Getting driver’s license puts Arizonans into ‘perpetual criminal lineup’

If you have a driver’s license in Arizona, your face now lives in a government database that uses facial recognition technology to see if you’re really who you say you are, or if you’re stealing someone else’s identity.

But that’s not the only use of the system – law enforcement at all levels can also run photos using the facial recognition technology to see if you’re wanted for a crime.

That’s what one researcher refers to as a “perpetual lineup.” Most people living in Arizona, at any given time, are part of a constant police lineup, simply by virtue of having a driver’s license.

Here’s how it works: After someone at the Motor Vehicle Division takes your photo, your face is scanned by a system based on a proprietary algorithm that analyzes facial features. The system compares your face against the 19 million photos in the state’s driver’s license database to look for similarities. If an image is similar enough, the system will flag it for further review.

The Arizona Department of Transportation publicly boasts about the more than 100 cases it has taken to court for fraud using the technology, which has been in place since early 2015.

But beyond press releases touting its successes, the department does not inform people who have applied for a license that their photos will be scanned perpetually for law enforcement purposes. No such disclosure appears on the license application.

ADOT officials say they believe people know about the technology and its full usage despite the lack of disclosure. And department officials say the public should welcome the searches.

Michael Lockhart, the chief of ADOT’s inspector general’s office, said the department hasn’t heard any concerns from citizens about privacy or security.

“We’ve never had anybody that has asked us or been concerned about it,” Lockhart said. “Frankly, if you look at the whole concept of a driver’s license or an ID, you willingly go get those. It isn’t like you’re thinking this is all going to be private.”

Motorists must have 
a driver’s license

While some groups take issue with facial recognition in general, most say it’s not necessarily the use of the technology to root out fraud in identification that is an issue. When such a powerful technology is available, missions could expand to other areas, experts say.

And law enforcement’s access to the program means the technology at ADOT is being used outside its intended purpose of finding fraud, they say.

Couple the concerns about the perpetual lineup with the lack of disclosure to license-holders, and you have a problematic situation, said Clare Garvie, a fellow at the Georgetown Law Center on Privacy and Technology. Garvie authored a study, “Perpetual Line-Up,” on facial recognition that is widely cited for its public records-based dive into how law enforcement uses state-run facial recognition databases, and how little oversight there is on the government’s use of such technology.

“If you don’t know that a system is in place, you actually don’t have the choice of  consenting to it or not,” Garvie said.

Informed consent, through giving notice to people that their faces will be matched up against millions of others when they apply for a license, is a basic tenet of privacy, Jim Dempsey, the executive director of the Berkeley Center for Law & Technology, said.

Even if notice is given, it’s unlikely that people would opt out of getting a license because facial recognition technology is used because people will decide driving a car and having a legal ID outweigh the risks, Dempsey said.

“It’s an important element. The lack of it is an issue, but it’s one that should be corrected and would be easy to correct,” he said.

Why they say 
it’s needed

The Transportation Department says the use of facial recognition allows it to maintain the quality and accuracy of the IDs it issues.

On average, the system flags 200 new licenses each day, according to ADOT spokesman Ryan Harding. Of the 200, 5 percent, or 10, typically move to a second level and require further evaluation. Of those 10, usually one will advance to a final step and become an active investigation, he said.

The list of criminals charged because of the facial recognition program is extensive. Examples include a man who stole the identity of a dead baby, a sex offender who stole identities and racked up charges under other names, and a woman who used stolen identities to get government benefits she wasn’t entitled to.

The technology has also been used in immigration enforcement. A statement of probable cause for an arrest in September by Immigration and Customs Enforcement show ADOT flagged an undocumented man for applying for a license under someone else’s name.

When ADOT searched his house, they found two guns, ID documents and Social Security cards in other names. The man, Mario Rivera-Gamboa of Mexico, was previously deported in 1999, court documents say, after he was convicted of aggravated assault and a drive-by shooting. He wasn’t at his house when the department searched it, so a warrant was issued for his arrest.

Dempsey, of Berkeley, said there shouldn’t be cause for alarm about the matching of driver’s license photos to others in the database to find fraud.

And law enforcement using the technology to search for potential criminals is at least a government-to-government pursuit, he said.

Still, “it is using data arguably for a purpose other than the purpose for which it was collected, which theoretically is incompatible with the concept of fair information practices,” Dempsey said.

Dempsey’s concerns about facial recognition apply more to how people can fight back if they believe they have been flagged inappropriately. He also questioned how such systems will be handled as technology continues to advance, and what role the private sector may be granted. Those issues need to be handled on a case-by-case basis – there’s not a specific rule that applies to all uses of facial recognition, he said.

What the law says (nothing)

The department claims the use of such technology to capture fraud helps it comply with the federal REAL ID Act, which increased standards for identification documents. Though the REAL ID Act does not explicitly call for facial recognition, it does say states need to take measures to reduce fraud.

Jay Stanley, a senior policy analyst at the American Civil Liberties Union, said the government should be transparent about its use of such technology and how effective it is. States should also be reluctant to share their databases with other entities for other purposes, he said.

“DMV photo databases are probably the most comprehensive databases in existence,” which means they’re “very, very powerful” tools for potential surveillance, something groups like the ACLU worry could be a next step, Stanley said.

Arizona isn’t alone in its use of facial recognition software in its driver’s license database. Most states use the technology. And while many states also allow law enforcement access to the program to some degree, others, like Vermont, ban the use of such technology entirely, and some require a warrant or court order to scan faces.

ADOT points to a 2004 executive order, issued by Democratic Gov. Janet Napolitano, which created its departmental inspector general. The order says the inspector general’s office is designed to deter fraud in ADOT’s programs.

Aside from the 2004 order, there are no laws that specifically apply to the facial recognition program. The Arizona Legislature has not weighed in or approved the usage of the technology. There are no parameters set up in law to govern who can access the system, its oversight and its general usage.

The department also entered into an agreement with the FBI in February that allows the agency to request searches using the facial recognition program.

And ADOT did write a policy, issued on December 30, 2016, that lays out how facial recognition should be administered.

The policy details how law enforcement can utilize the system. While no law enforcement agencies have direct access to the database, ADOT conducts searches comparing law enforcement images to driver’s license photos.

While the ADOT policy governs the program, agency policies can change as the state’s administration changes since no policy is written in law.

How to search

In order for a search to be granted, the search must involve people suspected of committing a crime or “who law enforcement may suspect is about to commit a crime.” People could also be involved in activities that are threats to public safety, sought as part of a criminal investigation or “intelligence-gathering effort,” applicants for a security clearance, have a warrant issued for them, suspected of benefits fraud or labeled as a missing person.

Those requesting a search have to submit a form, and they must either be a law enforcement agency or a “governmental non-criminal justice agency” involved in searching for missing people or investigating fraud.

ADOT documents who conducts searches in an audit log. The log, obtained through a public records request, shows 90 searches at the behest of law enforcement agencies in the past six months. Twenty of those found no matches, while the majority of them found potential hits. Most of the searches were requested by the Department of Public Safety.

Harding, the ADOT spokesman, said the department’s inspector general’s office reviews the requests and “will reject any that aren’t connected with a police investigation, court order or court proceeding,” but he couldn’t provide any examples of rejected requests.

The Electronic Frontier Foundation, a civil liberties nonprofit focused on privacy, says there should at the very least be a court involved before law enforcement can access millions of unwitting people’s identities, its staff attorney, Adam Schwartz, said.

It’s really hard to function in a car-based society without a driver’s license, and people shouldn’t be subjected to an invasive technology when they decide to follow the law and get a legal document that allows them to drive, Schwartz said. It’s a misuse of data to collect data, in this case images, for one thing and use them for other purposes, he said.

Plus, he pointed out, in many states, including Arizona, agencies have started using facial recognition technology outside of any formal approval from the public and its representatives, state lawmakers, Schwartz said.

“Before government starts using powerful technology to surveil the public, there ought to be a more open and transparent process where the public controls whether or not this is picked up,” he said.