Portland adopts landmark facial recognition ordinances | Hacker News Reader

Portland adopts landmark facial recognition ordinances

thehill.com

201 pointsanigbrowl191 comments

All: please don't turn this thread into an ideological flamewar. It's an interesting story and it's possible to have a curious conversation about it, so let's do that instead.

https://news.ycombinator.com/newsguidelines.html

How does this apply to something like Facebook scanning someone else’s photo and detecting my face in it?

So for an entity present in Portland they cannot run facial recognition in a public place in Portland. But what if entity A is partnered with entity B. Entity B procures images of people in public in Portland city limits and places them on a server in another state. Entity A, which is conveniently headquartered elsewhere takes the data from the server and runs facial recognition. This is clearly facial recognition of persons in public in Portland. But it’s not by a Portland business and the computing isn’t done in Portland either.

Doesn’t Facebook have a Portland office?

Social media is specifically excluded.

There's a specific exception for social media applications:

> 34.10.040 Exceptions.

> The prohibition in this Chapter does not apply to use of Face Recognition Technologies:

> A. To the extent necessary for a Private Entity to comply with federal, state, or local laws;

> B. For user verification purposes by an individual to access the individual’s own personal or employer issued communication and electronic devices; or

> C. In automatic face detection services in social media applications. [1]

That seems like it would include what Facebook is doing -- but the ordinance never defines a "social media application" and also uses face detection and face recognition interchangeably in some places, so it's hard to say for sure what it allows.

[1] https://static1.squarespace.com/static/5967c18bff7c50a0244ff...

So that would mean things like Clearview [1] wouldn’t be legal on any person or photograph taken in Portland. Which is great for privacy, but I wonder how they’d enforce that.

[1] https://www.nytimes.com/2020/01/18/technology/clearview-priv...

Doesn't that make it illegal for someone to use Clearview in public, as opposed to making Clearview itself illegal?

It seems unclear whether face detection unto itself is allowed. Eg automated face blurring. The spirit is definitely the one-to-many searching.

This law could certainly use more clarity.

I think it's good that it is simple. People are constantly complaining about the excess of legalese in various contexts. A law that can be understood is cool and a breath of fresh air. I doubt the judges will have any trouble parsing between face blurring and face recognition.

Also, the definition excludes the face blurring use case. "'Face Recognition' means the automated searching for a reference image in an image repository." Although that detail does mean that if you're not searching for "a reference image" then you would technically be clear of the law's restriction. What if you build features based on a reference image then delete the image? Or what if what you're searching for is a person and the image is not the search target?

That I suspect would take more effort to parse. But the penalties are pretty light and the provable damages done by facial recognition are pretty minor, so if organizations get a lot of value out of facial recognition then they might want to try rolling the dice.

I think in a way you are countering your first point that it's good that it's simple. I'm not big into the facial recognition space but I'd imagine that the tech is saving personalized feature vectors and not images. Thus making the definition already moot. Then again maybe that means the language isn't simple enough.

That's a fair point but most systems capture the face chips for human comparison. Is it still capturing "features of images in a repository" if your face descriptors are anonymous with no face images? This is imho a loophole they missed

Although that detail does mean that if you're not searching for "a reference image" then you would technically be clear of the law's restriction. What if you build features based on a reference image then delete the image? Or what if what you're searching for is a person and the image is not the search target?

Any reasonable interpertation would find that the representation used during search doesn't affect what is happening.

Even if the representation isn't an image? The code seems pretty explicit on that point. The courts seem to only do interpretation where the code is ambiguous. They don't seem to guess where the law is explicit. That being said, if there is a problem they can always just change the law. Maybe the signalling effect will be enough. Companies won't want to adopt expensive technological workarounds while knowing that the city is motivated to close loopholes.

Yes absolutely.

Searching for text uses a TF-IDF or BM25 representation.

The only way to make image search work is to use a non-pixel representation. No court will find you aren't searching for an image because of that.

Sure, you have to use a non-pixel representation to make an image search index. I understand that. However, if the end result of the search is not an image, then is it the same? For example, you could learn some very basic features from an image, like "person's skin has this hue, their eyes are this color, etc." If you wrote that down and made it searchable, with the search target being a person's unique identifier (SSN or whatever), it would surprise me if that ran afoul of this rule, even if the features were extracted from an image. You can't be searching for a reference image if there is no reference image to search for.

Maybe I'm wrong though. IANAL and honestly it doesn't matter. But if I were writing this law, I would write that no one would be allowed to use any system that extracts and searches using or makes searchable information about human faces. That would seem to cover my proposed workaround, and I doubt it would hurt any other use case that they meant to protect.

It seems unclear whether face detection unto itself is allowed. Eg automated face blurring.

It's pretty clear that isn't banned. See point 6 in the explanation:

6.Face Recognition means the automated searching for a reference image in an image repository by comparing the facial features of a probe image with the features of images contained in an image repository (one-to-many search). A Face Recognition search will typically result in one or more most likely candidates—or candidate images—ranked by computer-evaluated similarity or will return a negative result.

Face detection isn't face recognition in that case, I believe. Face detection is identifying a face in general, not any specific face. Face recognition is finding a specific face in a set of images.

Yes - we seem to be in adamant agreement? (To quote myself: "It's pretty clear that isn't banned.")

It is written to outlaw recognition (ie, the search action), NOT detection.

Oh, yeah, I misread that as "is banned" for some reason. My mistake, sorry for the confusion.

Great, Facebook pipes everything directly into the US intelligence agencies. Its not just Chinese tech firms that have ties to the military.

> But it’s not by a Portland business and the computing isn’t done in Portland either.

Then it's not illegal. Portland's jurisdiction only extends to the borders of Portland. Even when it makes logical sense, you can't have agencies in Portland exercising executive control over organizations and people that don't live there. That way lies madness.

But it's a pretty easy loophole to close - just make it illegal to share images of people in public in Portland for the purposes of facial recognition. Now you can keep sharing images the way you used to, but it's a huge liability to try to do this to skirt the law.

At the end of the day if someone really wants to use facial recognition on (against?) someone in Portland, there are legal ways to do it even with explicit prohibitions like this. And the more nefarious the actors, the more likely they'll just use an illegal way.

