Thread: Ohio residents not told how license photos used

Ohio residents not told how license photos used

Chrissie Thompson, The Cincinnati Enquirer 2:02 p.m. EDT August 26, 2013

Facial recognition software launched two months ago scans IDs and mug shots to identify crime suspects.


Ohio Attorney General Mike DeWine speaks at a news conference in Cincinnati in this Friday, July 19, 2013, file photo. Initially DeWine didn't think it was necessary to alert the public to the use of new facial recognition software when he found out it was in use. On Monday, Aug. 26, 2013, he said he should have announced the technology when it launched in June.(Photo: Al Behrman, AP)

Story Highlights

• State attorney general wasn't aware of software's start but says he should have announced it
• Security protocols weren't outlined prior to launch
• Protocols have been developed and attorney general has created advisory group for updated rules

LONDON, Ohio -- Without informing the public and without first reviewing security rules for the system, Ohio law enforcement officers started using facial recognition technology more than two months ago, scanning databases of driver's license photos and police mug shots to identify crime suspects, The Cincinnati Enquirer has learned.

After they launched the system, officials in Ohio Attorney General Mike DeWine's office weighed what new security protocols to establish for the state's law enforcement database and wondered when they'd be ready to tell the public about it.

In hundreds of pages of e-mails and memos reviewed by The Enquirer, officials also disagreed about whether the system was in beta testing or in a full launch and promised to make changes to the website that would be used to upload license photos, which was vulnerable to hackers.

STORY: Report: NSA spying broke privacy rules many times
STORY: NSA collected thousands of e-mails by Americans

Since June, police officers have performed 2,600 searches using the new database feature, which is designed to analyze a snapshot or, in some cases, a security camera image, and identify the person by matching the photo with his or her driver's license photo or police mug shot.

Last week, DeWine told The Enquirer he didn't think the public needed to be notified about the launch because 26 other states have facial recognition databases.

During a news conference Monday -- held after The Enquirer's investigation in Columbus, Ohio -- DeWine said he should have announced the new facial recognition technology when it launched in June.

"If I had it to do over again, we would have put out a release the day it went up," said DeWine on Monday.

Now, more than two months into the launch, DeWine is creating an advisory group of judges, prosecutors and law enforcement officials to make recommendations for updated rules for the system's use. The new advisory group will report back to him in 60 days.

"As the different stories were in the paper about the public's concern about what the government was doing (to monitor cellphone, e-mail and Internet usage), we started looking at this," DeWine said. "While I firmly believe that the protections that are in place are adequate ... I felt that we should reach outside our department."

The facial recognition system is aimed in part at leveraging the growing prevalence of security cameras in daily life. Ohioans are on camera in parks, schools, elevators, stores, highways and parking garages. Cameras track boats on the Ohio River, gamblers at casinos, revelers at concerts and sometimes people walking in their own neighborhood.

The cameras can help to solve crimes, but opponents question whether the loss of privacy is worth the gains.

People with access to the new system -- Ohio's law enforcement officers and civilian employees of police departments -- could match any photo of people on the street to photos in the database and gain access to personal information.

Law enforcement officers have long been able to look up suspects' driver's license photos and mug shots, with laws outlining harsh penalties for misusing the records. But the facial recognition system opens up new avenues for misuse, even as it offers new opportunities for solving crimes. Before the facial recognition system's development, officers had to know a person's name or address to find a photo. Now, with facial recognition, people with access to the Ohio Law Enforcement Gateway can potentially identify any stranger they see or encounter, as long as they have a photo.

The system offers clear public safety advantages. It could make it easier to identify a dead body, a confused or mentally ill person or someone who refuses to reveal his or her identity: Just shoot a photo and run it through the system. E-mails from officials in the attorney general's office showed excitement at the possibility of uploading old photos of escaped convicts or photos sent in chat rooms by child exploitation suspects.

"For us not to do this would be a dereliction of our duty to the state of Ohio to protect them," DeWine said.

'Who approved that to go live?'

Ohio's new facial recognition system launched June 6, without the knowledge of the attorney general or his chief operating officer. Upon learning about it two weeks later, after it had already been used for 900 facial recognition searches, top officials debated turning it off.

On June 20, during a meeting with DeWine, Chief Operating Officer Kimberly Murnieks sent an urgent e-mail to DeWine's chief information officer and top deputies: "First question: Can we turn this off for now? I am told it has been 'live' for two weeks. Who approved that go live?"
^“If I had it to do over again, we would have put out a release the day it went up.^”
— Mike DeWine, Ohio attorney generalOfficials had been working to develop the facial recognition technology for three years -- even before DeWine won the race for attorney general in the November 2010 election.

