EFF’s Top Recommendations for the Biden Administration
by on Fri, 22 Jan 2021 00:16:32 +0000:
At noon on January 20, 2021, Joseph R. Biden, Jr. was sworn in as the 46th President of the United States, and he and his staff took over the business of running the country.
The tradition of a peaceful transfer of power is as old as the United States itself. But by the time most of us see this transition on January 20th, it is mostly ceremonial. The real work of a transition begins months before, usually even before Election Day, when presidential candidates start thinking about key hires, policy goals, and legislative challenges. After the election, the [url=https://crsreports.congress.gov/product/pdf/R/R46602]Presidential Transition Act[/url] provides the president-elect’s team with government resources to lay the foundation for the new Administration’s early days in office. Long before the inauguration ceremony, the president-elect’s team also organizes meetings with community leaders, activists, and non-profits like EFF during this time, to hear about our priorities for the incoming Administration.
In anticipation of these meetings, EFF prepared a [url=https://www.eff.org/wp/eff-transition-memo-incoming-biden-administration]transition memo[/url] for the incoming Biden administration, outlining our recommendations for how it should act to protect everyone’s civil liberties in a digital world. While we hope to work with the new Administration on a wide range of policies that affect digital rights in the coming years, this memo focuses on the areas that need the Administration’s immediate attention. In many cases, we ask that the Biden Administration change course from the previous policies and practices.
We look forward to working with the new Biden Administration and the new Congress to implement these important ideas and safeguards.
Read EFF’s [url=https://www.eff.org/wp/eff-transition-memo-incoming-biden-administration]transition memo[/url].
Political Satire Is Protected Speech – Even If You Don’t Get the Joke
by on Wed, 20 Jan 2021 23:34:22 +0000:
[i]This blog post was co-written by EFF Legal Fellow [url=https://www.eff.org/about/staff/houston-davidson]Houston Davidson[/url].[/i]
Should an obviously fake Facebook post—one made as political satire—end with a lawsuit and a bill to pay for a police response to the post? Of course not, and that’s why EFF filed an [url=https://www.eff.org/document/amicus-brief-merrifield]amicus brief[/url] in [i]Lafayette City v. John Merrifield[/i].
In this case, Merrifield made an obviously fake Facebook event satirizing right-wing hysteria about Antifa. The announcement specifically poked fun at the well-established genre of fake Antifa social media activity, used by some to drum up anti-Antifa sentiment. However, the mayor of Lafayette didn’t get the joke, and now Lafayette City officials want Merrifield to pay for the costs of policing the fake event.
In EFF’s amicus brief filed in support of Merrifield in the Louisiana Court of Appeal, we trace the rise and proliferation of obviously parodic fake events. These events range from fake concerts (“[url=https://www.facebook.com/events/d41d8cd9/drake-live-cheesecake-factory/1698541877066068/]Drake live at the Cheesecake Factory[/url]”) to quixotic events designed to forestall natural disasters (“[url=https://www.facebook.com/events/1870483396379712/]Blow Your Saxophone at Hurricane Florence[/url]”) to fake destruction of local monuments (“Stone Mountain Implosion”). This kind of fake event is a form of online speech. It’s a crucial form of social commentary whether it makes people laugh, builds resilience in the face of absurdity, or criticizes the powerful.
EFF makes a two-pronged legal argument. First, the First Amendment clearly protects the kind of satirical speech that Merrifield has made. Political satire and other parodic forms are an American tradition that goes back to the country’s founding. The amicus brief explains that [i]“[/i]Facetious speech may be frivolously funny, sharply political, and everything in between, and it is all fully protected by the First Amendment, even when not everybody finds it humorous[i].”[/i] Even when the speech offends, it may still claim constitutional protection. While the State of Louisiana may not have seen the parody, the First Amendment still applies. Second, parodic speech, by its very definition, has no intent to cause the specific serious harm that the charge of incitement or similar criminal liabilities requires. After all, it was meant to make a point about online misinformation.
We hope the appeals court follows the law, and rejects the state’s case.
Blyncsy’s Patent On Contact Tracing Isn’t A Medical Breakthrough, It’s A Patent Breakdown
by on Wed, 20 Jan 2021 21:21:11 +0000:
Stupid Patent of the Month
Contact tracing is critical for limiting the spread of a contagion like COVID-19, but that doesn’t mean it’s inventive to compare people’s locations using their smartphones. Rather, it’s all the more important to protect the basic methods of public health from bogus patent claims.
The CDC [url=https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/contact-tracing.html]recommends[/url] contact tracing for close contacts of any “confirmed or probable” COVID-19 patients. But doing the job has been left to state and local public health officials.
In addition to traditional contact tracing by public health workers, some are using “proximity apps” to track when people are near one another. These apps [url=https://www.eff.org/deeplinks/2020/04/challenge-proximity-apps-covid-19-contact-tracing]should be used only with careful respect for user privacy[/url]. And they can’t be a substitute for contact tracing done by public health workers. But, if used carefully, such apps could be a useful complement to traditional contact tracing.
