8

Background

I am a very junior researcher working at a government research institution that, alongside R&D, hosts lots of educational courses. Due to presence of potentially sensitive data, biometric and other security restrictions are present; most of which are handled by inhouse IT. Recently, there have reliability issues with our security solutions, and until new tenders and contracts were laid out, we were asked to brainstorm some intermediate (preferably cheap) measures. Also of note, the entire campus is under (usually multiple) camera surveillance at all times.


Problem

During discussion, me and a colleague had brought up small-scale facial recognition technology (FRT) as a long term prospect. We were asked if there were open source solution and I suggested OpenFace (by Carnegie Mellon University). Management was very interested and asked IT to deploy it in campus as a separate project and to use it as a way for tracking everyone on campus at all times. I had registered my protest at this being a possible privacy violation at the time, but nobody else seemed concerned.

Later, my colleague was separately informed that she and I were strictly not to inform anyone on campus. She was also told look over the implementation and give recs if necessary.

The problem is, I think FRT can be irresponsible and can be a violation of privacy unless handled very carefully. Even OpenFace's readme makes this very point. None here shares my POV, and I'm kind of at a loss as to what to think. I can bring it up to higher authorities, but I'm very, very junior and don't want to make a mess about something trivial. My initial suggestion had been purely to implement FRT while entering highly sensitive rooms like server racks/satellite control centers/etc.


So, is it ethical to implement such wide-spread face recognition, possibly violating privacy, without informing users? If not, what can I do about it?


PS

Also, I'm in India, if that helps. And I know that there are no strictly legal objections.

  • 2
    Quite apart from any ethical issues, a small initial rollout seems eminently reasonable. It seems highly likely that whatever "reliability issues" affect the existing biometric security measures would impact facial recognition. And it is much easier as a practical matter to work through those initial issues with a small-scale deployment. That would also let you assess what privacy implications there would be for a wider scale deployment. – Justin Cave Oct 19 '15 at 5:44
  • 1
    There are privacy concerns and there are legal privacy concerns. Does India codify individuals' right to privacy in law? If the issue ends up only being an ethical one, with no legal worries, then it is a personal (your) ethical dilemma and one you would have to work out on your own (do you continue to work there). – CGCampbell Oct 19 '15 at 11:35
  • 2
    "If [it's not ethical], what can I do about it?" Discussion here seems to focus on whether this specific thing is legal or ethical or not. But the "what can I do about it" part of the question is probably more important to you. Suppose you eventually conclude that it is definitely unethical. Unfortunately, your options in this case probably come down to either (1) find a new job, or (2) squint your eyes at the problem and convince yourself that it's hunky-dory. – Brandin Oct 19 '15 at 13:01
  • 1
    Putting aside ethics for a moment... the first question should be whether or not your organization NEEDS this type of monitoring. Something like this is NOT a commercial off-the-shelf system which just needs to be turned on and used. It requires a lot of organizational effort. Going from recorded video to face-recognition is a HUGE step up in cost. No use wasting time arguing about ethics if the thing isn't even needed. – teego1967 Oct 19 '15 at 15:09
  • 1
    Ethics aside, I would hazard that reliability of facial recognition would be lower (in every day use, i.e., out side a lab setting) would be just as bad / worse than you current measures. So would not be a practical solution. I would expect a lot of false positives and negatives, which means you could not trust it to be a useful security tool. – DarcyThomas May 13 '16 at 2:20
7

If I understand you correctly, the new thing would be that you build a database of everyones movement across the campus. This is different from having CCTV or guards in place, as previously the data of who is at which place and what time was not aggregated this way before.

Here's the ethical concerns I see:

  • It does not seem to solve the problem: Presumably, the sensitive information is 'present' in some rooms on some machines etc. You need to stop people from getting where they are not supposed to be. Why is knowing that X went from room 1 to room 2 along hallway 3 and taking a bathroom break along the way a solution to your problem

  • Data tends to get used. Even if there are no concrete ideas what to do with all the data on who moves where now, there will be. This needs careful consideration. Maybe they'll skim this data for people who spend 'too much' time smoking or on the toilet. You know more about your campus, give this some thought.

