The Digi Yatra initiative of the Indian government can drastically reduce the time you spend catching a flight at the airport. With the simple expedient of using your biometric data, say your face, it makes for a seamless glide past check-in and security. Facial recognition is increasingly becoming big, even in India. The country is in the process of putting together what will reportedly be one of the largest facial recognition systems in the world for use by police and investigative agencies. This comes at a time when the EU has proposed a temporary ban on facial recognition — a move that received strong backing from Alphabet CEO Sundar Pichai. Kenneth Mohanty breaks it down

What is the new tech and why does the government want it?

The National Crime Records Bureau (NCRB), which is under the Union home ministry, floated a tender last year for an Automated Facial Recognition System (AFRS), saying it will be a great aid in the “identification of: criminals, missing children/persons, unidentified bodies and unknown traced children/persons”. AFRS is seen as being a force multiplier for one of the world’s most understaffed police forces. The date of opening the bids, set for beginning January, has now been postponed to January 31.

How will AFRS work?

The request for proposal (RFP) for AFRS says it will be a webbased application that will be able to identify or verify a person from multiple input sources. AFRS will be able to scan digital images, photos, digital sketches, video frames, etc. and compare facial features of an image with an already existing image database. Also, it will add photos from newspapers, sketches etc., tagging these for sex, age, scars, tattoos and other identification. The system will capture images from CCTVs and generate alerts if a blacklist match is found.

What are the laws that will regulate AFRS?

After Delhi-based NGO Internet Freedom Foundation (IFF) pointed out that AFRS “does not emerge either from legislation or an existing executive power of the Centre”, NCRB responded that use of facial recognition was proposed in a cabinet note of 2009. But a cabinet note is not a law but only a record of proceedings and, therefore, does not provide any legal basis for AFRS. India’s Personal Data Protection Bill, 2019, is yet to clear Parliament. Further, cyber law expert Pavan Duggal was quoted in media recently saying that the IT Act, 2000, does not specially deal with misuse of facial recognition and “there is not even any framework to regulate storage of facial recognition data” in India.

What is the database AFRS will use to match photos?

The RFP says the database will be of photos available with passport, integrated police databases, prisons, women and child development ministry, state or national automated fingerprint data system or any other image database available with police/others. AFRS will also be required to pull photos/data available digitally in all 36 states/UTs every 30 minutes. CCTV feeds and video feeds obtained from private or other public bodies can also be used by AFRS. In a reply to a legal notice by not-forprofit Internet Freedom Foundation that it later withdrew, NCRB said AFRS will not be integrated with Aadhaar database, but as has been pointed out, presumably there are no legal guarantees ensuring such assurances.

Who can access the data?

The AFRS proposal says the database of photographs is “for sharing by all the stakeholders in the system” and will aid officers of civil police. The RFP adds that the “term stakeholders shall cover, 1. MHA/NCRB, and 2.

state police forces”. AFRS will be a centralised web app hosted at the NCRB Data Centre in Delhi with the service to be made available for access to all the police stations of the country. The authorised requests using AFRS would come from police stations.

Who handles or stores the facial data?

The AFRS system is to be implemented by the winner of the contract, who will also provide 24/7 monitoring and management of the server and AFRS system, including storage, security and backup. The contractor will need to put in safeguards against unauthorised access, accidental modifications or deletions, breach of confidentiality and data. But cases of leak of official data are all too common, including in India, where Aadhaar information was reportedly put online for sale.

What are safeguards proposed for facial recognition?

Restrictions have been sought on data sharing. For example, Huffington Post reports that flyer data collected by companies for Digi Yatra can be used for marketing. Also, collection of collateral data has to be limited. For example, police filming protests and disturbances also capture images of people not involved. But it will be tough for a machine to discern between actors in a frame when capturing data from a video.

How are other countries using facial recognition?

China’s use of facial recognition is known to be highly invasive and the government applies it in everything from mobile SIM registrations to catching jaywalkers. In the face of ongoing protests in Hong Kong, it banned wearing of face masks, leading to fears among protesters that it was in order to identify them from video footage. Its potential as a surveillance tool makes the technology controversial and Reuters reported last week that European Union is considering banning facial recognition in public areas for up to five years to come up with regulations to prevent abuses. Tech review firm Comparitech ranked 50 countries “to find out where biometrics are being taken, what they’re being taken for, and how they’re being stored”.