B. Fourth Amendment

The two district courthouses serving Cheltenham Township, Pennsylvania, adjudicate landlord-tenant disputes and municipal ordinance violations and also hold preliminary hearings and arraignments on more serious criminal charges.102 Several years ago, the Cheltenham Township Police Department stationed officers outside a courthouse parking lot to “perform counter-surveillance”—taking photos of people attending the court hearing of an alleged gang member. These photos were then run through Pennsylvania's face recognition system, which searches state mug shots and, beginning in 2012, all 34 million Pennsylvania driver’s license photos.103 We do not know if the photos were taken of suspected criminals—or if they were just people who happened to be in the courthouse parking lot.

This may seem unremarkable: Surreptitious police photography is an established policing technique. While the Fourth Amendment protects us against “unreasonable searches and seizures,” it is unclear whether face recognition constitutes a “search.” (See Sidebar 3.)

Protections from “unreasonable searches and seizures” can originate in any of the three branches of government: the judiciary, the legislature, or the executive, which includes law enforcement. Instead of allowing those protections to grow old and out of date, however, legislatures across the country are passing dozens of laws restricting the use of 21st century tracking technology to monitor public conduct. When legislators have hesitated, state and federal courts have stepped in and interpreted the Fourth Amendment to require warrants and other protections.

Unfortunately, courts and legislatures by and large have not applied these protections to face recognition technology. In the absence of guidance from legislatures and courts, police departments have created systems that often fall short of the protections offered against other tracking technology.

  • 102. Magisterial District Courts of Pennsylvania are courts of limited jurisdiction that handle landlord-tenant disputes, small claims of up to $12,000, summary offenses, municipal code violations, and preliminary hearings and arraignments in misdemeanor and felony offenses that will be tried in higher courts. Magisterial District Courts, County of Montgomery Magisterial District Courts, Montgomery County, http://www.montcopa.org/300/Magisterial-District-Courts (last visited Aug. 18, 2016). Cheltenham Township is served by Magisterial District Court 38-1-02 and 38-1-03. Magisterial District Courts, County of Montgomery Magisterial District Courts, Montgomery County, (Sept. 19, 2016), http://www.montcopa.org/DocumentCenter/View/10059 (last visited Aug. 18, 2016).
  • 103. See Pennsylvania JNET, Pennsylvania Justice Network 2012–2013 Annual Report, Document p. 016738; Welcome to the JNET Facial Recognition System Slides (May 5, 2014), Document p. 010750.

SIDEBAR 3: Face recognition and the Fourth Amendment.

Before 1967, the Supreme Court generally adhered to a property-based view of the Fourth Amendment. Judges’ rulings on whether or not a Fourth Amendment “search” occurred largely turned on the existence of trespass.104 In 1967, however, the Court declared in Katz v. U.S. that “the Fourth Amendment protects people, not places.”105 In a concurrence, Justice Harlan set forward a test, additional to trespass, to determine whether or not a Fourth Amendment “search” had occurred: Has the government infringed on an expectation of privacy that “society is prepared to recognize as ‘reasonable’”?106 This became known as the “reasonable expectation of privacy” test.

The Supreme Court has never formally recognized a reasonable expectation of privacy in public conduct. In the 1983 case of U.S. v. Knotts, the Supreme Court found that the use of technology to track a person’s public movements—movements otherwise visible to the naked eye—did not infringe a reasonable expectation of privacy.107 In U.S. v. Jones (2012), the Court reiterated that it had not “deviated from the understanding that mere visual observation does not constitute a search.”108

Nevertheless, in Jones, a “shadow majority” of five justices expressed a willingness to reevaluate the contours of the reasonable expectation of privacy test to encompass some forms of geolocation tracking of public movements.109 In later cases, the Supreme Court highlighted the transformational nature of 21st century surveillance technology—and rejected simplistic comparisons of modern technology to older policing practices. In Riley v. California (2014), for example, the Court ridiculed the government’s contention that a search of an arrestee’s smartphone was “materially indistinguishable” from a search of a person’s pockets upon arrest. “That is like saying a ride on horseback is materially indistinguishable from a flight to the moon,” Justice Roberts wrote.110

At publication, no cases in any state or federal court—let alone the Supreme Court—have addressed whether any form of law enforcement face recognition constitutes a Fourth Amendment search. It is unclear whether the Court would treat face recognition as being tantamount to “mere visual observation”—or if the Court would analogize it to space travel.

