On the ground

As part of Reclaim Your Face’s investigation in rights-violating deployments of biometric mass surveillance, EDRi member Hermes Center explains how the Italian Police are deploying dehumanising biometric systems against people at Italy’s border.

By Reclaim Your Face campaign lead organisation Hermes Center
Originally published in Italian here.

The Reclaim Your Face campaign has been investigating and exposing abusive and rights-violating uses of facial recognition tech, and other biometric mass surveillance, since its launch last year. In the latest in a long line of examples that show that these inherently discriminatory technologies are being used to further exclude some of society’s most marginalised people, Hermes Center explain how the Italian Police are deploying dehumanising biometric systems against people at Italy’s borders. Now, more than ever, we need to call for a ban on these biometric mass surveillance practices. The Reclaim Your Face campaign’s major EU petition (European Citizens’ Initiative), launching on 17^th February, will gives us the legal means to demand just that.

The introduction of facial recognition systems in Italy continues to show the same symptoms that we denounce in the Reclaim Your Face campaign: lack of transparency, absolute disregard for the respect of human rights and inability to admit that some uses of this technology are too dangerous.

The latest episode concerns the Automatic Image Recognition System (SARI), initially acquired by the Italian police in 2017 and now, as revealed in an investigation by IrpiMedia, at the center of a new public tender with the aim of upgrading the system and employing it to monitor arrivals of migrants and asylum seekers on the Italian coasts and related activities.

“In order to do so, the Ministry of Interior has used two strategies: taking advantage of the European Internal Security Funds and, as shown by some documents obtained by IrpiMedia thanks to a FOIA request, ignoring the questions of the Italian Data Protection Authority (DPA) that has been waiting for two years to close an investigation on the facial recognition system that the police wants to use,” reads the article.

In our Reclaim Your Face requests, we ask the Ministry of the Interior to publish all the evaluations of the algorithms used, the numbers on the use of the system, and all the data on the type of faces in the database used by SARI.

This information is fundamental in order to understand the effects of the algorithms that act on a database that is already strongly unbalanced and discriminatory: as revealed almost two years ago by Wired Italia, 8 out of 10 people in SARI’s database are foreigners. It is not clear how many of these are migrants and asylum seekers.

The biometric and digital identity processing of migrants and refugees in Italy has been studied in a Data&Society report carried out in 2019 by researcher Mark Latonero in partnership with Reclaim Your Face partner CILD, an Italian NGO. The field analysis uncovered an entire ecosystem composed of NGOs, government, researchers, media, and the private sector that collects, analyses, and manages digital information about migrants and refugees to provide them with support, regulate them, and study their behaviors. Collecting this data can lead to varying degrees of discrimination due to existing biases related to the vulnerability of migrants and refugees. Mindful of this study, we imagine how pervasive and unprotected a facial recognition system adopted on precisely one specific category of people could be. An additional level of scrutiny that we do not want to be normalised and become part of the daily lives of us all.

While requests on transparency of the algorithm and the database are not met and even the DPA is still waiting for an impact assessment of the system, the Ministry is also exploiting European money from the Internal Security Fund.

IrpiMedia details the subject of the contract as follows: “The budget allocated for the enhancement of the system is 246000€ and the enhancement includes the purchase of a license for a facial recognition software owned by Neurotechnology, one of the best known manufacturers in the world, able to process the video stream from at least two cameras and the management of a watch-list that includes up to 10 thousand subjects. In addition, the hardware and software configuration must be of small dimensions, to be inserted in a backpack and allow to carry out ‘strategic installations in places that are difficult to access with the equipment provided,’ reads the technical specs of the public tender of the Ministry of Interior.”

Biometric surveillance dehumanises us into lifeless bits of data, depriving us of our autonomy and the ability to express who we are. This is even more dangerous when applied to people who reach our countries escaping from violence, economic disasters, and environmental catastrophes. Meeting human beings with biometric surveillance technologies destroys our humanity.

The story is shocking, but it is not inevitable. Brutal technologies that amplify already persecurtory anti-migration strategies are the latest tool that show the extent of these structural problems. Banning biometric mass surveillance means not only stopping the use of such tools, but addressing the underlying inequalities and discrimination of our societies. You can support Reclaim Your Face’s campaign against discriminatory and intrusive biometric mass surveillance.

