Tsinghua Professor^[a][b][c] Lao Dongyan: The hidden worries of facial recognition technology

*Note: These are Jeffrey Ding’s informal and unofficial translations -- all credit for the original goes to the authors and the original text linked below. Jeff is a Rhodes Scholar at Oxford, PhD candidate in International Relations, Researcher at GovAI/Future of Humanity Institute, and Research Fellow at the Center for Security and Emerging Technology. These are informal translations and all credit for the original work goes to the authors. Others are welcome to share excerpts from these translations as long as my original translation is cited. Commenters should be aware that the Google Doc is also publicly shareable by link. These translations are part of the ChinAI newsletter - weekly-updated library of translations from Chinese thinkers on AI-related issues: https://chinai.substack.com/

________________________________________________________________________________

Author: Dongyan Lao (劳东燕 )’s public WeChataccount [劳燕东飞]

Date: October 31, 2019

Original Mandarin: https://mp.weixin.qq.com/s/7eo7AqcPJ6qiaTTh2o25zA?fbclid=IwAR0ZxckmxEGmD2rgZIloKYF3DiaAjvHpdki6oqwgH8EubR2I-Eb1y8_ySKQ

I learned from the news the other day that the Beijing Subway will apply facial recognition technology to carry out screening security checks on passengers, on the grounds that it will improve efficiency of passenger traffic.

After reading this news, my first reaction was: this is crazy. Fortunately, I saw a Guangming.com commentary article (in Mandarin) yesterday, titled, ‘Don't make facial recognition technology into the modern “ink punishment.”’ ^[d]Why is my heart anxious? Other than this article, public discourse was so quiet, and it seemed that not many people were paying attention to this matter. I had to wonder if I was going crazy.

You need to show your ID card when entering or leaving the university campus, have your ID card checked when you mail something, scan your face to check in at a hotel, and it ’s not enough to go through a security check to ride the subway. Now you need to go one step further and use the so-called new technology to continue to improve the level of security. I want to ask, when will it end? Next, is it necessary to fully install face recognition machines on all roads and in all public places, in order to intercept pedestrians and interrogate and search them at any time, and detain those who are considered to be dangerous to safety?

Regarding this uncontrolled investment in security, I'm getting more and more confused as to who it is guarding against and who it is protecting. I originally thought that I should be the object of protection, but with these successive measures, I clearly felt that I was the object of control. As a law-abiding citizen, I usually abide by the law, have no prior criminal record, am relatively dedicated to my work, and can live harmoniously with others. I don’t know why I should be guarded against like this?

Living in this society, I often feel that I am not trusted. Whether it is reimbursement for scientific research expenses, or constantly escalating security, what I can sense is an atmosphere of unlimited alert. On the former occasion, I felt like I was being guarded against like a thief; on the latter occasion, I felt like I was being watched as a potential evil force in society. This is probably not just my own experience.

There is a principle of presumption of innocence in modern criminal procedure law. According to this principle, anyone is legally presumed innocent until convicted by the court. However, the current security measures are based on the presumption of guilt. Everyone is presumed to be a danger to public safety and needs to pass through increasingly stringent security checks without exception. To say that such security measures are actually used to protect the general public like you and me, unless one has a personality disorder, who would believe it?

Maybe some people will take exception to my comments, thinking that I am being too sensitive about this incident. To generalize overall, there may be four types of views:

Responses to Counterarguments^[e]

First, some people may think that I am overthinking it, and I cannot appreciate and thank the government, as a father figure, for its protection and kindness.

I can only say: forgive me, but I cannot accept this type of kindness.

Imagine all the personal data, including what websites you usually go on, what news and videos you watch, what you buy, what person you chat with on WeChat, what specific content you talk about, what you like and dislike, etc. This is already enough. Now add personal information in biometrics, and then put it all under the control of a huge organization. We must know that in our society, any personal data, as long as it is controlled by enterprises or other institutions, is also controlled by the government.

Because this huge organization is run by specific people, this is equivalent to saying that all personal data, including highly recognizable biometric data, are controlled by a few people in that group. We should think carefully about how much personal information these people actually control, why do they control our personal information, and what are these personal information used for.

The people who control our data are obviously not God. They have their own selfish desires and weak points. Therefore, it is unknown how they will use our personal data and how they will manipulate our lives. Not to mention, such data may be leaked or hacked due to improper storage, leading to harmful results that may be exploited by criminals.

Second, some would say that as long as you don't do bad things, you don't have to worry about the government controlling your personal data.

All I can say is that I don't want to become a “transparent” person; the idea of ​​becoming a “transparent” person makes me very disturbed.

In a normal society, individuals should have the right to oppose any organization's arbitrary access to their personal biometric data. The law’s protection of an individual’s privacy and property rights and freedoms gives individuals a space for self-government, which cannot be infringed upon by others.