  • 104. See Olmstead v. United States, 277 U.S. 438, 473–75 (1928).
  • 105. See Katz v. United States, 389 U.S. 347, 351 (1967).
  • 106. See Katz v. United States, 389 U.S. 347, 361 (1967) (Harlan, J., concurring).
  • 107. See United States v. Knotts, 460 U.S. 276, 282 (1983) (finding that a criminal defendant lacked a reasonable expectation of privacy in his movements on public roads where those movements were visually observable to the public, and that police use of a beeper to track those movements “does not alter the situation”).
  • 108. 132 S. Ct. 945 at 953 (2012).
  • 109. See United States v. Jones ,132 S. Ct. 945 at 954 (Sotomayor, J., concurring); 132 S. Ct. 945 at 957–58  (Alito, J., concurring) (2012).
  • 110. See Riley v. California, 134 S.Ct. 2473, 2488 (2014).

1. Courts have limited geolocation tracking—but not face recognition.

Except for forensic analysis of latent fingerprints and DNA, law enforcement collection of biometric information has typically required a physical search or handling of a suspect—e.g., reaching into their mouth for a buccal swab, or rolling their fingers on an inkpad. The physical nature of these searches or seizures may seem like a small detail, but it has major consequences for the Fourth Amendment: Namely, it means that judges have felt comfortable regulating that conduct under the Fourth Amendment.111

Face recognition changes the equation by allowing tracking and identification outside of a traditional Fourth Amendment search or seizure. The Pinellas County Sheriff’s Office’s use policy for mobile biometric identification (Figure 8 below112) illustrates this powerfully.

  • 111. See Maryland v. King, 133 S.Ct. 1958, 1968–1969 (2013) (“It can be agreed that using a buccal swab on the inner tissues of a person’s cheek in order to obtain DNA samples is a search.”); Florida v. Hayes, 470 U.S. 811, 816 (1985) (finding that a Fourth Amendment seizure has clearly occurred where the police “forcibly remove a person from his home or other place in which he is entitled to be and transport him to the police station”).
  • 112. Pinellas County Sheriff’s Office, Standard Operating Procedure POB 52: Mobile Biometric Usage (Jan. 12, 2016), Document p. 014375.
Pinellas County Sheriff’s Office, Standard Operating Procedure: Mobile Biometric Usage.
Figure 8 :  Pinellas County Sheriff’s Office, Standard Operating Procedure: Mobile Biometric Usage.

PCSO bars officers from physically detaining individuals, and stresses that the absence of consent should not preclude officers from taking a photograph in a public place. Rather, if someone is in public, officers are encouraged to photograph that person and use biometric identification “whenever practical.”113

In this respect, face recognition is not alone—geolocation tracking via cell-site location information, automated license plate readers (ALPRs), and drones also allow tracking through non-invasive observation. Thus, as Sidebar 3 suggests, all of these tracking technologies would seem to fall into a constitutional grey area.114

And yet a growing number of state supreme courts and lower federal courts are interpreting the Fourth Amendment to limit public surveillance. This is clearest with geolocation tracking. Federal district courts in California and New York have found that individuals do have a reasonable expectation of privacy in the extended records of their movements revealed by cell-site location information—and that the Fourth Amendment requires police to get a warrant to obtain this information.115 The highest courts of Massachusetts and New Jersey have done the same, although each state reached this conclusion by interpreting their state constitutions, rather than the Fourth Amendment.116 In these cases, the courts recognized that dragnet-style surveillance raises serious and novel privacy concerns—and that those concerns are not extinguished by the fact that the behavior tracked occurs in public.117

To date, however, not a single state or federal court has considered the question of whether a face recognition search constitutes a search for the purposes of the Fourth Amendment, or an analogous provision in a state constitution. As a result, the Fourth Amendment implications of face recognition technology remain an open question.

