
Facebook’s Face Recognition Tech Goes on Trial - aaronyy
http://spectrum.ieee.org/biomedical/imaging/facebooks-face-recognition-tech-goes-on-trial
======
TheBeardKing
From the article it sounds like the result of the lawsuit may be just that
facebook adds a disclaimer to their ToS that you accept them using your
biometric data by using their service. No surprise there, if you don't want
any service collecting any of your data, don't use their service.

~~~
dsp1234
_No surprise there, if you don 't want any service collecting any of your
data, don't use their service._

Unfortunately, that doesn't go far enough. I don't use FB, but that doesn't
mean it doesn't collect my data. It does because my husband and friends use
FB, and I do not control the information they share about me with FB.
Currently it has to be, "if you don't want any service collecting any of your
data, don't use their service, and don't interact with other people or
companies who use their service.". As an example of where your original
statement fails, I don't want to be tracked in the mall by companies tracking
my phone.

~~~
cookiecaper
>Currently it has to be, "if you don't want any service collecting any of your
data, don't use their service, and don't interact with other people or
companies who use their service."

Not sure you have any other option. Most of the time, you can't restrain what
other people choose to do with images they've taken that contain your
likeness, and you can't stop them from posting content that mentions their
spouses. That person is willfully disclosing this data under the terms they've
accepted. If the person is disclosing data about you that you don't want
disclosed, that's an issue between you and that person, not that person and
the entity who receives their willful, free, and unprompted disclosures.

Facebook can't know _a priori_ that the user intends to disclose information
on a person who doesn't want Facebook to know about them, and thus can't do
anything about it until it's too late. Allowing people to delete other
peoples' content because they don't want to be mentioned/included in it is an
obvious non-starter (and Facebook already includes this to a reasonable extent
with untagging features).

The privacy threat could be partially, not totally, mitigated by radically
changing the way we approach online services, but I don't see how that could
be pushed through. It wouldn't benefit any commercial entity, so no one with
private motive would bankroll it to a height that could reasonably challenge
FB, and it surely wouldn't be fair to use police/military force to dismantle
Facebook et al and force users into a hypothetical somewhat-more-private
decentralized, self-hosted, encrypted Facebook replacement, so we're basically
stuck.

The reality is that this is the world we live in now. I don't think there's
really a way to avoid it. Legal solutions that prevent vendors from
referencing some data points may limit some effects here and there, but I
think it's going to be difficult to craft something that really accomplishes
anything big, and the tech and data is still going to be out there and used by
some people regardless of the legal status.

~~~
pjc50
This is literally what EU data protection is for: if you're going to process
personal data, people have the rights to know what it is, whether it's
correct, and to have it deleted.

~~~
yellow_postit
From the article the tagging feature is not available in the EU. An
interesting question is are the citizens better/happier/safer without this
feature? I don't propose to know how to measure that.

------
artursapek
> “We could soon have security cameras in stores that identify people as they
> shop,”

I stopped using Facebook 5 years ago because I noticed using it made me
unhappy. I continue to not go back because of privacy concerns like this.

~~~
cookiecaper
You know people who use Facebook. They upload pictures that, more likely than
not, include your face. Facebook knows your face even if it doesn't know your
name (which people will often readily supply even if you don't have an
account, so don't be so sure that they don't know your name too).

You don't want to be "that guy" constantly demanding that your friends pull
down any picture that you show up in, a request your friends will probably
ignore anyway, and which will greatly diminish your personal likability.

The government has your name, face, address, and other personal information
stored away safely in DMV and passport databases, among several others, and
this information is surely being used in similar ways behind the scenes.
Facebook neatly bundles all of its data and submits it to the NSA via PRISM
every day, granting the government full access to both datasets, although to
be frank, just Facebook's dataset is going to be good enough to track someone
down, even if a little more work is necessary to dig up the exact details like
address.

An interested party with such access could almost surely run a program and
find the last people you were photographed with, which will almost definitely
make it easy to find you personally. Combine this with smart surveillance
systems and any time you enter a public place, sans cell phone or any other
trackers, your personal location can be recorded.

I don't really think there's any way around it and I am in fact surprised that
people haven't already made a public "search by face" engine. Correlate this
data with Facebook or some other all-seeing collections and the technology to
dynamically identify every individual that enters a building via surveillance
footage is already there. The only thing holding it back now is a) political
correctness and b) the practical difficulty of extracting all of this data at
a large scale into a format that can be easily cross-referenced. Both of these
are permeable and temporary restrictions, and access to the data is already a
non-issue for some actors.

Expect to see such systems developed and sold in the next several years. Laws
may make such software illegal, which will limit distribution to laypeople,
but ultimately it will still be out there for interested parties to acquire.

The age of unscannables and cyberpunks is upon us. The only way to retain
privacy will be to wear your hair in interesting ways. [0]

[0] [https://cvdazzle.com/](https://cvdazzle.com/)

