We Are Always Watching: The Dawn of Biometric Surveillance
By: Žygimantas Kapočius
Tags: Digital Policy, Biometrics, Intelligence, Privacy, Surveillance

This report was originally submitted for the Big Data for Intelligence course supervised by Dr. Ayşe Ceyhan (Sciences Po Paris) — May 2019

Heather Dewey-Hagborg’s computationally generated 3D portraits

In 2012, an American artist Heather Dewey-Hagborg embarked on a controversial biopolitical art project called Stranger Visions. She collected items New Yorkers unintentionally left behind (chewed up gum, cigarette butts, strands of hair) to “computationally generate 3D printed life size full color portraits representing what those individuals might look like, based on genomic research.” (Dewey-Hagborg) The project exemplifies the eerie potential of biological surveillance in identifying individuals through genetic determinism. Indeed, biometric authentication as “the automated recognition of individuals based on their anatomical and behavioral characteristics” (Biometics Research Group) is increasingly utilized in intelligence and law enforcement.

Biometrics serve as a convenient mechanism through which individuals can be identified by unalterable biological characteristics. The datafication of these characteristics with the help of Big Data analytical tools can be used in in a variety of contexts, including military, border protection, healthcare, among others. Case in point, American military intelligence “has relied heavily upon biometrics to identify hostile actors in a guerilla or counterinsurgency environment” (Gioe : 216) during post-9/11 invasions of Iraq and Afghanistan. A group of Jordanian researchers proposed a new approach in identifying jihadist militants “from their geometric features of victory sign alone, as this sign might be the only information available about such persons.” (Hassanat, Alhasanat and Abbadi : 6) In the meantime, private companies are also employing biometric features, such as fingerprint recognition in smartphones, in provision of goods and services, as the total revenue of the global biometric system market is expected to reach $30 billion by 2021. (Statista : 7)

In the process, vast amounts of data containing sensitive biological characteristics of individuals are increasingly accumulated in public and private biometric databases. This report aims to analyze the privacy and data protection implications of datafication when it comes to biometric information. Firstly, it will characterize the increasing use of biometrics in intelligence and law enforcement contextualizing it in the broader theoretical framework. Secondly, it will explore the privacy and data protection issues emerging from the use of biometrics in surveillance. Finally, it will conclude with a brief case study of genetic information potential in intelligence, drawing on practical examples from commercial and forensic use of DNA.

Biometrics: A Gold Standard for Law Enforcement

Identity has come to be one of the crucial components and means of governance in an increasingly digital world. As far as intelligence and law enforcement is concerned, “identification has become represented at the forefront of the techniques and technologies of so-called homeland security.” (Amoore : 22) In particular, biometric technologies are often described “as the new silver bullet, the simultaneous ‘solution’ to a number of problems associated with the organizational desire for positive identification.” (Lyon : 501) As biometric authetification relies on unique physiological features, Jain, Bolle and Pankanti point to 7 factors that provide biometric parameters with several comparative advantages as a source of intelligence, notably:

‣ Universality

‣ Distinctiveness

‣ Invariance

‣ Collectability

‣ Performance

‣ Acceptability

‣ Circumvention (1998 : 1)

According to their biological characteristics, the biometric modalities can be further categorized into hand-based, facial region, ocular and periocular region, behavioral and medico-chemcial attributes. (Unar, Seng and Abbasi)

As a result, biometrics serve as an attractive tool for intelligence and law enforcement institutions, because “identification may be achieved using features that almost all human beings have by virtue of being bodily creatures, in a process that is relatively quick, non-invasive and low-risk (…) for the person identified.” (Lyon : 501)

Owing to the convenience of biometric characteristics in identification and the advent of modern technology, public and private actors alike have embarked on biometric datafication, amassing vast amounts of bodily characteristics in databases. To this end, biometric systems are created for “the capture and storage of enrollment (reference) biometric samples, and the capture of new samples and their comparison with corresponding samples (matching). (Pato and Millett : 2) In this enrollment and verification process, the information collected is stored in a database.