  • 113. Pinellas County Sheriff’s Office, Mobile Biometric Usage Policy (Apr. 26, 2016), Document p. 014375.
  • 114. Cell-site location tracking—tracking a suspect’s smartphone by getting location information from his wireless carrier—hits another Fourth Amendment hurdle: The idea that we have no reasonable expectation of privacy in information we volunteer to a third party—in the present case, our phone company. See, e.g., Smith v. Maryland, 442 U.S. 735, 746–47 (1979); United States v. Graham, 824 F.3d 421, 437-38 (4th Cir. 2016) (en banc).
  • 115. See In re Application for Tel. Info. Needed for a Criminal Investigation, 119 F. Supp. 3d 1011, 1023 (N.D. Cal. 2015), appeal dismissed (Feb. 5, 2016) (finding that “individuals have an expectation of privacy in the historical CSLI associated with their cell phones, and that such an expectation is one that society is willing to recognize as reasonable”); id at 1039 (requiring a warrant for historical cell-site location information); In re U.S. for an Order Authorizing the Release of Historical Cell-Site Info., 809 F. Supp. 2d 113, 119–20 (E.D.N.Y. 2011) (finding that “cell-phone users maintain a reasonable expectation of privacy in long-term cell-site-location records”); id at 127 (requiring a search warrant for historical cell-site location information).
  • 116. See Commonwealth v. Augustine, 4 N.E.3d 846, 865-66 (Mass., 2014), State v. Earls, 70 A.3d 630, 644 (N.J., 2013). Separately, see Tracey v. State, 152 So. 3d 504, 526 (Fla. 2014), reh'g denied (Dec. 8, 2014) (imposing a probable cause requirement for obtaining real-time cell-site location data in Florida);
  • 117. See, e.g., In re Application for Tel. Info. Needed for a Criminal Investigation, 119 F. Supp. 3d 1011, 1020–21 (discussing the Knotts court’s indication that dragnet-style surveillance would raise issues distinct from those presented in the instant case); Tracey v. State, 152 So. 3d at 513 (discussing the Knotts court’s indication that dragnet-style surveillance would raise issues distinct from those presented in the instant case).

2. Legislatures have not placed meaningful limits on law enforcement face recognition.

The Fourth Amendment acts as a floor, not a ceiling, for the protections the government can extend to its citizens against a particular police practice. This means that legislatures are free to create more privacy protections and safeguards than the minimum that courts believe the Fourth Amendment requires.

Legislators across the country have eagerly passed laws expanding the privacy rights of citizens against a range of 21st century public tracking technology. A total of 17 states have passed laws regulating law enforcement geolocation tracking, and 13 states have passed laws regulating law enforcement’s use of drones; these laws generally require that police obtain warrants, supported by probable cause, before engaging in tracking.118 Another 9 states have passed laws regulating police use of automated license plate readers (ALPRs).119 Although most of these laws do not generally require warrants, they do generally limit when ALPRs can be deployed, how the data they collect can be used and shared, and how long that data can be kept.

  • 118. See generally Cal. Penal Code §§ 1546 et seq.; Colo. Rev. Stat. Ann. § 16-3-303.5; 724 Ill. Comp. Stat. Ann. 168/1 et seq.; Ind. Code Ann. §§ 35-33-5-15; Me. Rev. Stat. tit. 16, §§ 647 et seq.; Md. Code Ann. Crim. Proc. §1-203.1; Minn. Stat. § 626A.42; Mont. Code Ann. § 46-5-110; N.H. Rev. Stat. Ann. §§ 644-A:1 et seq.; R.I. Gen Laws Ann. §§ 12-32-1 et seq.; Tenn. Code Ann. § 39-13-610; Utah Code Ann. §§ 77-23c-101 et seq.; Va. Code Ann. § 19.2-70.3; 13 V.S.A. § 8102; Wash. Rev. Code Ann. §§ 9.73.260 et seq.; Wis. Stat. Ann. § 968.373;  Alaska Stat. Ann. §§ 18.65.900 et seq.; Ind. Code Ann. 35-33-5-9; Fla. Stat. Ann. § 934.50; Ind. Code Ann. 35-33-5-9; 725 Ill. Comp. Stat. Ann. 167/1 et seq.; Me. Rev. Stat. tit. 25, § 4501; 2015 Nev. Rev. Stat. Ann. §493.112(2)-(4); N.C. Gen. Stat. Ann. §§ 15A-300.1 et seq.; N.D. Cent. Code Ann. §§ 29-29.4-01 et seq.; Or. Rev. Stat. §§ 837.310 et seq.; Tenn. Code Ann. §§ 39-13-609, 39-13-902; Utah Code Ann. §§ 63G-18-101 et seq.; Vt. Stat. Ann. Tit. 20, § 4622; Va. Code Ann. § 19.2-60.1.
  • 119. Cal. Veh. Code § 2413; Cal. Civ. Code §§ 1798.29, 1798.90.5; Colo. Rev. Stat. Ann. § 24-72-113; Me. Rev. Stat. tit. 29-a, § 2117-A; Md. Code Ann., Pub. Safety § 3-509; Minn. Stat. §§ 13.82, 13.824, 626.847; N.H. Rev. Stat. Ann. §§ 261.75-b, 236.130; N.C. Gen. Stat. Ann. §§ 20-183.30 et seq.; Utah Code Ann. §§ 41-6a-2001 et seq.; Vt. Stat. Ann. tit. 23, §§ 1607 et seq.