The Reclaim Your Face movement is growing, and our demands for transparency, limiting the accepted uses and respect for humans are becoming more and more common across Europe. New organisations are joining the coalition each week, and people across Europe continue to sign the petition to add their voices to our demands. Now, thanks to campaigning by Homo Digitalis in Greece and Bits of Freedom in the Netherlands, we’re getting closer to real political and legislative changes that will protect our faces and our public spaces from biometric mass surveillance.

By RYF leads Homo Digitalis and Bits of Freedom

Dutch DPA speaks out against biometric surveillance in public space

On 23 November, Dutch broadcasting station BNR did a morning show on facial recognition in publicly-accessible areas. In the Netherlands, these so called ‘smart’ cameras are used more and more in supermarkets, companies and football stadiums. In the 2-hour radio show, Lotte Houwing from Bits of Freedom put forward the case for a ban and more effective enforcement against biometric surveillance technologies in publicly-accessible spaces.

Later in the show the vice-president of the Dutch data protection authority (DPA), the Autoriteit Persoonsgegevens, was interviewed. She explained that the increase in the use of facial recognition technologies in the Netherlands is because of the abuse of the legal ground of “substantial public interest”. The explanatory memorandum which accompanies Dutch privacy laws gives the example of the security of a nuclear power plant as a possible justification for the use of such technologies. This means that you cannot use these technologies against petty thieves.

The Dutch DPA thinks that part of the problem of these harmful deployments is caused by misunderstanding and lack of knowledge about what is a legitimate use of facial recognition and other biometric surveillance technology. To tackle illegitimate uses, the DPA has now sent directed guidelines to explain the law to the different industry associations that have been the biggest users of this invasive technology. So far, there has not been a direct promise regarding enforcement measures against illegitimate deployments to follow this phase of targeted information. However, the vice-president was very clear about the DPA’s perspective on biometric surveillance in public space: “It is as if somebody is following you around with a camera and a notebook throughout the whole day. That’s a surveillance society we do not want.”

We embrace these statements of the DPA and encourage them to take concrete action for our fundamental rights and freedoms in publicly-accessible spaces. Reclaim Your Face and BanThisBS!

Civil society complaints against biometric surveillance lead to official investigations in Greece

In Greece, the work of EDRi member Homo Digitalis has started to bear fruit. In June 2020 the Greek watchdog submitted two strategic complaints before the Hellenic DPA against a centralised biometric database of the Hellenic Police. The database contains fingerprints and facial images of all Greek passport holders. However, based on the EU laws on passports (namely, Regulation 2252/2004 & Regulation 444/2009) as well as the set case-law of the Court of Justice of EU (for example, the Willems case and the Schwarz case), biometric data shall be stored in the storage medium of the passport itself – the document we carry in our pockets and bags. More precisely, the EU laws neither prohibit nor allow for national central databases of biometric data to exist at Member State’s level. So, the EU countries that are interested in establishing such biometric databases must take their own legislative initiatives on this matter.

However, as Homo Digitalis claims, this is not the case for Greece. Specifically, there is no Greek law in place providing in detail all the necessary safeguards about this centralised database, such as its functions, the rules for the related data processing activities, as well as the security and organisational measures that shall be in place. It is crucial to remember that based on EU law -Article 10 of the Law Enforcement Directive – processing of biometric data is allowed where it is strictly necessary, subject to appropriate safeguards, and authorised by the European Union or Member States law. So, the lack of such national legislation clearly violates European data protection laws.

In August 2020, the Hellenic DPA launched an official investigation regarding this centralised database following Homo Digitalis’ complaints. But, the positive news from Greece does not stop here! Do you remember the actions of Homo Digitalis in March 2020, described in a previous EDRi-gram, against a smart-policing contract of the Hellenic Police? It related to smart devices enabling facial recognition and automated fingerprint identification during police stops. In August 2020 the Hellenic DPA started an official investigation regarding this complaint, as well! Stay tuned for related developments and closely follow the ReclaimYourFace campaign for more.