Unless someone with an absurdly broad patent stops them.
In April, while many states were still under the first set of shelter-in-place orders, a Utah company called Blyncsy was building a website to let government agencies know that it wanted to get paid—not for giving them any product, but simply for owning a patent they’d managed to get issued in 2019. In [url=https://www.bloomberg.com/news/articles/2020-05-07/startup-seeks-royalties-from-google-apple-covid-tracking-apps]news[/url] [url=https://www.bloomberg.com/news/articles/2020-05-07/startup-seeks-royalties-from-google-apple-covid-tracking-apps]reports[/url] and its own press release, Blyncsy said that anyone doing cellphone-based contact tracing would need to license its patent, U.S. Patent No. [url=https://patents.google.com/patent/US10198779B2/en]10,198,779[/url], “Tracking proximity relationships and uses thereof.”
By September, Blyncsy had begun [url=https://www.wired.com/story/utah-company-claims-invented-contact-tracing-tech/]demanding $1 per resident payments[/url] from states that released contact tracing apps, including Pennsylvania, North Dakota, South Dakota, and Virginia.
“State governments have taken it upon themselves to roll out a solution in their name in which they’re using our property without compensation,” Blyncsy CEO Mark Pittman told Wired.
The developer behind North Dakota and Wyoming’s contact tracing apps told Wired that Blyncsy’s threatened patent battle could “put a freeze on new states rolling out apps.”
Given Blyncsy’s $1 per person price point, a state like Virginia, with more than 8 million residents, would be vastly overpaying for contact tracing technology. That state’s app cost $229,000 to develop.
[b]Contact Tracing is Very Good And Very Old[/b]
Unfortunately, our patent system encourages the acquisition and use of bad patents like the one owned by Blyncsy. The company’s patent essentially claims technology that’s well over a century old, and could be performed with pencil and paper. Simply adding a smartphone into the works—a “mobile computing device,” as Blyncsy’s patent describes it—doesn’t make the patent valid.
And the patent’s primary claim doesn’t have any technology in it at all. It’s a pure “business method” patent, except that the only business it appears to support is demanding money from state public health departments. Simplifying the language of Claim 1, it describes:
Receiving data about the location of a first person, who “has a contagion”
Receiving data about the location of a second person
Determining if they’re close together
Determining when they were close together
Determining whether the “proximity relationship” is positive or negative
Labeling the second person as being either contaminated or not
That’s just contact tracing, a process that has been done with simple writing and human interviews since at least the mid-19th century. In a famous breakthrough for the field of epidemiology, British doctor John Snow [url=https://www.ph.ucla.edu/epi/snow/snowcricketarticle.html]traced an 1854 cholera epidemic[/url] near London to a specific water pump on Broad Street.
Patent documents have even more specific descriptions of Blyncsy’s claimed method. Last week, Unified Patents [url=https://www.unifiedpatents.com/insights/2021/1/15/1500-awarded-for-blyncsy-prior-art]published some prior art for the Blyncsy patent[/url], including a 2003 patent application directed to an “electronic proximity apparatus” that alerts individuals when they are exposed to a contagious disease.
Doing research, writing down the results, and trying to figure out how people got sick isn’t a patentable invention—it’s just basic science. The patent’s other claims are no more impressive. The issuance of the Blyncsy patent isn’t a success story, it’s evidence of glaring flaws in our patent system.
Too often, patents are issued that don’t embody any innovation. These simply become a 20-year-long invitation for a company to demand payment for the innovation and work of others. Sometimes that’s other companies, and sometimes it’s our own governments. In this case, Blyncsy is trying to make a buck by levying what amounts to a tax—but one that only benefits a single, for-profit company.
Unfortunately, we’ve seen patent holders repeatedly try to take advantage of the pandemic. Last year, patent troll Labrador Diagnostics tried to use [url=https://www.techdirt.com/articles/20200316/14584244111/softbank-owned-patent-troll-using-monkey-selfie-law-firm-sues-to-block-covid-19-testing-using-theranos-patents.shtml]old patents belonging to the notorious firm Theranos[/url] to sue a real firm making COVID-19 tests. Another patent troll [url=https://www.eff.org/deeplinks/2020/05/new-low-bad-patent-patent-troll-sues-ventilator-company]sued a ventilator manufacturer[/url]. A health crisis is a time to carefully limit, not expand, the power of patents.
Oakland’s Progressive Fight to Protect Residents from Government Surveillance
by on Wed, 20 Jan 2021 19:26:57 +0000:
The City of Oakland, California, has once again raised the bar on community control of police surveillance. Last week, Oakland's City Council voted unanimously to strengthen the city's already [url=https://www.eff.org/deeplinks/2018/05/oakland-new-gold-standard-community-control-police-surveillance]groundbreaking[/url] Surveillance and Community Safety Ordinance. The latest [url=https://www.eff.org/document/oakland-ordinance-amending-oakland-municipal-code-chapter-964-which-regulates-citys]amendment[/url], which immediately went into effect, adds prohibitions on Oakland's Police Department using [url=https://www.eff.org/deeplinks/2020/09/technology-cant-predict-crime-it-can-only-weaponize-proximity-policing]predictive policing technology—[/url]which has been shown to amplify existing bias in policing—as well as a range of privacy-invasive biometric surveillance technologies, to the city’s existing ban on government use of face recognition.