Number of states that regulate police use of…

13
Drones
9
Automated license plate readers
17
Geolocation tracking
5
Face recognition

Not a single state has passed a law that places comprehensive limits on law enforcement use of face recognition technology. Five states have passed laws that limit some discrete aspect of police face recognition use.

  • Police Body Worn Camera Footage. In 2015, Oregon passed a law barring face recognition searches of recordings from police body-worn cameras, but leaving open the possibility that face recognition may be used on live videos rather than recordings.120 Recently, New Hampshire passed a similar law, which will take effect in 2017.121 (Below the level of state law, the city of Cincinnati adopted a similar regulation, and six local police departments have adopted use policies roughly to this effect.)122
  • Police Drone Footage. Two states, Maine and Vermont, have passed laws restricting the use of face recognition on footage collected by police drones. The Vermont law states that face recognition shall not be used on any data that a drone collects “on any person, home, or area other than the target of the surveillance.”123 The Maine law is more ambiguous, requiring state officials to issue rules for drones that will restrict the use of face recognition.124
  • Destruction of Records. Michigan law requires the destruction of biometric data, including the fingerprint and face recognition data from people who are arrested but never charged or who are found innocent.125 The law provides little else by way of protection, however. Instead, it expressly authorizes the collection of biometric data for almost all crimes, and expressly allows non-criminal biometric information—for example, face recognition data derived from a driver’s license photo—to be used for criminal purposes.126

Given their limited scope, none of these laws provide the range of protections afforded by most state laws governing geolocation tracking, drones, or automated license plate readers.

Apart from regulating police face recognition systems, seven states directly or indirectly curb law enforcement access to state department of motor vehicle face recognition systems, which are typically designed to detect identity fraud. Maine, Missouri, New Hampshire and Vermont have blanket bans on their DMVs using biometric technology or collecting biometric data.127 Washington stipulates that the DMV can use biometric technology only to verify the identity of a license or ID card holder.128

Both Washington and Oregon prohibit disclosure of biometric data to law enforcement, although Washington allows disclosure for identity theft crimes.129 Hawaii’s regulations do not expressly address face recognition, but nonetheless block law enforcement access to license photos outside of investigations into identity theft.130

The few, discrete protections that these laws do provide may be easily evaded. Vermont law, for example, expressly prohibits its Department of Motor Vehicles from implementing “any procedures or processes for identifying applicants for licenses, learner permits, or non-driver identification cards that involve the use of biometric identifiers.”131 Somehow, however, Vermont has interpreted this provision to allow the FBI to request—and obtain—face recognition searches of 1.8 million Vermont driver’s license and ID photos.132 Given that they do not directly constrain law enforcement, other states’ DMV provisions could be read in a similarly narrow manner.