I'm listening to this podcast about the ban and it's loaded with concerns. https://xraypod.com/show/banned-in-pdx/biz-and-tech-groups-a...

For one, the lobbyists and pro-tech groups that are against the ban, have nothing to say about what happens when the tech is wrong. They're painting a perfect world where the tech is solid and used for things like identifying missing children.

The podcast describes the high level of false positives in the algorithms. They say "top performing" algorithms are pretty good, but generally speaking ... no. Not good.

And there's the implementation. How does this get rolled out? Who's responsible for breaches? Who can access the data? Will anyone be able to sell access to the data?

But I always come back to: what happens when it's wrong? And I don't expect perfection. KNOWING that this tech is flawed, it's important to ask "what level of flawed is acceptable?"

> Will anyone be able to sell access to the data?

This is an extremely concerning point, and one that a lot of people (myself included) wouldn't even think about. If you search for "dmv" on this site, there are several posts within the last year about DMVs all over the country selling personal info. I really doubt police departments wouldn't do the same with this data.

I can certainly get behind anything that lowers the amount of surveillance that is happening. Good on Portland for respecting the rights of regular everyday people instead of over-policing government and corporate entities.

Does this have that big an impact on surveillance though? You can still set up all the cameras you want to record in public spaces (which i think is a good thing, I.e. this allows people to film police just as much as it allows always-on surveillance that can be used by police).

I don’t really understand why the law needs to take such a strong form. If it said something like “you cannot convict someone on purely a facial recognition match”, that would be a reasonable law and protect against the kind of bias in AI that people are rightly worried about. You still need a human witness, or need the whole jury to agree that the face in a video is the suspect. Maybe the law can even make sure that a facial recognition match in a video is not even admissible evidence in a trial.

But really facial recognition is just an automation tool. So this is a law that says you’re not allowed to make use of a more efficient tool to solve problems. Instead of doing an automated scan of available video footage to look for a suspect’s face, we’ll just pay police officers for a hundred hours of overtime to pour over footage manually until they find a match. (And of course, if bias is the concern, there will continue to be bias in which cases the police and DA feel are worth investing those resources in, and in manually identifying a match).

I just don’t see how this kind of law that basically says “everyone must pretend this ubiquitous technology doesn’t exist at all” is such a clear win. And of course enforcing it as it becomes more and more ubiquitous will be near impossible.

It has to start somewhere :) . I think cameras should be banned wholesale for any use other than watching -your- property. No police cams, no public street cams, etc. There is just too much potential for government abuse. It is the job of police, FBI, NSA etc to do everything they can to capture/stop crooks (of their various areas of interest). The Constitution (and general common sense human rights) gets in the way of that and they will use every tactic they can to get around it and stay legal or in a gray zone. This just gives more incentive to them abuse their mandates. This is why there needs to be a hard well defined wall against public surveillance by any government entity without a very very specific warrant. This includes them using anything obtained from a business. I mean down to the crime/individual/specific area of the street. As it stands they want a web of cameras with auto identification and tracking of everyone "just in case". That goes against any sense of liberty to live your life as you see fit as long as you aren't breaking the law. You really should not have to worry -at all- that big brother is watching, listening, recording, or any of that until you start breaking the law.

Thou shalt not make a machine in the likeness of a human mind. [1] 'Tis but the first overture in the Butlerian Jihad.

[1]: https://en.wikipedia.org/wiki/Dune_(franchise)#The_Butlerian...

Ix is descended from the US.

This is absurd. If taking a photograph in a public place is protected 1st amendment activity (and it is), then this amounts to telling me how I am allowed to think about what data I already have a right to have.

I have a lot of respect for Hardesty (and I vigorously volunteer in PBEM NET, a department she oversees), but I also notice that this comes on the heels of local efforts to use facial recognition tech to identify abusive police officers, who have been authorized (!) to cover their badge numbers here.

How does the first amendment protect your right to photograph others, and even if it does somehow, how does it protect your doing whatever you want with that photo?

If you take a photo of someone and don’t obtain their permission to use it aren’t you violating their right to privacy, which is clearly secured by the forth amendment?

> How does the first amendment protect your right to photograph others

I'll leave you to read the numerous SCOTUS rulings (and, for the purposes of freedom in other jurisdictions, analogous court rulings) instead of trying to explain myself.

In short: the fact that a photon bounces off of your face does not entitle you to control every person who might capture it, in perpetuity, throughout time and space.

I was born with eyes capable of a materially identical task as a CMOS sensor: must I look away any time you I see you in public? Must I refrain from remembering that I saw you? If I testify that you shot my friends and neighbors with impact munitions - a nightly occurrence in this city - will it be as reliable as if I had photographed you and compared your face to an index of known violent repressive forces in Portland?

I find this logic to be the maximal case for ego: to believe it, you have to believe that light itself is made for you alone.

> how does it protect your doing whatever you want with that photo

Do you generally dispute that people have a right to think about and process data however they wish? Must I cover my ears if a state secret is uttered by a journalist or friend? Must I refrain from thinking critically about whether it implicates a powerful person in criminal activity?

Well, isn't it the same if we, the people of Portland, seek to compile photographs of police officers who have been repeatedly abusing and terrorizing us and use them to recognize their faces?

> their right to privacy, which is clearly secured by the forth amendment?

I know of no such plausible argument being made about the faces of people appearing in public, and certainly no actual jurisprudence in the Western legal tradition.

When in public, you can be reported on. You can be photographed and recorded. If you decide to spray chemical weapons at people, you can be held accountable.

Just because your eyes are sort of like a cmos sensor and your brain sort of like a recording device doesn't mean its exactly the same they very clearly banned a process on an external computer. You are free to run your brains built in facial recognition on anything you photograph and write them down in pen.

What you aren't allowed to do is feed a stream of data to a computer and run facial recognition over the stream.

It's pointless to pretend these activities are legally or literally equivalent when this just isn't so. Additionally the first amendment seems to only apply in this context if it pertains to freedom of the press. Presumably you would have to argue that the inability to ask the computer to guess the identity of all and sundry materially impaired your ability to report on current events.