~~~
lobotryas
>search by face

The Russians have already done this:
[https://www.google.com/amp/s/amp.theguardian.com/technology/...](https://www.google.com/amp/s/amp.theguardian.com/technology/2016/may/17/findface-
face-recognition-app-end-public-anonymity-vkontakte)

Discreetly snap someone's photo and there's an excellent chance that face
recognition will fond their social media profile. Now you have their name and
potentially a lot more (age, school, hometown, etc).

All it takes is enough centralization and a culture of sharing a lot online
and you're loving in the future!

------
jeyoor
It's good to see that privacy concerns are being voiced publicly. I'm not
certain that class-action lawsuits are the most productive approach to take,
though.

On the technical side, I was intrigued that the "black box" of multilayer
neural networks could provide a legal defense for Facebook in this case.

Often, the fact that neural networks are harder to analyze compared to other
AI techniques is cited as a detriment, but in this legal case it could prove
useful.

~~~
iaw
I think because the state law was written about recording the distance between
facial features the implementation comes into play.

I swear that whole "letter of the law" concept in the US as opposed to the
actual intent is frustrating.

~~~
aisofteng
There's also the concept of the spirit of the law.

~~~
iaw
That's what I meant, I'll leave the comment as it stands though.

Edit: I guess you could say, that was the spirit of my post :D

------
e324809234
As someone who had cosmetic surgery, it took a good amount of changes to be
tagged as a "different" person by Facebook and the Photos app. One operation
that altered the frontal view of the jaw seemed to have finally done the trick
(many common operations like rhinoplasty mostly affect your side profile.)

~~~
djloche
Facebook doesn't properly identify me vs my brother, so they still have some
things to work one.

~~~
jedberg
Are you twins or just "regular" siblings?

~~~
djloche
He's 2 years older than me.

I think part of this is that their facial recognition doesn't have a logic
check based on the other context data that they have.

eg. my brother's wife will post vacation photos of him, him with his kids, and
him with her, and yet sometimes it still auto-identifies the pictures of him
as me. Facebook knows I'm logged in at an ip 1000 miles away. Facebook knows
my brother is with his wife because they both have logged in recently while on
vacation. Yet I am tagged instead of him.

~~~
kakaorka
I think they only try to recognize the face and don't really care about
anything more than that and because it's actually very accurate, that strategy
has been working so far.

------
goombastic
This means I'll be recognized even if I appear in photographs taken by others
in public places and I dont even use FB. This is unsettling.

------
gooseus
How soon before this analysis is being used to cross-reference with terrorist
and sexual predator watch-lists causing all sorts of problems for people who
happen to closely resemble anyone on those lists?

I'm thinking it's time to buy stock in suppliers of masks, cosmetic surgery
and other forms of facial obfuscation.

~~~
petre
There are already make-up patterns that obfuscate the face causing face
detection tofail, but no one wears that on a daily basis, because it looks
rather weird.

------
benjismith
To me, the interesting thing about this is that the "biometric data" is
actually the collection of photos that the users uploaded.

