Police using technology riddled with controversy overseas

High-tech investigative tools being imported by the police are attracting controversy overseas.

Many of these are capable of facial recognition, though police say they are not using this on the public.

Police earlier this year did a tech stocktake which they made public.

The advanced systems they are spending tens of millions on are being deployed often after wide adoption overseas, particularly by US law enforcement.

"Police do not use public-facing or 'live' facial recognition technology," police said in a statement.

This function is, however, an integral feature of many systems, which suggests police may be paying to use a fraction of a system's power.

The tech's use is constrained by the Privacy Act, and Search and Surveillance Act 2012, but various researchers have said these need to be updated, given more teeth or added to with laws specifically regulating biometrics, and facial recognition in particular.

"There is currently no official position on this, and no legal or regulatory barrier to the police deployment of this technology," a research report said on Friday.

'Go-to phone hacker'

Three systems in the police stocktake are of special interest: Cellebrite, BriefCam and bodyworn cameras.

Police already have the first two, and they had been looking at bodycams for some time but then put a halt to it.

Cellebrite has been dubbed by CNN as the FBI's "go-to phone hacker".

It extracts personal data from android mobiles or iPhones, even locked or encrypted ones, and reaches beyond the device into over 50 social media and Cloud-based sources or apps, including Snapchat and Instagram, without needing any permission from Apple, Google or the like.

Cellebrite's marketing to law enforcement says it can track and analyse a suspect's Facebook likes and events and Twitter posts and connections "to get a better understanding of a suspect or victim's interests, relationships, opinions and daily activities".

New Zealand police have had Cellebrite for years.

Court affidavits show they used its tool called UFED in 2014 to extract data from a cellphone obtained during a search of journalist Nicky Hager's home - a search later ruled illegal.

Police said they used the tool on "lawfully-seized cellphones".

Cellebrite had facial recognition added in 2017. "Police has not made use" of this, police said in the stocktake.

Wellington facial recognition researcher, associate law professor Nessa Lynch said New Zealand law was not set up to cope with this but reflected times when police officers stood on street corners spotting trouble.

"Adding a facial recognition and capability to that [phone extraction], downloading that data gives a huge picture of my associates and my life," Lynch said.

"I'm not sure our laws on search and surveillance really capture the amount of data that we now have in our phones."

Video analysis

BriefCam was developed in Israel and is now owned by Japanese major Canon.

It aggregates footage happening at different times to analyse as if the events were simultaneous. It goes beyond facial recognition - adding 27 other ways of narrowing down a search.

"Advanced multi-camera search powerfully identifies men, women, children and vehicles of interest with speed and precision, using face recognition, appearance similarity, apparel, colour, size, speed, path, direction, dwell time and illumination change filters," its marketing to investigators says.

It lets police create watch lists of faces and license plates.

Its use was approved by New Zealand's police executive in February this year.

Police said their version of BriefCam could not take live CCTV feeds - instead it was used retrospectively, initiated by a small number of forensic staff, who then let investigators see the results if need be.

When they already had a face or car in a photo, they then scanned the footage for that. Such searching protected privacy more than a manual search, by zipping over what was not relevant, police said.

The aim is to analyse CCTV footage hundreds of times faster than previously, for what police call a "known face or a car movement".

BriefCam declined to comment.

Bodycam controversy

Police have begun looking at bodyworn cameras (BWC) for officers.

"[The] Response and Operations Group have been looking at BWC technology for some time and are keen to run a proof of concept, but a directive was given to pause any further work on this idea," the stocktake said.

Overseas, controversy is brewing about companies that want to empower these cams with facial recognition.

A study for the US Department of Justice in 2016 outlined some benefits, saying this "can allow law enforcement to overcome the difficulties and time involved in achieving accurate identification when reviewing video footage at a later time".

However, one of the biggest players in bodycams - and tasers - Axon, shied away from this on ethical grounds, saying the facial recognition was not reliable enough to avoid potential abuse of people's rights.

Facial recognition was "not evil" but whether its use was benign or not depended on the person, researcher Lynch said.

"If I'm a vulnerable member of society ... those are the people that are going to bear the brunt of surveillance.

"A question as well of who designs this technology? As a general trend ... it's a very undiverse group of people who design these systems", with little consultation, particularly with Māori, she said.

Function and sharing

There was limited visibility of police technology until after their [https://www.rnz.co.nz/news/national/416483/police-trialled-facial-recognition-tech-without-clearance

trial of Clearview AI] earlier this year was exposed by the media.

For instance, the police minister had no briefings about facial recognition tech initiatives in the last parliamentary term, until Clearview. It did not even know about the $23m rollout of a vastly more powerful image handling system called ABIS 2.

By contrast, Internal Affairs briefed its minister twice in 2018 about its $24m facial recognition passports system upgrade, according to a new OIA response.

"It is close to the Cabinet approval threshold [of $25m]. We will be guided by you whether you choose to approve the business case" or refer it to Cabinet, Internal Affairs said in a briefing.

Facial recognition is a "cornerstone" of passport processing here, unlike in most countries where it is mostly used to spot fraud, documents say.

It was also used to check a person was not on the department's "watchlist", an OIA response said.

Passport data is shared with police, but Internal Affairs said it "is important to note that the department does not share facial algorithms with any agencies".

Police said passport images they got from DIA, including on officers' mobile phones, were viewable only and not stored.

"The photos that are retrieved are not stored on the phone, even temporarily," said deputy chief executive of insights and deployment Mark Evans:

"The system allows officers to do a simple visual check when engaging with a person, and does not involve the use of any matching or recognition software."

Facial recognition was used in a limited way, "to compare still images of unidentifiable suspects, where those images have been submitted as part of an investigation", he said.

Only trained staff in the National Biometric Office could use the FR tools, and use was audited.

Facial recognition is integral to its Identity Verification Service (IVS) and RealMe services that let a passport holder verify who they are online.

Internal Affairs was also leading work called Identity in the Justice Sector to set standards for identity management and data sharing within the justice and border control sectors, it said.

This would influence what tech was bought.

Immigration has a biometrics capacity upgrade running till next October to implement the latest face and fingerprint matching algorithm for visa processing.

This is on top of at least three other upgrades since 2016 to its Identity Management Engine (IDME) system, that cost $26m to set up in 2016.

The 2019 upgrade was "focused on identity processing rather than facial matching", Immigration said.

One part of IDME, called Enroll, had captured 21,000 sets of biometric data between 2016 and this year, another OIA response showed.

Responsible AI

One view of where the global proliferation of biometric-gathering and analysing tech in law enforcement and border control might be going is provided by a leading global consultancy Accenture.

It envisaged three stages of surveillance penetration, with society's full consent, where reams of citizens' data were constantly updated within predictive analytic AI.

The end goal was a comprehensive public safety system, it said.

"Imagine a future where the entire city is monitored by responsible AI, providing law enforcement with the tools and intelligence to stop atrocities and virtually all crime in real time," Accenture said.