Oakland is now (as far as we know) the first city to ban government use of voice recognition technology. This is an important step, given the growing proliferation of this invasive form of surveillance, at [url=https://www.fastcompany.com/90307401/why-is-a-prison-company-storing-the-voice-prints-of-even-innocent-people]home[/url] and [url=https://www.hrw.org/news/2017/10/22/china-voice-biometric-collection-threatens-privacy]abroad[/url]. Oakland also may be the first city to ban government use of any technology that can identify a person based on “physiological, biological, or behavioral characteristics ascertained from a distance.” This would include recognition of a person’s distinctive [url=https://apnews.com/article/bf75dd1c26c947b7826d270a16e2658a]gait[/url] or manner of walking.
Last June, the California city of Santa Cruz became the [url=https://www.eff.org/deeplinks/2020/09/technology-cant-predict-crime-it-can-only-weaponize-proximity-policing]first U.S. city[/url] to ban its police department from using predictive policing technology. Just a few weeks ago, [url=https://thelensnola.org/2020/12/18/new-orleans-city-council-approves-ban-on-facial-recognition-predictive-policing-and-other-surveillance-tech/]New Orleans[/url], Louisiana, also prohibited the technology, as well as certain forms of biometric surveillance. With last week's amendments, Oakland became the largest city to ban predictive policing.
Oakland is also the first city to incorporate these prohibitions into a more comprehensive Community Control of Police Surveillance ([url=http://communityctrl.com]CCOPS[/url]) framework. Its ordinance not only prohibits these particularly pernicious forms of surveillance, but also ensures that police cannot obtain any other forms of surveillance technology absent permission from the city council following input from residents. This guarantees transparency, accountability, and community engagement before any privacy-invasive surveillance technology can be adopted by local government agencies.
Last week marks the second significant update to Oakland's CCOPS ordinance since it went into effect in 2018. One year later, the law was amended to ban government use of face recognition. At the time, Oakland was one of only three cities to ban the technology. Neighboring [url=https://www.eff.org/deeplinks/2019/05/san-francisco-takes-historic-step-forward-fight-privacy]San Francisco[/url] was the first, having included its ban in its own CCOPS ordinance. Since then, over a dozen U.S. cities have followed suit. Now [url=https://www.eff.org/deeplinks/2020/06/now-time-tell-congress-ban-federal-use-face-recognition]federal legislation[/url] seeks to bar federal agencies from using the technology. The bill is sponsored by Senators Markey and Merkley and Representatives Ayanna Pressley, Pramila Jayapal, Rashida Tlaib, and Yvette Clarke.
The recent amendments to Oakland’s surveillance ordinance were sponsored by the city’s [url=https://www.oaklandca.gov/boards-commissions/privacy-advisory-board]Privacy Advisory Commission[/url], which is tasked with developing and advising on citywide privacy concerns. In a [url=https://secure-justice.org/blog/first-in-the-nation-bans-predictive-analytics-biometric-surveillance-technologies]blog[/url] published by Secure Justice—a Bay Area non-profit lead by the Commission's chair, Brian Hofer—Sameena Usman, of the San Francisco office of the Council on American-Islamic Relations ([url=https://ca.cair.com/sfba/]CAIR[/url]) explained: "Not only are these methods intrusive and don't work, they also have a disproportionate impact on Black and brown communities – leading to over-policing." EFF joined 16 other groups in [url=https://www.eff.org/document/coalition-letter-supporting-oaklands-privacy-advisory-commissions-proposed-amendments]supporting[/url] the new law.
EFF applauds the Commission and Oakland's City Council for taking this groundbreaking step advancing public safety and protecting civil liberties. Predictive policing and biometric surveillance technologies have a harmfully disparate impact against people of color, immigrants, and other vulnerable populations, as well as a chilling effect on our fundamental First Amendment freedoms.
Why EFF Doesn’t Support Bans On Private Use of Face Recognition
by on Wed, 20 Jan 2021 16:29:33 +0000:
Government and private use of face recognition technology each present a wealth of concerns. Privacy, safety, and amplification of carceral bias are just some of the reasons why we must ban government use.
But what about private use? It also can exacerbate injustice, including its use by police contractors, [url=https://nymag.com/intelligencer/2018/10/retailers-are-using-facial-recognition-technology-too.html]retail[/url] establishments, business improvement districts, and [url=https://www.cnet.com/news/google-nest-hub-max-a-new-face-tracking-camera-for-your-home-weve-got-questions/]homeowners[/url].