So when the technology was ready, on June 6, the agency's IT workers and officials closest to the project turned it on, without getting DeWine's permission, said Tom Stickrath, head of Ohio's Bureau of Criminal Investigation.

The decision to launch the system "was almost an IT-driven thing," Stickrath told The Enquirer. "We'd been ready for quite some time and we talked about it and talked about it and talked about it. ... IT literally said to Steve Raubenolt that we were ready, and then we hit the on switch and then set up the briefing." Raubenolt is the Bureau of Criminal Investigation official who oversees the law enforcement database.

In the June 20 briefing with DeWine, officials quickly adopted a practice of calling the launch a "test," although some continued to be nervous about whether the system should have been launched before new policies were created.

Before June 20, "I didn't know it was up live, but I wasn't concerned that it was up live," DeWine said. "Whether you call it a test phase or don't call it a test phase, if we find something (wrong), we would change it, and if we find something alarming, we would shut it down. ...

"The fact that over half of states use (facial recognition technology), the fact that the FBI has used it, the fact that we have controls in (the online database) that work in the sense that we could prosecute people ... all of those indicate to me that what we have is adequate."

He said the system is still in a trial phase, but said its scope or use isn't expected to change after the trial period ends.

Communications between top officials refer to "concern" and "controversy," citing the sensitivity of privacy issues after news broke of the federal National Security Agency's secret spying efforts on cellphone calls, e-mails and Internet browsing.

System narrows millions to top 12
When a law enforcement officer or employee conducts a facial recognition search, he or she uploads a snapshot or security camera image of someone who needs to be identified. The system compares the image with more than 21 million mug shots and license photos and returns up to 12 most likely to match the snapshot.

The officer can then review the photos to judge whether any of them might be the same person in the uploaded image.
^“We'd been ready for quite some time and we talked about it and talked about it and talked about it. ... IT literally said to Steve Raubenolt that we were ready, and then we hit the on switch and then set up the briefing.^”
— Tom Stickrath, head of Ohio's Bureau of Criminal InvestigationStraight-on, high-resolution photos work the best in the system. That means security-camera stills, which are often shot from above and which are often grainy, don't often return accurate results. Photos in which people are wearing glasses or smiling also aren't as easy to match.

The database retains Ohioans' current driver's license photos and their previous two photos. Paired with the photo is all the personal information found on a driver's license -- sex, address, birth date, height, weight and eye and hair color. Since the use of driver's license photos is governed by Ohio and federal law, residents don't receive anything when they get their license photo taken that explains how the government may use the photo, said Ohio Bureau of Motor Vehicles spokesman Joe Andrews.

After finding out the facial recognition software had launched, DeWine said he instructed his advisers to develop recommendations for emphasizing the seriousness of its use.

"I said at that point, 'Look, we're doing this. We're going to continue to do it, (but) we'd probably ought to look at this as a trial stage where we look at who is using it and what are they using it for,' " he said. " 'Is the protocol strong enough? Do we have enough protection?' "

Two months later, in mid-August, DeWine signed off on a plan to develop new protocols. Officials plan to:
• Freshen a policy given to law enforcement agencies to remind them online tools are to be used only as part of "the administration of criminal justice."
• Beef up the agreements that users and agency heads must sign before using the database.

Meanwhile, use of the facial recognition system continues. While the attorney general's office doesn't keep statistics on the number of arrests made after police get a lead from a facial recognition match, law enforcement officials already have some success stories.

In Solon, near Cleveland, police used the tool when they found an abandoned baby stroller that included baby wipes covered in blood. Using a family photo found in the stroller, police were able to identify the owners. The baby was fine, but they did come upon a domestic dispute between the parents, DeWine said. In Indiana, a man arrested for a range of thefts had four driver's licenses, all for different identities, and Ohio's facial recognition system was able to point out an additional name he had used.

"These (new) protocols would balance a concern for privacy with the great benefit that can come, the criminals that can be caught, and crimes prevented by the use of this technology," DeWine wrote in a chain of official e-mails sent Aug. 15.
"There certainly will be lives saved by its use."
http://www.latimes.com/business/money/la-fi-mo-baby-boomers-may-have-no-one-to-care-for-them-in-old-age-20130826,0,2883385.story

RELATED

http://www.alipac.us/f9/state-photo-...police-281150/

RELATED

http://www.alipac.us/f12/fbi%92s-nex...-track-261195/