The most important limitation to place on the use of facial recognition to prevent misuse is a warrant requirement. Probable cause warrants are our most important shield against improper surveillance, providing both independent oversight and ensuring that invasive surveillance is directed only at individuals suspected of wrongdoing. This is why there are warrant requirements for use of powerful electronic surveillance tools such as wiretapping, cellphone location tracking, thermal imaging devices, GPS tracking devices, and cell-site simulators. Indeed, neither the public nor the courts would find it acceptable for law enforcement to track someone’s cellphone for a month absent any authorization or limits, even if law enforcement stated that this surveillance would just be used for leads.

A warrant rule would provide significant benefits in preventing facial recognition from being used to catalog sensitive but innocuous activities and associations, and would increase public trust that law enforcement was using the technology responsibly. And because most investigative applications of facial recognition focus on identifying an individual whose image is recorded in commission of a crime, meeting this requirement should not be a significant barrier to legitimate use. A warrant requirement could also include reasonable exceptions modeled on existing rules, such as those governing identification of victims and missing persons, as well as exceptions that could be made in exigent circumstances.

Another critical regulation to prevent abuse is a requirement that use of facial recognition be limited to investigation of serious offenses. Such a rule is necessary to prevent law enforcement from using the unprecedented discretionary power facial recognition offers for selective enforcement, as occurred during the Baltimore protests. This rule would also be a key means of ensuring that law enforcement uses this tool exclusively in cases that receive the highest level of scrutiny and review. And it would prevent facial recognition from being used for dragnet surveillance, something that is already occurring in China as facial recognition constantly monitors all public activity, ostensibly in an effort to curb petty offenses.

POGO’s task force on facial recognition recommended that departments center a serious crime limit on Uniform Crime Reporting Title 1 crimes, with some additions and deviations. This would allow law enforcement to use facial recognition in order to respond to significant crimes and threats, while limiting the risk of selective enforcement and abuse.

Finally, it is essential that defendants are given notice when facial recognition is used as a basis for their arrest and prosecution. This must occur even if facial recognition is used as the basis for obtaining future evidence, rather than itself serving as direct evidence in court proceedings. In some jurisdictions, law enforcement uses facial recognition thousands of times per month, but defendants almost never receive notice of its use in investigations. As the New York Times described in a detailed investigation of how law enforcement agencies use facial recognition:

Any technological findings presented as evidence are subject to analysis through special hearings, but facial recognition results have never been deemed reliable enough to stand up to such questioning. The results still can play a significant role in investigations, though, without the judicial scrutiny applied to more proven forensic technologies …. In some of the Florida cases The Times reviewed, the technology was not mentioned in initial warrants or affidavits. Instead, detectives noted “investigative mean” or an “attempt to identify” in court documents, while logging the matters as facial recognition wins in the Pinellas County records.

As discussed above, the reliability of facial recognition is highly dependent upon circumstance and manner of use. While enacting the recommendations provided in reference to this issue would mitigate risk, defendants still have the right to review whether it was used in a proper manner with reasonably reliable results, as with any other forensic technology.

Recommendations

POGO offers the following recommendation on use of the technology, which are largely based on the limits recommended by our Task Force on Facial Recognition.

In order to enhance community confidence in law enforcement and any use of facial recognition technology, we recommend that if law enforcement entities wish to use facial recognition, they do the following:

1. Encourage community debate before deploying facial recognition. Law enforcement entities should inform their local community of their intention to use facial recognition before implementing a system, and facilitate a public debate so that their adoption of facial recognition is preceded by establishment of community-based standards.

In order to reduce the risk misidentifications, improve accuracy, and ensure proper treatment of facial recognition as a forensic technology, we recommend that if law enforcement entities use facial recognition, they do the following:

2. Require independent testing and prioritize high accuracy standards. Law enforcement should only use software that is regularly tested by independently entities—such as the National Institute of Standards and Technology—and have higher levels of accuracy both in general and among various demographic groups.

3. Require extensive training for officers using facial recognition. Before allowing an officer to use a facial recognition system, departments should require extensive training on the technology, including on its overall limits, the impact of image quality, the impact of confidence thresholds, and the tendency for higher rates of error for certain demographic groups.

4. Treat facial recognition as a forensic tool rather than an all-purpose tool. Use specially trained and designated staff that are not involved in investigations related to the scans they run.

5. Do not use unreliable matches with low confidence thresholds. Require high confidence thresholds in order to use potential matches, and do not deploy standards that automatically return a set number of matches even if they have a low confidence threshold.

6. Prohibit the use of junk science methods based on artificial imagery. Prohibit the use of facial recognition with images that are partially computer generated, or images such as sketches or images of lookalikes that are not photographs of the individual being sought.

7. Require independent verification of matches. Require independent verification of matches produced by facial recognition, and place a limit on the value matches can have—such as considering them equivalent to an anonymous 911 call—as the basis for officers’ actions and investigations.

8. Prohibit the use of real-time facial recognition. Real-time facial recognition and crowd scanning should not be permitted while this form of facial recognition is so prone to error.

In order to provide proper safeguards against abuse and improper targeting that invasive surveillance tools such as facial recognition can be misappropriated for, we recommend that if law enforcement entities use facial recognition, they do the following:

9. Require probable cause warrants. Law enforcement should be required to obtain a probable cause warrant from a judge in order to use facial recognition for investigative purposes. Exceptions can be made for situations such as identifying victims, locating missing persons, or responding to exigent circumstances.

10. Establish a serious crimes limit. Use of facial recognition should be limited to serious crimes, such as Uniform Crime Reporting Title 1 crimes.

11. Require disclosure to defendants. Defendants should receive notice whenever facial recognition was used in an investigation that led to their prosecution, including when facial recognition served as the basis for obtaining derivative evidence.

12. Require strict auditing with public transparency. Law enforcement should maintain a regular auditing system with public reporting on results to ensure these rules are followed and the public has confidence in them, and publish reports on how often facial recognition is sought and used.