  • 120. See Or. Rev. Stat. § 133.741(1)(b)(D).
  • 121. See N.H. Rev. Stat. Ann. § 105-D:2(XII) (effective Jan. 1, 2017).
  • 122. The city of Cincinnati and police departments in five other localities bar searches of body-worn camera recordings, but allow analysis of footage from particular incidents. See Cincinnati Police Department, Body Worn Camera System (July 14, 2016), https://www.bwcscorecard.org/static/policies/2016-07-14 Cincinnati - BWC Policy.pdf (“Stored video and audio from a BWC shall not . . .  Be searched using facial recognition software. [ . . . ] This does not prohibit CPD from using recognition software to analyze the recording of a particular incident when reasonable suspicion exists that a specific suspect or person in need of assistance may be a subject of a particular recording.”); Baltimore Police Department, Policy 824: Body Worn Cameras Pilot Program (Oct. 26, 2015), https://www.bwcscorecard.org/static/policies/2015-10-26%20Baltimore%20-%20BWC%20Policy.pdf ( “Stored video and audio data from a BWC shall not … be searched using facial recognition software” but same exception); Baltimore County Police Department, BCoPD Body-Worn Camera Use Policy at “System Recordings”, https://www.bwcscorecard.org/static/policies/2016-07-14%20Baltimore%20County%20-%20BWC%20Policy.pdf (“System records … may not be … searched using facial recognition software” but same exception); Montgomery County Police Department, Body Worn Camera System (Apr. 20, 2016), https://www.bja.gov/bwc/pdfs/MCPD-BWCS-Pilot-Program-Summary-Report.pdf ( “The stored video and audio data from a BWCS recording may not … be searched using facial or voice recognition software” but same exception); Parker Police Department, Parker Police Department Policy and Procedures Manual: Recording Devices and Imaging Equipment (May 6, 2016), https://www.bwcscorecard.org/static/policies/2016-05-06 Parker - BWC Policy.pdf (“The Department shall not utilize any biometric technology, such as facial recognition, to conduct searches of video files. Stored video and audio data from a BWC shall not … be searched using facial recognition software” with same exception). The Boston police adopted a policy that appears to bar real-time face recognition. See Boston Police Department, Body-Worn Camera Pilot Program Policy (July 12, 2016), https://www.bwcscorecard.org/static/policies/2016-07-12 Boston - BWC Policy.pdf (“BWC’s will not include technological enhancements including, but not limited to, facial recognition or night-vision capabilities.”).
  • 123. Vt. Stat. Ann tit. 20 § 4622(d)(2) (“Facial recognition or any other biometric matching technology shall not be used on any data that a drone collects on any person, home, or area other than the target of the surveillance.”).
  • 124. Me. Rev. Stat. Ann. tit. 25 § 4501(5)(D) (“Restrictions on the use of … facial recognition technology, thermal imaging and other such enhancement technology”).
  • 125. See Mich. Comp. Laws Ann. § 28.243(7)-(8).
  • 126. Mich. Comp. Laws Ann. § 28.243 at (1), (2), (4), (5); Mich. Comp. Laws Ann. § 28.248.
  • 127. See Me. Rev. Stat. Ann. tit. 29-A, § 1401 (“9. Use of biometric technology. The Secretary of State may not use biometric technology, including, but not limited to, retinal scanning, facial recognition or fingerprint technology, to produce a license or nondriver identification card.”); Mo. Ann. Stat. § 302.189 (“The department of revenue shall not use, collect, obtain, share, or retain biometric data nor shall the department use biometric technology, including, but not limited to, retinal scanning, facial recognition or fingerprint technology, to produce a driver's license or nondriver's license or to uniquely identify licensees or license applicants for whatever purpose.”); N.H. Rev. Stat. Ann. § 260:10-b (“The state shall not collect, obtain, or retain any biometric data in connection with motor vehicle registration or operation, or in connection with driver licensing.”) and N.H. Rev. Stat. Ann. § 263:40-b (“The department is prohibited from using any facial recognition technology in connection with taking or retaining any photograph or digital image for purposes of this chapter.”); Vt. Stat. Ann. tit. 23, § 634(c) (“The Department of Motor Vehicles shall not implement any procedures or processes for identifying applicants for licenses, learner permits, or nondriver identification cards that involve the use of biometric identifiers.”)
  • 128. See Wash. Rev. Code Ann. § 46.20.037(1) (stipulating that DMV may use its face recognition system “only to verify” applicants identities and prevent identity fraud).
  • 129. See Wash. Rev. Code Ann. § 46.20.037(4)(d); Or. Rev. Stat. Ann. § 807.026 (“biometric data may not be made available to anyone other than employees of the [Department of Transportation] acting in an official capacity”).
  • 130. Haw. Code R. § 19-122-1(g) (“Except as may be required by law, the examiner of drivers shall not permit a digital image or personal information obtained from a state of record to be accessed or used by a law enforcement agency or personnel of such agency for any other purpose.”).
  • 131. See Vt. Stat. Ann. tit. 23, § 634(c).
  • 132. See U.S. Gov’t Accountability Office, GAO-16-267, Face Recognition Technology: FBI Should Better Ensure Privacy and Accuracy 47 (May 2016).

