Your “Expectation of Privacy” Just Got Lower

Your “Expectation of Privacy” Just Got Lower

Last month, researchers at Stanford University announced they had developed software that was able to accurately predict a person’s sexual orientation.

Drawing from photos on a popular dating website, their program was able to correctly distinguish self-identified gay men from heterosexual men 81% of the time. It had a 71% success rate in distinguishing gay women from heterosexual women. When the algorithm was given five images of the same person to examine, the accuracy rose to 91% for men and 83% for women.

Given that the individuals whose photos were analyzed had already self-identified as straight or gay, you might wonder whether the software is a genuine threat to privacy. It could be if the technology is used by police in countries like Saudi Arabia or Russia to investigate suspected homosexuals.

But that’s just the tip of the iceberg in terms of the threat to privacy that face recognition and other biometric technologies pose. And everyone is vulnerable.

In the US, you have no right to privacy with respect to your facial features. No federal law regulates the collection of biometric data. For instance, anyone with a camera can legally take your picture in a public space. And with applications such as FindFace Pro, police can match your photo to a database of millions of photos in a fraction of a second.

Buy Gold at Discounted Prices

It should thus come as no surprise that images of millions of faces recorded by cameras installed in public spaces have made their way into archives compiled by law enforcement. The FBI can now search over 400 million photos from this source as well as driver’s license photos, passport photos, and visa application databases. Not to mention another 650 billion photos on Facebook alone – although police do need a warrant to retrieve photos or other data not posted for the public to view.

Similarly, the Supreme Court has ruled that you have no legal expectation of privacy with regard to your “personal characteristics.” That means police don’t need a warrant to collect your fingerprints, although they do to conduct an invasive procedure such as a blood test. Therefore, if you can unlock your smartphone with your fingerprint, the police in many parts of the US can force you to do so.

And anyone who retrieves an image of your fingerprints can probably unlock your phone as well. Think of the 5.6 million sets of fingerprints that were stolen in 2015 from the US Office of Personnel Management, which was widely believed to be the work of hackers employed by the Chinese government.

Nor is it just high-tech means that can be used to steal your fingerprints. In 2015, researchers at Vkansee, a firm specializing in security for mobile devices, demonstrated they could collect fingerprints using Play-Doh and use the resulting images to unlock an iPhone.

Law enforcement and intelligence agencies are also investigating biometric markers other than faces and fingerprints to identify suspected terrorists. Research dating back to 2010 demonstrates the effectiveness of “brain fingerprinting.” This involves using an electroencephalograph (EEG) to determine if a piece of information is stored in a person’s brain. The EEG pinpoints an involuntary reaction called a “P300 response.” The P300 response is a spike in brain activity a fraction of a second after a test subject is shown a familiar image or other stimuli.

For instance, an individual suspected of being a member of a terrorist cell that plans to bomb a train station could be shown photos of different train stations. The image that elicits the largest P300 response will be the most likely target.

I’m not aware of any court addressing the question of whether an individual can be forced to submit to P300 analysis. But an EEG is a painless procedure that merely involves placing electrodes on a test subject’s head. It’s possible US courts will conclude that no warrant is required for the test, since no expectation of privacy extends to your personal characteristics.

Of course, brain fingerprinting need not be restricted to terror investigations, especially in countries with poor reputations for civil liberties. For instance, let’s say a totalitarian government decides to arrest everyone acquainted with an individual identified as an enemy of the state. Investigators merely need to perform P300 analysis on that person’s suspected friends and associates to identify who will be arrested.

Keep in mind that as technology progresses, the biometric tools used to identify, classify, investigate, and punish us will only become more sophisticated. Short of becoming a hermit for life and never emerging from your cave, there’s little you can do to completely avoid biometric surveillance. But you can minimize it.

Don’t renew your driver’s license until it expires. Driver’s license photos taken more than a decade or so ago aren’t necessarily in digital form and are harder to match. The photo on my driver’s license was taken in 1996 and won’t expire until 2020.
Unsubscribe from Facebook and other social networks. Or if you use these networks, don’t post photos of yourself. Also, ask your friends not to post photos with you in them on social media and especially not to tag photos of you. If they do tag you, you can remove the tag from a photo or post. Here’s the procedure for Facebook. You can even have a bit of fun by asking your friends to tag pets, vehicles, or other objects with your name, thus confusing face recognition algorithms.
Wear head coverings. A hat will prevent a camera from capturing a clear image of your face unless you look at it directly. If you’re a Muslim woman or don’t mind dressing as one, a burqa will obscure your entire face.
If you’re a man, grow a beard. Like hats or other head coverings, a beard – at least a full one – hides enough of your face to make face recognition difficult.
Disable fingerprint or other biometric unlocking of your smartphone or any other electronic device. Instead, use a hard-to-guess passphrase. While there is no expectation of privacy with respect to your physical characteristics such as your fingerprints, US courts have generally ruled you can’t be forced to divulge a passphrase without a court order.
Don’t submit to any type of voluntary search. That includes your phone, your vehicle, or for that matter, an EEG. If the police force you to submit to a search, never consent to it. Say, “Officer, I will not try to prevent you from conducting this search, but I do not consent to it.” This precaution won’t prevent the search, but will make it less likely that any incriminating items or information found can’t be used against you.
None of these steps are 100% effective at avoiding biometric surveillance. Only redefining our expectation of privacy will do that. And I’m not holding my breath for that to happen.

Reprinted with permission from Nestmann.com.