Headline writer gets it backwards

Today I came across what might be a perfect example of a biometrics headline/article non sequitur.

The article linked below, is pretty bullish on biometrics from both the convenience and security angles. In addition to favorable quotes from a user and an industry executive, an Electronic Privacy Information Center (EPIC) staff member is quoted speaking of biometric technologies in favorable terms. As long-time readers may recall, that hasn't always been the case.

Given all that, it's hard to comprehend why the headline writer went with:

New technology causes new privacy, security concerns (WJXT - Jacksonville, FL)

I'd quibble that that the headline writer has it backwards. On the article's own terms a better headline would be, Privacy, security concerns fuel new technology, but reading the article might have given me an unfair advantage.

EFF sues for FBI response to FOIA request

EFF Sues FBI For Access to Facial-Recognition Records (Electronic Frontier Foundation)

As the FBI is rushing to build a "bigger, faster and better" biometrics database, it's also dragging its feet in releasing information related to the program's impact on the American public. In response, the Electronic Frontier Foundation (EFF) today filed a lawsuit to compel the FBI to produce records to satisfy three outstanding Freedom of Information Act requests that EFF submitted one year ago to shine light on the program and its face-recognition components.

Since early 2011, EFF has been closely following the FBI's work to build out its Next Generation Identification (NGI) biometrics database, which would replace and expand upon the Integrated Automated Fingerprint Identification System (IAFIS). The new program will include multiple biometric identifiers, such as iris scans, palm prints, face-recognition-ready photos, and voice data, and that information will be shared with other agencies at the local, state, federal and international levels. The face recognition component is set to launch in 2014.

The text of the actual suit is also available at the EFF site [pdf] here.


Adam Vrankulj, covering the topic at Biometric Update, recalls that "The Electronic Privacy Information Center (EPIC) filed a FOIA lawsuit against the FBI in April to obtain documents related to the NGI."

That's a good catch, and it offers the opportunity to revisit the EPIC suit, assessed at the time here, in: EPIC sues FBI over biometrics FOIA request, where we noted EPIC's tendency to overshoot the mark where technology is concerned.

The EFF requests are, to summarize, for:
1. Records related to the FBI's proposed relationship with states to "build out its facial recognition database"
2. The FBI's plans to combine civil and criminal data
3. Records related to the reliability of facial recognition capabilities

When compared to those of EPIC, the EFF FOIA activities certainly reflect a more moderate approach that would appear to have a higher likelihood of bearing fruit. The EFF seems carefully to avoid asking for information that the FBI can't provide, and it would appear to be an easier request to comply with than EPIC's.

UPDATE:
The EFF's FOIA request/lawsuit has borne fruit.
FBI Plans to Have 52 Million Photos in its NGI Face Recognition Database by Next Year (EFF) Read te whole thing.

EPIC sues FBI over biometrics FOIA request

EPIC Sues FBI to Obtain Details of Massive Biometric ID Database (EPIC)
The text of the lawsuit (pdf) is here.

Key bit:

On September 20, 2012, EPIC transmitted, via facsimile, its first FOIA request to the FBI for agency records (“EPIC’s First FOIA Request”).

35. EPIC’s First FOIA Request asked for the following agency records:

a. All contracts between the FBI and Lockheed Martin, IBM, Accenture, BAE Systems Information Technology, Global Science & Technology, Innovative Management & Technology Services, Platinum Solutions, the National Center for State Courts, or other entities concerning the NGI.

36. On September 21, 2012, EPIC transmitted via facsimile another FOIA request to the FBI for agency records (“EPIC’s Second FOIA Request”).

37. EPIC’s Second FOIA Request asked for the following agency records: a. All technical specifications documents and/or statements of work relating to the FBI's development, implementation, and use of technology related to NGI.

38. In both of its FOIA requests, EPIC asked the FBI to expedite its response to EPIC’s FOIA requests because EPIC is primarily engaged in disseminating information and the requests pertained to a matter about which there was an urgency to inform the public about an actual or alleged federal government activity. EPIC made this request pursuant to 5 U.S.C. §552(a)(6)(E)(v)(II). EPIC based the request on the need for the public to obtain information about the NGI program. EPIC cited extensive news coverage of the NGI program and the fact that aggregating these voluminous biometric data has profound privacy implications for U.S. persons.

39. In both of its FOIA requests, EPIC also requested “News Media” fee status under the Freedom of Information Act, based on its status as a “representative of the news media.”