3. Most police departments place few constraints on face recognition.

In September 2015, the Department of Justice announced a new policy for federal law enforcement’s use of cell-site simulators. Up until that point, the Department had obtained what it viewed as “appropriate legal authorization” before using the devices.133 The authorization was less than a warrant; rather, the Department had merely certified to a judge that the information being obtained was “relevant to an ongoing criminal investigation.”134 Now, however, the Department announced that, not as a matter of law, but “as a matter of policy,” federal law enforcement would seek a warrant before using a cell-site simulator.135

The Department of Justice’s announcement illustrates an important and often overlooked principle: Law enforcement agencies are free to voluntarily adopt restrictions on tracking technology that go above and beyond their view of what current statutes or case law requires.

While some agencies have exercised that authority, a surprising number of police departments appear to have not taken basic steps to limit use of face recognition. We can evaluate these agencies on three simple metrics:

  • Have they adopted a use policy telling officers when it is appropriate to use face recognition, and how they should and should not use it?
  • What degree of individual suspicion do they require prior to running a search?
  • Do they limit the use of face recognition to certain serious offenses?

a. A surprising number of agencies have not adopted use policies.

Of 52 agencies, at least 24 either did not provide a face recognition use policy in response to our document requests, or were clearly covered by another agency’s use policy.136 At least five of those agencies—the Daytona Beach Police Department, the Jacksonville Sheriff’s Office, the Nebraska State Patrol, the Kansas City Police Department (former program), and the Iowa Department of Public Safety—expressly acknowledged that they did not have a use policy (or, in the case of Iowa, a “finalized” use policy) for law enforcement face recognition.137

b. A minority of agencies clearly require individualized suspicion prior to search.

Even though several agencies provided contract documents for real-time face recognition systems, not a single agency provided documents suggesting that they require a warrant—or judicial approval of any kind—prior to any face recognition search.

The agencies did, however, impose different kinds of legal restrictions that do not require judicial approval. Some agencies require officers to have an individualized suspicion that the individual whose photo is being submitted for a search be involved in a crime, but they vary in the degree of suspicion required. The agencies may require that officers have probable cause to believe that the individual search for was involved in a crime, or the agencies may merely require that an officer have reasonable suspicion to that effect.

Other agencies do not require any degree of individualized suspicion and instead only stipulate that face recognition searches must be conducted for criminal justice or law enforcement purposes. In these jurisdictions, anyone’s face can be searched in their face recognition database, so long as this is done in furtherance of a law enforcement mission.

Overall, of the 52 agencies, plus the FBI face recognition unit (FACE Services), we were able to determine the legal standard that applied to face recognition for only 24 of them, plus the FBI. Of those agencies, three required probable cause, and 10 required reasonable suspicion. The remainder either required a criminal justice purpose or provided no documentation to suggest a legal standard of any kind. Putting it differently, only 13 of 52 agencies (25%) clearly required any degree of individualized suspicion (e.g. reasonable suspicion or probable cause) prior to a face recognition search.

  • 133. See Office of Public Affairs, Department of Justice, Justice Department Announces Enhanced Policy for Use of Cell-Site Simulators (Sept. 3, 2015), https://www.justice.gov/opa/pr/justice-department-announces-enhanced-policy-use-cell-site-simulators.
  • 134. U.S. Department of Justice, Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology (Sept. 3, 2015) at 4, https://www.justice.gov/opa/file/767321/download.
  • 135. See Department of Justice, Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology (Sept. 3, 2015) at 3, https://www.justice.gov/opa/file/767321/download (“While the Department has, in the past, appropriately obtained authorization to use a cell-site simulator by seeking an order pursuant to the Pen Register Statute [sic], as a matter of policy, law enforcement agencies must now obtain a search warrant supported by probable cause…”) (emphasis added); see also 18 U.S.C. § 3122(b)(2) (pen register statute requiring “a certification… that the information obtained is relevant to an ongoing criminal investigation being conducted by that agency”).
  • 136. These agencies are: Baltimore Police Department; Chicago Police Department; Daytona Beach Police Department; Iowa Department of Public Safety; Jacksonville Sheriff’s Office; Los Angeles County Sheriff’s Department; Los Angeles Police Department; Maryland Department of Public Safety and Correctional Services; Maryland State Police; Miami Police Department; Minnesota Department of Public Safety; Montgomery County Police; Nebraska State Patrol; San Francisco Police Department; Tampa Police Department; Texas Department of Public Safety; Virginia State Police; Arizona Department of Public Safety; Auburn Police Department; Illinois State Police; Kansas City Police Department; New Bedford Police Department; Plymouth County Sheriff’s Department; and the San Jose Police Department.
  • 137. See Daytona Beach Police Department, Interview with Jimmy Flynt (Jan. 19, 2016) Document p. 000107; Jacksonville Sheriff’s Department, Interview with Crime Analysis Unit Manager Celbrica Tenah (Feb. 17, 2016) Document p. 010709; Nebraska State Patrol, Letter from Agency Legal Counsel Wendy Wussow (Feb. 16, 2016), Document p. 009181; Kansas City Police Department, Interview with Sgt. Jake Becchina (Jan. 28, 2016), Document p. 010191; Iowa Department of Public Safety, Letter from Commissioner Roxann M. Ryan to Clare Garvie (Apr. 1, 2016), Document p. 011911 (“Our Department has not yet adopted a final policy.”). Note that while the Daytona Beach and Jacksonville jurisdictions access the Pinellas County Sheriff’s Department face recognition system, they do not appear to be required to follow the Pinellas County use policy.
Legal Standards for Face Recognition Search, by Jurisdiction
Figure 9 :  Legal Standards for Face Recognition Search, by Jurisdiction

