by the legislative branch can be used for a second (and entirely different) purpose without going back to the legislative branch for permission. The immediate reaction from Congress seems like a pretty good indicator of what the response would have been if they had asked. I expect that come the next state legislative season, there will be a rash of new laws banning all uses of the state database except for enumerated reasons.
@Kit:
Yeah, I’m actually with you here. But, again, this seems like a place where we need to rethink the law rather than make enforcement random. I jaywalk quite often when I’m in urban areas. But I’m not an idiot or a jerk about it: I make damn sure no cars are coming and nobody is going to have to slam their brakes to avoid running me over.
@Michael Cain:
This is potentially an interesting argument. But, for one thing, drivers licenses are state matters. It would be odd for federal law enforcement to go to state legislatures for permission here. It makes perfect sense that they’d go to state law enforcement and other local-executive channels.
Maybe. Then again, we have a reaction from precisely two Congressmen in the story.
I expect that it’ll vary considerably from state to state.
I wonder if we will eventually differentiate between “computer surveillance” and “human surveillance”. Should police officers monitor cameras at a sporting event? Probably. But should they monitor cameras in a public restroom? After all, lots of crimes are committed there, from drug use to assault to pretty destructive or gross acts of vandalism. Still, public bathrooms are a bridge too far for me. But what if it wasn’t a human monitoring it? What if a bathroom camera system only alerted a human if its algorithm identified a possible crime in progress, and then it got the attention of a human for a judgment on the video, perhaps with the faces initially blurred out?
This is going to be more of an issue than we realize, very soon. It is now cheaper to read a bar code with a camera than a laser scanner, so there are cash register cameras everywhere. I’m pretty sure that if we were designing from scratch it would make more sense and be cheaper to decide if someone’s hands are under the faucet with a vision system than with the horrible hand sensors that never seem to be adjusted right. Cameras will be everywhere, and processing power is cheap and everything will be connected to the net if only to let a maintenance person know when it is broken. Once the infrastructure is in place, it’s only a matter of time before a manufacturer “adds value” by using those cameras to detect when someone is spray painting “F*** YOU” on the walls or stuffing the sinks with tissue and letting them overflow. Should humans, absent a crime in progress, be able to access those camera feeds?
@Kit:
Having just paid a ticket when a camera system caught me going 63mph in a construction zone, at 11:30 at night without any construction workers present, I can tell you we are already past that point.
In fact, I suspect this could end up being a big push behind self driving cars, as you can set them to obey the speed limit and simply catch up on your sleep or watch a movie. The bill of materials for the hardware costs almost nothing now, and the software that identifies the license plate number and mails the ticket is simply modified off-the-shelf stuff. It won’t be long until every little town that depends on a local speed trap for revenue has one (or ten) of these installed.
@MarkedMan: Except that it would rapidly backfire….if you’re a small town trying to raise money through speed traps it’s not going to help you if automated cars immediately slow down to the posted speed limit when entering. Funds raised: $0. What you want are the people who sorta slow down but not enough because they’re impatient or can’t see why they should slow down to 30 mph for 1/4 mile when everything around it is 55 mph and it’s 2 AM.
What is next – RFID chip implants? I would refuse. And I will not take some kind of national ID number.
@Tyrell:
Well, okay.
Like your Social Security Number?
Regardless, I’m not sure how those apply here.
@MarkedMan:
I agree that it could get creepy fast. But, yes, once we’ve agreed that cameras are a reasonable intrusion in spot A, it strikes me that it’s reasonable enough to be able to use the best photo databases we have available to go after perpetrators.
@grumpy realist: That was my point: the use of these traffic cameras will drive technology in the cars. Who will end up paying the fines? The people who can’t afford the new technology. As we see, towns like Ferguson see that as a feature, not a bug.
I would argue that the “legitimate aims” to which those photos may be put should be limited to the aims for which they were collected in the first place, because it’s those original aims that defined the scope of your expectation of privacy. When I have my photo taken for a driver’s license, the core purpose is to create a form of identification that evidences my ability and authorization to drive on public roads. Accordingly, that’s all I expect them to use it for unless I voluntarily use it as a form of identification when seeking other authorizations (e.g., authorization to enter a secure federal facility or airport boarding area, obtain government benefits, etc.), and then I expect them to use it solely for those purposes. I don’t expect them to have carte blanche to use it for more or less whatever they want regardless of whether it’s related to the purposes for which I gave it to them in the first place.
