Brussels BRU to trial eGates

Brussels Airport starts facial recognition trials (Flanders Today)

Brussels Airport plans to introduce facial recognition scanners next year, the management company said. The technology is already in use at other major airports in Europe, including Heathrow and Schiphol.

Fingerprints in European passports legal – EU court

The European Union's highest court rejected on Thursday a German man's challenge to the inclusion of his fingerprints in his passport, saying such data helped to prevent identity fraud and curb illegal immigration. (GMA News)

Law enforcement interoperability, though little discussed, is a big deal

Tyneside jewellery heist could lead to DNA sharing (Chronicle Live)

A jewellery heist on Tyneside has sparked a review of DNA sharing across Europe that could force police to hand over criminal records to foreign counterparts.

Specialists in Newcastle will spearhead a £1.2m effort to design a database that profiles crimes committed across the continent as part of a controversial EU information sharing treaty.

It comes just 12 months after a convicted murderer and his armed gang from Eastern Europe were convicted of carrying out an armed raid at a Newcastle jewellers.

Led by convicted murderer Marek Viidemann, the ring was linked to at least 150 armed robberies across the UK and Europe before being eventually jailed for a total of more than 30 years.

First, DNA is likely to be a small part of whatever system improvements emerge.  It's expensive and slow compared to just about any other biometric modality or combination of modalities such as finger, face and iris.

From a management standpoint it seems that if you want to have a free flow of people, you need to have a free flow of law enforcement information. This is easier said than done. It's often a challenge even when dealing with adjacent counties in the same state in the US much less, as in the European context, two different countries.

The term for this system compatibility and ability to effectively cooperate among departments is interoperability. It is a managerial and technical challenge that is rarely dealt with in popular depictions of how law enforcement works but, especially as the complexity of the law enforcement challenge increases, it is of critical importance.

Often, there are good systems in place for passing information "up the chain of command," i.e. from street cop all the way up to a state or national information repository, but the information doesn't always flow as freely back down again in the other direction. For various reasons, the formal links between street-level law enforcement officers in neighboring jurisdictions run up through a centralized authority and then back down again, though there are often informal links that bypass the up-and-back-down information flow model. The implications for efficient multi-jurisdictional law enforcement are clear.

Some of these issues came up a couple of years ago in a post. Usefulness of Biometrics in Law Enforcement: Who is the Customer? The analysis there can be extended from biometrics to all sorts of law enforcement IT systems and it has a great deal of bearing on issues like the ones raised by the Newcastle jewelry heist by international criminals.

Many police professionals put a lot more into databases of all types than they ever get out of them. Through biometric technologies and other integration services, SecurLinx works hard to balance that out a bit for our law enforcement customers.

German Interior Minister: EU needs US-style entry database (The Local)

EU Urges Google on Transparency

EU regulators say Google must revise its privacy policy (The Verge)

The EU is fine with Google's unified privacy policy acting as a "general guideline" about its operations, but it wants the search giant to return to its old system, which provided specific privacy notices for each Google product. It says these product-specific privacy policies must include "simple and clear explanations" on when, why, and how location, credit card, unique device identifiers (UDIDs), and telephony data is collected, along with information on how users can opt out. It asks that Google adds a specific clause for biometric data where necessary as there is currently no mention of facial recognition in its privacy policy.

UPDATED: Ukraine, Biometric Passports and the Politics of ID

Yanukovych: Ukraine to fulfill obligations on introduction of biometric passports (Kyiv Post)

Ukraine has had a hard time with implementing a biometric passport.

First, there are real and compelling reasons for adopting a new document standard for passports that uses a chip to hold information (including biometric information). Defense against document fraud, human trafficking and other types of organized crime spring immediately to mind.

Then there is the pressure from Europe to modernize ID documents. Because of Europe's huge market, cultural importance and proximity to many non-EU countries, there is a lot of international travel to and from the EU. At the same time, the relative wealth of the EU countries compared to the countries with which they share land borders creates incentives for extra-legal behavior (immigration, smuggling, organized crime, etc.) that might be lowered by adopting more rigorous ID management practices.