The data-structures used for facial recognition are just metadata, extracted
from the original imagery. It seems to me like data retention laws would apply
to the original imagery, but not the derivative data structures. But that's
obviously not what privacy-conscious user would expect...

I'm interested in seeing how this kind of case ends up being decided, when it
(inevitably) ends up at the supreme court.

~~~
amelius
> It seems to me like data retention laws would apply to the original imagery,
> but not the derivative data structures.

That's probably not how it works.

If I have a database of personal information of users, and I throw away the
user's day of birth (but not birth year), I have still a database with
sensitive information.

Also, if I convert a CD to MP3 format, then I'll also throw away 90% of the
original information. I might still be liable for illegally copying a song.

(IANAL)

------
Keverw
I like the face feature personally. Kinda just neat and makes tagging super
easy.

However I'm curious, How does Illinois even have jurisdiction to sue Facebook?
As far as I know they don't have any land or employees there being a
California based company. Even many terms of services say you agree which
court to dispute. Seems like Illinois is over reaching to me.

[https://www.facebook.com/legal/terms](https://www.facebook.com/legal/terms)

> You will resolve any claim, cause of action or dispute (claim) you have with
> us arising out of or relating to this Statement or Facebook exclusively in
> the U.S. District Court for the Northern District of California or a state
> court located in San Mateo County, and you agree to submit to the personal
> jurisdiction of such courts for the purpose of litigating all such claims.
> The laws of the State of California will govern this Statement, as well as
> any claim that might arise between you and us, without regard to conflict of
> law provisions.

~~~
stablemap
They have an office in downtown Chicago. Sales and marketing, I think.

~~~
Keverw
Yep - just did a Google search and landed on this.
[https://www.facebook.com/careers/search/?q=&location=chicago](https://www.facebook.com/careers/search/?q=&location=chicago)

So I guess that's how they can get them... I really hope Facebook wins though.
Last time I checked Face recognition creates 3 floats from a face. I'm not
sure Facebook's specifics but in general that how it works.

So in a way I'm amazed a face can be turned into 3 numbers, and also think
it's silly to sue over 3 numbers in the grand scheme of things.

------
ljk
> _Therein lies the irony: If Facebook doesn’t save faces in its database, it
> may save face in court._

is this irony? isn't it just a pun?

------
crumpled
Suppose facebook has the ability to look at a photo and determine who is in
the photo, and the court determines that amounts to storing biometric data
(despite the explicit exclusion of photos from the definition of biometric
data). Now facebook would have to get explicit permission from users and non-
users to collect biometric data. How could they possibly not collect data from
non-users? If they have the ability to turn the feature on at any moment, any
photo of a person would amount to biometric data, whether the person was a
user or not. There doesn't seem to be a good way to comply. They could not
host photos (no way). They could stop pursuing facial recognition (yeah
right). My favorite solution is to have them alter any new upload by blurring
out the faces of any person who hasn't consented to them storing biometrics.

------
rb808
It freaked me out in the recent video about tech in Russia. You could take a
picture of someone with your phone and it'll find them in social networks. Eg
you could take a picture of someone on a street them find everything about
them.

You can't stop progress.

See 30 minutes in.

[https://www.bloomberg.com/features/2016-hello-world-
russia/](https://www.bloomberg.com/features/2016-hello-world-russia/)

[https://findface.ru/](https://findface.ru/)

------
cinquemb
Facebook et al are only paving the way for the future where more and more
people and smaller organizations will have such tools and data at their
disposal for whatever means. These walled gardens of data can only maintain
this advantage for so long.

------
traviswingo
This seems ridiculous to me.

That being said, Facebook can't just allow users to opt out of biometric data
stores?

~~~
yellow_postit
They would likely require people to upload multiple photos to build a profile
to "opt-out" and even then there are FPs and look-a-likes that make such an
opt-out hard to guarantee (e.g. identical twin where one opts-in and one opts-
out)

