Are we giving up our biometric privacy in exchange for supposed security?

Identifying ourselves through our faces and fingerprints is part of everyday life. Biometric features are used to be able to log into our computers, access the office and gym, unlock our mobile phones and even to pay or access our banking online.

Since the usefulness of biometric systems was discovered, an important evolution in their use has taken place, from public security to private security. The demand for biometric surveillance systems increased after the 9/11 attacks in the United States, and thus cameras were incorporated into public spaces with the purpose of preventing terrorist attacks and identifying criminals.

Decades ago, Jain and his team explained the deterrent effects of biometric systems on crime and fraud, the increased streamlining of business processes, and the protection of critical resources. For example, casinos in the United States have been identifying cheaters for years by comparing images to photographs of individuals who have been arrested or thrown out of casinos.

In our study we explained that the progressive increase in the use of biometric systems has left behind a period in which they were used sporadically and for security purposes. Now the users are clients, workers and simple citizens.

This expansive context opens up an important social debate around the privacy and security of these systems.

The position of multinationals

Amazon, IBM and Microsoft repudiated the use of facial recognition systems to violate human rights after the events that occurred in the United States with the death of George Floyd.

IBM stopped offering software of facial recognition, indicating that it opposes and does not tolerate the use of any technology for mass surveillance, racial profiling and the violation of human rights and freedom.

Amazon has implemented an extended one-year moratorium on facial recognition technology for police use and is asking the US government to establish regulations for the ethical use of this type of technology.

Microsoft has indicated that it will not sell facial recognition technology to US police departments until there is national regulation of these technologies based on respect for human rights.

Algorithms that go wrong

Another element that stands out about this type of technology resides in the possible errors.

Various studies have indicated that the algorithms of facial recognition systems make erroneous classifications based on the skin color, age and sex of individuals.

One example of this was the American Civil Liberties Union (UCLA) test of Amazon’s facial recognition system “Rekognition”, in which they compared photos of members of the United States Congress with 25,000 photos of convicted persons. In the results they obtained 28 false positives: 28 members of Congress were identified by the system as people who had been convicted of a crime. The results of the black-skinned individuals were disproportionate with respect to the white-skinned ones.

In the current era of convergent technological development, where different devices exchange data in a fluid and agile way, the demand for the so-called biometric privacy is growing. Companies have important restrictions on the uses of biometric data.

IBM highlights the need for a specific regulation for each use of this type of technology and, for this, it is necessary to take into account both the end users and the purpose that the biometric recognition system will have. It is essential to make this differentiation, because facial recognition systems that, for example, help emergency health care services to quickly identify the victims of a natural disaster should not be regulated in the same way as facial recognition systems. incorporated into cameras in police vehicles.

The World Bank organization, in its manual on biometric systems, established a series of requirements for the protection of this type of data, indicating that:

1. It should be preventative and not corrective. That is, you must carry out a risk analysis before, during and after the implementation of the system to anticipate potential threats.

2. Privacy is given by default. This implies that the user does not have to actively protect his data, but the system must protect it when entering the system.

3. Privacy must be built into the design at all stages, from acquisition to processing and in limited connectivity scenarios.

4. It must present full functionality. This means that there is a balance between security and privacy without compromising one or the other.

5. It must have end-to-end security at every step of the system.

6. It must present visibility and transparency.

7. There must be respect for individual privacy.

Security is an instrumental concept, a means that makes the exercise of rights and freedoms possible. Protecting freedom of expression and assembly and the principles of equality are some of the challenges that States, guarantors of the rights of their citizens, are focused on regulating to supervise the use of biometric systems, especially by their own political entities.

Therefore, we show that, far from prohibiting a technology that has beneficial applications for society, the orientation of legislative efforts in terms of privacy is directed towards specific regulations according to the use of the data, as well as the sectors of application.

The question is not based on deciding whether individuals should have more security and less privacy or vice versa, but on knowing how to identify risks and threats considering the uses and applications. This makes it possible to take advantage of the benefits of biometric systems in security areas, respecting fundamental rights and public liberties, which, in turn, will reduce citizen concerns.

Michelle Madeline Cámara Mora, Professor of the Department of Criminology and Security, Camilo Jose Cela University and Carmen Jordá Sanz, Director of the Department of Criminology and Security, Camilo Jose Cela University

This article was originally published on The Conversation. Read the original.