The technology poses serious privacy risks.
Image: Flickr/Daniel Paquet
In November of 2015, the Royal Canadian Mounted Police had a problem.
At the time, the US Federal Bureau of Investigation had been using its massively controversial database of biometric information—photos of people's faces, tattoos, iris scans, and more—at "full operational capacity" for about a year. The RCMP, on the other hand, was stuck with a national fingerprint database that didn't allow officers to scan and search people's faces or other body parts. Canada's federal police force was falling behind its southern counterpart.
The RCMP had "no authority" to support new capabilities for its nationwide Automated Fingerprint Identification System, or AFIS, according to an internal presentation from November 24 of 2015 that Motherboard obtained through an access to information request. Still, the police felt a pressing need to improve "interoperability with international partner systems"—in other words, to make sure their system meshed with what police in other countries were doing—but lacked an opportunity to do so.
Undeterred, the RCMP went ahead and began working to procure a new AFIS system that could analyze and capture faces, fingerprints, palm prints, tattoos, scars, and irises—all without clear authorization or approval by the country's federal privacy watchdog, or even a plan to implement it.
So, yeah, the RCMP is trying to bring biometric identification to Canada without anybody noticing.
"There are significant privacy concerns"
One of the "business drivers" of the RCMP's recent bid to replace its current AFIS with an off-the-shelf product, according to the internal presentation, was to "create procurement options for new requirements," such as facial recognition. In March, the RCMP told Motherboard that the force was seeking a system that would allow them "to implement facial recognition as an option."
A procurement document from last year describing the required capabilities of the new AFIS reads like an outtake from Minority Report.
"The suspect photos will typically be from surveillance videos, Closed-Circuit Television (CCTV), handheld cameras including cell phones, or other non-controlled, poor-quality sources. In many cases, only partial facial images will be showing," the document states. "The [facial recognition capability] will be required to perform a one to one (1:1), and a one to many (1:N) digital facial comparisons."
The system should also be able to analyze tattoos and body marks, it says.
"There are no immediate plans to use facial recognition features," RCMP spokesperson Annie Delisle wrote Motherboard in an email. "The priority for the RCMP is to replace the Automated Fingerprint Identification System. Once the new AFIS is operational, the RCMP may consider the use of facial recognition features."
The documents obtained through an access to information request show that facial recognition is not formally a mandatory requirement for the AFIS, but a successful vendor must still demonstrate that it can provide the capability. This is a subtle and strange distinction that RCMP documents show was a point of confusion for interested vendors. According to the force's response to a vendor's question about the scope of the required biometrics, photos of scars, body marks, and tattoos will be "captured at a later date."
Despite requiring a demonstration from its vendors, the RCMP will not be evaluating the effectiveness of facial recognition technology, Delisle said.
"It is unclear what legal authorization would be required for its deployment"
"That the RCMP is looking at purchasing this kind of capability is in line with what the FBI and other [law enforcement agencies] around the world are doing," said Christopher Parsons, a postdoctoral fellow at Toronto-based surveillance research hub Citizen Lab.
A previously published RCMP document notes that all of the new system's scanners for fingerprints and facial images "must have undergone testing by the FBI and be listed on the FBI Certified Products List."
"However," Parsons continued, "in all of those jurisdictions there are significant privacy concerns, concerns about the general efficacy of the technology, concerns about whether too much data is collected in the first place, and concerns linked to the risks associated with information sharing between departments."
The FBI's biometric database, called the Next Generation Identification (NGI), has been widely criticized by civil rights groups such as the Electronic Frontier Foundation and the American Civil Liberties Union due to the potential for abuse by officers. As numerous incidents in the UK and US have shown, police are sometimes unable to resist the urge to dip into a database of personal information to settle their own very personal scores.
There may be an additional privacy risk in Canada, Parsons wrote, thanks to recent legislation that made it even easier for federal agencies to share information. A January 2016 email sent to S/Sgt. Michael Leben, manager of RCMP latent fingerprint operations in Ottawa, states that the force's new AFIS system is part of a joint venture with Canada Border Services Agency to identify people entering Canada.
The CBSA is currently running a pilot project for facial recognition, cheerily titled Faces on the Move, for which it submitted a required privacy impact assessment to the Office of the Privacy Commissioner, the nation's federal privacy watchdog. The CBSA has no plans to permanently implement the technology, the assessment states, and agency spokesperson Line Guibert-Wolff told Motherboard that tattoos and body marks are not part of the pilot.
"Facial recognition has significant potential for privacy invasion, while it is unclear what legal authorization would be required for its deployment," Tamir Israel, a lawyer for the Canadian Internet Policy and Public Interest Clinic, wrote Motherboard in an email.
"This means that when law enforcement inevitably decides to use the technology," Israel added, "it is unclear whether the legal authorization they will rely on for its deployment will be sufficient to address its potential for invasion and whether sufficient additional safeguards will be put in place."
As for what "authority" the RCMP would need to implement facial recognition and other biometric technologies, Israel suggested that this could refer to approval of the program by the Office of the Privacy Commissioner, which the border agency obtained for its pilot.
According to Delisle of the RCMP, "There is currently no RCMP policy with regards to the use and retention of facial recognition images. In the event a new service requirement is identified in the future, consultation with the Office of the Privacy Commissioner of Canada would first be initiated."
The OPC has not received any privacy impact assessments from the RCMP relating to the use of facial recognition technology, spokesperson Tobi Cohen told Motherboard in an email.
"If the RCMP were to use facial recognition in any capacity, we would expect to receive a [privacy impact assessment] on the program," Cohen wrote. "To date, we have not."
Based on documents obtained through an access to information request, as well as publicly available procurement documents, it is clear that the RCMP is actively seeking the capability to perform biometric analysis—similar to the FBI's controversial use of the technology—without any clear policy or framework for implementing it.
The force seems intent on not advising the country's privacy watchdog until the very last part of the process. And they've had plenty of time; an internal presentation shows that the force planned to award a contract by the end of June 2016. No contract has been awarded.
The RCMP has reversed an old cliché. When Canada's cops really, really want lemonade, they don't wait for life to hand them lemons. They grow them.