The EU is driving its end of the bargain by harmonizing travel and ID practices within the EU (plus a few other countries; see Schengen Area) and offering visa-free travel to citizens of countries that make it easier to administer cross-border traffic through better document technology and law enforcement cooperation.

So what's not to like?

ID documents are, of course, extremely political. They are also a source of revenue to the authorities that issue them and the companies that supply the materials, services, or the manufacturing related to them.

For the nation of Ukraine and Ukrainians who are frequent international travelers successful passport modernization would be a good deal with the state collecting fees that frequent travelers can afford to pay and who are, in turn, compensated with smoother border crossings. Ukrainians who don't, won't or can't travel would be left alone.

So what's not to like?

Ordinary Ukrainians weren't sure about the second part and the international travelers weren't sure about the first part.

A year ago, the deliberations on ID document modernization in Ukraine took place under a cloud of suspicion that the new document wouldn't actually move the country to visa free travel to Europe, would cost a lot, and since Ukrainians already carry domestic passports, foreign passports, social identity cards, identity cards for insured people, pension certificates, certificates of persons with disabilities, and driving licenses, many (enough, apparently) suspected that the true impetus behind the effort was just another opportunity to collect fees and/or throw a new contract to a connected firm and they worried that the effort might not be limited to international travel documents.

Ukrainian President Viktor Yanukovych vetoed the effort of last year and the initiative seems to have been resurrected as something resembling the more optimal approach described in theory above.

It's not a done deal yet but it looks like Ukraine is making progress.

NOTE: This post has been modified slightly from the original version to add clarity.

UPDATE:
Valeriy Khoroshkovskiy is the first deputy prime minister of Ukraine. Perhaps more relevant to our discussion here, he also used to run the State Customs Service.

His piece today in the Kyiv Post is much lengthier than other treatments of Ukraine's regional integration efforts which tend to be very narrowly focused.

In it, he discusses in more detail many of the topics we touched on above, including:

• Visa free regime with the EU; 
• Biometric passports;
• Other identity documents;
• Human trafficking;
• and the flip-side of organized crime, corruption.

New European Data Protection Supervisor Opinion on Data Privacy & Biometrics

Privacy guardian wants one EU rulebook on ID databases (The Register)

"The EDPS [ed. European Data Protection Supervisor] considers that the proposed Regulation should establish a minimum set of requirements, in particular with respect to the circumstances, formats and procedures associated to security as well as the criteria, conditions and requirements, including the determination of what constitutes the state of the art in terms of security for electronic trust services," it said.

The watchdog said that if common security requirements are not to be set out in the new laws, then provision should be put in place to allow the European Commission to "define where needed, through a selective use of delegated acts or implementing measures, the criteria, conditions and requirements for security in electronic trust services and identification schemes".

Assistant EDPS Giovanni Buttarelli, who signed the opinion, said that the proposed new law should set out a requirement that trust service providers and electronic identification issuers should have to provide individuals who use their services with "appropriate information on the collection, communication, and retention of their data". He added that those organisations should also have to provide individuals with "a means to control their personal data and exercise their data protection rights".

The world can always use more Transparency and Consent.

Special attention for biometric data follows the section quoted above.

The pdf of the Supervisors report can be found here:
Opinion of the European Data Protection Supervisor on the Commission proposal for a Regulation of the European Parliament and of the Council on trust and confidence in electronic transactions in the internal market (Electronic Trust Services Regulation)

Facebook consents to delete face recognition data of EU users

Facebook Agrees to Delete EU Facial-Recogniation Data (Bloomberg)

The owner of the biggest social-networking site has faced several European reviews over concerns a facial-recognition program that automatically suggests people’s names to tag in pictures breaches privacy rights.

Facebook Ireland “agreed to delete collected templates for EU users by Oct. 15” and to seek regulator consent “if it chooses to provide the feature to EU users again,” the Irish Office of the Data Protection Commissioner said in the conclusions to a review today.