Lyon and Bennett observe that “national identification systems have been proliferating in recent years as part of a concerted drive to find common identifiers for populations around the world.” (2008 : 3) For instance, in 2009, India constructed a biometric identity system Aadhaar, connected to the national identity card, which “retains the cardholder’s demographic and biometric information — including iris scans — in a national, centralized database.” (Dixon : 544) With 1.2 billion users enrolled (around 15% of the global population) since its conception, Aadhaar is the world’s largest biometric identity program. (World Government Summit and OECD)

The identification potential of biometrics is also progressively instrumentalized by intelligence and law enforcement institutions. In 2011, the FBI deployed the Next Generation Indetification (NGI) biometrics database, which “provides the criminal justice community with the world’s largest and most efficient electronic repository of biometric and criminal history information.” (Federal Bureau of Investigation) The initiative aimed to expand the pre-existing IAFIS database “to include multimodal biometric identifiers such as iris scans, palm scans, face-recognition-ready photos, and voice data, and makes that data available to other agencies at the state and federal levels.” (Electronic Frontier Foundation)

The NGI encompasses an immense volume of personal information, including more than 70 million criminal records and 38 million civil records. (Kofman) In such way, the activities of the FBI are endowed with an added multimodal functionality, which is symptomatic of “the normalization of datafication as a paradigm in science and society” (van Dijck : 198) in the activities of intelligence and law enforcement bodies.

This broader paradigm shift energized by Big Data technology does not only foster new capabilities, but also presents operational challenges. Gioe emphasized the rise of Big Data technology like biometric identification as a ‘double-edged sword’ for the intelligence community, as “the role of such interconnected technology on the battlefield and improved real-time situational awareness has been revolutionary for military personnel, but networked computer systems carrying massive amounts of information can also pose a threat to military officers.” (2017 : 216)

Indeed, the American military has extensively used biometrics-enabled intelligence in Afghanistan. For instance, it controversially enrolled individuals on the ground in the Biometric Enabled Watch List (BEWL), connected to the domestic FBI and Department of Homeland Security databases. This allowed the US to not only “identify and locate suspected insurgents,” (Public Intelligence) but also acquire extensive biometric information on the population under the pretext of coutnerterrorism. On the flip side, there are emergent operational challenges intelligence agencies face with the increasing penetration of biometrics. Case in point, the future of international human intelligence (HUMINT) operations is at stake, as “biometrics — particularly those at international borders — make alias travel more challenging.” (Gioe : 2016) Ironically, the privacy of intelligence officers is at risk, as biometrics are increasingly becoming part of the equation in a multiplicity of contexts.

Hence, the advent of biometrics-enabled intelligence is symptomatic of the broader paradigm shift in the intelligence community, as Big Data is transforming its methodological and operational tooxbox. Owing to the parameters that take into account the intrinsic qualities of individuals, biometrics serve as an attractive and relevant tool in the conduct of intelligence and law enforcement activities, particularly forensic, battlefield and counterterrorism investigations. Simultaneously, the implementation of biometrics in other commercial and public contexts, such as national identification systems, provides intelligence and law enforcement entities with new avenues for data collection, bolstering and adding value to their modus operandi.

As emphasized by Maj. Gen. (ret.) Farkash, the former head of the Israeli Defence Forces Directorate of Military intelligence, the datafication of biometrics allows “to fuse all of this information together in real time and determine actionable intelligence for end users, namely special forces and similar units.” (2017) However, as colossal quantities of information containing intrinsic biological characteristics of individuals are collected and stored in databases, it is necessary to consider the ethical and privacy-related implications of biometrics-enabled intelligence.

Under Surveillance: A Global Paradigm

Beyond operational dynamics, a broader epistemological shift is occurring in intelligence and surveillance. However, debates on this transformation remain scarce and confined to the academic circles, while the consideration of privacy and data protection issues remains ever-relevant in the context of the digital era. Ceyhan uses Bauman’s liquid modernity theory to emphasize the transformative “fluid conditions of globalization and the production of a global risk society generating an increase of perceived uncertainties and insecurities in almost all aspects of life.” (2008 : 105)

In this context, Bentham’s panopticon, a metaphor widely used in surveillance studies to describe “increased capabilities of ‘watchers’ (…) to acquire more power over the ‘watched’,” (Manokha : 220) is evolving with the emergence of surveillance technologies. According to Lyon, “electronic technologies through which power is asserted in today’s mutuable and mobile organizations makes the architecture of walls largely redundant.” (Bauman and Lyon : 10)

The trend is indicative of new dynamic characteristics of liquid surveillance, which enables the “creation of a space that is not colonized either by individuals and citizens, and also not controlled by states, generating new fears and anxieties.” (Ceyhan : 106) The 2013 Snowden revelations sparked new concerns over the privacy and data protection implications of surveillance.

Contextualizing within the scope of the aforementioned example of the Indian biometric system, the American whistleblower has pointed out in 2018 that India has virtually “created a mass surveillance system with Aadhaar, and warned that Indians could face a civil death given that Aadhaar is linked to everything.” (The Times of India) There are several dimensions that point to the critical privacy flaws within the Indian biometric system.

