The Perpetual Line-up

A. Records request survey of law enforcement agencies.

We submitted an initial 106 public records requests to state and local law enforcement agencies across the country.299 We selected agencies that met at least one of two criteria:

1. Agencies we could identify as having piloted or implemented face recognition. We identified these agencies from news articles, vendor or agency press releases and annual reports, or other publicly available sources discussing the implementation of face recognition for law enforcement purposes.
2. The 50 largest law enforcement agencies in the country, by force size.

Each records request asked for any policies, manuals, or procedure documents the agency had created or received; audit reports; training manuals and technical specifications; contracting and financial documents; and any memoranda of understanding or other agreements pertaining to face recognition. In total, we received substantive responses from 90 agencies, and over 15,000 pages of responsive records. A list of the agencies we surveyed, grouped by type of response received, and a template of the records request, can be found in this section.

Following up on our records request, we conducted over a dozen phone interviews with agency officials about their current or former use of face recognition. We also conducted site visits and more extensive in-person interviews with two agencies, the Michigan State Police and the Pinellas County Sheriff’s Office. In the interest of obtaining candid answers, some of the interviews with engineers and vendor companies were conducted on the condition of anonymity.

All City and State Backgrounders were sent in draft form to the respective agencies in advance of publication, with an invitation to submit edits if needed. We have incorporated the relevant information that was provided to us in response to these drafts into our Face Recognition Scorecard.

B. Face recognition technology research and literature review.

To complement our records request survey and to gain an understanding of the state of face recognition technology today, we conducted interviews with researchers both in academia and government who worked on: (1) the application of face recognition to law enforcement; (2) issues surrounding biases in accuracy rates across race; and (3) the role of trained human review of face recognition results. We also spoke with technologists and representatives from two of the leading companies that provide face recognition algorithms to law enforcement about their approach to testing and compensating for accuracy biases. Additionally, we conducted an in-depth review of the existing technical literature on face recognition, focusing particularly on research addressing the presence of bias in the accuracy rates of face recognition algorithms.

C. Fifty-state legal survey of biometrics laws.

We conducted a fifty-state survey of laws that may govern or inform the use of face recognition by law enforcement, or, for comparison, state laws that govern the use of other tracking or surveillance technology. This survey answered the following questions:

1. Does the state have any non-fingerprint biometrics law that would control law enforcement use of face recognition?
2. Does the state have a law that either allows or restricts law enforcement use of or access to photographs from driver’s license records?
3. Does the state have a “stop-and-identify” law?
4. Has the state passed a law regulating law enforcement use of geolocation tracking?
5. Has the state passed a law regulating the use of drones?
6. Has the state passed a law regulating the use of automated license plate readers (ALPRs)?

D. The Face Recognition Scorecard.

We evaluated each agency on seven criteria. We scored all agencies that (1) owned a face recognition system and provided us with responsive documents, as well as (2) the agencies that access the FBI’s face recognition database, the Next Generation Identification Interstate Photo System, and (3) the FBI face recognition unit (FACE Services). There is overlap between the first two categories. Entries are greyed out where we did not have sufficient information to evaluate the agency on that criterion.

People in the Database. Who is enrolled in the face recognition database or network of databases available to the law enforcement agency?

• + Mug shots of individuals arrested, with enrollment limited based on the underlying offense, and/or with mug shots affirmatively “scrubbed” by police to eliminate no-charge arrests or not-guilty verdicts.
• o Mug shots of individuals arrested, with no limits or rules to limit which mug shots are enrolled, or where mug shots are removed only after the individual applies for, and is granted, expungement.
• - Driver’s license photos in addition to mug shots of individuals arrested.

Real-Time Video Surveillance. How has the agency addressed the risks of real-time or historical video surveillance?