Data-protection regulators from the 27-nation EU have been looking into Facebook’s facial-recognition feature.

The theme of the article is consent.

Ukraine harmonizing ID practices with Europe

Ukraine to Introduce European Standard of Biometric ID (Press Release via Sacramento Bee)

A bill concerning the introduction of biometric IDs in Ukraine passed the first reading in the country's parliament. Biometric documents will contribute to border security between Ukraine and the EU. The draft law provides for the creation of a unified state demographic register, which will contain basic personal information on each citizen. Additionally, the draft stipulates issuing the documents for traveling abroad that have a built-in proximity chip with registry information on the holder.

See also:

Biometric IDs A Step Toward EU – Ukraine Visa Simplicity (argophilia)

With the EU planning to assess the effect visa liberalization will have on illegal migrations soon, Ukraine tourism inbound and out stand to benefit if the new IDs fly with EU counterparts. The President of Ukraine, Viktor Yanukovych, created the State Migration Service already, an agency responsible for managing citizenship, immigration, registration, and political asylum issues.

The Facebook Face Rec Saga Continues as EU Reopens Inquiry

Germans Reopen Facebook Privacy Inquiry (NY Times)

Data protection officials in Germany reopened an investigation into Facebook’s facial recognition technology Wednesday, saying the social networking giant was illegally compiling a vast photo database of users without their consent.

Euroborder Management News

Finland and the Baltic States Agree to Biometrics for Non-EU border control (Itar-Tass via FOCUS News Agency) 

 Internal Affairs Ministers of Finland, Latvia, Lithuania and Estonia have signed a joint agreement proposing the introduction of biometric control.

The four agreeing countries have land borders with three non-EU countries. They are Russia, Belarus & Norway.

Norway is in the Schengen area. Russia and Belarus are not.

Map of EU countries
Map of Schengen countires

European Commission Approves Biometric Driving Licenses

Smart driving licences coming to UK (PR Web at Yahoo!)

The EC has given the go-ahead for new plastic licences to include biometric data on drivers, but no address, and these could come into effect as soon as 2015, by which time the UK Government has said it wants to end the need for the paper counterpart to the present licence.

The press release seems to have been put out by Businesscarmanager.co.uk. I didn't find any additional information on the biometric license there, but I did find this, which is fun:

I say Rupert, slow down! Diamond Insurance has revealed the Top Ten men’s and women’s names associated with speeding offences.

Adding a "te" onto the end of Juliet's name doesn't slow her down much at all. Juliet is #1; Juliette is #6 on the list for women.

Germany will wait on Irish investigation of Facebook Facial Recognition

German Regulator Suspends Facebook Facial-Recognition Probe (Bloomberg)

A German privacy regulator suspended its probe of Facebook Inc. (FB)’s facial-recognition features pending an Irish audit of how the social-media company handles personal data.

Hamburg’s data-protection authority said it will wait for Facebook to negotiate with Ireland’s privacy regulator before deciding whether Facebook complies with rules for using biometric data in an application that suggests people to tag in photos on the social-networking site.

Token, PIN & Biometric: Authentication Should Include Two of Three

Or so says the European Central Bank.

Euro Central Bank to tighten grip on web cash security (Register -UK)

European Central Bank Sees a Role for Biometrics in Improved Banking Standards

ECB launches consultation on secure internet payment standards (V3.co.uk)

Under the ECB plans, internet payment providers would need to ensure that customers are able to “strongly” identify themselves before a payment was processed.

This strong identity would have to include two of three proposed elements: a password; something belonging to the customer, such as a token, a smart card or mobile phone; or some form of biometric check.

EU, Facebook, FaceRec & Consent

Facebook's facial recog bots can't eat your face without your say-so (The Register)
They can taste it, though...

Social networking sites need to obtain users' "informed consent" before suggesting to other users that those individuals feature in photos that they are uploading to the site, an EU privacy watchdog has said.