First, Dixon criticizes the “marked lack of protective regulatory controls of the Aadhaar program, which has in turn resulted in profound mission creep and a loss of autonomy.” (2017 : 565) Nonetheless, the Supreme Court of India ruled in favor of its constitutional validity back in 2018. While it struck down controversial clauses like sharing of data on the grounds of national security, the Court retained the compulsory enrollment in the system for many crucial aspects of public service delivery, such as welfare. (Bloomber Quint)

Critically, WikiLeaks revealed that the CIA potentially possessed the tools to access the Indian biometric identity database. Aadhaar was implemented by an American company Cross March, which allegedly assisted the CIA in the creation of a “covert information tool that is used (…) to secretly exfiltrate data collections from such systems provided to liaison services.” (Kasli) This alleged meddling of a foreign actor in a national framework speaks volumes in illustrating the transnational implications of liquid surveillance.

Meanwhile, as the “world’s largest collection of fingerprints, DNA profiles, palm prints, face images and other biometric identifiers,” (Kofman) the Next Generation Identification (NGI) database of the FBI has also been subject to rigorous public scrutiny concerning issues of privacy and data protection. In 2016, the FBI has requested to be exempt from the Privacy Act of 1974, which “governs the collection maintenance, use and dissemination of information about individuals that is maintained in the systems of records by federal agencies.” (US Department of Justice)

In its notice of proposed rule-making, the FBI justifies the request “in order to prevent interference with the FBI’s mission to detect, deter and prosecute crimes and to protect national security, which includes the use of criminal record information and biometric identifiers.” (US Federal Register) This has garnered heavy criticism from civil society, as it pointed to the controversial arbitrary involvement practices, because the “database stores millions of identifiers for US citizens who have not been convicted of a crime, alongside those who have.” (Kofman) It potentially hampers the ability of uninvolved individuals to pass background checks in pursuing employment, in addition to danger of potential false positives in criminal investigations. The FBI was eventually granted the exemption, an emblematic example of the emergence of a liquid surveillance space beyond the control of legislation and bottom-up democratic oversight.

In the global context, China has been particularly invested in biometric surveillance methods for social governance. In 2014, it embarked on the implementation of a highly controversial social credit system (SCS). With prospective application in the country by 2020, the SCS aims to create an overarching citizen surveillance and ranking framework, under which “people will be ultimately scored based on past behavior, taking in misdemeanors such as traffic offenses and court records.” (Lucas and Feng) The system, frequently branded as Orwellian, relies heavily on Big Data technology, including artificial intelligence and biometrics, with ultimate goal of making every Chinese citizen traceable “by a file compiling data from public and private sources by 2020, and for those files to be searchable by fingerprints and other biometric characteristics.” (Hvistendahl) China’s invasive encroachment on citizen’s privacy does not end there, however.

Authorities in Xinjiang, a region in eastern China populated by a historically persecuted Muslim Uyghur minority, “are collecting DNA samples, fingerprints, iris scans and blood types of all residents in the region between the age of 12 and 65.” (Human Rights Watch) There has been evidence of complacency of American companies in this case of state surveillance, as a recent leak has “led to accusations that Microsoft had partnered with [Sense Nets] to help repressive surveillance efforts in Xinjiang.” (Burt) The Chinese biometric surveillance practices are becoming a practical embodiment of a digital panopticon.

The aforementioned examples illustrate that the epistemological frameworks that conceptualize the emergence of liquid surveillance in the digital era are increasingly manifested in the real world. The datafication of personal characteristics through Big Data technology, as evidenced by cases from applications of biometric identification methods, entail threats to privacy and data protection. Manokha points out that digital surveillance can indeed lead to the so-called chilling effect. As he further explains, this concept “is now widely used to describe changes in behavior made by individuals, aware of being under surveillance, to be in conformity with the perceived norms and expectations of the surveyors.” (2018 : 230)

As the Snowden revelations have also shown, individuals change their behavior both online and offline, as soon as they acknowledge the scale of surveillance, even if “there was no increase in coercive or repressive measures by security agencies.” (ibid : 228) In the case of biometric surveillance, this effect could potentially lead to a greater sense of unease and anxiety, since individuals could be identified by their intrinsic biological features, rather than their online presence. The passivity through which biometric information could be collected, such as CCTV cameras and the analysis of DNA trances, can lead extensive and intrusive surveillance practices in a form of a digital panopticon.

It’s in the DNA: Can You Escape Biometric Surveillance?