Others here not only refers to other individuals or general organizations, but also governments, including countries. If the biometric data of an individual can be obtained without consent in the name of security, do the legal protections of privacy and freedom of residence mean anything? Without privacy there is no freedom.

Third, some people point out that they are not important people, and others presumably have no interest in learning about our personal information.

Those who hold this view are not small in number. Regarding the large-scale collection of personal data, even if they are the object of collection, many people do not feel that there is any problem. They think that they are not important people, and others should not be interested to look too closely at me. So, I'm still safe enough.

I can only say that when you put your personal safety issue on the neglect of others, you basically live like a dead gambler. And, you are not only betting on your luck, but you are also betting that the person who controls the data is an angel. To those who wishfully think they can win this bet, while I admire your ostrich-like character, I secretly think you probably need to pay some intelligence tax.

It is best for these types of optimistic people to take a serious look at the movie "Enemy of the State"^[f] movie from more than 20 years ago. The ending of the movie itself is not bad, and the wicked are eventually reported for their crimes. However, if you are the protagonist in the play, I am afraid that you do not have the same luck, and you can only wait for the tragedy to end. Worst of all, you probably didn't know how you died in the end.

Fourth, there are people who will argue that this type of technology promotion has some issues, but opposing it does not have any use, and they are too lazy to spend energy opposing it.

For issues that concern our own important rights and interests, I can only say that if we do not stand up and express our opposition and make our due efforts, it is naturally impossible to expect others to help call this out. How do you know that opposition is ineffective before you make the minimum effort? Even if opposition is ultimately invalid, it is better than tamely putting on your own shackles. At least we put in the work and struggled.

As those who have had their rights violated, if we just endure this in silence and do not even dare to express our opposition, it is tantamount to helping the other party to scheme and hurts yourself. Taking a step back in this situation, this is not the boundless sea and sky, but we are likely to fall into the abyss from now on. Because this is not a problem that can be solved simply by stubbornly tolerating it. Watching us go step by step towards the abyss, this was at least partly caused by our own stubborn forbearance.

I express my firm opposition to the facial recognition technology that the Beijing Subway is about to promote. Below are my specific reasons:

Reasons Professor Lao Opposes Facial Recognition in the Beijing Subway

First, face recognition involves the collection of biometric data that is important for individuals. Relevant organizations or institutions must prove the legitimacy of their methods before collection.

According to the existing laws and regulations, since the common (notion) of personal information, including one’s address, phone number, email address, account, and one’s location tracking, etc. is identifiable, collection of this information must get the person’s approval beforehand. At the same time, if the collecting party improperly uses, sells, or merges the corresponding information, it may also trigger legal liabilities including criminal liabilities.

The personal orientation of biometric data is more obvious, and for individuals, it is more important to observe than what is commonly considered personal information. Why is it not necessary to obtain the consent of the person whose data is being collected? In addition, there are no restrictions on the subject, purpose, method, scope, and procedures of the collection, and there is no corresponding legal responsibility for illegal collection or use.

If the government is the main principal of collecting data, then, obviously, it needs the explicit authorization of the law; it cannot be done without authorization, and the government has no right to collect biometric data of ordinary citizens in the name of security. If this data collection is being done by a company or other institution, its collection of personal biometric data requires at least the explicit consent of the person being collected; collection without consent is an illegal act of obtaining the personal information of citizens.

Second, the subway’s implementation of facial recognition involves important personal rights and interests of the public. Its implementation without a hearing lacks minimum legitimacy.

A few years ago, the Beijing subway undertook a broad solicitation of the public’s views on a fare adjustment, and it went through a strict hearing process. If fare adjustment requires extensive consultation and hearing process, then how can facial recognition technology be directly introduced without soliciting opinions or holding a hearing, when facial recognition obviously involves more important personal rights? Could it be that the biometric data of an individual is not as significant as a few RMB?^[g]

Without going through any argumentation process, we are ready to launch facial recognition on a large scale. People have reasons to doubt whether this involves illegal transactions or whether it is the result of lobbying by relevant interest groups.

Thirdly, the application of facial recognition technology is said to realize security screening, but the problems involved in the standard itself have not been solved.

What authority does a traffic management department have to sort passengers into groups? What law is it based on? Beyond this, what standards are the relevant departments planning to use to screen passengers, what is the specific content of the standards that are adopted, from whom are these standards coming from and how are they being confirmed, will the standards be made public, etc. Shouldn't these problems be solved before implementing face recognition? The sorting criteria for even garbage must be clearly stated, let alone the sorting of people.^[h]

If the relevant departments intend to adopt internal standards, how do we know whether the standards are legal and reasonable? How can I know if there is discrimination, which is prohibited by the law? How can I find out if there is a problem of arbitrarily setting the content of standards? If the interested parties are not satisfied with the classification criteria, or believe that inappropriate screening violates their legal rights, how can they proceed and how can they ensure that their rights are effectively remedied? Before these problems are addressed, how can it be decided so lightly that facial recognition can be used for security screening in a place like a subway?