Most of the people likely targeted by this law are apt to be neither professional press nor citizen journalists and wont be able to take advantage of this argument. Whereas citizens photographing cops would likely be able to make this argument.

> Additionally the first amendment seems to only apply in this context if it pertains to freedom of the press.

That wasn't my understanding. I thought that SCOTUS had repeatedly ruled that you had absolutely no expectation of privacy when in a public location? It seems weird to me to have a legally protected right to make recordings that doesn't extend to their use (at least for personal purposes).

Even so, I suppose the ordinance might be legal because I've never heard of a "right to use of facial recognition technology" or anything that would otherwise imply that. That being said, I find the idea a bit disquieting. I value privacy highly and have serious concerns about the current state of affairs, but specific algorithms being disallowed on the level of an individual person is highly concerning to me.

Isn't it only large actors (ie corporations and governments) where abuse becomes a serious concern due to their geographic reach and available resources?

It's not that there's a right to facial recognition technology but that there's an implied right that, if I take a photo, that I can use that photo. (Except in some specific ways, e.g. using it in some libelous way to misrepresent the subject, certain types of commercial use like ads, etc.) Certainly if I take a picture of a person there can't be a blanket prohibition on trying to figure out who that person is.

In the US I have pretty wide rights to take a photo in a public place for editorial purposes and to publish it (which is a variant of freedom of the press).

Can't you exercise your freedom of the press without automatically subjecting all passers by to facial recognition? For example one could argue that the freedom of the press would be paramount were you wanting to write a story about an event that had happened while using facial recognition to identify participants and or witnesses without letting people gather info on every person on the public street at all hours from now until forever?

You having no expectation of privacy means that the person being photographed has no constitutional rights as far as the constitution to protect. Conversely the photographer has no first amendment right to take a picture save freedom of the press.

If the picture isn't being captured for the purpose of informing their fellow citizenry they have no first amendment rights at all to protect in this scenario.

If both of these things are true this law creates a new right not to be subject to facial recognition which if it doesn't contravene state or federal legislation is perfectly legal.

Do you have a legal theory as to why this law would be problematic? The first amendment seems like a dead end but if you would like to argue it could you please expand on the matter?

> Conversely the photographer has no first amendment right to take a picture save freedom of the press.

Why do you say this?

> If the picture isn't being captured for the purpose of informing their fellow citizenry they have no first amendment rights at all to protect in this scenario.

Even if free press is the only basis for protection of the practice of photography under the constitution, there is no requirement that press activities be exclusively for the purpose of "information their fellow citizenry", and no requirement that the person in question be part of the "citizenry" in the first place.

Someone taking photographs in public is not required to disclose all photographs in order for this activity to be protected. Press generally covers not only publication, but documentation, research, and other press activities. If I take a photo in public, the subsequent activities of performing research and analysis of that photo are also protected activities.

I would say this because the literal text is

>Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances

Wherein do you construe taking a picture to be a first amendment situation save where it constitutes an act of communication? Press in current context could be stretched broadly enough to fit basically anyone with a cell phone but in order for it to be protected it has to be capturing something to share with your fellow man.

A person taking a picture to share with their fellow man or even using facial recognition to enrich that communication with more info could well be protected but an org feeding a video stream into facial recognition to blanket gather info on your fellow man would be apt to be disallowed.

> I would say this because the literal text is

Isn't this statement exactly what the 9th amendment says not to do when interpreting the first 8?

> A person taking a picture to share with their fellow man or even using facial recognition to enrich that communication with more info could well be protected

...well, that's what's prohibited by this law.

> an org feeding a video stream into facial recognition to blanket gather info on your fellow man would be apt to be disallowed

...and that's not prohibited by this law.

That's what we're dealing with here in Portland.

I hate to be an RTA guy, but did have you taken the opportunity to read the ordinance?

From TFA

> The first bars all city bureaus from acquiring or using the controversial technology with minimal exceptions for personal verification.

> The second blocks private entities from using the software that scans faces to identify them in all public accommodations.

Firstly the city isn't allowed to use facial recognition save for identifying its own personnel. Second private entities ie everyone else including individuals and corporate personages aren't allowed to use it in all "public accommodations"

Here is a legal definition of public accommodations

https://www.law.cornell.edu/uscode/text/42/12181

7E is (E) a bakery, grocery store, clothing store, hardware store, shopping center, or other sales or rental establishment;

Here is a "private entity"

> (6) Private entity

The term “private entity” means any entity other than a public entity (as defined in section 12131(1) of this title).

I originally just read the article but reading the full text of the law doesn't change my perception now that I have read it.

It absolutely would forbid walmart from streaming their cams to facial recognition software and while in theory citizen journalism could be negatively effected it seems trivially arguable that any usage that serves the interest of citizen journalism is already covered by the first amendment.

If you wonder WHY people want to ban facial recognition realize it is notoriously inaccurate when applied to a large corpus of data especially with bad photos wherein missidentification can trivially lead to the total destruction of people's lives. Case in point.

https://projects.tampabay.com/projects/2020/investigations/p...

I notice that you conveniently decided to exclude, among the exceptions listed, "In automatic face detection services in social media applications." I wonder why?

I didn't choose to copy and paste the entire article into this discussion I presume this means that people can post photos to facebook and facebook can automatically tag people.

I'm assuming this exception is to preserve what a lot of people regard as desirable functionality.

Aside from the rather odd argument about hardware, letting authorities decide whether someone's use of photography to record events counts as legitimate journalism sounds rather unsettling.

Also photography can directly be considered a form of speech (e.g. artistic expression).

I don't think that the argument about hardware is "rather odd", I think it's the crux of the issue in Portland right now.

Our police bureau is terrorizing our citizenry before our eyes. So we brought cameras. So they covered their badges. So we started working on facial recognition. So they banned it.

If our eyes were sufficient to show the world what's happening and to document which cops are the most culpable, there'd be no hardware discussion at all.

I don't think anyone would consider the city or a mall running their security cameras data through facial recognition an artistic endeavor.

I don't think anyone would consider someone taking a picture in public to run afoul of this law.

> I don't think anyone would consider someone taking a picture in public to run afoul of this law.