As evidenced by the biopolitical art project of Dewey-Hagborg, by simply collecting cigarette butts from public spaces it is possible to recreate the facial features of the smoker. The use of DNA-based biometrics can in fact enable law enforcement, investigative and intelligence institutions to identify people though genetic information. the increasing use of biometric DNA technology in public and private realms were “spurred by sociological phenomena such as genetic essentialism (the notion that genetic material is the “essence” of the individual) and genetic determinism (the notion that genetic information is determinative of an individuals predisposition for disease as well as other social behaviors).” (Arrigo)

Compared to other modalities, DNA is the most identifiable biometric, because it contains the unalterable characteristics specific to an individual. The collection and testing of DNA has already been digitized by forensic investigators and law enforcement agencies.

Nonetheless, the collection and storage of DNA samples is not limited to artistic projects and intelligence agencies — it has also been on the rise in the private sector, although its share in the market still remains fairly limited. In particular, online platforms like 23andMe, MyHeritage and Ancestry allow users to send a sample of their own DNA in order to find possible lost relatives and acquire a better understanding of their ethnic heritage. At first glance, these services seem innocuous, but the possible access of intelligence agencies or third parties to the private DNA databases of such companies can constitute major risks for the privacy of its users, but also those who are not.

Verge Science’s short documentary The At-home DNA Test Craze is Putting Us All at Risk outlines the privacy issues that individuals face when they use one of these services. Through comparison of the DNA with other samples from the dataset, it is possible to track down distant relatives of the person in question. By looking at the single nucleotide polymorphism (SNPs), which are specific segments of the DNA that reveal information about the genealogy of the person, the platform inks the DNA to a specific region of the world or to a set of matching people.

In doing so, companies that sell this type of service collect vast amounts of DNA samples in their private biometric databases. As the documentary explains, the number of people tested by the consumer genetics companies is estimated to be around 26 million individuals. In order to authenticate a specific person through DNA matching, it is not necessary to have an exact match in the system. Through a long range of familiar search, it is possible to connect the DNA of the person in question to a potential third cousin.

Verge Science argues that “for any population with some common ancestry, DNA from just 2% of the people could make anyone findable via a third cousin or closer. For example, all Americans with some European ancestry could be matched by just a 2% pool.”

Should intelligence and law enforcement agencies decide to get access to these databases, they have two legal solutions. First, they can contact the company and solicit collaboration, as it was the case for FamilyTreeDNA, which admitted sharing genetic data with the FBI. (Haag) Second, if the company refuses to collaborate, these actors would require a specific judicial warrant, such as a court order, that would compel the company to give access to the data. However, peculiar work-arounds emerged with the boom of at-home DNA testing companies with readily accessible databases.

While these databases are primarily used to trace lineage or ethnicity, the 2018 breakthrough in a 1970s murder case illustrates that these databases can be used by investigators to identify suspected criminals. Case in point, American investigators were faced with an impasse in the “Golden State Killer” case, who between 1976 and 1986 raped and killed dozens of individuals across California. Despite the fact that investigators possessed his DNA samples, they were not verifiable in FBI’s extensive DNA databases. With the emergence of freely available commercial DNA databases, police “checked the crime scene DNA against one of the genealogy sites that have recently become popular. (…) GEDmatch, a free service, confirmed that police used it to identify” (Selk) the serial killer via a close relative. The criminal is now facing charges more than four decades after the crime was committed.

This phenomenal instance points to the underlying privacy issues in the digital era. Liquid surveillance practices now go beyond traditional modus operandi of the intelligence community. As the conclusion of the “Golden State Killer” case shows, the intelligence community is not limited to their in-house resources and databases, as now they can pool into freely available commercial counterparts. While the aforementioned case points to the immense potential of commercial DNA databases in forensic investigation, the fact that individuals can be traced and identified through the DNA of their relatives from a small pool of samples speaks volumes about the implications to the integrity of personal privacy. In this context, an ethical dilemma persists, since genetic information is not something an individual personally chooses and gives consent to share with its relatives.

In the meantime, your entire physiological features can be reconstructed from a cigarette butt left behind in a public space.

_____________________

Sources:

Amoore, Louise. “Governing by Identity.” Bennett, Colin J. and David Lyon. Playing the Identity Card: Surveillance, Secuirty and Identification in Global Perspective. London and New York: Routledge, 2008. 21–36.

Arrigo, Bruce A. The SAGE Encyclopedia of Surveillance, Security, and Privacy. Charlotte: Sage Publishing, 2016. Bauman, Zygmunt and David Lyon. Liquid Surveillacne. Cambridge: Polity Press, 2013.

Biometrics Research Group. What is Biometrics?

Bloomberg Quint. Aadhaar: A Quick Summary of the Supreme Court Majority Order. September 26, 2018.

Burt, Chris. Biometric Surveillance Raises Ethics Concerns for China-US AI Industry Sharing. April 12, 2019.

