Italian police has acquired a facial recognition system
It’s going to be used during public demonstrations
It often seems that Italy is at the margins of the surveillance debate, a topic that is mainly focused on foreign intelligence agencies such as the American NSA and the British GCHQ.
If this, however, makes us think that Italy does not buy such technologies, we would be making a serious mistake. In the last few months, some details have been revealed about the Italian law enforcement systems that radically transform our perception: there are Internet interception systems, IMSI-catcher to monitor mobile phones, and software to scrape audio from the web in order to create a database of voice fingerprints.
In the Italian arsenal of surveillance technology, however, there was still something missing: facial recognition. But it came quickly.
Last January, the Ministry of the Interior commissioned Parsec 3.26 to provide software for the “Automatic Image Recognition System (SARI)” which, if we want to be more precise, is a system for facial recognition. According to the Quotidiano di Puglia, Parsec 3.26 is a Lecce-based company that funds and collaborates with the CNR ISASI research center “for the development of facial recognition algorithms.”
As we can read in the technical specifications of the contract, SARI must be able to handle two operating scenarios, Enterprise and Real-Time. The first is one in which “an operator needs to search for the identity of a face in an image, using one or more facial recognition algorithms, within a large database.”
The database in question stores 10 million images and the output of the algorithm must be a list of faces similar to the one sought.
For the Real-Time scenario, however, given a narrow geographic area, a system needs to be able to “analyze in real-time the faces of subjects captured by the cameras installed there, comparing them with a watch-list whose size is ‘in the order of hundreds of thousands of subjects.’
The algorithm must generate alerts when people belonging to the watch-list appear in the video feed — this system, as stated in the specifications, is “in support of territorial control operations at events and/or public demonstrations.”
For this scenario, a separate contract was planned in order to purchase 10 camera kits and their communication systems to collect video streams.
The use of facial recognition for events is certainly not new: the London Met police have already used it during the Notting Hill carnival and such systems have even been used during a football match in Colombia.
Facial recognition, however, poses serious dangers to citizens’ rights, according to Tommaso Scannicchio, lawyer and research doctor in comparative private law, who has been involved in privacy for five years and fellow of the program “Civil Liberties in the digital era” with CILD, contacted by mail.
Using these systems during events and public demonstrations “is likely to undermine the right to freedom of association and expression”
“The risks to privacy are enormous. First of all, there is currently no warranty provision that specifies the ways and limits of capture and related database management,” explains Scannicchio. The Real-Time system also provides the ability to store captured images from streaming video, as required in the technical specifications.
Scannicchio continues, “it does not assume suspicion of a crime, that is to say, that a citizen’s investigation file is open,” and we should ask ourselves “on which legal grounds an innocent citizen has to have his own image in a database of law enforcement agencies.”
Using these systems during public events and public demonstrations “is likely to undermine the right to freedom of association and expression,” Scannicchio adds, and the fear of being filmed “is certainly capable of generating the well-known chilling effect” — knowing of being monitored we modify our behavior with serious repercussions on our freedom of expression.
Facial recognition algorithms also pose risks with regard to the number of false positives — all those people who are identified by mistake — and in the SARI system it is required that algorithms be selected from those tested in the National Institute of Standards and Technology (NIST) report of 2014.
In the report, however, it is clearly stated that algorithms for recognizing people in video sequences are not considered, and it is also emphasized that image quality plays a key role in the accuracy of decisions.
“As proprietary algorithms, and even managed by law enforcement,” adds Scannicchio, “it’s totally opaque, for example, the percentage of error that these systems have and how many innocents are mislabeled for criminals.”
According to the technical specifications, the delivery and commissioning of SARI at the premises of the Scientific Police must be completed within 6 months of signing the contract. I contacted the Scientific Police to ask for information on the state of the work, to see if the system has been used, and above all to clarify for which cases it will be used — only anti-terrorism or any protests against the government?
At the time of publishing of this post I have not received any feedback yet.
As it happened after pointing out the CRAIM voice recognition system, the Italian Data Protection Authority will probably want to open an investigation on SARI and I’ll update the article as soon as I have further developments.
Meanwhile, however, we should perhaps start buying masks.
[UPDATE] On Friday 10th November 2017, the Italian DPA filed a formal request to the Police in order to obtain more information on SARI.