• + Written policy (1) prohibiting the use of face recognition for real-time video or historical video surveillance, or (2) that restricts its use only to life-threatening public emergencies and requires a warrant. 
• o No written policy addressing real-time or historical video surveillance, but agency has affirmatively stated that it does not use face recognition in this manner.
• - Agency has deployed, purchased, or indicated a written interest in purchasing face recognition for real-time or historical video surveillance but has not developed a written policy or affirmatively disclaimed these practices.

4th Amendment. What legal standard does the agency require prior to a face recognition search? This is a bifurcated standard. If the agency uses face recognition on databases that include only mug shots, earning it a “green” or “yellow” in the first column (People in Database), the first standard is used. If the agency uses face recognition on databases that include driver’s license photos, earning it a “red” in the first column, the second standard is used.

Targeted database—mug shots only.

• + Reasonable suspicion for the person to be searched, and at least one of the following: (1) searches are limited to suspects and victims of crimes; and (2) Investigate and Identify searches are limited to felonies only.
• o Reasonable suspicion for the person to be searched but the standard has exceptions or allows for searches for bystanders or witnesses as well.
• - No legal standard stated, or a statement that face recognition may be used for any “law enforcement” or “criminal justice” purpose.

Dragnet database—license and ID photos.

• + (1) Searches are limited to investigations of serious offenses and require a warrant or court order supported by probable cause; or (2) searches are limited to identity-related crimes.  
• o Probable cause or searches are limited to investigations of serious offenses (for non-identity related crimes).
• - Anything less than probable cause (for non-identity related crimes).

Free Speech. Has the agency considered and taken steps to limit the use of face recognition in a way that would pose risks to free speech, assembly, and association?

• + Express statement in a face recognition use policy prohibiting the use of face recognition to target or collect information on individuals on the basis of their race, religion, or other bases that may stifle speech.
• o (1) A statement in a face recognition use policy prohibiting the use of face recognition in violation of state or federal law, including the First Amendment; or (2) a statement in a general operating policy or police manual prohibiting the targeting or collection of information on individuals on the basis of their race, religion, or other bases that may stifle speech.
• - No statements outlined in either section above.

Accuracy. How has the agency built safeguards against errors into their face recognition program?

• + Agency demonstrates four or five criteria listed below.
• o Agency demonstrates three of the criteria.
• - Agency demonstrates two or fewer of the criteria.

The criteria are:

• Algorithms have been tested by the National Institute of Standards and Technology;
• Contract with vendor company contains provisions that require face recognition algorithms to have been tested for accuracy and will be tested at all future opportunities;
• Most or all face recognition queries are validated by trained human examiners or agencies have a unit or designated personnel that perform a review and screening function of the candidate lists (weighted as two criteria);
• Face recognition results or candidate lists are treated as investigative leads only.

Public Transparency. Has the agency publicly posted its face recognition use policy, and has it been reviewed or approved by a legislature or privacy and civil liberties groups?

• + Agency has a public face recognition use policy that has been reviewed or approved by a legislature and/or privacy and civil liberties groups.
• o Agency has a public use policy, but there is no evidence the policy received external review or approval.
• - Agency has not made its use policy public, or has no use policy.

Internal Audits. Does the agency monitor and conduct audits of face recognition use by its officers and other accessing agencies? (Since our records request specifically asked for records pertaining to audits, when an agency did not provide audit records or sample audit forms and did not deny this request, it was assumed that no audits were conducted.)

• + Formal audit procedure is in place and there is evidence that audits are indeed conducted.
• o Audit procedure in place but it is unclear if audits are conducted.
• - No audit procedure in place and/or no audits are conducted.