  • They want to keep it secret. Did everyone on the campus consent to have all their movements logged? In all likelhood not, so this is clearly unethical, even if legal.

  • Thank you! You've formalised my concerns far better than I could have. – RaunakS Oct 19 '15 at 9:23
6

I don't see why it would be unethical, people are already on camera, this is just manipulation of existing data. It's benefits in terms of security are easy to identify. I don't see any basic difference than having security personnel watching the camera views which is commonplace in many businesses.

  • 1
    I see. My colleague basically said the same as you; my issue was mostly to with tracking people on campus without their permission. If, as you say, this is commonplace then I suppose my concerns are without merit. – RaunakS Oct 18 '15 at 23:00
  • 4
    @RaunakS The campus belongs to them. Why would they need permission? – paparazzo Oct 18 '15 at 23:08
  • 7
    I don't think it's that cut and dried. I would suggest talking to your campus's ethics committee, who can far better answer your question than the Internet. – Jane S Oct 18 '15 at 23:49
  • 1
    @JaneS We do not have an ethics committee, or a body resembling such. We do have unions; but I'm leery of approaching them as they can be ... ... politically motivated. – RaunakS Oct 19 '15 at 0:06
  • 1
    probably best not to bring yourself to the Unions attention in my opinion – Kilisi Oct 19 '15 at 0:48
4

Whether something is ethical or not is always also based on the culture you are in. As I don't know the culture in India, I can only tell you the culture in Germany.

For a data collection to be ethical, it must follow some core requirements:

  1. Appropriation
    It must be known what the data is used for and what the point of the data collection is. As far as I can tell, this requirement is not fulfilled. How this face tracking data is going to be used and what the purpose is, is unknown.

  2. Reduction
    The data you collect must be limited to the amount that is necessary to fulfill the purpose and there is no data already available somewhere that you can re-use. For example, if there is an incident and the existing camera footage shows the face of the person, why do you need to identify all other persons that have nothing to do with the incident? It would be sufficient to let the face recognition software run on the few seconds of the incident and maybe a few minutes before to identify witnesses. But that's it.

  3. Necessity
    The data you collect and the way you collect it, must be necessary. It must be in proportion to the desired purpose. For example, to measure how much time a student spends on the toilet, you do not need a camera in the stall, although it would work; but there are other less intrusive methods to measure time, so the camera footage is not necessary.

  • I am trying to write down my thoughts and objections to appeal to HR and your points helps clarify some things. Thank you! – RaunakS Oct 19 '15 at 15:03
2

If the data from the face recognition detectors are sent outside the campus, then the issue needs to be discussed upon. Both with the people inside the campus, the management and the ethics committee of your institute; as the privacy of people is at stake here.

But, if the data remains in-house, and used just for surveillance by the in-house guards, etc; then I don't see any difference between the existing technology and the present one, in terms of privacy intrusion. So, if this is the case, you can go ahead and implement it.

  • Initial plans are to keep presence and movement data on local servers unless there is some security concern, in which case all relevant info will be sent to head office. – RaunakS Oct 19 '15 at 9:27
  • Then, I don't see any reason why it shouldn't be used. – Dawny33 Oct 19 '15 at 9:59
  • Glad to be of help. If you found it helpful, then please upvote and accept, so that it can help people with similar problems. – Dawny33 Oct 19 '15 at 10:03
2

Here's the quote from OpenFace:

We do not support the use of this project in applications that violate privacy and security. We are using this to help cognitively impaired users to sense and understand the world around them.

The issue isn't that the project ITSELF violates people's privacy, but how it is used. You can use camera for perfectly legal and respectable purposes, and obviously NOT legal and invasive purposes.

I believe one way to use it that violates privacy is to use it to scan data on the internet, grab the embarrassing photos of a particular person, and use this data to attack them.

HOWEVER! Your superiors are thinking about something that causes them to tell you not to tell anyone. If their purpose is simply security, why were they unable to provide the arguments presented on SE by complete strangers? We do not have access to what your superiors are thinking, but it may be useful to tread with care and protect yourself from anything illegal. Get written specifications as to what it is for, and get legal sign-off on them. You don't want to position yourself as a scapegoat.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.