This article is part of a special report on artificial intelligence, The AI Issue.
Ready for your closeup? Your face could soon be included in police databases searchable by law enforcement across the European Union.
The Council of the EU has been advised to include photos of the Continent’s residents in a network of databases that could be searched by police using facial recognition software, according to an internal report circulated by the Austrian government and obtained by POLITICO.
These photos could include pictures culled from driver’s licenses and passports, if another recommendation obtained by POLITICO and circulated by the Finnish presidency of the Council last year were to be adopted.
The recommendations were made by focus groups comprising of representatives of EU countries and tasked by the Council with coming up with ways to improve an existing system, called the Prüm network, that police already use to share information across borders.
"We will never be anonymous again” — Jan Penfrat, senior policy adviser at European Digital Rights
Currently, Prüm requires all EU member countries to interconnect their fingerprint, DNA and vehicle registration databases for mutual searching — but it does not yet include facial imagery.
The proposals, if realized, would allow a police officer in one country to feed a picture into the Prüm network, and compare it to millions of faces in every other member country’s databases. Were the system to detect a match, police officers would have to approve any further exchange of data, like names or addresses.
The report on facial recognition emphasizes that national laws should continue to govern the storage and use of images. Brussels would only set the rules for cross-border searches.
Reinhard Schmid, a senior official with the Austrian criminal intelligence service who is participating in the Prüm discussions on behalf of Vienna, said the system has been “the most successful tool we have in criminal investigation,” and “the most important tool that we have to identify international criminality.”
Image via iStock
He noted that the Austrian state holds vast numbers of facial images — for example, from driver's licenses — but currently, police can only search criminal photo databases.
Privacy advocates worry Prüm’s expansion into facial recognition would be ripe for abuse.
“In many places in the EU today, facial images are almost ubiquitously taken by surveillance cameras in public spaces,” said Jan Penfrat, senior policy adviser at European Digital Rights, a privacy advocate. “Once our facial images have been analyzed and digitized by facial recognition software, automated systems across the EU will be able to recognize us wherever we go. We will never be anonymous again.”
Starting Small
The first effort to combine police biometric databases in the EU was in 2005, through a convention signed by seven member countries in the small German town of Prüm. The resulting Prüm network interconnected the DNA, fingerprint and vehicle registration databases of the seven signatory states. In 2008 the convention became EU law, extending the same obligations to all member countries.
Since then, national biometric databases have grown extensively. Internal police data on DNA databases provided to the Council of the EU, reviewed by POLITICO, show some striking increases. In 2013, the French database held over 2.2 million samples, coming either from known individuals — such as those arrested and convicted — or from “stains” found at crime scenes. Five years later, that database had more than doubled in size. DNA databases in the Czech Republic, Spain, Hungary, Poland and Romania, while not as large, have grown at a similar rate.
Despite the rapid expansion of these data banks, the exchange of biometric data among European police forces has faced significant legal, technical and procedural hurdles. After the Prüm legislation came into force in 2008, police found they had issues using biometric data from other countries in court, explained Carole McCartney, a law professor at the University of Northumbria, in Newcastle. In 2009, further EU legislation was introduced to ensure that all EU forensic science laboratories meet the same standards.
Image via iStock
The reports recommending the addition of facial imagery are part of a process involving the Commission, the Council and EU member countries that is looking at expanding the Prüm system. The report circulated by Austria addresses the inclusion of facial recognition in the network. The one distributed by the Finnish presidency suggests ways to improve the sharing of vehicle registration and driver’s license data, including photographs.
Other focus groups are looking at ways to improve the handling of fingerprints and DNA data.
The findings have been discussed in the Council’s Working Party on Information Exchange and Data Protection (DAPIX), a group that handles legislation and policies on the exchange and protection of personal data in the field of law enforcement.
Facial flaws
The expansion of Prüm into facial imagery has been criticized by privacy advocates and experts skeptical of the system.
Facial recognition technology is particularly prone to confuse the faces of women and people of color, raising concerns over gender bias and racial discrimination. The focus group on facial recognition argued against including a quality standard for imagery, however, and suggested that data from surveillance cameras, which often capture blurry or incomplete facial portraits, be included.
“Since the main objective of the cooperation will be the identification of unknown persons on the basis of mostly poor data quality search images, searches in the reference databases of the Prüm partners must be possible with poor image quality,” the report states, adding that the system “should be allowed to transmit and process very poor trace image qualities to carry out comparisons.”