Perversely, as Figure 9 shows, the agencies engaging in higher risk deployments appear less likely to require individualized suspicion.138 Of the 29 agencies that have used face recognition under a Moderate Risk deployment model—either Stop and Identify or Arrest and Identify using a mug shot database—10 of them (34.5%) required some form of individualized suspicion. Meanwhile, of the 24 agencies (including the FBI) that have used a High Risk deployment—Stop and Identify or Arrest and Identify using a driver’s license database—only three (12.5%) require individualized suspicion.

  • 138. The Michigan State Police requires probable cause, or that a subject is unable to provide identification due to incapacitation, for the use of face recognition on mobile devices. See Michigan State Police, SNAP Acceptable Use Policy, Document pp. 011436–011439 (Michigan Department of State images encompass driver’s license photographs). It is unclear from the use policy what the standard is for desktop searches, but in correspondence the Department indicated that a “law enforcement reason” is required. Michigan State Police, Letter to Clare Garvie on state one-page feedback, Document p. 016824. Both mobile and desktop systems can run searches against Michigan’s driver’s license photo database. Michigan State Police therefore is listed both in Probable Cause : High Risk Deployment and Unknown : High Risk Deployment.
Agencies engaging in higher risk deployments appear less likely to require individualized suspicion for a search.

The absence of an individualized suspicion requirement means that face recognition may be used on effectively anyone—e.g., a pedestrian anywhere near a crime—so long as some criminal justice purpose can be cited for the search. At least three agencies—including the FBI face recognition unit (FACE Services)—expressly allow face recognition searches to identify witnesses to a crime, not just criminal suspects.139

c. Only one agency limits face recognition use to certain crimes.

When Congress passed the Wiretap Act in 1968, it did not allow wiretaps of oral and phone communications for all criminal investigations. Rather, it restricted federal wiretaps of those communications to investigations of certain serious federal offenses. Congress gave even narrower authority to state law enforcement, allowing wiretaps only for certain felonies.140

There are echoes of this trend in modern law enforcement biometrics. Jurisdictions may search the FBI face recognition database (NGI-IPS) for investigations of any crime—regardless of the nature or the severity of the offense.141 But in order to be enrolled in that database’s “unsolved photo file”—a photo file of unidentified individuals that is compared to every new photo enrolled in the database—a photograph must pertain to an investigation of a felony offense for criminal homicide, forcible rape, robbery, or aggravated assault.142

Likewise, in Maryland v. King, the Supreme Court upheld a Maryland law requiring the collection of DNA from all individuals charged with violent crimes, burglary, or attempted burglary, and the search of their DNA against the federal DNA database, which includes forensic DNA samples from unsolved crimes.143 In upholding that program and differentiating it from a generalized search, however, the Court cited the “fundamental” distinction that Maryland’s DNA searches were limited to individuals arrested, detained, and charged with a serious criminal offense.144

None of the 52 responsive agencies clearly restricted face recognition use to more serious crimes. Only one, the Nebraska State Patrol, limited its use to a certain kind of offense—identity theft.145

