Police release findings from independent expert review of Facial Recognition Technology

An independent review has provided Police with detailed advice on the opportunities and risks associated with the use of Facial Recognition Technology (FRT). 
 
In responding to the review Police has decided it will not use live Facial Recognition technology without further detailed analysis, taking account of legal, privacy and human rights concerns – with a particular focus on the New Zealand context.
 
The independent expert review was conducted by Drs Nessa Lynch and Andrew Chen.  
 
Police is now embarking on a Response Plan based on the 10 recommendations of the review, to ensure the safety and security of police staff and communities is at the forefront of our thinking. 
 
“FRT is a subject that draws strong interest, and sometimes distrust and controversy along with it. However, with this technology’s fast paced development, there are also opportunities for more effective policing. Getting this balance right is imperative, and the review has given us clear guidance on the legal and ethical use of this technology,” says Deputy Chief Executive Mark Evans. 
 
FRT is anything that uses an image of a person’s face, to support identification of that person. The scope of this technology is growing, and ranges from one on one comparison (ie, SmartGate system at the border), to Live Automated FRT – sophisticated camera software which can identify multiple people in large crowds. 
 
As confirmed by the review Police does not currently use live Facial Recognition Technology.
 
“Police will not use live automated FRT until the impact from a security, privacy, legal, and ethical perspective is fully understood. 
 
“Our Response Plan also ensures that Police use of FRT for identification purposes is clear and provides a best practice analysis of those we will use and why,” Mr Evans says.
 
Police’s Response Plan will adopt all 10 recommendations from the review, some of which are already in train.
 
“It is critical that we continue to use technology safely and responsibly, as accuracy and bias are key concerns for FRT. We are committing today to engaging with communities before we make any decisions on the use of Live FRT. 
 
“This puts us in the best position to prepare for any considered future adoption of the technology,” says Mr Evans.
 
 
Notes to Media
 
FRT Response Plan
 
Police has accepted all 10 recommendations in the FRT Review, and further work will need be undertaken to develop robust governance policies and processes to enact the FRT Response Plan. Police will be clear and transparent on this process and steps to delivery. The Response Plan’s 10 actions – Police will:
 
1. Continue to pause any development of Live FRT: 
Police will not deploy any Live FRT and will engage in wider public consultation before any possible change to this position is made. Police will continue to monitor technology developments in this space, to help inform any decisions on future use.
 
2. Review its current collection and retention of facial images:
Police will implement a set of rules for the collection and retention of facial images to be used in FRT systems across varying contexts, including the collection and use of Open Source Intelligence (OSINT) data. Police are already developing new rules for the use of images of children and young persons. This work will encompass the use of FRT. Police will align this with recommendations of the upcoming Independent Police Conduct Authority and Office of Privacy Commissioner reviews into use of facial identification photos taken in public by Police. 
 
3. Continue to strengthen the process for ethical commissioning of technology:
Considerations from the FRT Report will inform new technology proposals under the New Technology Framework. An owner in Police will be identified, who will be accountable for FRT, and new proposals of FRT use will be required to be approved through the New Technology framework process (currently being developed).
 
4. Ensure continuous governance and oversight of deployment:
Police will maintain operational governance oversight, following approval and enactment of any FRT capability. Police will develop a life cycle management system (Algorithm life cycle management, which will form part of the New technology framework), to ensure controls and auditing are maintained, there is no scope creep and systems are fit for purpose.
 
5. Uphold TeTiriti in partnership with Māori:
Police will consult, collaborate, and codesign with Māori academics and community representatives. It will consider research alongside Māori to inform the understanding of weaknesses of FRT systems in the Aotearoa New Zealand context. Police will incorporate the findings of the Understanding Policing Delivery programme into any FRT policy. 
 
6. Uphold transparency:
Police will continue proactive release of its technology capabilities and reports (including Privacy Impact Assessments and partnerships of third party providers). It will provide guidance to the public on when a person may be subject to FRT and form a policy on the use of FRT. Police will look at ways to better understand the collective voice of public perspectives in respect of FRT.
 
7. Develop a policy statement on FRT surveillance in public places:
Police will develop clear policy covering the application of principles which guides Police treatment of public surveillance obtained images in relation to FRT use. This will ensure Police are clearer with the public when Police are allowed to capture an image and when a warrant is needed. This also includes the application of the same principles to online/digital open sources. 
 