By way of analogy, should the medical information a person gives to the government via Medicaid and Medicare be usable by the government for purposes other than administering that person’s participation in those programs and the medical care they receive through them? That’s a huge database of DNA and other biometric data that could be helpful in criminal, immigration, and national security investigations too.
I disagree with that logic. The “reasonableness” of a search is judged both by the intrusiveness of the search itself and the importance of the government interest necessitating it. The government interest in apprehending murderers and terrorists is much more compelling, and therefore justifies a higher degree of intrusiveness, than its interest in apprehending people who commit non-violent misdemeanors. Yes, that’s an explicit “ends justify the means” approach, but that’s how you judge whether something is “reasonable” and it’s the logical basis of the Court’s differing levels of scrutiny.
I’ve always been torn on this all or nothing idea of law enforcement. On the one hand, imperfect enforcement makes it easier for bad laws to stay on the books because the full burden isn’t felt by enough people (or enough people with privilege and influence) to generate a change. Draconian drug laws that are primarily enforced against poor and marginalized communities are a quintessential example. On the other hand, imperfect enforcement also acts as a check against government oppression because it provides a safety valve for people to skirt a bad law until it can be changed. The practical difficulty of enforcing anti-sodomy laws, for example, allowed at least some room for gay people to live their lives and develop a community until such time as society at large could be persuaded to finally scrap those laws. On the whole, I think I come out in favor of imperfect enforcement, because I think bad laws and government overreach are inevitable, and periods of genuine oppression are at least highly likely, so I’d rather preserve enough flex in the system for dissidents to slip through the cracks if/when the need arises.
@R.Dave: You raise a number of good points and concerns here.
So, obviously, that’s a baseline. It’s certainly legitimate up to that point. But, surely, there are other legitimate aims?
To take a somewhat silly example, you lose your wallet. A good Samaritan turns it in to the police. Surely, the police should be able to look at your driver’s license and contact you to return the wallet?
Further, the point of drivers licensing is ultimately public safety, with a bit of revenue collection thrown in. If we can use that photo to identify murders and child molesters, isn’t that a legitimate use?
I agree that we should expect law enforcement to place higher priority on more serious crimes. And that justifies a more aggressive pursuit: a high-speed chase may be warranted to apprehend a suspected serial killer; it’s not to catch a petty shoplifter. But I’m not sure that difference applies to 4th Amendment claims. Absent hot pursuit and other established categories, police are no more entitled to violate the rights of a suspected murderer than a suspected pickpocket.
I’m not sure I follow. Reasonableness of a search is based on probable cause, not the nature of the crime. And differing levels of scrutiny have to do with Constitutional hierarchies. Racial discrimination is enjoined by the 14th Amendment and several federal laws authorized by it. So, government action that discriminates on the basis of race is subject to strict scrutiny: the policy gain has to be unrelated to race and of such high value as to make disparate impact worthwhile.
I agree that it’s murky. As noted upthread, I’d be uncomfortable with perfect enforcement of our traffic laws even though I think we ought to have traffic laws. (I’d allow people to treat red lights like stop signs at 2am, but that’s a whole different issue.)
I’m comfortable in a world where Barack Obama is President with ICE doing what it was in fact doing under his watch. I’m decidedly less comfortable under President Trump and his tweets of massive roundups. There, though, it’s not so much that I don’t think we should enforce our immigration law aggressively but rather that I don’t think we should do so cruelly.
I see this plain and simply as something that is ripe for abuse. Federal law enforcement officers fishing around in state databases on an informal basis (“Hey Joe, can I come over and go thru your DMV records?” “Yeah sure Bill. We’re open till 5.”) with out any kind of check or balance. Like that was never problematic before? I’m looking at you, J. Edgar.
@James Joyner:
And yet they do so, quite often with impunity.
@OzarkHillbilly:
I can see all manner of abuse of certain kinds of confidential records. But I’m having a harder time seeing it with DMV records, especially just the photos.
Again, I have more qualms about the increasing presence of surveillance cameras. But, if we catch someone committing a serious crime legitimately, I’m not opposed to using ID photos to identify them for questioning.