Still, EFF does not support banning private use of the technology. Some users may choose to deploy it to lock their mobile devices or to demonstrate the hazards of the tech in government hands. So instead of a prohibition on private use, we support strict laws to ensure that each of us is empowered to choose if and by whom our faceprints may be collected. This requires mandating informed opt-in consent and data minimization, enforceable through a robust private right of action.
Illinois has had such [url=https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57]a[/url] [url=https://www.eff.org/deeplinks/2019/08/victory-lawsuit-may-proceed-against-facebooks-biometric-surveillance-0]law[/url] for more than a decade. This approach properly balances the human right to control technology—both to use and develop it, and to be free from other people’s use of it.
The menace of all face recognition technology
Face recognition technology requires us to confront complicated questions in the context of centuries-long racism and oppression within and beyond the criminal system.
Eighteenth-century “[url=https://truthout.org/articles/the-surveillance-of-blackness-from-the-slave-trade-to-the-police/]lantern laws[/url]” requiring Black and indigenous people to carry lanterns to illuminate themselves at night are one of the earliest examples of a useful technology twisted into a force multiplier of oppression. Today, face recognition technology has the power of covert bulk collection of biometric data that was inconceivable less than a generation ago.
Unlike our driver’s licenses, credit card numbers, or even our names, we cannot easily change our faces. So once our biometric data is captured and stored as a face template, it is largely indelible. Furthermore, as a CBP vendor found out when the face images of approximately [url=https://www.oig.dhs.gov/sites/default/files/assets/2020-09/OIG-20-71-Sep20.pdf]184,000[/url] travelers were stolen, databases of biometric information are ripe targets for data thieves.
Face recognition technology chills fundamental freedoms. As early as 2015, the Baltimore police used it to target [url=https://www.aclunc.org/blog/facebook-instagram-and-twitter-provided-data-access-surveillance-product-marketed-target]protesters against police violence[/url]. Its[url=https://www.eff.org/wp/law-enforcement-use-face-recognition] threat to essential liberties[/url] extends far beyond political rallies. Images captured outside houses of worship, medical facilities, community centers, or our homes can be used to infer our familial, political, religious, and sexual relationships.
Police have unparalleled discretion to use violence and intrude on liberties. From our nation’s inception, essential freedoms have not been equally available to all, and the discretion vested in law enforcement only accentuates these disparities. One need look no further than the [url=https://www.history.com/this-day-in-history/bloody-sunday-civil-rights-protesters-beaten-selma]Edward Pettus Bridge[/url] or the [url=https://www.democracynow.org/2009/4/24/flashback_a_look_back_at_the]Church Committee[/url]. In 2020, as some people took to the streets to protest police violence against Black people, and others came out to protest COVID-19 mask mandates, police enforced their authority in [url=https://www.vox.com/2020/5/27/21271811/george-floyd-protests-minneapolis-lockdown-protests]starkly[/url] [url=https://slate.com/news-and-politics/2020/05/police-response-george-floyd-minneapolis-shutdowns.html]different[/url] manners.
Face recognition amplifies these police powers and aggravates these racial disparities.
Each step of the way, the private sector has contributed. Microsoft, Amazon, and IBM are among the many vendors that have built face recognition for police (though in response to [url=https://www.eff.org/deeplinks/2020/06/ibm-amazon-end-and-pause-fr-programs-where-microsoft]popular pressure[/url] they have temporarily ceased doing so). Clearview AI continues to process[url=https://www.eff.org/wp/law-enforcement-use-face-recognition#_idTextAnchor004] faceprints[/url] of billions of people without their consent in order to help police identify suspects. Such companies ignore the human right to make informed choices over the collection and use of biometric data, and join law enforcement in exacerbating long-established inequities.
The fight to end government use of face recognition technology
In the hands of government, face recognition technology is simply too threatening. The legislative solution is clear: ban government use of this technology.
EFF has fought to do so, alongside our members, [url=http://eff.org/fight]Electronic Frontier Alliance allies[/url], other national groups like the ACLU, and a broad range of concerned community-based groups. We supported the effort to pass San Francisco’s [url=https://www.eff.org/deeplinks/2019/05/san-francisco-takes-historic-step-forward-fight-privacy]historic 2018 ordinance[/url]. We’ve also advocated before city councils in California ([url=https://www.eff.org/deeplinks/2019/10/victory-berkeley-city-council-unanimously-votes-ban-face-recognition]Berkeley[/url] and [url=https://www.eff.org/deeplinks/2019/07/victory-oakland-city-council-votes-ban-government-use-face-surveillance]Oakland[/url]), Massachusetts ([url=https://www.eff.org/deeplinks/2020/06/victory-boston-bans-government-use-face-surveillance]Boston[/url], [url=https://www.eff.org/deeplinks/2019/12/victory-brookline-votes-ban-face-surveillance]Brookline[/url], and [url=https://act.eff.org/action/no-face-surveillance-in-somerville]Somerville[/url]), and Oregon ([url=https://www.eff.org/deeplinks/2020/09/portlands-fight-against-face-surveillance]Portland[/url]).