The proposal is “a dystopian horror story” that “would create a completely incoherent legal landscape within the EU,” said Cornelia Ernst, an MEP with the left-wing GUE/NGL group. “At the end of the day, it would be full of loopholes. Protection levels would be severely undermined, and data quality nearly unmeasurable.”
Some experts say it is difficult to gauge Prüm’s effectiveness. The EU does not release overall statistics about the number of cases solved under Prüm, or the amount of searches made that result in false positives.
Image via iStock
“There’s hardly any statistical information about the number of exchanges, the number of matches, the number of matches being followed up by local police authorities,” said Victor Toom, a forensic science specialist who has studied the field for over 15 years. “If there's one thing that the Prüm system is not, it’s transparent. And if it lacks transparency how can it be accountable?”
Rafaela Granja, a sociologist at the University of Minho in Portugal who studies the transnational sharing of DNA data, said that even if systems are improved, the Prüm network itself doesn’t have sufficient oversight mechanisms.
“We have no way of actually assessing if this system is indeed contributing to international crime-fighting,” said Granja. “Professionals working with it say it has a positive impact, but it cannot be measured with the data available. Unless you solve some of the very prominent issues that we have in the system as it is now, I would argue against expanding it.”
Still, law enforcement officials are convinced of the system’s benefits. A spokesperson from the Spanish interior ministry said that the expansion of Prüm to handle facial recognition data, the addition of driver’s license and passport photos and the creation of a centralized EU database would all be "an improvement" on the current system.
In Germany, the federal criminal police agree. “The Prüm network has proven its efficiency today with fingerprint, DNA and vehicle registration data,” said Daniil Kushnerovich, a police spokesperson. “It is now time to expand the mechanisms to other kinds of data, like facial images. [We] therefore strongly support the EU Commission’s plans to revise the legal and the technical basis for Prüm.”
‘Pandora’s box’
Since late 2018, the European Commission has spent more than €1 million studying ways to expand the Prüm network, including nearly €700,000 to the consultancy firm Deloitte. That work is currently being finalized and has addressed the possibility of including facial recognition, said a Commission spokesperson.
According to the focus group on facial recognition, Deloitte’s consultants raised the possibility of creating a centralized police facial image database at the EU level, but the police experts involved in the working group rejected it. Schmid, the official with the Austrian criminal intelligence service, confirmed this account.
“All suggestions of the study contractor towards a data storage of personal or case data on central servers of the EU … were unanimously and strictly rejected by all experts because of legal as well as of forensic and organizational reasons,” reads the document.
Deloitte officials declined to comment for this story, citing confidentiality requirements. The Commission denied that any such suggestion was ever made.
Depending on national laws, police forces already have access to vast numbers of facial images, beyond mugshots of those arrested or convicted. An EU “Manual on Law Enforcement Information Exchange” dated June 2019 and seen by POLITICO lists the “information/databases managed and directly accessible by law enforcement authorities” in every member state. They include databases of identity cards, passports, driving licenses and residence permits.
“Are we all walking around as citizens? Or are we all walking around as suspects?” — Carole McCartney, law professor at the University of Northumbria
— The focus group on facial recognition suggested these images be included in any pan-EU facial recognition system: “Every possible hit from every database which is able to be searched should be provided,” it says.
The Commission has also provided €500,000 to a project called Towards the European Level Exchange of Facial Images (TELEFI), which is working to locate every source of facial recognition data available to police in the EU, with the eventual goal of merging them into one pan-European network.
“The TELEFI project will review the organizational, technical and legal aspects of facial recognition in connection with the investigation and prosecution of crime across Europe,” reads a project presentation obtained by POLITICO, in order to “recognize the status and position of the Member States to move towards the possible exchange of Facial Data.”
The presentation also poses the question of whether recorded speech could be added to Prüm in the future. Andra Sirgmets, the project manager, and Üllar Lanno, director of the Estonian Forensic Science Institute, the lead institution on the TELEFI project, both declined to answer questions.
Though the expansion of the Prüm system to facial recognition and the inclusion of images from driver's licenses, passports, residence cards and other identity documents would vastly expand the police’s ability to locate unknown suspects, for some experts it raises more profound questions about the rights of citizens in a liberal democracy.
“That’s just a Pandora’s Box there, isn’t it?” said McCartney, the Northumbria University law professor. “What you’re saying is, for me to own a car and to drive, I have to submit that my photo and information is going to be used for policing purposes across the entire EU,” she added. “Are we all walking around as citizens? Or are we all walking around as suspects?”
This article was developed with the support of Journalismfund.eu.
Vladimir Putin is no Peter the Great