I guarantee you someone will. But my point was about the first amendment being applicable to the topic of photography, not about a state law. And art was an example, not a definition of speech.

So you're telling me that, once you enter a place that I can see, you get to examine whether I'm using a biological eye or a CMOS sensor or a cybernetic implant or whatever else? And then, having examined that, you get to assess what I'm doing, in private, with the data that I collect from my sensor experience of existence. But it's your privacy that's implicated?

How far does this philosophy extend? If I have a telescope on another planet and process the input in a way that you don't like, can you extradite me to Earth and charge me with a crime?

It would be helpful to keep the conversation in scope of things that are real or could happen.

It's perfectly reasonable to use a hypothetical to reveal how consistent or measured an argument is.

And none of what I've said here is so far removed as to be useful. Wearable or implantable cameras are coming. Taking photographs of one jurisdiction from another jurisdiction happens all the time.

You absolutely can as an single individual, with that CMOS camera on your person. It's when we start using a networked database to store faces, this is when it should become unlawful IMO.

There's a big difference between a human brain and a vast 24/7 all-seeing database which can identify an individual out of millions of faces.

This law effectively prohibits the former while allowing the latter (with the exception for "social networking"). That's the whole problem here.

This is so obviously designed for the cops.

Yes, but without criminalizing individual's right to video recording in public - sometimes this is necessary when you're dealing with bullying or sociopaths (where covert body cameras can be highly effective). Same for exposing animal rights abuses in farm. You want to be gather as much evidence, preferrably video, as you can in those circumstances?

> If you take a photo of someone and don’t obtain their permission to use it aren’t you violating their right to privacy, which is clearly secured by the forth amendment?

If you are in a public place you do not have a right to privacy. You are in public and a photographer has a right to photograph and publish your photo without permission (with certain exceptions like accidental nudity). Any pictures taken in public can be used without permission, even for most commercial activities.

I'm curious how laws like this would handle jurisdiction. If I take a photo in Portland and send the data to Morocco where facial recognition is used and the results are sent back to Portland, have I violated anything?

iANAL, but I would imagine local laws are applied locally.

For example, I can buy an AR-15 without a pistol grip in California, travel to any free state and attach a pistol grip to that rifle. Doing that I would not violate California law, even though AR-15 with pistol grip is illegal in CA.

"What makes Portland's legislation stand out from other cities is that we're prohibiting facial recognition technology use by private entities in public accommodations,"

Prohibition is too strict. Better would be to allow opt in, so that my hotel, gym, uber, pizza parlor, etc., could recognize me and customize their service accordingly if I consent.

As a practical matter, how could opt in work? Suppose you've opted in and I haven't. We both walk into the pizza parlor. How does the system know that you've opted in without attempting to recognize both of us?

Failing to recognize someone does not detract from their privacy. If they fail to recognize everyone who isn't opted in, who is harmed?

The problem with this argument is the assumption that everyone gets a facial scan and the computer processes the data all the same, in order to recognize whether the individual is recognizable or not. How can we be sure that that data is not getting saved for later? The system is too ripe for abuse and everyone loses their privacy.

Sure it does. Failing to recognize someone at scale can very much impact someone's privacy. Holes in data are, in and of themselves information.

For example, if an unrecognized face was logged on 47th street, then an unrecognized face was logged on 50th, then 52nd, then 55th (where a crime occurred), then back down to 47th, you might be able to draw some patterns about where to look for your suspect even if they hadn't opted in.

Edit: Also, you are trusting that the system isn't storing markers for people it doesn't recognize. My concern would be that if I opt in later, suddenly all my past history becomes discoverable. That's a lot of trust to put in the hands of private firms (or the police), neither of which I'm comfortable holding that information.

Excellently put. Also, just because it didn't generate a facial ID hit, doesn't mean they can't use ReID and track the descriptor vector.

In fact if I were a not-quite ethical user of facerec, I'd flag and bin all vectors and image chips that failed to ID.

I work on facerec and ReID. But it's for deep fake detection and the like, blue team stuff. But the deep ID technologies are very concerning to me in general.

Honestly this is a really, really good point I hadn't thought of (and well articulated) and I think you've changed my mind on prohibition v. opt-in.

It will try to recognize you but you will not be in the database, so it will say match not found. Presumably nothing would be stored about you in that interaction

> Presumably nothing would be stored about you in that interaction

Given how prevalent the tracking of users is, anonymous or otherwise, I'd be extremely pessimistic about this assumption.

Same here. I don't want the system to even try to recognize me. No one's doing this stuff on site, which means that they'd be uploading my face to a cloud provider and using their system, which means they'd be doing the things people are having a problem with in the first place.

And no one would ever lie about such things for a profit.

Are there logs?

I'm suspicious having seen how the GDPR is effectively being circumvented by making nonessential cookies more or less opt-out, and by making the process so annoying that the average person doesn't care enough to do it. It's a lot easier to enforce "not allowed" than "do it in a user-friendly way".

Plus, in a public place, how do you only apply facial recognition technology to a single person? It seems like in most cases, you must first apply it to everyone else nearby to discriminate them from anyone who opted in.

The GDPR isn't being circumvented in those cases. It is being blatantly and flagrantly violated. The GDPR explicitly requires that refusal to be tracked have no more friction than accepting being tracked. If the banner has a "Accept and Continue" button, then it must have a "Refuse and Continue" button as well. Adding any more steps than that is a violation, not merely a circumvention.

I may be naive and misunderstanding, but if a private entity is using facial recognition on their property, that doesn't appear to be prohibited? Like if a gym wanted to do a face scan to "log you in" that seems like that'd be permissible? I'm not a lawyer. I found the actual draft:

D.“Places of Public Accommodation”

1.means: Any place or service offering to the public accommodations, advantages, facilities, or privileges whether in the nature of goods, services, lodgings, amusements, transportation or otherwise.

2.does not include: An institution, bona fide club, private residence, or place of accommodation that is in its nature distinctly private.

https://static1.squarespace.com/static/5967c18bff7c50a0244ff...

IANAL, but I think "distinctly private" here means your house, or the private clubhouse you rent with some friends, etc. In other words, places that the general public isn't welcome to visit (as opposed to even a gym where anyone with $100 can sign up).

A private country club would certainly fall under this exemption, but a normal gym might not unless it's already qualifying for the private club tax exemption.

Approximately, a business that's open to the public is considered to be a public space, even if it's on private property.

A restaurant dining room is public, but the kitchen would be private (IIUC). A private club (ie you register for membership and only members are allowed inside) is private. (Aside: That's how indoor smoking establishments like hookah bars get around anti-smoking laws in Washington state.)

This leaves me uncertain about gyms - that seems more like a country club than a restaurant or hotel?

A problem with opt-in data collection is that whenever the law allows a user to opt in, businesses will require the user to opt in.

A ban on facial recognition doesn't mean much if every hotel, gym, and pizza parlor has a shrink-wrap contract or cookie banner [1] forcing you to opt in to their data collection if you want a room or a pizza.

[1] https://news.ycombinator.com/item?id=23090393

...which is fine and well within their rights. Businesses don't have to offer people any services if those people don't want to follow their rules. Under federal anti-discrimination laws, businesses can refuse service to any person for any reason, unless the business is discriminating against a protected class.

And we are changing those rights, which is fine and well within our rights.

It is so refreshing to see this asserted, that citizens can update the societal contract through legislation when deemed necessary instead of simply being at the mercy of corporate interests.

This is literally the point of legislation and I haven't seen the opposite asserted even once.

> ...which is fine and well within their rights.

Not anymore. :)

Portland decided that the rights of the individual outweigh the rights of businesses when it comes to this issue. Strongarming people into giving up their privacy won't work. The argument that "if you don't like it, you can go elsewhere" has also been shown to not work when every business is harvesting every bit of personal data they feasibly can.

The argument that "if you don't like it, you can go elsewhere" has been shown to work extraordinarily well when it comes to businesses choosing to go elsewhere rather than serve high crime neighborhoods. In fact it's a big part of why people from those neighborhoods lack opportunity.

You're not really helping your own case here. Especially as you're basically using an example of a case whereby having the state not act in the public's interest by addressing the high crime problem, it leads to poor outcomes for the populace; actually justifying the prohibition in the interests of the public's privacy in general over the freedom of private individuals to create a facial recognition based privacy free zone through their own volition and recognizance by leaving contractual acceptance of facial recognition based programs and data sharing open in much the same way as functioning and effective law enforcement prograns are justifiable in maintaining public safety.

Another way of looking at it is that your counterargument to 'business just does what it wants with no regard to the needs of consumers' is 'business just does what it wants with no regard to the needs of consumers.'

Those neighborhoods lack opportunity because they lack funds and have ethnic names and or faces. When the same resume gets a fraction of the bites when you put the name Jamal on it vs John its pretty easy to identify the issue. Furthermore I don't think disallowing facial recognition is going to materially effect the services offered in a city so this seems like you shimmed it in there.

Well it is within their rights, in the hypothetical scenario being discussed where the law was opt-in rather than prohibition.

This doesn't work unless you have a choice. We've already gone from "free, but we collect your data" to "paid, but we also collect your data and didn't decrease the price." Just look at TVs or ISPs.

Before you say "well that's user's rights" I think we're all aware that most people are tech illiterate. They are starting to become aware of the problem but everyone feels completely helpless because they don't even know the first steps (and quite frankly it isn't just laziness, they don't have the literacy rate).

Good opt-in regulation doesn't exist currently - think of all the click-through legalese and cookie popups/gdpr consent popups etc.

We'd need something like a once in a lifetime registered consent that service providers would be required to respect quietly and provide non-degraded service to people without the opt-in.

Even this would probably require multiple rounds of regulation iteration to fix the loopholes.

Would the scanner have to do the recognition stuff _before_ it knows whether the person on-camera has actually opted in?

What qualifies as part of the facial recognition chain? Does source video count?

Because I could see an interpretation in which people filming police activities and the people they arrest as no longer being allowed.

What about that?

If they are running automatic facial recognition on the video then yes, it's banned.

The social media loophole seems ripe for exploit. As long as the destination of the content goes to a social platform it's all free game.

I wonder what they will consider a social platform as people develop new systems to get around this law. Cuz logic and unknown reasons.

Yeah that is a silly loophole. If it's dangerous enough to ban ( and it is) how can social media be a justifiable exception. Unless they implicitly trust the people that run social media companies for some reason?

My guess is that they lack the jurisdiction to regulate how (for example) Facebook processes images on their platform. Rather, the ordinance only applies to entities while they are within the city. So without the social media exception, it would likely be illegal for any individual within city limits to take a picture with the intent to upload it to Facebook. That would make for some interesting fallout to say the least.

A lot of the comments here seem conflicting, to say the least. The article has:

> use by private entities in public accommodations

Which still doesn't fully explain it for me. In an HN comment someone linked what appears to be the ordinance in question: (https://static1.squarespace.com/static/5967c18bff7c50a0244ff...)

That says (§34.10.020 D) that a place of public accommodation is a "place or service" offering various things. I'm not quite sure how to interpret the wording "advantages, facilities, or privileges" though. In addition to public businesses, I'm assuming that would include city parks (they seem like facilities), but what about roads and sidewalks? I guess those offer "advantages" and "privileges", at least?

But regarding the context of the earlier comments in this chain, it seems like intent would be the key factor. Recording video with the intent to run facial recognition against it, whether it was to be done by you or someone else, would presumably qualify as a violation.

So what about recording large quantities of video without intending to run facial recognition, for example a dash cam, but then later running it against a specific segment in response to an incident?

Recording video with the intent to run facial recognition against it, whether it was to be done by you or someone else, would presumably qualify as a violation.

It seems to me quite clear that the act of running facial recognition is the problem.

I'm not clear on your meaning?

In context, an earlier comment asked about the legality of filming police activities under this ordinance. I was pointing out that intent typically matters to the courts.

What's unclear? The law is written about the act of running facial recognition. Videoing isn't banned, writing facial recognition software isn't banned etc.

Sure - intent matters - but it's the act of running the facial recognition software that is banned.

If you start videoing police and were stopped by police and the police could show you were intending to run it through facial recognition then the court might find them stopping you was legal based on this.

But if you are filming police and live broadcasting it on Twitter or something then it's pretty unlikely a court would find stopping you was legal under this law. But if you streamed it to someone else having previously organised for them to run recognition then stopping might be legal.

This seems unconstitutional. It amounts to blocking photography in public spaces and using those photos as you see fit.

It also seems very untimely. Portland is exactly the type of city that needs surveillance, to identify and arrest criminals who are committing property damage, theft, and arson as part of daily riots.

Where's your constitutional right to photograph me and use my photo on your billboard if you see fit? If you don't believe that's OK, and it's clearly not, then we can agree that there are limits to your right to use photographs you've taken of someone.

Also, I've heard approximately zero people from Portland calling for more police presence, even if it would cut down on the non-Portlanders traveling there to start problems. From what I can tell, they're not asking for or welcoming of that kind of "help".

I live in Portland. I don’t live downtown where most of the videos you see are coming from, but I do live in a neighborhood very close to downtown. Over the past few months there have been a bunch of smashed windows (and presumably theft) at many of the businesses on the main street, graffiti is out of control, theft appears to be increasing as well. This is all just in my neighborhood. There are also the fires being set downtown and other violence between various battling groups. I can’t say for sure that putting more police on the streets would solve all these problems, but we need to do something. We are not headed on a good trajectory but for whatever reason it seems like our political leaders are in support of this destruction. We do need help.

We must live near each other. For privacy I won't say where, but I am within two miles of downtown East of the river. The neighborhood has changed for the worse in the past 6 months by an insane amount. I don't feel safe and I'm a fit young male.

Yup, sounds like we are in pretty much the same neighborhood. I wouldn't yet say I feel unsafe, but it sure doesn't seem like the city is moving in a positive direction. It makes me sad because I love this city and maybe I'm naive but I would like to believe that there are ways that we can address injustices that have been perpetrated against some of our neighbors without burning everything to the ground.

Unsafe is relative. I don't think I'll be assaulted, but I do think I could be robbed, or my property stolen. There is also the constant risk of folks in mental health crises or high as fuck being unreasonable or aggressive.

Stay safe, Portland is a good town at times, just it's 2020 you know?

That's fair. And seriously, now I can say I have heard of Portlanders wanting help.

I live in Portland, too. And we do need help. But facial recognition is unreliable. I'd hate to be the one who's misidentified but, overzealous law enforcement keeps insisting it's me. Or, maybe I'm shaking hands with some random person and then facial recognition is used to make it look like we're buddies, and accomplices in some mess he's in.

And I've seen enough unreliable technologies hit the market and marketers don't talk about the flaws or limitations in a responsible way. They highlight when the tech has done something miraculous.

With all of this kind of stuff I ask: what happens when the tech is wrong? Who's accountable? Who makes the victim whole? Too often the answer is nobody is accountable.

> Where's your constitutional right to photograph me and use my photo on your billboard if you see fit

If it’s in a public place I would absolutely have a constitutional right to use that photograph, sell that photograph etc

Not for all purposes, no. You don't have an unlimited right to publish other people's imagery for commercial purposes absent permission, even if they are photographed in public, and they would be able to recover damages from you for doing so.

> You don't have an unlimited right to publish other people's imagery for commercial purposes absent permission, even if they are photographed in public

You 100% absolutely do if it is in public when it comes to publishing, even commercial publishing. Where do you think news gets their photos? Travel magazines? Professional photographers? You don’t need permission to publish or sell a photograph taken in a public place regardless of who or how many people are in it.

Your photos are fair game but if you present someone prominently in your ad they absolutely can come after you for damages or for monetary compensation for using their image. Why do you think that celebrities can sue for it? You think the average joe can't do the same thing?

That is true - the problem isn’t the photo though it is the false endorsement. A false endorsement in any medium is illegal.

Yes, that's why I mentioned the publication of the photo for some commercial purposes, eg advertising. Nobody is disputing your right to take pictures in public.

> You don't have an unlimited right to publish other people's imagery for commercial purposes absent permission, even if they are photographed in public

You disputed it right here. You 100% have a right to PUBLISH even for commercial purposes without permission.

Slight misconception. You don't need a release for some narrow commercial purposes, like artwork, academic study, or selling to news/wire services. But if you want to use it for stock photography, marketing (i.e. local businesses, tourism boards), entertainment production, or to produce a likeness or design which you intend to own separately, then you would need a release.

Good test here is if you could reasonably make a civil claim against the person reusing/redistributing the cropped images of themselves for their own purposes after the fact without permission.

The problem is that "commercial" is an ambiguous/misleading term in this context. (Cue the long-standing discussion over non-commercial in the context of Creative Commons that was never resolved.)

As you say it means certain types of uses but does not mean simply that I'm making money off it. I can absolutely take your picture in a public place and , in general, sell it to any newspaper or sell a poster made from it if I want.

Again not true at all. If I take a picture of Times Square with 1000 people in it, I don’t need permission from anybody there. I can sell the photo as a stock photo or otherwise with absolutely no permission. The same principle is true for a picture of one person on your local street.

Crowd photo yes. Photo of one recognizable person? Stock sites will absolutely look for a model release so that it can be used in marketing materials, ads, etc. You can, of course, simply publish it on a blog or in a newspaper or sell it as a poster without permission.

Stock sites may but again, not the law

With all kindness, it is you who are mistaken. Right to Publicity laws vary state-to-state. For example, California has rather strict Right to Publicity Laws[0] while (oddly) Oregon has less strict rules[1]. There are various factors to consider in every jurisdiction, but the rule of thumb is definitely not ‘if you take a photo in a public space then you can use it for commercial purposes’.

[0] http://www.dmlp.org/legal-guide/california-right-publicity-l... [1] https://www.rightofpublicityroadmap.com/law/oregon

Edit: corrected intended phrasing of 1 sentence.

> The mere fact that a person’s likeness is used in connection with a commercial product or service does not violate the statute

Nope even your own source confirms it. You can publish a photo taken in public for commercial purposes without permission - the only exception listed there is if your present it in such a way that it appears as an endorsement. Then you need permission (for the endorsement). In that case though it isn’t the photo that is the problem it is the false endorsement (which is illegal no matter what the medium, photo, words etc).

LOL - you only hear what you want to hear.

it is so damn easy to support the protests in Portland and some other cities when you don't have to experience it. The violence and fear is real, when your city officials effectively abandon their duties to score political points it should tell you your worth.

I live near a not so violent city now; we had a time with it but it died out awhile ago because it was embarrassing an important mayor but I too had coworkers looking to get out of the area. People expect the government they elect to protect people and property and it is very disconcerting when they won't.

Worse is the excuses they use for not doing so making you ask, then at what point would you step in?

Same. Was watching twitter feeds if people planning to come up to “F$&@!” My area. Lots of people with guns near me. Could have ended very badly.

Police shutdown the highway and trains. Eventually people gave up and went back to burning downtown.

On the contrary. It is times like these in which citizens need protections from those that may not have their best interests in mind. People have every right to protest and should not be surveilled in doing so.

People don’t have a right to commit crimes and call it a protest. Identifying criminals should be made efficient and facial recognition is part of that.

> Identifying criminals should be made efficient

This is a nightmare sentiment. No, identifying criminals should not be efficient at all. Everyone is a criminal -- whether that's speeding, jaywalking, vandalism, littering, loitering, or whatever, the last thing we need is police having more powers to point to someone they dislike and saying, "We've got footage of you doing X, comply with our demands or suffer the consequences."

Better for us to actually remove those laws.

Hmm... I disagree. Speed limits are important. So are various other laws that require human judgement to interpret.

There's a reason we have 'judges' -- the law will never cover all corner cases, and the law needs to set boundaries that are sometimes ok to override. You need a human in the loop evaluating various interpretations and keeping those interpretations current with societal expectations. (And those humans absolutely should not be the police.)

> Speed limits are important. So are various other laws that require human judgement to interpret.

What is there to interpret about a speed limit? If someone is going faster than the speed limit they are breaking the law. Add an error bar for equipment accuracy and the case is as closed as anything can be in life.

We don't want judges making decisions unless it is strictly necessary. That is where racism/sexism/classism/etc start entering the legal system. Judges are empowered to judge, but it'd be better if they can keep it to a minimum,

> If someone is going faster than the speed limit they are breaking the law.

In some (many?) jurisdictions, posted speed limits are not absolute limits but are rather evidence for the judiciary to consider when deciding whether the driver was operating a motor vehicle faster than what was reasonable and proper. (Faster than reasonable and proper being the actual law that has possibly been broken.)

Removing judicial discretion in favor of zero-tolerance laws is a step in the wrong direction I believe.

Speed cameras can be poorly calibrated / setup, there can be multiple cars in frame and they ticket them all, it can be a different person driving, the OCR on the license plate can fail and pick a different car, the officer may have tampered with the evidence, the car may have been stolen, etc.

All of these require due process for something as simple as a speeding ticket.

Best to do both.

We have laws for a reason and they must be enforced. Your argument here seems to be hinged around naming less damaging crimes like jaywalking to make enforcement seem frivolous. But to most people, enforcing laws against vandalism or littering do matter.

Leaving aside the crimes you named, police do need tools to identify, locate, and arrest those who engage in more serious crimes like property damage (car thefts, burglaries, bike thefts, etc), violence (rioters throwing Molotov cocktails, assaults, shootings), looting, etc. Enforcing the law matters in order to retain a stable and just society. It absolutely should be efficient, both in the interest of serving justice so there is a deterrent against crime, but also to save taxpayers’ money by making more efficient use of policing resources. Suggesting we keep police from enforcing the law efficiently is illogical and dangerous, and followed to its conclusion, is no different than arguing that police should also be denied other tools like computers or electricity.

Then get rid of the law! What is the point of the law if we're all "criminals" according to you and any attempts at prosecuting such laws is met with "rules" about making it less effective. How ever did this become about "how can this tool be used to harass people". Police can harass you using absolutely nothing other than the powers given to them by virtue of being a policeman.

Identifying criminals that are breaking the law should absolutely be easy, efficient and absolute. Either you agree they are breaking the law and that the law is just, or the law is unjust. Otherwise, if you agree that there is a "grey" area between the two, then you're just inviting abuse by virtue of selective-policing.

Thank God - speeding, jaywalking and littering are very rarely criminal.

I would very much like to see less speeding, jaywalking, vandalism, littering, and loitering. Reducing these all seem like they'd have a net positive effect.

Giving police better technology to do their jobs doesn't automatically make them corrupt. Those who are corrupt are going to temporarily have more power, sure, but that's all the more reason to root them out and implement better transparency and balance checks at the same time.

>People don’t have a right to commit crimes and call it a protest.

Yes they do, it's called civil disobedience, and many Americans from marginalized groups wouldn't have the rights they enjoy now without it. In fact, as people like to point out, America was born from it.

My understanding is that the "traditional" notion of civil disobedience excludes acts of violence (the crimes that the parent was probably referring to) and for the participants to be willing to accept punishment for the law that they are breaking (i.e. you must be prepared to be arrested, fined, etc.).

The point is to show respect for the rule of law while at the same time calling attention to an injustice.

The notion that you can commit arson, theft, assault, vandalism, and so on with impunity as long as you self-proclaim you are doing it for a just cause is not what "civil disobedience" is about, IMHO.

Your reference to the founding of America only seems relevant if you think the current government is illegitimate and needs to be replaced forcefully and in its entirety (i.e. you are making a revolutionary argument). If someone wants to make that argument then I think they should be able to justify that drastic measure with a rationale that is a bit more coherent than protest slogans and be able to explain what they intend to put in place instead of the current government.

You are correct, that's why sit ins and say blocking a road work. Grabbing a rock and using it to destroy someone's storefront is a crime and those people need to go to jail. It just seems like a shame that some people don't seem to see the difference now and support the rioters and people destroying property as if they are noble souls or something rather than the criminals that they are.

I'm disturbed by the riots as much as anyone but I applaud this legislation.

Facial recognition and citizen movement tracking is a slippery slippery slope I want nobody in power to control.

The thing that confuses me is this is clearly done for the rioters but they're the ones with the ideology that generally results in this type of draconian citizen tracking.