Likewise, we helped pass California’s [url=https://www.eff.org/deeplinks/2019/10/victory-california-governor-signs-ab-1215]AB 1215[/url]. It establishes a three-year moratorium on the use of face recognition technology with body worn police cameras. AB 1215 is the nation’s first state-level face recognition prohibition. We also joined with the ACLU and others in demanding that manufacturers [url=https://www.eff.org/deeplinks/2018/05/amazon-stop-powering-government-surveillance]stop selling the technology to law enforcement[/url].
In 2019, we launched our [url=http://aboutfacenow.org/]About Face[/url] campaign. The campaign supplies [url=https://www.eff.org/aboutface/toolkit]model language[/url] for an effective ban on government use of face recognition, tools to prepare for meeting with local officials, and a library of existing ordinances. Members of EFF’s organizing team also work with community-based members of the Electronic Frontier Alliance to build local coalitions, deliver public comment at City Council hearings, and build awareness in their respective communities.
The promise of emerging technologies
EFF works to ensure that technology supports [url=https://www.eff.org/tags/eff30]freedom, justice, and innovation[/url] for all the people of the world. In our experience, when government tries to take technology out of the hands of the public, it is often serving the interests of the strong against the weak. Thus, while it is clear that we must ban government use of face recognition technology, we support a different approach to private use.
As [url=https://mediajustice.org/staff/malkia-devich-cyril/]Malkia Cyril[/url] wrote in a 2019 piece for McSweeney’s [url=https://www.eff.org/the-end-of-trust][i]The End of Trust[/i][/url] titled “[url=https://www.eff.org/deeplinks/2019/02/watching-black-body]Watching the Black Body[/url]”: “Our twenty-first-century digital environment offers Black communities a constant pendulum swing between promise and peril.” High-tech profiling, policing, and punishment exacerbate the violence of America’s race-based caste system. Still, other technologies have facilitated the development of intersectional and [url=https://www.eff.org/issues/digital-rights-and-black-led-movement-against-police-violence]Black-led[/url] movements for change, including encrypted communication, greater access to video recording, and the ability to [url=https://www.csmonitor.com/Technology/2016/0124/Ferguson-How-Twitter-helped-empower-ordinary-residents]circumvent the gatekeepers[/url] of traditional media.
[url=https://www.eff.org/issues/security]Encryption[/url] and [url=https://www.eff.org/deeplinks/2014/06/why-you-should-use-tor]Tor[/url] secure our private communications from snooping by stalkers and foreign nations. Our [url=https://www.eff.org/deeplinks/2020/06/you-have-first-amendment-right-record-police]camera[/url] [url=https://www.eff.org/issues/right-record]phones[/url] help us to document police misconduct against our neighbors. [url=https://www.supremecourt.gov/opinions/16pdf/15-1194_08l1.pdf]The Internet[/url] allows everyone to (in the words of the U.S. Supreme Court) “become a town crier with a voice that resonates farther than it could from any soapbox.” [url=https://www.eff.org/issues/blockchain]Digital currency[/url] holds the promise of greater financial privacy and independence from financial censorship.
EFF has long resisted government efforts to ban or hobble the development of such novel technologies. We stand with [url=https://www.eff.org/document/fields-eff-amicus-brief]police observers[/url] against wrongful arrest for recording on-duty officers, with [url=https://www.eff.org/cases/woodhull-freedom-foundation-et-al-v-united-states]sex workers[/url] against laws that stop them from using the Internet to share safety information with peers, and with [url=https://www.eff.org/files/2016/03/03/16cm10sp_eff_apple_v_fbi_amicus_court_stamped.pdf]cryptographers[/url] against FBI attempts to weaken encryption. Emerging technologies are for everyone.
Private sector uses of face recognition
There are many menacing ways for private entities to use face recognition. [url=https://www.nbcmiami.com/investigations/miami-police-used-facial-recognition-technology-in-protesters-arrest/2278848/]Clearview AI[/url], for example, uses it to help police departments identify and arrest protesters.
It does not follow that all private use of face recognition technology undermines human rights. For example, many people use face recognition [url=https://support.apple.com/en-us/HT208109]to[/url] [url=https://www.samsung.com/us/support/answer/ANS00062630/]lock[/url] their smartphones. While passwords provide [url=https://ssd.eff.org/en/module/attending-protest]stronger[/url] [url=https://www.eff.org/files/2017/03/10/digital-privacy-border-2017-guide3.10.17.pdf]protection[/url], without this option some users might not secure their devices at all.