The Article 29 Working Party said, though, that the networks can process the images legitimately without the consent of those featured in the photos under EU data protection laws in order to assess whether that consent has been given. However, it said that sites processing images in order to verify consent must delete that information "immediately after" that processing is complete.

The above article makes an interesting technical point and hints at an interesting point about privacy.

In order to biometrically determine whether or not someone is in a particular database — such as the database of people who have given consent to be "tagged" — a biometric search must be undertaken. The Art.29 Data Protection Working Party has acknowledged the difference between the search and enrollment functions and probe vs. database images. This is good because, as implied in the article, to fail to make these distinctions would make it impractical to find out if someone had consented to something in the first place without making them express their consent all over again.

There's also an interesting privacy point — Facebook's knowledge about non-facebook users (such as your humble scribe). The sly "spam your friends" button that sends an email to everyone in a new user's email contact list is one way Facebook collects personal information (email addresses) of non-facebook users and begins to turn that data into information when the same email address turns up in multiple Facebook users' contact lists.

The photo tagging feature also allows/encourages Facebook users to add information about non-users to Facebook's database. The Art.29 Data Protection Working Party has recommended a technical solution to the photo-tagging feature's ability to collect information on non-consenting individuals for Facebook's use, which is great. But a 100% solution is as much social as technological.

There's an etiquette to these things. Facebook makes it very, very easy for users to tell Facebook about people who don't use Facebook, but it seems impossible that Facebook could police its users in such a way as to prevent them from violating the privacy of other people. Facebook collects information on non-users, and Facebook can be used to communicate information about non-users without consent. These are two separate issues.

In a final twist, Facebook's very existence may depend upon its users' discretion and restraint in choosing what to post and tag, and Facebook's agility in handling the information. A user may love the facial recognition tagging feature but hate to be outed as the Key West Spring Break wet T-shirt contest winner.

Russia, EU Cannot Agree on Visa Requirements for Business Passports

Russia’s request for lifting the visa requirement for people with business passports remains an unsolved problem on its way to the facilitation of the visa regime between Russia and the EU, writes Russian Kommersant daily. (Focus)

New EU Agency to Manage State-run Biometric Databases

Agency headquartered in Tallinn, Estonia (

A new European Union agency – tasked with managing large-scale information technology systems that hold millions of records related to migration and security, including biometric data – will be inaugurated by EU home affairs commissioner Cecilia Malmström in Estonia tomorrow.

Databases include:
♦ Schengen area travel documents
♦ Visa applications
♦ Asylum cases


h/t @silicontrust
Also check out the The Silicon Trust blog.

Visa-free Travel: Kosovo Tries to Catch Up with the Rest of Europe

Kosovo Buckles down to Become Visa-Free (Turkish Weekly)

Kosovo is a newly-independent nation that is still putting down roots in the international system.

"Kosovo should address challenges in the border control sector, inter-state organized crime, repatriation and reaching technical and technological standards in the administrative system. But also improving of the political image and [improving] the economic situation of the country," Agron Bajrami, Kosovo columnist, editor-in-chief of daily Koha Ditore told SETimes.

"These are probably the biggest challenges because these are real and deep problems which have not been addressed -- they are also the stain that burdens Kosovo's name in almost every quarter of the world. [Dealing with these issues] will go beyond the time frames and political frames of visa liberalization."

The two "man on the street" quotes at the end of the article are also very interesting.

EU, Russia Move Toward Visa-Free Travel

Russia and the European Union agree on moves towards visa-free travel (EurActiv.com)

Advances towards visa-free travel depend on the implementation of a number of "common steps" such as introducing biometric passports and preventing illegal migration.

"This decision has clear potential benefits to our citizens and for people-to-people contacts," said European Commission President José Manuel Barroso, who participated in EU-Russia summit. "But this will probably not happen next year."

Russia pledged to give at least €7.5 billion ($10 billion) to help indebted eurozone countries via the International Monetary Fund. Previous statements from Moscow had indicated $10 billion would be the upper limit.

Biometric passports offer governments a way to increase confidence in the travel documents they issue.