  • 139. The other agencies are the Michigan State Police and the Pennsylvania Justice Network. Federal Bureau of Investigation, Department of Justice, Privacy Impact Assessment for the FACE Services Unit, at 10–11 (May 1, 2015), https://www.fbi.gov/services/records-management/foia/privacy-impact-assessments/facial-analysis-comparison-and-evaluation-face-services-unit (“Probe photos are potential subjects, victims, or witnesses of/to federal crimes that have been collected pursuant to authorized FBI investigations.”). Michigan State Police, Interview with Peter Langenfeld, Program Manager, Digital Analysis and Identification Section (Mar. 23, 2016), Document pp. 010928 (MSP allows face recognition searches to identify witnesses to a crime, not just criminal suspects) Michigan State Police, Mobile Facial Recognition, Web Application Instructions, Document p. 011345 (The image of “capture” drop-down includes the categories: insufficient ID, warrant, criminal suspect, witness, victim, other as categories under which an officer can add a probe on a mobile device.). Pennsylvania Justice Network, JNET Facial Recognition User Guide, Document p. 010845 (“Facial recognition is used primarily with images of suspects or witnesses from surveillance or CCTV cameras, but can also be used with photos from other sources, such as social media sites or still photos.”)
  • 140. See The Omnibus Crime Control and Safe Streets Act of 1968 (Pub.L. 90–351, 82 Stat. 197, enacted June 19, 1968, codified at 42 U.S.C. § 3711); 18 U.S.C. § 2516(1)-(2).
  • 141. See Criminal Justice Information Services Division, Federal Bureau of Investigation, U.S. Department of Justice, Interstate Photo System (IPS) Policy and Implementation Guide (Version 1.2) (Sept. 3, 2014) Document p. 009325 (not establishing any crime-based limitation on searches and stating that “[i]t is the responsibility of the user agency to develop appropriate usage policies for the IPS component…”).
  • 142. See Criminal Justice Information Services Division, Federal Bureau of Investigation, U.S. Department of Justice, Interstate Photo System (IPS) Policy and Implementation Guide (Version 1.2) (Sept. 3, 2014) at 3, Document p. 009320) (specifying that such photos must be “lawfully obtained pursuant to an authorized criminal investigation and meeting a felony crimes against persons Uniform Crime Report coding definition”).
  • 143. Maryland v. King, 133 S.Ct. 1958, 1979-80 (2013); Md. Code Ann., Pub. Safety 2-504(d)(1).
  • 144. Maryland v. King, 133 S.Ct. 1958, 1977-78 (2013).
  • 145. See Nebraska State Patrol, Memorandum of Understanding between the Nebraska State Patrol and the Nebraska DMV , Document p. 009190 (restricting Nebraska State Patrol’s access to the Nebraska DMV’s photo repository for the purpose of “enhanc[ing] the ID Theft Task Force Working Relationship between the NSP and the DMV”).

Sidebar 4: Scoring Fourth Amendment Protections

Our score for Fourth Amendment protections turns on the level of individualized suspicion required prior to running a face recognition search. Where a jurisdiction relies on a driver’s license rather than a mug shot database, however, the score takes into account proportionality (i.e., Does the jurisdiction restrict the use of dragnet-style driver’s license photo databases to the investigation of serious offenses or identity crimes?). In other words, our score uses a bifurcated standard. If the agency uses face recognition on databases that include only mug shots, the first standard is used. If the agency uses face recognition on databases that include driver’s license photos, the second standard is used.

Targeted database—mug shots only.

  • + Reasonable suspicion for the person to be searched, and at least one of the following: (1) searches are limited to suspects and victims of crimes; and (2) Investigate and Identify searches are limited to felonies only.
  • 0 Reasonable suspicion for the person to be searched but the standard has exceptions or allows for searches for bystanders or witnesses as well.
  • - No legal standard stated, or a statement that face recognition may be used for any “law enforcement” or “criminal justice” purpose.

Dragnet database—license and ID photos.

  • + (1) Searches are limited to investigations of serious offenses and require a warrant or court order supported by probable cause; or (2) searches are limited to identity-related crimes.
  • 0 Probable cause searches are limited to investigations of serious offenses (for non-identity-related crimes).
  • - Anything less than probable cause (for non-identity crimes).

Next Section