@James Joyner: I thought that the SS number was not supposed to be used as an ID. With all the data bases, hacking, and advances in technology, there is no real confidentiality. My doctor is constantly entering information into a laptop. Who gets access to all of that?
Years ago some of the school systems used student Social Security numbers as an id number on the standardized tests. A lot of those answer sheets probably wound up out in dumpsters.
I will just note that a few years ago, I took a trip to Australia and New Zealand and had several occasions where I passed through airport security and customs traveling between the two countries. Each nation expedites it’s customs clearance by using facial recognition. I was stopped at every customs entry port for direct inspection and interview during my trip. Reason? Over the previous 6 months, I had lost 20 pounds and apparently the contours of my face had changed because of it.
Just sayin…
@James Joyner:
Same here, but that is because of my ignorance of LEO procedures and powers and no doubt a lack of imagination. Time and again we have seen people given unfettered access or power and time and again we have seen that access or power abused. Trust me on this, some day, some where, some FBI/ICE/SS/ATF/US Marshall etc etc agent will use unlimited, unofficial access to this data to settle a personal score, or find the name and address of that really hot blonde who smiled at him in the grocery aisle, or ad nauseum.
At the very least a judge should have to sign off on a warrant after ascertaining that a crime was actually committed and that there is in fact an actual real world investigation.
Thorny issues.
Regarding instant enforcement–Arizona has a lot of red light cameras; when you run a red, it snaps a photo of your plate, runs the plate, and issues the ticket with the date/time stamp on it.
My father, in his early 80s, doesn’t care too much for these. I keep telling him the way to avoid getting the tickets is to not run the lights. He insists they are calibrated to snap when the light’s still yellow (I have my doubts about this, and think it likely has more to do with his aging reflexes, which, come to think about it, is probably at least part of the reason there are so many of these cameras in AZ in the first place…)
As others have mentioned, the low quality of facial recognition is a concern.
@OzarkHillbilly:
That’s likely true. I’m sure IRS agents and others do this sort of thing with some frequency. Or, hell, DMV employees. I’m honestly not sure how one truly safeguards against that.
This may be too cumbersome in practice but I don’t know for sure. It seems like a lot for simply matching up names and faces. And I suspect we’d get blanket warrants for OPERATION REAL AMERICA or some such. But it may be that some supervision is in order.
@James Joyner:
And then you mention “competing priorities” and move on. I’m wondering if you would be so blasé if the competing priorities affected you more directly.
Meanwhile, I’m pretty sure you don’t understand all of the ways this data can be used — we can spend all day coming up with scenarios, and miss some really nifty and exciting ones that are likely being used because that’s just not our area of expertise.
Here, where you can see some of the implications that bother you, you’re opposed.
So, right now, police put up semi-functional cell phone towers to get the phone numbers of people at protests, and it is legal to fly over your house (at a certain distance) with infrared cameras to look for the heat of a marijuana growing operation.
I don’t think you know enough to meaningfully approve of any of this. I know I don’t. And I don’t think our courts and legislators understand it either.
I’m bothered that this is being done without a public debate, or significant oversight, or any real guidelines on how his should be used. There should be public hearings, with experts who have a better understanding, before things like this happen.
@Gustopher:
No, my point is that I’m actually more worried about the implications of the surveillance itself than pairing it with DMV photos, which strikes me as reasonable so long as the surveillance itself is reasonable. As noted upthread,
But there sheer fact that we’re using available DMV photos in the enforcement effort doesn’t bother me.
That may well be! I don’t approach this as a subject matter expert but rather as someone who has been interested in a lot of the surrounding issues going back to my undergraduate days—more than 35 years—but does something completely different for a living. With rare exceptions, I see my posts here as conversation-starters rather than definitive statements.
@James Joyner:
It is not possible to put up 100% safeguards against anything. Every power gets abused by somebody eventually. That is still no reason not to put up a speed bump or 2 to slow things down, make people stop and think about what they are doing and that there will be a sworn record of it with their personal “fingerprints” on it. It does not necessarily have to be a judge who signs off on it, but it does have to be somebody not in the employ of that particular agency.
@grumpy realist: South Carolina? Some of those small, sleepy towns that people go through on the way to the beaches drop the speed limit from 55 to 45 to 20. And drivers had better hit the brakes on the dot. I knew one guy who got two tickets and paid on the spot. Later on he checked his record. Those tickets never showed up.