If internal standards are used to arbitrarily divide passengers into various grades and ranks and then to apply different security screening measures based on this sorting, we have reasons to suspect that this approach violates the constitutional principle of equality and violates citizens' fundamental right to personal liberty. Article 37 of the Constitution clearly stipulates that illegal detention and other methods of illegally depriving or restricting the personal freedom of citizens are prohibited, and illegal searches of citizens are prohibited.

Fourth, in the end, there is not enough evidence to show that the use of facial recognition in subways can improve transport efficiency; even if there is evidence to prove this, efficiency itself is not a sufficient basis for implementation.

Subway transit officials claim that the implementation of facial recognition technology in the subway is to improve traffic efficiency during high passenger flow periods. The problem is that their claims do not constitute objective facts. Before doing a solid empirical investigation, how can we be convinced that the use of this technology in the subway will help improve traffic efficiency? Based on my personal experience at airports and hotels, I can hardly believe this conclusion.

Even with some support from experts, we have reasons to doubt whether the experts' judgments are correct. Because this involves the prediction and evaluation of unknown events, expert judgment is entirely likely to be vulnerable to errors. For example, for many years before the policy allowing Chinese couples to have two children was announced, many demographic experts arrogantly stated that this policy would cause a sharp increase in China’s population. Since the policy was announced, what happened to the actual fertility rate? It’s perfectly obvious to anyone who has eyes.

Taking a step back, even if using facial recognition can really improve traffic efficiency, efficiency itself is not a sufficient basis for implementation. Don't fool the public in the name of efficiency, okay? In terms of efficiency, the absence of a so-called security check on the subway can best improve traffic efficiency during times of high passenger flows.

I don't know if the relevant department has done any basic investigations. Existing security checks on people and items, especially those of people, are useless during both peak and regular periods. Except for wasting taxpayer money, it is really impossible to see what kind of role and significance that these security checks have.

Based on the corresponding reasons, especially considering the potentially enormous dangers and negative effects, I am not only opposed to the use of face recognition technology in subways but also opposed to it use in airports, hotels, and other scenes, where people are forced to undergo facial recognition checks.

Commercial organizations use factors such as small profits or convenience and security as enticements so that people can use face recognition "voluntarily." Due to the problem of insufficient information notification, it is difficult to establish effective user consent, so this use can hardly be said to be legitimate.

Not long ago, I attended a lecture on facial recognition technology. At that lecture, I learned that some Chinese companies have been vigorously developing facial recognition technology in recent years. In order to avoid the attention of the public, these companies even deliberately kept a low profile and successfully realized large-scale promotion of the technology while avoiding becoming a public topic.

Such deliberate efforts make me shudder. While seeking their own interests, have these companies and their corresponding technical personnel never consider what kind of disaster that pushing this technology would bring to society? Do they not know that one day that this may come back to bite them?

Don’t give me the spiel about the neutrality of technology. Facial recognition technology is used wildly to obtain the personal information of ordinary citizens, which is being continuously gathered in the hands of large organizations. Do these companies and technicians who force technology research and promotion dare to say that they have no responsibility themselves? If the world of electric screens actually arrives one day, you are well-deserved heroes; I hope that at that time, there will still be people free to drink the fine wine at the celebration party.

A media industry person who attended that lecture deleted the facial recognition (features) of WeChat and Alipay before she finished listening to the lecture. When talking, she said that she was not afraid that personal information would be used by police, but she was just worried about this data being abused by commercial organizations.

In response, I confessed that as a legal practitioner, especially someone who researched public law, I was never too worried that my personal information was being misused by commercial organizations; because the misuse of my data by commercial organizations, at most, only cost me some money .^[i]

What really gives me concern and fear was that my information is being abused by public authorities; because when they misuse the data, I have no idea what the price would be for myself and my family, property, reputation, occupation, freedom, health, or life. Everything is possible.

In the name of security, for public places like the subway where large numbers of people flow in and out, first it was an item inspection, then a bodily inspection. Now facial recognition is also being pushed. In a few years, will we go further and implement genetic or fingerprint recognition? According to the current trend, this possibility is entirely present. In the near future, perhaps public transportation such as the subway will become a privilege, available to only some members of society.

If this society has not yet fallen into a state of persecution and paranoia, it is time to say enough on security issues. The hysterical pursuit of security has brought to society not security at all, but complete suppression and panic.

In the end, I solemnly recommend that the National People's Congress Standing Committee conduct a fundamental legitimacy review for the Beijing Metro’s measure to employ facial recognition for security screening. At the same time, it should consider initiating corresponding legislative procedures for a legal approach to regulating the arbitrary use of facial recognition technology. ^[j]