8. Implement guidance for access to third party systems:
Going forward, Police will in principle apply the same guidelines and principles when considering the use of third party FRT systems, as Police systems. Police will ensure robust governance, oversight, monitoring and auditing of third party systems to achieve this. Further work will be required to understand the full implications of what this requires.
 
9. Embed a culture of ethical use of data in the organisation:
Police will develop further understanding of data ethics principles and bias across the organisation. This could include through recruit training, scenario examples, embedded messaging at points of access to devices and tools, and online learning.
 
10. Implement a system for ongoing horizon scanning:
Police will identify a list of significant emergent technologies to monitor for appropriate use within Police capabilities. Police will be cognisant that current or future resource capability is able to meet the requirements of ongoing monitoring, development of policy, and technology developments. This will ensure continuing safe and responsible assessment and use of new technology. Police will evaluate that current policies and standard operating procedures are fit for purpose.
 
The full Review report can be found on the Police website here.
 
 
What technologies and considerations does the Response Plan cover?
 
Automated Live FRT
 
Automated Live FRT is a form of live biometric tracking involving the application of software to a live video feed. The system compares a pre-selected watchlist of images to the video feed and electronically alerts when the person’s face is detected. The system can be used from a static camera network or through mobile cameras. Police has not used this technology and earlier assessments into its use have not continued. Police has decided the following:
• Pause any further consideration of developing Live FRT. 
• Deliver a public statement on this stance.
• Engage in wider consultation before there is any change in this position.
• Monitor developments and use to inform decisions on any future use.
 
FRT in security and access
 
Police uses this technology for internal security access purposes into Police systems, buildings and communications systems (similar to many public and private organisations). Police are currently issued smartphones as standard equipment, and some staff may choose to use the Face ID facial recognition function to unlock their phones. This is optional, and Police do not hold the reference images for identity verification. Police will continue to use this technology, though will consider ongoing improvements made through the FRT Response Plan.
 
Identity verification via FRT
 
Identity matching/facial comparison involves the manual loading of an official facial image to a database to verify a person’s identity. This verifies a person’s identity against their driver’s licence, can match a person against a watchlist, and can be used for police line-ups. This type of FRT improves ‘scale and speed’ on existing manual processes of searching image databases individually. Specialist and trained Police will continue to use this technology, though it will be considered in ongoing improvements made through the FRT Response Plan.
 
Retrospective analysis using FRT
 
This technology uses lawfully obtained non-live feed historical information (ie, CCTV video footage) to identify a known person of interest. The technology identifies searchable objects (ie, red cap, blue t-shirt, vehicle registration plate), which can then be investigated further by Police teams. This technology will continue to be used by specialist and trained teams, though it will be considered in ongoing improvements made through the FRT Response Plan.
 
OSINT data sources
 
Open Source Intelligence (OSINT) is information collected from publicly available sources (ie, the internet, social media platforms and news websites). Unlike government databases (ie, for driver’s licenses or passports), there is no verification on authenticity of such images. Therefore, their use risks erroneous image matching and privacy breach issues. A system for using this technology was earlier looked into by Police but not progressed. Police will continue to assess use of this technology in ongoing improvements made through the FRT Response Plan.
 
Access to third party systems
 
Police have access to some external camera systems (ie, CCTV footage) as part of a network with continuous access, or through data being provided by private owners in response to specific incidents. Some of these providers have FRT within their systems, which are not controlled by Police. However, Police use of these systems is restricted to identification using human verification process and evidence support. Police will therefore enact the same guidelines and principles it uses, to any third party system used. Further work on this will occur, including ongoing assessment of this technology in ongoing improvements made through the FRT Response Plan.
 
Counting/Categorisation by demographics or emotions
 
This uses tools to assess head count, emotional state or broader demographics in usually a larger, crowd setting (ie, Police watching a live feed to estimate crowd size and attitude, in order to assess Police response needs). Police have previously trialled a system for counting time spent by people at Police stations, to analyse demand trends and inform capacity planning. While this is not strictly FRT, the impacts of public privacy mean it will be considered within ongoing improvements made through the FRT Response Plan.
 
Combination of multiple FRT capabilities
 
The combination of all FRT methods (or the connected use of two or more of them as a tool) can additionally increase the risk to public privacy. Therefore, the effect of multiple FRT use and tools will also be considered within ongoing improvements made through the FRT Response Plan.