40. EPIC further requested waiver of all duplication fees because disclosure of the records requested in EPIC’s FOIA requests will contribute significantly to public understanding of the operations and activities of the Government.

Here's what EPIC wants:

Requested Relief

A. order Defendant to conduct a reasonable search for all responsive records;
B. order Defendant to promptly disclose to plaintiff responsive agency records;
C. order Defendant to recognize Plaintiff’s “news media” fee status for the purpose of EPIC’s FOIA requests, waive all duplication fees, and disclose all responsive agency records without charge;
D. order Defendant to grant Plaintiff’s request for expedited processing;
E. award Plaintiff its costs and reasonable attorneys’ fees incurred in this action pursuant to 5 U.S.C. § 552(a)(4)(E) (2010); and
F. grant such other relief as the Court may deem just and proper.

We'll see where this goes. Some of the requests — the names of the contracted companies, for instance — seem reasonable. Some of the requests — section 37 in particular — may be a little trickier to comply with. To cite just one reason, it's not unusual for entities that contract with government bodies to share highly confidential information about intellectual property with their customer with the understanding that it will be kept confidential. So, the FBI probably posses information it is unable to disclose that comes under section 37 of the EPIC request.

This FOIA request and lawsuit, however, is a win-win for EPIC. Send a fax. Get access to all sorts of information or gain attention through a lawsuit.

The FBI is probably indifferent.

It's worth noting, however, that in the past EPIC has overshot the mark where biometrics are concerned. In EPIC Fail we discussed EPIC's opinion that facial recognition technology should be banned.

Privacy: How to Hide From Google

"If you are not paying for it, you're not the customer; you're the product being sold."

—blue_beetle, Metafilter discussion.

In yesterday's post, EPIC Fail, I took the privacy group Electronic Privacy Information Center (EPIC) to task for taking out it's frustrations with Google & Facebook, which are organizations, by lobbying for a ban on a technology: facial recognition.

If you share EPIC's frustrations but would like to channel them in a more productive way, Wired offers some helpful hints in a "How-To Wiki": Hide from Google

Instead of using what influence they have on trying to ban technology, groups like EPIC should be doing a better job of educating the public about the privacy implications of their everyday activities, very few of which have anything even remotely to do with facial recognition.

Helping people to understand technology so as to make informed decisions about what to share and what to keep private is a noble endeavor (see Wired article above). Going over their heads to limit their choices is not.

Often, however, EPIC is quite good at educational efforts. This is demonstrated by their role in the organization of, and participation in, the Twitter privacy chat, #PrivChat (which begins in 8 min. and features Microsoft Chief Privacy Officer, Brendon Lynch).

This is when they're at their best.

EPIC Fail

EPIC Calls for Moratorium on Facial Recognition Technology (EPIC.org)

The Electronic Privacy Information Center has published its comments to the United States Federal Trade Commission (FTC). "In the absence of guidelines and legal standards, EPIC recommends a moratorium on the commercial deployment of facial recognition techniques."

In the "absence of guidelines and legal standards," advocating for the development of guidelines and legal standards makes a lot more sense than a moratorium, and banning (however temporarily) a technology makes it impossible to gain the real-world experience necessary to develop informed, rational, reasonable and fair guidelines and standards.

Also, since biometric technologies including facial recognition, are useful in privacy protection, a moratorium on commercial facial recognition applications curtails an individual's right to make decisions about how to protect their own privacy in the most convenient and cost-effective way.

The EPIC document is long on risks and short on abuses. I noticed only two cases of abuse (one by Google and one by Facebook) cited in the entire 24 page document and a repetition of the Pitt-Patt red herring addressed here. Many, including EPIC, have found fault with what Google and Facebook have done with facial recognition technology. As EPIC notes, they acted in violation of their own privacy policies, i.e. they lied. What's facial recognition got to do with that?

Moratoriums and bans are seldom the best way to ameliorate a new technology's negative effects. EPIC fails to recommend an appropriate length of time for a moratorium and a moratorium without an end date is a ban. This is a disproportionate response to the risks EPIC cites in its comments. By advocating for such strong measures in response to the facts it cites, EPIC risks casting itself as a threat to individual rights (including the right to privacy) and courts skepticism of its motives.

For a couple of more balanced takes on the subject of facial recognition, see:
Face Recognition in the Era of the Cloud and Social Media: Is it Time to Hit the Panic Button?
by Joseph J. Atick and
Face Recognition: Improved Benefit? Or Erosion of Privacy? by Carl Gohringer