Assessing impact of using facial recognition technology

In a previous video I talked about the importance of assessing the impact of technology before adopting it. Today I want to talk to you about the impact of increased use of facial recognition technology. You may have already heard about the use of facial recognition technology to detect the mix of male and female customers at bars. Facial recognition technology is also used to identify people on the street or in a crowd.

Facial recognition is what is known as biometrics, which is identification of people from some features of their body such as fingerprint, iris pattern, or facial characteristics. No matter what biometrics we pick, if you stop and think about it for a moment, you would realize that your fingerprint or facial image does not come with your name stamped on it. Rather, somewhere in a computer system your facial image and your name are linked together. That linkage between your name and your facial image must be correct to begin with and the information must be stored securely.

Additionally, facial recognition systems are not error-free and there is a potential for misidentification.

So, as much as facial recognition is useful, it is not error-free. Therefore, you need some protection when the facial recognition technology misidentifies you as someone else. You need some way of correcting the mistake.

There is also the potential of someone trying to fool a facial recognition system by presenting, for example, a photograph or a video of you as your face. Something has to be done to detect such misuse and not accept a photograph as substitute for a face. It’s not easy to overcome this problem because facial recognition system identifies people from photographs or videos.

This means that if you are using facial recognition technology to identify customers or perhaps suspected criminals, you have to make sure that appropriate security precautions are in place to protect the linkage between a person’s facial image and their identity information and that the information is correct in the first place. You must also provide some sort of recourse when someone is misidentified.

Here's some more information to help you...

You may find my previous videos on technology impact assessment and biometric technology helpful:


NBTMV - On the need to assess impact of technology...

NBTMV on using biometric technologies to identify ...

NBTMV on using biometric technologies to identify people

Biometric technologies use specific features of your body such as fingerprint, facial image, iris pattern, or even the geometry of your hand, to identify you.  Assessing the impact of using biometrics depend on the exact type of use. If your laptop has a fingerprint reader where you swipe your finger to log in, then all we may need to worry about is the possibility that the system somehow could not match your fingerprint with what was previously stored in the system, in which case, there should be some alternate method for logging into the laptop.

On the other hand, if biometric technology such as facial recognition is used to identify a person from among millions in a database, then we have to think about many more things.

For  starters, you know that your fingerprint or facial image or iris pattern do not come with your name stamped on the it, which means that some computer system has to store your identifying information with your biometric features.  That association must be correct when it’s initially stored (meaning that your biometrics are linked to your identifying information) and the information must be securely stored and maintained.

Next, we have to consider the potential of errors in the system that compares and matches your biometric features such as your fingerprint or your facial image with information stored in a database. There is a possibility of misidentification where someone else’s biometric may be identified as yours or vice versa. This means that we need to provide some redress mechanism for anyone who is misidentified. This is especially important if the biometric is being used to look for a criminal, for example, and you are mistakenly tagged as that criminal.

Another potential problem is when someone intentionally tries to fool the system by presenting, for example, a photograph of you as that your facial image.

These are among some of the issues that we need to consider when assessing the impact of using biometric technologies to identify people.

Here's some more information to help you...

In 2002 GAO had published the following report that assesses use of biometric technologies for improving border security:

GAO-03-174, Nov 15, 2002

There are a number of books on biometric technologies as well:

NBTMV - On the need to assess impact of technology before adopting it

It’s important to assess the impact of technology before using it either in a product or for your or your organization’s use (for that matter, for the nation’s use as well).

Let’s start with an example. Suppose you are a cell phone manufacturer and you decide to capture all user actions so that you can “debug” -- fix problems -- when something goes wrong and also improve performance when you see some parts of the system not performing to expectation. Capturing user actions is a perfectly valid approach to this need, but, if you did not inform the users upfront, they’d probably be concerned about privacy and security of the collected information.

As another example, suppose we promote production of ethanol from corn as a fuel and as a way to reduce dependence on fossil fuel. However, corn is also used as food and as cattle feed. What if there is impact on food prices and cattle feed because corn is diverted from these uses to ethanol production.

One way to avoid such problems is to conduct a technology impact analysis (or technology impact assessment) up front. The framework is fairly straightforward. You consider the technology for some intended use. Now, before you adopt the technology, think of all the unintended consequences, which are usually not good. These are foreseen, but uncertain, and, therefore, “risks.” If you think of them up front, you can then take action to either mitigate these risks or decide to accept them.

In the case of the cell phone example, if this was done, the cell phone manufacturer could have foreseen the privacy and security risks and acted beforehand by informing the users about the intended use of the information being captured and letting them opt in, if they so desired.

In summary, it’s important to assess the impact of technology before deciding to incorporate it in a product or adopting it for your or your organization’s use. Proactively doing an impact assessment could save you lots of headaches and, not to mention, potential negative consequences later on.

Here's some more information to help you...

The following book covers similar ideas and may be interesting to check out: