Privacy

Facial recognition is a threat to privacy, racial justice, free expression, and information security. EFF supports strict restrictions on face recognition use by private companies, and total bans on government use of the technology. Face recognition in all of its forms, including face scanning and real-time tracking, pose threats to civil liberties and individual privacy. “False positive” error rates are significantly higher for women, children, and people of color, meaning face recognition has an unfair discriminatory impact. Coupled with the fact that cameras are over-deployed in neighborhoods with immigrants and people of color, spying technologies like face surveillance serve to amplify existing disparities in the criminal justice system.

Across the nation local communities from San Francisco to Boston have moved to ban government use of facial recognition. In New York, Electronic Frontier Alliance member Surveillance Technology Oversight Project (S.T.O.P.) is at the forefront of this movement. Recently we got the chance to speak with them about their efforts and what people can do to help advance the cause. S.T.O.P. is a New York-based civil rights and privacy organization that does research, advocacy, and litigation around issues of surveillance technology abuse.

What does “Ban The Scan” mean? 

When we say scan, we are referring to the “face scan” component of facial recognition technology. Surveillance, and more specifically facial recognition, disproportionately targets Black, Brown, Indigenous, and immigrant communities, amplifying the discrimination that has defined New York’s policing for as long as our state has had police. Facial recognition is notoriously biased and often abused by law enforcement. It is a threat to free speech, freedom of association, and other civil liberties. Ban the Scan is a campaign and coalition built around passing two packages of bills that would ban facial recognition in a variety of contexts in New York City and New York State. 

Are there any differences with the State vs City version?

The City and State packages are largely similar. The main differences are that the State package contains a bill banning law enforcement use of facial recognition, whereas the City package has a bill that bans all government use of the technology (although this bill has yet to be introduced). The State package also contains an additional bill banning facial recognition use in schools, which would codify an existing regulatory ban that currently applies to schools.

What hurdles exist to its passage? 

 For the New York State package, the coalition is newly coming together, so we are still gathering support from legislators and the public. For the City package, we are lucky to have a lot of support already, and we are waiting to have a hearing conducted on the residential ban bills and move them into the next phase of legislation. We are also working to get the bill banning government use introduced at the City level.

What can people do to help this good legislation? How to get involved? 

We recently launched a campaign website for both City and State packages (banthescan.org). If you’re a New York City or State resident, you can look up your legislators (links below!) and contact them to ask them to support these bills or thank them for their support if they are already signed on. We also have social media toolkits with graphics and guidance on how to help spread the word!  

Find your NYS Assemblymember: https://nyassembly.gov/mem/search/ 

Find your NYS Senator: https://www.nysenate.gov/find-my-senator 

Find your NYC Councilmember: https://council.nyc.gov/map-widget/  

Our faces are often exposed and, unlike passwords or pin numbers, cannot be remade. Governments and businesses, often working in partnership, are increasingly using our faces to track our whereabouts, activities, and associations. This is why EFF recently submitted comments to the U.S. Commission on Civil Rights, which is preparing a report on face recognition technology (FRT).   

In our submission, we reiterated our stance that there should be a ban on governmental use of FRT and strict regulations on private use because it: (1) is not reliable enough to be used in determinations affecting constitutional and statutory rights or social benefits; (2) is a menace to social justice as its errors are far more pronounced when applied to people of color, members of the LGBTQ+ community, and other marginalized groups; (3) threatens privacy rights; (4) chills and deters expression; and (5) creates information security risks.

Despite these grave concerns, FRT is being used by the government and law enforcement agencies with increasing frequency, and sometimes with devastating effects. At least one Black woman and five Black men have been wrongfully arrested due to misidentification by FRT: Porcha Woodruff, Michael Oliver, Nijeer Parks, Randal Reid, Alonzo Sawyer, and Robert Williams. And Harvey Murphy Jr., a white man, was wrongfully arrested due to FRT misidentification, and then sexually assaulted while in jail.

Even if FRT was accurate, or at least equally inaccurate across demographics, it would still severely impact our privacy and security. We cannot change our face, and we expose it to the mass surveillance networks already in place every day we go out in public. But doing that should not be license for the government or private entities to make imprints of our face and retain that data, especially when that data may be breached by hostile actors.

The government should ban its own use of FRT, and strictly limit private use, to protect us from the threats posed by FRT. 

We could go on for days talking about all the work EFF does to ensure that technology supports freedom, justice, and innovation for all people of the world. In fact, we DO go on for days talking about it — but we’d rather hear from you. 

What does EFF mean to you? We’d love to know why you support us, how you see our mission, or what issue or area we address that affects your life the most. It’ll help us make sure we keep on being the EFF you want us to be.

So if you’re willing to go on the record, please send us a few sentences, along with your first name and current city of residence, to testimonials@eff.org; we’ll pick some every now and then to share with the world here on our blog, in our emails, and on our social media.

De Autoriteit Persoonsgegevens (AP) heeft trends en ontwikkelingen op het gebied van privacy in kaart gebracht die spelen binnen de arbeidsmarkt en de sociale zekerheid. De AP ziet een aantal grote risico’s, onder meer door algoritmes en artificiële intelligentie (AI).

Hostingbedrijf Leaseweb weigert na een cyberaanval openheid van zaken te geven aan de Autoriteit Persoonsgegevens, las ik bij NRC. Dit als vervolg op een datalekmelding augustus vorigjaar, Het Nederlandse Leaseweb deed eind augustus melding van een datalek bij de AP, als gevolg van een cyberaanval. Dat moet, en je moet dan ook openheid geven van de wet. Dus wat is hier aan de hand?

De zaak kwam aan het licht door een vonnis waarin de rechtbank Midden-Nederland de toezichthouder terugfluit: die had een onderzoeksrapport niet bij de externe deskundige moeten vorderen maar bij Leaseweb zelf. Dat is een beetje een zijsprong, dus laten we even terug naar de basis.

Eind augustus meldde Leaseweb bij een aantal klanten geraakt te zijn door een cyberaanval. Zoals Techzine destijds meldde: Een cyberaanval bij het Nederlandse Leaseweb veroorzaakte een storing in de infrastructuur van het bedrijf. Slechts enkele klanten die gebruikmaken van de cloudhosting-oplossingen van het bedrijf, konden daar last van ondervinden. Om de gevolgen van de aanval zo klein mogelijk te houden, haalde Leaseweb vervolgens kritieke infrastructuur offline. Voor het daarop volgende onderzoek werkte men “nauw samen met een gerespecteerd cyberbeveiligings- en forensisch bedrijf”. En hoewel er naar eigen zeggen “geen ongeoorloofde activiteiten” waren aangetroffen, deed men toch een melding van een datalek. Bij zo’n melding moet je ook opnemen wat je gaat doen om het probleem op te lossen en eventuele nadelige gevolgen te beperken. Dat was dus onder meer dat onderzoek door cybersecuritybedrijf Northwave.

De AP is als toezichthouder bevoegd om “alle voor de uitvoering van haar taken vereiste informatie” op te vorderen (art. 58 AVG en 5:16 Awb). Onder die bevoegdheid eiste men het volledige rapport, omdat Leaseweb dit niet vrijwillig wilde overleggen. In reactie stuurde Leaseweb nog een bijlage, maar meende toen alles te hebben gestuurd. De AP vermoedde van niet, en dan krijg je dit: Bij brief van 2 november 2023 stuurt de AP de hostingprovider een rappel en deelt daarin mee dat als de hostingprovider blijft weigeren de gevorderde stukken te verstrekken er rekening mee gehouden dient te worden dat medewerking zal worden afgedwongen met een last onder dwangsom en/of een bezoek van toezichthouders van de AP aan het hoofdkantoor van de hostingprovider. Verder wordt meegedeeld dat het weigeren medewerking te verlenen een strafbare gedraging is waarvoor op zichzelf een boete kan worden opgelegd. De hostingprovider deelt hierop mee dat de brief van 10 oktober 2023 het volledige onderzoeksrapport en executive summary bevat en dat zij met het verstrekken hiervan aan haar medewerkingsverplichting heeft voldaan. “U heeft niet alles gestuurd.” “Welles!” “Nietes, nu sturen of dwangsom en boete.” “Welles!” En wat moet je dan?

De gedachte van de AP was om dan naar Northwave te gaan. Als die dan meer overleggen dan Leaseweb, dan heb je allereerst dus het complete rapport en ten tweede het bewijs dat Leaseweb te weinig had overlegd.

In principe kan dat: art. 5:20 Awb stelt dat Een ieder is verplicht aan een toezichthouder binnen de door hem gestelde redelijke termijn alle medewerking te verlenen die deze redelijkerwijs kan vorderen bij de uitoefening van zijn bevoegdheden. “Iedereen” en “alles”, dus niet “alleen wie mogelijk een wet schendt” en “datgene wat ze zelf relevant vinden”. Dus in theorie kan de AP inderdaad bij een ingeschakeld expertbureau alle stukken vorderen die bij zo’n rapport horen. Maar er zit wel een redelijkerwijstoets, en dat is waar het hier op strandde: Zo lang niet vaststaat dat de hostingprovider bij een opgelegde last onder dwangsom niet wil meewerken aan de inlichtingenverplichting die zij heeft, vindt de voorzieningenrechter het voor de vervulling van de taak van de AP redelijkerwijs niet noodzakelijk om inlichtingen bij verzoekster te vorderen. Van belang hierbij is dat de AP weet waar het datalek heeft plaatsgevonden en op grond van de mededelingen van de hostingprovider weet heeft van de aanwezigheid van een onderzoeksrapport. De AP staat een ander minder ingrijpend middel ten aanzien van verzoekster ter beschikking, zodat het subsidiariteitsbeginsel zich thans ertegen verzet dat de AP zich met een inlichtingenvordering en een last onder dwangsom wendt tot verzoekster in plaats van tot de hostingprovider. De AP had dus eerst de dwangsom moeten opleggen en dan kijken of Leaseweb toch met meer informatie kwam. Pas als daar niets was uitgekomen én de geur van informatie achterhouden was blijven bestaan, dan had men zich tot andere partijen mogen wenden.

Wat ik een beetje mis in het verhaal is waaruit de AP concludeerde dat er informatie werd achtergehouden. Is dat het enkele feit dat er een brief van één kantje (met appendix) werd overlegd in plaats van wat traditioneel een “lijvig rapport” heet? De in NRC geciteerde woordvoerder vind ik niet sterk klinken: „Het is te prijzen dat Leaseweb een melding heeft gedaan in augustus”, vervolgt de woordvoerder. „Maar na zo’n melding vragen we wel eens meer informatie op. Als we dat dan bij herhaling doen, maar geen informatie krijgen, moet een bedrijf niet gek opkijken dat we denken dat er informatie achtergehouden wordt. Het kan zijn dat er iets verborgen wordt, maar dat hoeft natuurlijk niet. Het maakt ons alleen maar nieuwsgieriger.” Arnoud

Het bericht Hostingbedrijf Leaseweb weigert openheid te geven over cyberaanval verscheen eerst op Ius Mentis.

Yesterday, the House of Representatives voted against considering a largely bad bill that would have unacceptably expanded the tentacles of Section 702 of the Foreign Intelligence Surveillance Act, along with reauthorizing it and introducing some minor fixes. Section 702 is Big Brother’s favorite mass surveillance law that EFF has been fighting since it was first passed in 2008. The law is currently set to expire on April 19. 

Yesterday’s decision not to decide is good news, at least temporarily. Once again, a bipartisan coalition of law makers—led by Rep. Jim Jordan and Rep. Jerrold Nadler—has staved off the worst outcome of expanding 702 mass surveillance in the guise of “reforming” it. But the fight continues and we need all Americans to make their voices heard. 

Take action

TELL congress: 702 Needs serious reforms

Yesterday’s vote means the House also will not consider amendments to Section 702 surveillance introduced by members of the House Judiciary Committee (HJC) and House Permanent Select Committee on Intelligence (HPSCI). As we discuss below, while the HJC amendments would contain necessary, minimum protections against Section 702’s warrantless surveillance, the HPSCI amendments would impose no meaningful safeguards upon Section 702 and would instead increase the threats Section 702 poses to Americans’ civil liberties.

Section 702 expressly authorizes the government to collect foreign communications inside the U.S. for a wide range of purposes, under the umbrellas of national security and intelligence gathering. While that may sound benign for Americans, foreign communications include a massive amount of Americans’ communications with people (or services) outside the United States. Under the government’s view, intelligence agencies and even domestic law enforcement should have backdoor, warrantless access to these “incidentally collected” communications, instead of having to show a judge there is a reason to query Section 702 databases for a specific American's communications.

Many amendments to Section 702 have recently been introduced. In general, amendments from members of the HJC aim at actual reform (although we would go further in many instances). In contrast, members of HPSCI have proposed bad amendments that would expand Section 702 and undermine necessary oversight. Here is our analysis of both HJC’s decent reform amendments and HPSCI’s bad amendments, as well as the problems the latter might create if they return.

The most important amendment HJC members have introduced would require the government to obtain court approval before querying Section 702 databases for Americans’ communications, with exceptions for exigency, consent, and certain queries involving malware. As we recently wrote regarding a different Section 702 bill, because Section 702’s warrantless surveillance lacks the safeguards of probable cause and particularity, it is essential to require the government to convince a judge that there is a justification before the “separate Fourth Amendment event” of querying for Americans’ communications. This is a necessary, minimum protection and any attempts to renew Section 702 going forward should contain this provision.

Another important amendment would prohibit the NSA from resuming “abouts” collection. Through abouts collection, the NSA collected communications that were neither to nor from a specific surveillance target but merely mentioned the target. While the NSA voluntarily ceased abouts collection following Foreign Intelligence Surveillance Court (FISC) rulings that called into question the surveillance’s lawfulness, the NSA left the door open to resume abouts collection if it felt it could “work that technical solution in a way that generates greater reliability.” Under current law, the NSA need only notify Congress when it resumes collection. This amendment would instead require the NSA to obtain Congress’s express approval before it can resume abouts collection, which―given this surveillance's past abuses—would be notable.

The other HJC amendment Congress should accept would require the FBI to give a quarterly report to Congress of the number of queries it has conducted of Americans’ communications in its Section 702 databases and would also allow high-ranking members of Congress to attend proceedings of the notoriously secretive FISC. More congressional oversight of FBI queries of Americans’ communications and FISC proceedings would be good. That said, even if Congress passes this amendment (which it should), both Congress and the American public deserve much greater transparency about Section 702 surveillance.  

Instead of much-needed reforms, the HPSCI amendments expand Section 702 surveillance.

One HPSCI amendment would add “counternarcotics” to FISA’s definition of “foreign intelligence information,” expanding the scope of mass surveillance even further from the antiterrorism goals that most Americans associate with FISA. In truth, FISA’s definition of “foreign intelligence information” already goes beyond terrorism. But this counternarcotics amendment would further expand “foreign intelligence information” to allow FISA to be used to collect information relating to not only the “international production, distribution, or financing of illicit synthetic drugs, opioids, cocaine, or other drugs driving overdose deaths” but also to any of their precursors. Given the massive amount of Americans’ communications the government already collects under Section 702 and the government’s history of abusing Americans’ civil liberties through searching these communications, the expanded collection this amendment would permit is unacceptable.

Another amendment would authorize using Section 702 to vet immigrants and those seeking asylum. According to a FISC opinion released last year, the government has sought some version of this authority for years, and the FISC repeatedly denied it—finally approving it for the first time in 2023. The FISC opinion is very redacted, which makes it impossible to know either the current scope of immigration and visa-related surveillance under Section 702 or what the intelligence agencies have sought in the past. But regardless, it’s deeply concerning that HPSCI is trying to formally lower Section 702 protections for immigrants and asylum seekers. We’ve already seen the government revoke people’s visas based upon their political opinions—this amendment would put this kind of thing on steroids.

The last HPSCI amendment tries to make more companies subject to Section 702’s required turnover of customer information in more instances. In 2023, the FISC Court of Review rejected the government’s argument that an unknown company was subject to Section 702 for some circumstances. While we don’t know the details of the secret proceedings because the FISC Court of Review opinion is heavily redacted, this is an ominous attempt to increase the scope of providers subject to 702. With this amendment, HPSCI is attempting to legislatively overrule a court already famously friendly to the government. HPSCI Chair Mike Turner acknowledged as much in a House Rules Committee hearing earlier this week, stating that this amendment “responds” to the FISC Court of Review’s decision.

This hearing was unlikely to be the last time Congress considers Section 702 before April 19—we expect another attempt to renew this surveillance authority in the coming days. We’ve been very clear: Section 702 must not be renewed without essential reforms that protect privacy, improve transparency, and keep the program within the confines of the law. 

Take action

TELL congress: 702 Needs serious reforms