Research and anti-surveillance scholars have made good use of the technology. 2018 saw [url=http://proceedings.mlr.press/v81/buolamwini18a/buolamwini18a.pdf]groundbreaking work[/url] from then-MIT researcher Joy Boulamwini and Dr. Timnit Gebru, exposing face recognition’s algorithmic bias. That same year, the ACLU utilized Amazon’s Rekognition system to demonstrate the disparate inefficacy of a technology that disproportionately misidentified congressional representatives of color as individuals in publicly accessible arrest photos. U.S. Sen. Edward Markey (D-MA), one of the lawmakers erroneously matched despite being part of the demographic the technology identifies most accurately, went on to introduce the [url=https://www.eff.org/deeplinks/2020/06/now-time-tell-congress-ban-federal-use-face-recognition]Facial Recognition and Biometric Technology Moratorium Act of 2020[/url].
These salutary efforts would be illegal in a state or city that banned private use of face recognition. Even a site-specific ban—for example, just in public forums like parks, or public accommodations like cafes—would limit anti-surveillance activism in those sites. For example, it would bar a live demonstration at a rally or lecture of how face recognition works on a volunteer.
Strict limits on private use of face recognition
While EFF does not support a ban on private use of face recognition, we do support strict limits. Specifically, laws should subject private parties to the following rules:
Do not collect a faceprint from a person without their prior written opt-in consent.
Likewise, do not disclose a person’s faceprint without their consent.
Do not retain a faceprint after the purpose of collection is satisfied, or after a fixed period of time, whichever is sooner.
Do not sell faceprints, period.
Securely store faceprints to prevent their theft or misuse.
All privacy laws need effective enforcement. Most importantly, a person who discovers that their privacy rights are being violated must have a “[url=https://www.eff.org/deeplinks/2019/01/you-should-have-right-sue-companies-violate-your-privacy]private right of action[/url]” so they can sue the rule-breaker.
In 2008, Illinois enacted the first law of this kind: the Illinois Biometric Information Privacy Act ([url=https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57]BIPA[/url]). A new [url=https://www.eff.org/deeplinks/2020/08/sen-merkley-leads-biometric-privacy]federal[/url] [url=https://www.merkley.senate.gov/imo/media/doc/20.08.04%20National%20Biometric%20Information%20Privacy%20Act.pdf]bill[/url] sponsored by U.S. Senators Jeff Merkley and Bernie Sanders seeks to implement BIPA on a nationwide basis.
We’d like this kind of law to contain two additional limits. First, private entities should be prohibited from collecting, using, or disclosing a person’s faceprint except as necessary to give them something they asked for. This privacy principle is [url=https://www.laprogressive.com/data-minimization/]often[/url] [url=https://www.eff.org/deeplinks/2019/12/sen-cantwell-leads-new-consumer-data-privacy-bill]called[/url] “[url=https://www.eff.org/deeplinks/2020/05/californias-lawmakers-must-enact-privacy-rules-advance-covid-19-efforts]minimization[/url].” Second, if a person refuses to consent to faceprinting, a private entity should be prohibited from retaliating against them by, for example, charging a higher price or making them stand in a longer line. EFF opposes “[url=https://www.eff.org/deeplinks/2019/02/payoff-californias-data-dividend-must-be-stronger-privacy-laws]pay[/url] [url=https://www.eff.org/deeplinks/2020/07/why-eff-doesnt-support-cal-prop-24]for[/url] [url=https://www.eff.org/deeplinks/2020/10/why-getting-paid-your-data-bad-deal]privacy[/url]” schemes that pressure everyone to surrender their privacy rights, and contribute to an income-based society of privacy “haves” and “have nots.” Such laws should also have an exemption for [url=https://www.eff.org/deeplinks/2020/11/clearviews-faceprinting-not-sheltered-biometric-privacy-litigation-first-amendment]newsworthy[/url] information.
EFF has long worked to enact more BIPA-type laws, including in [url=https://www.eff.org/deeplinks/2020/08/sen-merkley-leads-biometric-privacy]Congress[/url] and [url=https://www.eff.org/deeplinks/2017/02/protect-biometric-privacy-montana]Montana[/url]. We regularly advocate in Illinois to [url=https://www.eff.org/deeplinks/2016/06/danger-corporate-facial-recognition-tech]protect[/url] [url=https://www.eff.org/files/2016/06/07/2016-03-11_letter_-_eff_against_il_sb_2409_0.pdf]BIPA[/url] [url=https://www.eff.org/files/2016/06/07/2016-05-27_letter_-_eff_against_il_hb_6074_0.pdf]from[/url] [url=https://www.eff.org/document/2018-02-28-eff-letter-opposing-illinois-sb-3053-and-hb-5103]legislative[/url] [url=https://www.eff.org/document/2018-04-10-eff-letter-opposing-illinois-sb-3053]backsliding[/url]. We have filed amicus briefs in a [url=https://www.eff.org/deeplinks/2019/08/victory-lawsuit-may-proceed-against-facebooks-biometric-surveillance-0]federal appellate court[/url] and the [url=https://www.eff.org/deeplinks/2019/01/victory-illinois-supreme-court-protects-biometric-privacy]Illinois Supreme Court[/url] to ensure strong enforcement of BIPA, and in an [url=https://www.eff.org/deeplinks/2020/11/clearviews-faceprinting-not-sheltered-biometric-privacy-litigation-first-amendment]Illinois trial court[/url] against an ill-conceived challenge to the law’s constitutionality.
