Facial recognition software's privacy concerns

Odds are that a database on some server somewhere in the world contains your "faceprint": a digital representation of the shapes and spacings that make your mug yours.

It's likely as unique as a fingerprint and probably far more valuable to companies and the government, both of which are investing heavily in technologies to match faces to identities.

There are obviously useful applications, like automatically tagging your buddies in a social-network photo or - on an entirely different scale - recognizing known terrorists at airports. But there are frightening ones as well: allowing authoritarian states to identify peaceful protesters, enabling companies to accrue ever greater insight into private lives or empowering criminals to dig up sensitive information about strangers.

"Facial recognition blows up assumptions that we don't wear our identities on our person; it turns our faces into name tags," said Ryan Calo, director of privacy at Stanford's Center for Internet and Society. "It can be good and helpful, or it can be dangerous."

At a minimum, the technology demands a serious policy debate over the appropriate ground rules for this tool. But, of course, government officials are still grappling with online privacy questions from a decade ago, as private industry and law enforcement happily march ahead.

Just this week, Facebook officially acquired the facial recognition service Face.com, with reports putting the price tag at $55 million to $100 million. The Menlo Park social network has long licensed the technology to allow users to easily tag their friends in photos, but now presumably has greater power to leverage the tool in new ways.

In October, the technology and government publication Nextgov reported the FBI was building a nationwide facial recognition service, beginning with pilot tests this year in Michigan, Washington, Florida and North Carolina. It's one piece of a broader, $1 billion initiative to bulk up the bureau's fingerprint database with other biometric markers, including iris scans and voice recordings.

Facial recognition technology has been around for three decades. But the mobile and social revolutions are rapidly driving the field forward, as digital photos proliferate, cloud computing powers accelerate and software capabilities advance.

The more tagged photos there are of any given person - in different lighting conditions and from different angles - the more accurate the results become. In May, Face.com said it had scanned more than 41 billion photos, which could be combined with Facebook's own massive collection. Last year, the company said it had 100 billion images on file, with users adding more than 100 million tags per day.

Tech giants including Google, Apple, Microsoft and Yahoo also employ facial recognition technology in photo, video and gaming products, as do a handful of lesser known mobile app companies.

To their credit, most of these businesses allow users to turn off facial recognition features (Apple's iPhoto being a notable exception). Facebook enables users to prevent friends from tagging their photos and allows them to apply facial recognition only to people within their network.

Privacy settings

Still, the fact that facial recognition is on by default - and few people alter their privacy settings - means these online companies can gather additional information and insights. Making it easier to tag photos means users are more likely to do it, creating additional data points about activities and relationships. That comes on top of what consumers are already revealing about their likes, dislikes and routines in social networks and search engines.

"Once you combine all that data with facial recognition data, it just makes the honey pot of data more appealing to marketers and to companies - and more intrusive to consumers," said Jennifer Lynch, staff attorney at the Electronic Frontier Foundation.

Researchers also have demonstrated that the photo data on Facebook can be leveraged in ways the company never intended. In a report last summer, academics at Carnegie Mellon University said they were able to derive the identity of students on campus from photos more than 30 percent of the time, using off-the-shelf facial recognition software and publicly accessible Facebook data. Even with basic privacy settings on, a Facebook user's name, profile photo and interests often are readily available.

Through similar techniques, the researchers were often able to discover the real names of supposedly pseudonymous users of a popular online dating service.

More troubling still, in some cases they were able to accurately guess the first five numbers of students' Social Security numbers. They employed an algorithm previously developed at the university that can frequently predict the figure within a narrow range, using information like a person's date and state of birth.

"Knowledge of the first five digits of a target victim is sufficient for effective, brute force identity-theft attacks," the report said.

Plenty of data

That underscores mouthwatering possibilities for criminals, but it was merely one example of what could be accomplished, said Alessandro Acquisti, associate professor at Carnegie Mellon and the principal author of the study.

"If you start combining all these public databases together, you can end up with very sensitive information just from a face," he said.

That will only become easier over time, as the technology gets cheaper, more accessible and increasingly accurate.

All of which gets us back to the question: What's the appropriate policy response? Are there common-sense laws or regulations that should govern this technology?

Each application might demand different responses, and none of them will be straightforward, researchers say. The trick will be to protect the benefits of the technology, while minimizing the risks.

When it comes to social networks, "The best solution is to make data practices more transparent and to empower users to switch to different networks," said Yana Welinder, an academic fellow at Harvard Law School who wrote a recent paper on Facebook's facial recognition practices.

Acquisti raised the possibility of allowing consumers a "Do Not Identify" preference, much like the "Do Not Track" option for Web browsers now being fiercely debated by industry and privacy advocates. But he says those long-running negotiations will pale next to the complex legal questions posed by facial recognition.

"I do feel concerned about it, but I do not have a good answer," he said. "The genie is out of the bottle."