Ceyhan, Ayse. “Technologization of Security: Management of Uncertainty and Risk in the Age of Biometrics.” Surveillance and Society 5.2 (2008): 102–123.

Chin, Josh and Clément Bürge. Twelve Days in Xinjiang: How China’s Surveillance State Overwhelms Daily Life. December 19, 2017.

Dedrickson, Kirsten. “Universal DNA Databases: A Way to Improve Privacy?” Journal of Law and Biosciences 4.3 (2017): 637–647.

Dewey-Hagborg, Heather. Stranger Visions.

Dixon, Pam. “A Failure to “Do No Harm” — India’s Aadhaar Biometric ID Program and Its Inability to Protect Privacy in Relation to Measure in Europe and the US.” Health and Technology 7 (2017): 539–567.

Electronic Frontier Foundation. FBI’s Next Generation Identification Biometrics Database.

Farkash, Aharon Zeevi. Walk this Way, Talk this Way: Using Multiple Biometrics. April 1, 2017.

Federal Bureau of Investigation. Next Generation Identification (NGI).

Gioe, David V. “‘The More Things Change’: HUMINT in the Cyber Age.” Daver, Rober, Huw Dylan and Michael S. Goodman. The Palgrave Handbook of Security and Intelligence. London: Palgrave Macmillan, 2017. 213–227.

Haag, Matthew. FamilyTreeDNA Admits to Sharing Genetic Data With F.B.I. February 4, 2019.

Hassanat, Ahmad B. A., et al. “Victory Sign Biometric for Terrorists Identification.” 2016.

Human Rights Watch. China: Minority Region Collects DNA from Millions. December 13, 2017.

Hvistendahl, Mara. Inside China’s Vast New Experiment in Social Ranking. December 14, 2017.

Jain, Anil K., Ruud Bolle and Sharath Pankanti. Biometrics. Personal Identification in Networked Society. Boston: Kluwer Academic Publishers, 1998.

Kasli, Shelley. How CIA Spies Access India’s Biometric Aadhaar Database. August 25, 2017.

Kofman, Ava. FBI wants to exempt massive biometric database from the Privacy Act. June 1, 2016.

Lucas, Louis and Emily Feng. Inside China’s surveillance state. July 20, 2018.

Lyon, David and Colin J. Bennett. “Playing the ID Card. Understanding the Significance of Identity Card Systems.” Lyon, David and Colin J. Bennett. Playing the Identity Card: Surveillance, Secuirty and Identification in Global Perspective. London and New York: Routeledge, 2008. 3–21.

Lyon, David. “Biometrics, Identification and Surveillance.” Bioethics 22.9 (2008): 499–508.

Manokha, Ivan. “Surveillance, Panopticism, and Self-Discipline in the Digital Age.” Surveillance and Society 16.2 (2018): 219–237.

Pato, Joseph N. and Lynette I. Millett. Biometric Recognition. Challenges and Opportunties. Washington D.C.: The National Academies Press, 2010.

Public Intelligence. Identity Dominance: The U.S. Military’s Biometric War in Afghanistan. April 21, 2014.

Regalado, Antonio. 2017 was the year consumer DNA testing blew up. February 12, 2018.

Selk, Avi. The ingenious and ‘dystopian’ DNA technique police used to hunt the ‘Golden State Killer’ suspect. April 28, 2018.

Statista. “Biometric Technologies.” Statistical Report. 2017.

The Times of India. Snowden calls for criminal action against Aadhaar misuse. August 20, 2018.

Unar, J. A., Woo Chaw Seng and Almas Abbasi. “A Review of Biometric Technology Along With Trends and Prospects.” 47.8 (2014): 2673–2688.

US Department of Justice. Privacy Act of 1974. July 17, 2015.

US Federal Register. Privacy Act of 1974; Implementation — A Proposed Rule by the Justice Department on 05/05/2016. May 6, 2016.

US Government Accountability Office. Face Recognition Technology. FBI Shoud Better Ensure Privacy and Accuracy. Report to the Ranking Member, Subcommittee on Privacy, Technology and the Law, Committee on the Judiciary, US Senate. Washington D.C.: US Government Accountability Office, 2016.

van Dijck, José. “Datafication, dataism and dataveillance: Big Data between scientific paradigm and ideology.” Surveillance and Society 12.2 (2014): 197–208.

Verge Science. The at-home DNA test craze is putting us all at risk. April 16, 2019.

World Government Summit and OECD. Embracing Innovation in Government — Global Trends 2018. Review. Dubai: Observatory for Public Sector Innovation, 2018.