Illinois’ BIPA enjoys robust enforcement. For example, Facebook agreed to pay its users [url=https://www.chicagotribune.com/business/ct-biz-facebook-settlement-privacy-illinois-20200922-pjgcyodp4zfxha6bvluyndn6mm-story.html]$650 million[/url] to settle a case challenging non-consensual faceprinting under the company’s “tag suggestions” feature. Also, the ACLU recently sued [url=https://www.aclu.org/cases/aclu-v-clearview-ai]Clearview AI[/url] for its non-consensual faceprinting of billions of people. Illinoisans have filed dozens of other BIPA suits.
Government entanglement in private use of face recognition
EFF supports one rule for government use of face surveillance (ban it) and another for private use (strictly limit it). What happens when government use and private use overlap?
Some government agencies purchase faceprints or faceprinting services from private entities. Government should be banned from doing so. Indeed, most bans on government use of face recognition [url=https://www.eff.org/document/ban-government-use-face-surveillance-model-bill-0]properly[/url] [url=https://codelibrary.amlegal.com/codes/san_francisco/latest/sf_admin/0-0-0-61746]include[/url] [url=https://library.municode.com/ca/oakland/codes/code_of_ordinances?nodeId=TIT9PUPEMOWE_CH9.64REACUSSUTE_9.64.045PRACUSFARETE]a[/url] [url=https://www.eff.org/document/ordinance-banning-face-surveillance-technology-boston]ban[/url] on government obtaining or using information derived from a face surveillance system.
Some government agencies own public forums, like parks and sidewalks, that private entities use for their own expressive activities, like protests and festivals. If community members wish to incorporate consensual demonstrations of facial recognition into their expressive activity, subject to the strict limits above, they should not be deprived of the right to do so in the public square. Thus, when a draft of Boston’s [url=https://www.eff.org/deeplinks/2020/06/victory-boston-bans-government-use-face-surveillance]recently enacted[/url] ban on government use of face recognition also prohibited issuance of permits to third parties to use the technology, EFF [url=https://www.eff.org/document/eff-letter-boston-city-council-facial-recognition]requested[/url] and [url=https://www.eff.org/document/ordinance-banning-face-surveillance-technology-boston]received[/url] language limiting this to when third parties are acting on behalf of the city.
Some government agencies own large restricted spaces, like airports, and grant other entities long-term permission to operate there. EFF opposes [url=https://act.eff.org/action/no-airport-biometric-surveillance]government[/url] [url=https://www.eff.org/deeplinks/2017/08/end-biometric-border-screening]use[/url] [url=https://www.eff.org/deeplinks/2017/10/no-airport-biometric-surveillance]of[/url] [url=https://www.eff.org/deeplinks/2017/11/tsa-plans-use-face-recognition-track-americans-through-airports]face[/url] [url=https://www.eff.org/deeplinks/2018/12/year-review-airport-surveillance-takes-new-dangerous-direction]recognition[/url] [url=https://www.eff.org/deeplinks/2019/04/skip-surveillance-opting-out-face-recognition-airports]in[/url] [url=https://www.eff.org/deeplinks/2019/12/fighting-back-against-face-surveillance-skies-year-review-2019]airports[/url]. This includes by the airport authority itself; by other government agencies operating inside the airport, including federal, state, and local law enforcement; and by private security contractors. This also includes a ban on government access to information derived from private use of face recognition. On the other hand, EFF does not support a ban on private entities making their own use of face recognition inside airports, subject to the strict limits above. This includes use by travelers and airport retailers. Some anti-surveillance advocates have sought [url=https://papersplease.org/wp/wp-content/uploads/2020/10/SEA-ACLU-et-al-29SEP2020.pdf]more expansive bans[/url] on private use.
Private use of face recognition in places of public accommodation
[url=https://fortune.com/2015/11/09/wal-mart-facial-recognition/]A[/url] [url=https://www.buzzfeednews.com/article/leticiamiranda/retail-companies-are-testing-out-facial-recognition-at]growing[/url] [url=https://nymag.com/intelligencer/2018/10/retailers-are-using-facial-recognition-technology-too.html]number[/url] [url=https://www.theguardian.com/technology/2019/aug/04/facial-recognition-supermarket-facewatch-ai-artificial-intelligence-civil-liberties]of[/url] [url=https://www.forbes.com/sites/forbesbusinesscouncil/2020/05/08/how-facial-recognition-will-change-retail/?sh=646d50a93daa]retail[/url] [url=https://www.reuters.com/investigates/special-report/usa-riteaid-software/]stores[/url] and other places of public accommodation are deploying face recognition to identify all people entering the establishment. EFF strongly opposes this practice. When used for theft prevention, it has a racially disparate impact: the photo libraries of supposedly “suspicious” people are often based upon unfair encounters between people of color and law enforcement or corporate security. When used to micro-target sales to customers, this practice intrudes on privacy: the photo libraries of consumers, correlated to their supposed preferences, are based on corporate surveillance of online and offline activity.
