The Perpetual Line-up

On September 17, 2016, a week after the 15^th anniversary of the September 11^th attacks, New Jersey and the New York City region were shaken by two bombings and gripped with the fear of more to come. A suspect, Ahmad Khan Rahami, was apprehended just two days after the initial attack in Seaside Park, New Jersey. In the press, news emerged that a powerful technology had been used in the investigation: face recognition.297

It is unclear if face recognition actually helped investigators find Rahami.298 But the attacks in New York and New Jersey raise an urgent question: In regulating law enforcement use of face recognition, will we blunt our ability to respond quickly and effectively to threats to our safety?

We believe that the answer to this question is clearly “no.” A core conclusion of this report is that deployments of face recognition are diverse and differentiable. Face recognition can and should be used to respond to serious crimes and public emergencies. It should not be used to scan the face of any person, at any time, for any crime. The regulatory scheme that we propose will allow communities to enforce that difference.

Face recognition is not a monolith. Certain uses of the technology present fewer risks and conform to longstanding police practice. But as face recognition advances, it creates profound questions about the future of our society.

Are we comfortable with a world where face recognition is used to identify someone who police officers have legally stopped or arrested, or where it is used, in emergencies, to locate violent criminal suspects and terrorists? Perhaps.

Are we comfortable with a world where anyone with a driver’s license is automatically enrolled in a virtual, perpetual line-up? Are we comfortable with a world where the government can find anyone, at any time, by scanning the faces of people on the sidewalk? Are we comfortable with a world where this technology is less accurate on African Americans, yet more likely to be used to try to identify them?

• 297. See Shanika Gunaratna, The tech that went into catching the NY, NJ bombing suspect, CBS News (Sept. 19, 2016), http://www.cbsnews.com/news/tech-that-went-intro-catching-nj-nj-bomb-suspect/; Anthony M. DeStefano, How bomb suspect Ahmad Khan Rahami was caught in just 50 hours, Newsday (Sept. 19, 2016), http://www.newsday.com/news/new-york/how-bomb-suspect-ahmad-khan-rahami-was-caught-in-just-50-hours-1.12339972.
• 298. See Shanika Gunaratna, The tech that went into catching the NY, NJ bombing suspect, CBS News (Sept. 19, 2016), http://www.cbsnews.com/news/tech-that-went-intro-catching-nj-nj-bomb-suspect/ (“It’s still unclear to what extent officials used automated facial recognition technology”); Anthony M. DeStefano, How bomb suspect Ahmad Khan Rahami was caught in just 50 hours, Newsday (Sept. 19, 2016), http://www.newsday.com/news/new-york/how-bomb-suspect-ahmad-khan-rahami-was-caught-in-just-50-hours-1.12339972 (“NYPD investigators tried to use facial recognition software to identify Rahami, but the images of him captured on surveillance cameras around the bombing sites were either too grainy or didn’t show his face at the proper angle”).

Technology will not wait for us to answer these questions. Neither will law enforcement. Yet state legislatures and Congress have not passed a single law to comprehensively regulate police use of face recognition—and the Supreme Court has never formally recognized a right to privacy in public. With little to guide them, most—though not all—police departments have not taken adequate steps to rein in this surveillance technology.

In a rapidly evolving world, technology often outpaces privacy law. It is time for privacy law to catch up. Achieving this will require the action of all stakeholders. Privacy protections will not succeed if they are imposed unilaterally without the involvement of law enforcement, face recognition experts, and community leaders. It is time to enact 21^st Century privacy protections for a 21^st Century surveillance technology.