Its an upside down world man.

I do agree that limits on photography are probably unconstitutional though.

And I'm not sure the gain justifies the cost. Not being able to facial rec a robbery suspect is going to have tragic outcomes.

I feel the same way. It seems like the future is going to be some cyberpunk place where people have masks or face tattoos to obscure tracking regardless of legislation like this. I'm very pro privacy and facial recognition is quite scary but it seems an impossible tech to contain.

In theory, but not in practice, we can ensure governments aren't using it but businesses and private individuals seem almost impossible. Certainly underground businesses will take advantage of it like the mafia or other groups who figure out how to weaponize it.

> The thing that confuses me is this is clearly done for the rioters but they're the ones with the ideology that generally results in this type of draconian citizen tracking.

If you think anti-authoritarianism is an exclusively right-wing value you're sorely mistaken. Even the term 'libertarian' was co-opted from lefties. You'll learn more if you approach confusing issues with curiosity rather than calling Portland "upside down world" because your biases conflict with reality.

Do you know what the word generally means?

Welcome to HN! Please read the HN guidelines on commenting: https://news.ycombinator.com/newsguidelines.html

I'm happy to discuss this topic with you as long as you're willing to hold up your end of the conversation.

Do you live in Portland? How about your family: kids, parents, siblings? Do you own businesses here? Have you spoken to anyone involved in the protests, or local business leaders?

All of the above are true for me, and I was born here, and I for one applaud the new restrictions on facial recognition.

If your answer to most or all of the above questions is "no", please reconsider telling those of us with actual lives here here how we should want to be policed and why.

Not op but I’m not sure hot living there changes the fact that it will be struck down as unconstitutional

I live in Portland. Have my whole life. We need more police. We need enforcement of basic laws like larceny and grand theft auto. We need to enforce the laws we have. We need more police.

I called 911 to report an assault in progress. I was on hold for four minutes, and the police took over an hour to arrive.

Yep, (downtown) Portlander here also with similar thoughts.

I was in a bodega last week when a cop came in to respond to a robbery call that was made over 5 hours prior. The cashier was obviously having a bad day, but still absolutely livid at the response time.

We don't have enough cops to go around right now. Technology helps what cops we do have scale the impact each one can have. Ideally, we'd have more cops _and_ more technology that helps them do their job.

This ordinance is outright silly at best, and detrimental/dangerous at worst, IMO.

Technology can help. Good, proven technology. Facial recognition tech is not ready for prime time.

Too often we've seen the legal system use flimsy evidence, and comb the earth for experts who'll back up the flimsy evidence. Then years later the city is paying someone for their wrongful conviction.

I don't want to be the person whose life is turned upside-down, and unable to pay legal fees all because of some flawed facial recognition.

When facial recognition is reliable, then we need to talk about privacy and access to the data and how it's used.

I can already imagine what'll happen. Government entities like, law enforcement, will have to jump through hoops to get warrants and prove they have a good reason to access the data. However, private entities like grocery stores, marijuana dispensaries and car washes won't need a good reason. They'll use it for marketing, and making money allowing 3rd parties to access the data.

I'm not cool with any of that.

Tell you what: I (a frequent protestor at the JC and elsewhere) will volunteer my face and address, and allow you to perform facial recognition to match my face at any public place in Portland, if every PPB employee will do the same.

Deal?

Presently, the only way to identify the police officers who are polluting our town with toxic gasses and brutalizing families who are trying to assemble to protest the existence of their employers, is by their face.

So don't pretend for a second like it's we, the protestors, who are trying to hide.

A stationary camera looking up up peoples faces 24/7 in a huge database is a very different thing to occasional photography by an individual, who only has a limited memory capacity.

So it's the pervasive always-on nature that makes it different.

This is excellent, and remarkable! I'm hopeful that similar legislation will be considered by other cities.

It is unfortunate that providing people such basic protections from some of the worst evils of surveillance capitalism.

It won't be this year, or next, but fairly soon these laws are going to implicitly restrict people who are using Neuralink 2030 from opening their eyes.

Probably a pretty good reason not to get whatever the hell a "Neuralink 2030" is

Musk’s internal spotify

We're living in the gold ages before everything we do within eyeshot of anyone is recorded like that Black Mirror episode anyone can review/share anything they've seen with their own eyes.

And it's going to be very interesting, to say the least. This facial recognition war is just the start of our attempt to engineer ethics for the new era.

I mean, just imagine how sex will be different in this world.

> We're living in the gold ages before everything we do within eyeshot of anyone is recorded like that Black Mirror episode anyone can review/share anything they've seen with their own eyes.

I very much doubt that. Just because it may be technically possible to some degree at some point doesn’t mean that anyone would be interested in it. It’s technically possible today to wear a mic and record everything you hear and say for your entire life, but no one does that, and most people would find anyone that did very weird.

> It’s technically possible today to wear a mic and record everything you hear and say for your entire life, but no one does that, and most people would find anyone that did very weird.

I suspect that is largely due to technical limitations. Devices only recently became small enough, and battery life would still be a limiting factor for (say) your phone meaning you would need to carry a second device. Then there's the issue with placement - modern microphones still don't seem to work when obstructed by (for example) your pocket.

Contrast this with the (hypothetical) option to record everything using your phone, without meaningfully impacting its battery life, while it was still in your pocket. I think most people would actually opt to do that, even if it was technically illegal in their jurisdiction. There's just not really any downside and a whole bunch of potential upsides from the perspective of an individual.

> Contrast this with the (hypothetical) option to record everything using your phone, without meaningfully impacting its battery life, while it was still in your pocket. I think most people would actually opt to do that, even if it was technically illegal in their jurisdiction. There's just not really any downside and a whole bunch of potential upsides from the perspective of an individual.

I think we have fundamentally different views on what non-tech people look for out of technology, because I definitely disagree that “most people” would want to do that.

Good? Soon as people start walking around with voluntary brain implants, I'll start walking around with a microwave magnetron. Buzz buzz.

If you're looking for tech that will change the world, a good signal is when people try to ban it.

Not all "change the world" developments are for the better.

Reply on news.ycombinator.com