Hacker News Reader

Comment by erentz | Hacker News Reader

How does this apply to something like Facebook scanning someone else’s photo and detecting my face in it?

So for an entity present in Portland they cannot run facial recognition in a public place in Portland. But what if entity A is partnered with entity B. Entity B procures images of people in public in Portland city limits and places them on a server in another state. Entity A, which is conveniently headquartered elsewhere takes the data from the server and runs facial recognition. This is clearly facial recognition of persons in public in Portland. But it’s not by a Portland business and the computing isn’t done in Portland either.

View on HN

There's a specific exception for social media applications:

> 34.10.040 Exceptions.

> The prohibition in this Chapter does not apply to use of Face Recognition Technologies:

> A. To the extent necessary for a Private Entity to comply with federal, state, or local laws;

> B. For user verification purposes by an individual to access the individual’s own personal or employer issued communication and electronic devices; or

> C. In automatic face detection services in social media applications. [1]

That seems like it would include what Facebook is doing -- but the ordinance never defines a "social media application" and also uses face detection and face recognition interchangeably in some places, so it's hard to say for sure what it allows.

[1] https://static1.squarespace.com/static/5967c18bff7c50a0244ff...

So that would mean things like Clearview [1] wouldn’t be legal on any person or photograph taken in Portland. Which is great for privacy, but I wonder how they’d enforce that.

[1] https://www.nytimes.com/2020/01/18/technology/clearview-priv...

Doesn't that make it illegal for someone to use Clearview in public, as opposed to making Clearview itself illegal?

It seems unclear whether face detection unto itself is allowed. Eg automated face blurring. The spirit is definitely the one-to-many searching.

This law could certainly use more clarity.

I think it's good that it is simple. People are constantly complaining about the excess of legalese in various contexts. A law that can be understood is cool and a breath of fresh air. I doubt the judges will have any trouble parsing between face blurring and face recognition.

Also, the definition excludes the face blurring use case. "'Face Recognition' means the automated searching for a reference image in an image repository." Although that detail does mean that if you're not searching for "a reference image" then you would technically be clear of the law's restriction. What if you build features based on a reference image then delete the image? Or what if what you're searching for is a person and the image is not the search target?

That I suspect would take more effort to parse. But the penalties are pretty light and the provable damages done by facial recognition are pretty minor, so if organizations get a lot of value out of facial recognition then they might want to try rolling the dice.

Although that detail does mean that if you're not searching for "a reference image" then you would technically be clear of the law's restriction. What if you build features based on a reference image then delete the image? Or what if what you're searching for is a person and the image is not the search target?

Any reasonable interpertation would find that the representation used during search doesn't affect what is happening.

Even if the representation isn't an image? The code seems pretty explicit on that point. The courts seem to only do interpretation where the code is ambiguous. They don't seem to guess where the law is explicit. That being said, if there is a problem they can always just change the law. Maybe the signalling effect will be enough. Companies won't want to adopt expensive technological workarounds while knowing that the city is motivated to close loopholes.

Yes absolutely.

Searching for text uses a TF-IDF or BM25 representation.

The only way to make image search work is to use a non-pixel representation. No court will find you aren't searching for an image because of that.

Sure, you have to use a non-pixel representation to make an image search index. I understand that. However, if the end result of the search is not an image, then is it the same? For example, you could learn some very basic features from an image, like "person's skin has this hue, their eyes are this color, etc." If you wrote that down and made it searchable, with the search target being a person's unique identifier (SSN or whatever), it would surprise me if that ran afoul of this rule, even if the features were extracted from an image. You can't be searching for a reference image if there is no reference image to search for.

Maybe I'm wrong though. IANAL and honestly it doesn't matter. But if I were writing this law, I would write that no one would be allowed to use any system that extracts and searches using or makes searchable information about human faces. That would seem to cover my proposed workaround, and I doubt it would hurt any other use case that they meant to protect.

I think in a way you are countering your first point that it's good that it's simple. I'm not big into the facial recognition space but I'd imagine that the tech is saving personalized feature vectors and not images. Thus making the definition already moot. Then again maybe that means the language isn't simple enough.

That's a fair point but most systems capture the face chips for human comparison. Is it still capturing "features of images in a repository" if your face descriptors are anonymous with no face images? This is imho a loophole they missed

It seems unclear whether face detection unto itself is allowed. Eg automated face blurring.

It's pretty clear that isn't banned. See point 6 in the explanation:

6.Face Recognition means the automated searching for a reference image in an image repository by comparing the facial features of a probe image with the features of images contained in an image repository (one-to-many search). A Face Recognition search will typically result in one or more most likely candidates—or candidate images—ranked by computer-evaluated similarity or will return a negative result.

Face detection isn't face recognition in that case, I believe. Face detection is identifying a face in general, not any specific face. Face recognition is finding a specific face in a set of images.

Yes - we seem to be in adamant agreement? (To quote myself: "It's pretty clear that isn't banned.")

It is written to outlaw recognition (ie, the search action), NOT detection.

Oh, yeah, I misread that as "is banned" for some reason. My mistake, sorry for the confusion.

Great, Facebook pipes everything directly into the US intelligence agencies. Its not just Chinese tech firms that have ties to the military.

> But it’s not by a Portland business and the computing isn’t done in Portland either.

Then it's not illegal. Portland's jurisdiction only extends to the borders of Portland. Even when it makes logical sense, you can't have agencies in Portland exercising executive control over organizations and people that don't live there. That way lies madness.

But it's a pretty easy loophole to close - just make it illegal to share images of people in public in Portland for the purposes of facial recognition. Now you can keep sharing images the way you used to, but it's a huge liability to try to do this to skirt the law.

At the end of the day if someone really wants to use facial recognition on (against?) someone in Portland, there are legal ways to do it even with explicit prohibitions like this. And the more nefarious the actors, the more likely they'll just use an illegal way.

Doesn’t Facebook have a Portland office?

Social media is specifically excluded.

Reply on news.ycombinator.com