This week, the Indian government is going to close the chapter on its request for bids from companies to build India’s facial-recognition system which is going to be able to automatically identify persons from CCTV footage and other image databases. The project, called the Automated Face Recognition System, was announced by the National Crime Records Bureau (NCRB) in July. The rationale behind creating this nationwide database of labeled images is that it will help police forces across states identify criminals and bring crime rates down.
But applying this technology, or even procuring it, appears to have no clear legal basis in India. When the Internet Freedom Foundation, an organisation that fights to protect personal freedoms against digital intrusion, filed requests to see the minutes of pre-bid meetings to find out about the presentations received, the participants involved and the queries they might have had, it received a weak response from the government -- that the information could not be released because the procurement process was still underway.
Before diving into the problems associated with the wide-ranging application of facial-recognition algorithms, it needs to be said that CCTV footage has been key in solving crimes in the past. There are, without a doubt, useful applications of facial-recognition technology. But the problem remains that there are no safeguards to protect our data -- in this case, our faces -- from misuse. Manoj Kewalramani, a fellow at the Takshashila Institution, says that the government can now paint a full picture of who we are, given that it already has our biometric information. "If my face is my data, then I want to be in control of [how it is used]," he says. In fact, in the United States, a current presidential candidate has taken this concept of protecting dataknown as data dignitya step further and has argued for users to be paid a data dividend’ when they share information with social media companies.
MORE FROM INSIGHT | Is the induction spree doing the BJP more harm than good?
The thing is, face-recognition technology is not new. But it has improved by leaps and bounds in the recent past. A little context on machine or deep learning -- a subset of artificial intelligence (AI), which has made massive strides in the past few years -- helps in understanding why this technology could be considered a threat, unless it is regulated.
In 2016, a program known as AlphaGo, developed by Alphabet’s AI subsidiary, DeepMind, defeated the legendary human Go player, Lee Sedol. Go is a Chinese board game that had long held the interest of the AI research community because of the number of possible configurations of the board -- 10 to the power of 170 -- which is more than the number of atoms in the universe as we know it. AlphaGo used centuries of human knowledge to defeat Sedol. In other words, it used a massive data set of over 100,000 Go games to train itself. Then, in 2017, DeepMind launched AlphaGo’s successor, AlphaGo Zero. By contrast, Zero had only been programmed with the basic rules of Go. It learned the game by playing against itself (think over a million times) and updated itself every time it won a game. In just a matter of a few days, AlphaGo Zero had defeated AlphaGo by 100-0. Deep learning had arrived a decade earlier than scientists had expected.
MORE FROM INSIGHT | Why India opted out of the mammoth RCEP
This is, broadly speaking, how face-recognition software works too. Every time a mistake is made, the program remembers it. And the more data it has, the better it can train itself. It’s not just that facial-recognition technology merely taps into big data, but it generates big data. In other words, it’s not merely about computation strength anymore, but it is about creativity. What is also remarkable is how similar the methods used by human brains and artificial intelligence are when it comes to accurately identifying faces. In the human brain, evolution has led to a specific area -- called the fusiform face area -- becoming specialised for facial recognition. While scientists don’t know exactly what happens in the brain when it engages in recognition, a new study -- published as recently as October 30 -- suggests that human brains and machines have strikingly similar ways of accurately identifying faces.
So, what could misuse or unintended consequences look like? Imagine that you’re going to grab a cup of tea from a stall outside work. The smart camera along the road, now equipped with facial-recognition technology, is not only recording your movements but also identifying you in real-time. Or, consider the case of China, where authorities in the eastern province of Shandong, use face-recognition to identify and shame jaywalkers by displaying their faces on digital billboards. Even without a target, a technology this powerful gives way to a climate of fear -- who can forget the viral video of Hong Kong protesters pulling down a lampost they thought was bugged (it isn’t clear if it was) by Chinese authorities?
MORE FROM INSIGHT | The Maharashtra deadlock: Who will blink first?
For Europeans, Vistara is required to disclose the legal basis on which a passenger’s information is processed, as well as to ask for consent if there are other things the airline wishes to do with the information it has. A passenger has a very real choice to opt-out. In India, privacy activists are demanding exactly this choice. "We need at least the construct of choice," says N.S. Nappinai, a Supreme Court advocate who has pioneered cyber laws in India. For now, we're only offered an illusion of choice.
This is why the time has come to demand data dignity in India. Yes, there are laws that protect sensitive information from misuse by companies, like Section 43A of the Information Technology Act, but there are no laws yet when it comes to use or misuse by the government. Thankfully, that is likely to change given the strong demand for data protection laws by civil society. The Personal Data Protection Bill, 2018, which regulates how the government can use personal information, is likely going to be placed in the winter session of the Parliament that begins later this month.
All this to say that, in the age of the internet, which is already rife with adversarial examples to counter face-detection, it feels like the only way forward is to demand strong laws against misuse of personal information. If face-recognition technology doesn’t know how to begin small, and if we have become the new battleground of innovation, why should we demand any less?
ALSO READ | WhatsApp finally rolls out new group privacy settings for users, here's how to use it
ALSO READ | 2 ex-Twitter employees accused of spying for Saudi Arabia
ALSO WATCH | WhatsApp snooping row: India Today TV tracks down Israeli firm NSO