E. Agencies Surveyed Grouped by Response

Currently use or have acquired face recognition

Formerly used or acquired face recognition

Planned future use of face recognition

Dallas Area Rapid Transit Police

No responsive records—agency stated it does not use face recognition

No responsive records—response did not indicate whether other not agency uses face recognition

Complete denial of records request; appeal pending

New York City Police Department

No response to records request

Baltimore County Police Department

Brockton Police Department

Broward County Sheriff’s Department

Cleveland Police Department

Essex County Police Department

Indianapolis Metro Police

Massachusetts Department of Public Safety

Miami-Dade County Sheriff

Mississippi Department of Public Safety

New Mexico Department of Public Safety

Newark Police Department

Raleigh Police Department

Salt Lake City Police

Saint Louis County Police Department

Suffolk County Police

F. Records Request Template

[Date]
[Agency Address]

Re.:      Public Records Request—Facial Recognition Technology

Dear Public Records Officer:

The Center on Privacy & Technology, a think tank based at the Georgetown University Law Center, is conducting a survey of law enforcement agencies’ use of facial recognition technology (FRT). This is part of a project examining the benefits and possible risks of FRT in policing.

Pursuant to [State Records Request Law and citation], we request the following records pertaining to FRT. We intend this request to cover all software, hardware, databases and other technology used in FRT systems. However, we realize the following list of records is long, and not all records will be relevant or available. Therefore if it would be helpful, we welcome a phone conversation to narrow this request up front.

Records Requested

Please provide copies of the following records:

• Any manuals, policies, procedures and practices the agency follows for using the FRT system or requesting a FRT search from another party. This request includes, but is not limited to:
  • Procedures for using, deleting or retaining probe photos (photos of subjects being identified);
  • Sources of probe photos, such as mobile devices, body cameras or surveillance videos;
  • Procedures the agency follows after a positive match, such as requiring independent or in-person verification;
  • Permitted uses of the information created from a system match.
• Any manuals, policies, procedures and practices the agency follows for inputting photos and other information or migrating photo databases into the FRT system. This could be a list of sources for photos and other information (e.g., mug shot photos, driver’s license records, or prior probe photos).
• Any audits of the FRT system, including but not limited to: audits of the system, misuse reports, and reports to oversight bodies.
• The legal standard, if any, (e.g., probable cause, court order, relevance, consent) that is required before using the FRT system.
• Warrant applications for facial recognition searches, or judicial decisions and orders in the agency’s possession governing the agency’s use of the FRT system or requests to obtain a facial recognition search.
• Purchasing and procurement documents, including but not limited to: purchase orders, RFPs, responses to RFPs, invoices, and contracts for FRT hardware, software, and services.
• Any materials for training law enforcement and other personnel on using and maintaining the FRT system, including training manuals for mobile devices or other FRT hardware.
• Any manuals from the companies providing FRT system components, including but not limited to any technical specifications they have provided.
• Memoranda of Understanding (MOUs) or agreements with other state or local agencies—such as the Dep’t of Motor Vehicles or a municipal agency—on the use of, or requests to search, their FRT systems. Records of the requests made, including but not limited to: the number of requests made and the number granted.
• MOUs or agreements with federal, state or local law enforcement agencies on the use or sharing of FRT systems, and the results from those systems, including but not limited to: the number of requests made and the number granted.

This request is made on behalf of a not-for-profit organization whose mission is to advance the field of privacy and technology policy and to train law students from around the county in this field. Because of our not-for-profit status and the fact that this request is about a matter in the public interest, we request a fee waiver. If such a waiver is denied, please inform us in advance if the cost will be greater than $50.

According to [State Records Request Law], a custodian of public records shall comply with a request [within X business days of receipt / timeframe specified in the law]. Please furnish all responsive documents to Clare Garvie at cag104@law.georgetown.edu or:

Center on Privacy & Technology
McDonough Hall 444
600 New Jersey Ave, NW
Washington DC 20001

If you have any questions or want to discuss narrowing this request, please contact me at cag104@law.georgetown.edu or 202-661-6707 within the above timeframe. Thank you for your prompt attention to this matter.

Sincerely,
Clare Garvie  

• 299. As of October 14, 2016, we have submitted an additional 29 records requests to state agencies not surveyed in the first round of records requests.