The best way to solve this problem is with the strict limits above. For example, the requirement of written opt-in consent would bar a store from conducting face recognition on everyone who walks in.
On the other hand, EFF does not support bans on private use of face recognition within public accommodations. The anti-surveillance renter of an assembly hall, or the anti-surveillance owner of a café, might wish to conduct a public demonstration of how face recognition works, to persuade an audience to support legislation that bans government use of face recognition. Thus, while EFF [url=https://www.eff.org/deeplinks/2020/09/portlands-fight-against-face-surveillance]supported[/url] the recently enacted ban on [url=https://www.eff.org/document/portland-or-ordinance-prohibiting-acquisition-and-use-face-recognition-technologies-city]government use[/url] of face recognition in Portland, Oregon, we did not support that city’s simultaneously enacted ban on [url=https://privacyblogfullservice.huntonwilliamsblogs.com/wp-content/uploads/sites/28/2020/09/Portland-Ordinance-Private-Entities-1.pdf]private use[/url] of face recognition within public accommodations.
U.S. businesses selling face recognition to authoritarian regimes
Corporations based in the United States have a [url=https://www.eff.org/deeplinks/2015/02/eff-files-amicus-brief-case-seeks-hold-ibm-responsible-facilitating-apartheid]long[/url] [url=https://www.eff.org/deeplinks/2011/07/eff-urges-microsoft-and-cisco-to-reconsider-china]history[/url] of selling key surveillance technology, used to aid in oppression, to authoritarian governments. This has harmed journalists, human rights defenders, ordinary citizens, and democracy advocates. The Chinese tech corporation Huawei reportedly is building face recognition software to notify government authorities when a camera identifies a [url=https://www.washingtonpost.com/technology/2020/12/08/huawei-tested-ai-software-that-could-recognize-uighur-minorities-alert-police-report-says/]Uyghur[/url] person. There is risk that, without effective accountability measures, U.S. corporations will sell face recognition technology to authoritarian governments.
In collaboration with leading organizations tracking the sale of surveillance technology, we recently filed a [url=https://www.eff.org/document/eff-amicus-brief-doe-v-nestle-scotus]brief[/url] asking the U.S. [url=https://www.eff.org/deeplinks/2020/10/eff-supreme-court-american-companies-complicit-human-rights-abuses-abroad-should]Supreme Court[/url] to uphold the ability of non-U.S. residents to sue U.S. corporations that aid and abet human rights abuses abroad. The case concerns the [url=https://cja.org/what-we-do/litigation/legal-strategy/the-alien-tort-statute/]Alien Torts Statute[/url], which allows foreign nationals to hold U.S.-based corporations accountable for their complicity in human rights violations.
To prevent such harms before they occur, businesses selling surveillance technologies to governments should implement a “[url=https://www.eff.org/deeplinks/2011/10/it%E2%80%99s-time-know-your-customer-standards-sales-surveillance-equipment]Know Your Customer[/url][url=https://www.eff.org/deeplinks/2011/10/it%E2%80%99s-time-know-your-customer-standards-sales-surveillance-equipment]” framework of [/url][url=https://www.eff.org/deeplinks/2018/07/should-your-company-help-ice-know-your-customer-standards-evaluating-domestic]a[/url][url=https://www.eff.org/deeplinks/2018/07/should-your-company-help-ice-know-your-customer-standards-evaluating-domestic]ffirmative investigation[/url] before any sale is executed or service provided. Significant portions of this framework are already required through the [url=http://www.justice.gov/criminal/fraud/fcpa/]Foreign Corrupt Practices Act[/url] and [url=http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid=b598042103e95c10c396b0140e0620b7&rgn=div9&view=text&node=15:126.96.36.199.188.8.131.52.22&idno=15]export regulations[/url][url=http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid=b598042103e95c10c396b0140e0620b7&rgn=div9&view=text&node=15:184.108.40.206.220.127.116.11.22&idno=15].[/url] Given the inherent risks associated with face recognition, U.S. companies should be especially wary of selling this technology to foreign states.
EFF will continue to advocate for bans on [url=https://www.eff.org/aboutface]government[/url] [url=https://www.eff.org/deeplinks/2020/06/now-time-tell-congress-ban-federal-use-face-recognition]use[/url] of face recognition, and adoption of [url=https://www.eff.org/deeplinks/2020/08/sen-merkley-leads-biometric-privacy]legislation[/url] that protects each of us from [url=https://www.eff.org/deeplinks/2020/11/clearviews-faceprinting-not-sheltered-biometric-privacy-litigation-first-amendment]non-consensual collection[/url] of our biometric information by private entities. You can join us in this fight by working with others [url=https://www.eff.org/electronic-frontier-alliance/allies]in your area[/url] to advocate for stronger protections and signing our About Face [url=https://act.eff.org/action/about-face]petition[/url] to end face government use of face recognition technology.