Hacker News Reader

Comment by fwlr | Hacker News Reader

The article mentions the AI Act and claims it “restricts the use of remote biometric identification — including facial recognition technology — in public places unless it is to fight “serious” crime, such as kidnappings and terrorism”, which I am afraid seems rather hollow as that is basically how it is already used.

I’m not sure whether it’s the reporting that’s confused or the politicians, but this distinction between three different things (“facial recognition technology”, “private facial recognition databases”, and “predictive policing”) is very strange. Modern facial recognition algorithms are just clustering vectors, and facial recognition databases are just lots of pictures of faces, neither seems well-defined enough to easily ban. And predictive policing is just plain bizarre - what relationship does that have with facial recognition at all?

View on HN

Don’t retail stores in Europe use in-store analytics? These often employ cameras to track shoppers when they are in the store. They use sentiment analysis to figure out what shoppers like, the cameras look for people lingering more than usual and alert security, they use it to track how people move through the store to optimize layout, and when you finally pull out your credit card and buy something, they can link up your real world identity with all the footage they’ve just captured.

I think it’s pretty gross, but without government actions like this it will not stop.

> neither seems well-defined enough to easily ban

Seems like it would be easy enough to define. If an image or any other kind of data generated from an image is used in the process to identify a person, then you are doing facial recognition.

A link would be useful: there are rumours eu shopping centers are tracking (anonymously!) cell-phone routes through shopping centers; some places have sensors outside there windows to track foot tracffic and window shoppers but I've never heard of actual tracking of customers via facials: I rather suspect that would be a PR disaster. Nb - I alwaysys turn off my phone when going into shopping centers.

https://www.cyberlink.com/faceme/insights/articles/363/smart...

If you search for “in store analytics” you will find a lot more. This article is a decent overview though and has a few links.

Some of the stuff you listed under “in-store analytics” is more like “in-store statistics”, the kind of privacy problems addressed by this bill/proclamation don’t seem related to analyzing CCTV footage to optimize store layout or determine which products are popular, and it doesn’t seem like either the reporting or the politicking here is concerned with that. If they are then taking that information and trying to tie it to an identity based on credit card purchases, I do agree that’s gross and I wouldn’t object very hard if governments tried to stop that from happening (though I’m skeptical that facial recognition is doing much of the work in this paradigm, and I’m also skeptical that it works at all - most of this “know your customer” stuff is compelled by regulatory compliance, and the other stuff that is sold as improving conversion tends to be vaporware that fails to materialize real benefit).

>If an image … is used in the process to identify a person, then you are doing facial recognition

This is an easy definition of facial recognition that is very hard to ban! Police departments are doing facial recognition to catch criminals by this definition, and I don’t mean this in some narrow technical “well actually” sense: I mean that e.g. detectives in metro cities are given large binders of face pictures of many pickpockets and other criminals, they study these faces and train to recognize them in a crowd, and they go out in public aiming to recognize them. But my point was not that facial recognition is hard to define, my point was that “facial recognition technology” and “private facial recognition databases” and “predictive policing” are weird categories or distinctions to make.

Various police departments are also abusing facial recognition as undisclosed primary evidence and putting the wrong people in jail, in addition to destroying lives and forcing people to prove innocence after being assumed guilty.

https://www.nytimes.com/2020/12/29/technology/facial-recogni... (Another Arrest, and Jail Time, Due to a Bad Facial Recognition Match)

https://arstechnica.com/tech-policy/2023/01/facial-recogniti... (Black man wrongfully jailed for a week after face recognition error)

https://www.wired.com/story/face-recognition-software-led-to... (Face Recognition Software Led to His Arrest. It Was Dead Wrong)

I’m aware - I used to work on facial recognition technology for law enforcement.

In Finland, at least, the most common way is to get people to download an app, or join a bonus club. I'm sure they use visual analytics too, but identifying store visitors means storing personal data, which you can't do without explicit consent.

Are you talking about the GPDR? In Finland, are you allowed to store personal information? Can you maintain an address book or contact information on your phone? Does the law distinguish between commercial and non-commercial uses of personal information?

It applies to systematic collection and processing of personal data.

As always the law is about intent. It doesn't care about your technical arguments.

"Well the laws of Australia prevail in Australia, I can assure you of that. The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia."

Attempting to ignore physics and mathematics when making the law tends to not work out well....

At the same time a law can't narrowly target a specific technology, which then is bypassed easily by changing some technicality, but must be broad enough to cover different technical implications, while specific enough to catch the case you want to catch.

If a company wants to do business abroad they'll have to conform to those laws. And the law cares about intent.

Most means available would be used to fight serious crime. Imagine police saying "We cannot track the kidnapper of your child; we would be able to if we used facial recognition, but we're legally disallowed to use it". The voters won't support a case like that.

Note that unlike e.g. crackable encryption, facial recognition for law-enforcement needs can be deployed in a limited area for a limited time.

OTOH I see the value in banning facial recognition for e.g. marketing purposes. Even if you totally don't mind improving your personal shopping experience this way, detailed information about your location, exterior, gait, etc, is a dangerous asset in hands of criminals who steal it from the well-meaning commercial entities. It would e.g. greatly simplify identity theft, then snatching your assets and burdening you with large debts. The fewer copies of such info exists, the better; zero is best.

Video footage can still be used to fight crime without facial recognition. The kidnapper's car, clothing, direction, location (as determined from multiple cameras along the route), and more can be used.

In addition, if there is clear evidence of a crime, they could be required to get a warrant. At least that way a judge can determine if what is being done is arbitrary or has substantial justifications for going further.

> what relationship does that have with facial recognition at all?

It's not obvious? "If your face is detected to be dark and you have big lips, you're predicted to be a criminal..."

Reply on news.ycombinator.com