The news that Guo Bing, a special associate professor at Zhejiang University of Technology, had filed a lawsuit against Hangzhou Safari Park over its mandatory use of facial recognition technology at the entrance gate for park members has spurred public debate over the increasing intrusions of facial recognition into daily life beyond those used for law enforcement. On November 3, Fuyang District Court in Hangzhou formally accepted the case. NewsChina learned from Guo that he is yet to see any progress.
As with many new technologies in China, development has far outpaced regulation. There is still a question over who is eligible to collect facial recognition information, as well as where the boundaries should be placed on its application.
Facial recognition is already in wide use in China in fields such as public security, customs, finance and the military, as well as in airports, land border customs, train stations and even subway stations. For the most part, the public did not question these applications.
Li Mengyao from CloudWalk Technology told NewsChina that her company has expanded the application of facial recognition technology beyond security to areas including staff attendance mechanisms for private companies and government agencies.
According to a report from by the China Merchants Industrial Research Institute, the
market size of the Chinese facial recognition industry exceeded 10 billion yuan (US$1.42b) in 2018, and it is estimated that it will come close to 12 billion yuan (US$1.7b) for 2019. The industry is expected to enter a period of explosive growth as demand increases, and it is expected that the market could reach annual sales of more than 100 billion yuan (US$14.2b) in the next decade. Related industries, including the upstream sector of hardware such as high definition cameras, processing chips, service devices and data and video transmission equipment, the middle stream sector such as software design, as well as the downstream sector such as vertical domain solution providers, will all benefit.
According to a report broadcast on China Central Television (CCTV), China already had the world’s largest video surveillance network in 2017 to deter criminal activities. Statistics indicate that in the last five years, the rate of major crimes had fallen by more than 40 percent after China set up its “Skynet” system of 20 million surveillance cameras.
Previous experiences indicate that facial recognition technology does make false identifications. Media reported that primary school students in Zhejiang Province found they could use a printed photo of their parents to pass the facial recognition system of a smart courier drop box to access deliveries. In 2018, a test for Amazon’s face surveillance technology called Rekognition found that the software incorrectly matched 28 members of Congress to other people who had been arrested.
Commenting on the technical errors that plague facial recognition, Zhang Xiaobo of the Institute of Automation of the Chinese Academy of Sciences said that factors including lighting, posture and make-up can affect facial recognition systems. This could make the system vulnerable to all kinds of deliberate counterfeiting attacks, including stealing legitimate users’ photos, videos and by making 3D face masks.
The reason the technology sometimes fails is that the live movement detection technique is not applied. Li from CloudWalk Technology claimed that by using a 3D structured light technology developed by her company to carry out the live movement test, someone would not be able to cheat the system by wearing a mask or using a photo.
Although many facial recognition systems have added biological activity detection methods, attackers can still use video playback and automatic human face motion and other techniques to escape detection. Using face key point location and automatic face dynamic technology, fraudsters can achieve the blinking and mouth opening movements required by a facial recognition system.
The risk of leakage and resale of facial data is an increasing problem. Recently, the
reporter found an app offering 5,000 photos of faces for 10 yuan (US$1.42). Earlier, the reporter also found an online shop selling facial data with portraits of over 2,000 people, each of which contain about 50 to 100 photos of the same person with detailed information on the person’s eyes, ears, nose, mouth, eyebrows and other distinguishing features. According to the online shop owner, some of the face samples it sells are taken from search engines and some from a database of a foreign software company.
Industry insiders told the reporter that a lot of facial data can be obtained through Trojan horse programs, crawler technology, black market trading and other deceptive means. The facial data obtained by hackers and criminal groups may be sold on the black market.
Lao Dongyan, a law professor at Tsinghua University in Beijing, believes that compared with other personal information, facial data will pose a bigger risk and lead to unforeseen consequences. The combination of leaked facial and other identity information is enough to establish a 3D identity information database. In the future, Lao said, there is a terrifying possibility that a person at the other end of the camera will already know your name, address, personality, daily movements and spending habits.
Despite some preventative measures such as data masking taken by the industry, leaks still happen.
“It’s not a problem of the data itself, but the problem of management,” said Lin Dongdai, director of the State Key Laboratory of Information Security under the Chinese Academy of Sciences.
Fu Xiaolong, head of the science and technology department with CloudWalk, believes there is no difference between facial recognition data and fingerprints, iris, voiceprint and other biological information. “However, people’s faces are particularly sensitive, because faces are a particularly intuitive thing,” Fu told NewsChina. The non-contact nature of facial recognition makes it possible to collect facial information secretly, which also results in more public concern about the security of the technology.
Lao said the collection of facial images needs to be legally authorized, and the authorization is mostly based on local regulations or department rules, the level of which is too low. “The situation for collection of data for commercial purposes is even more complex. No one knows what information is collected, for what purposes, who’s collecting the data and the use of the data after collection,” Lao said.
In an interview with NewsChina, Wu Shenkuo, secretary general of the Research Center for the Internet Society of China, suggested that the government should establish minimum requirements for private sector development of facial recognition technology, so that only institutions that have been certified can collect fingerprints and facial information. At present, the legal nature of facial information is unclear, he said. “It can be either an extension of portrait rights, or it can be categorized as personal information,” Wu said.
Wang Xiaoning, head of AI at CCID Consulting, told NewsChina: “The controversy mainly focuses on the right to know before personal information is used and the scope of information collection and its use in the public domain.”
Lao pointed out that the legal protection framework is inadequate. The responsibility for data protection falls entirely on individuals. Apart from generating risks, data collectors can also obtain benefits in the process of data collection, while the risks are usually borne by individuals. Data collection enterprises enjoy rights, but rarely are subject to obligations or requirements.
According to Lai Jianhuang, a professor at the School of Data and Computer Science at the Guangzhou-based Sun Yat-sen University, facial recognition technology should be managed and regulated by the government, such as the Ministry of Public Security.
NewsChina learned that a stricter data protection law is on the government agenda following the enactment of China’s Cyber Security Law in 2018. On August 21, Zang Tiewei, spokesperson for the legal work committee of the Standing Committee of the National People’s Congress (NPC), said at a press conference that a Personal Information Protection Law is included in the legislative plan for the 13th NPC Standing Committee.
According to Hangzhou Safari Park, the purpose of using facial recognition technology at the entrance is for customer convenience and efficiency. Professor Guo said it is a violation of his personal right to privacy.
Zhao Zhanling, contributing researcher at the intellectual property center of the China University of Political Science and Law in Beijing, told the reporter that the Hangzhou park was not in breach of Chinese law. Some legal professionals predicted that Guo was likely to win his case, but the court would most likely base its final judgment on contract disputes rather than precedent regarding protection of personal information.
The first legal case involving facial recognition in China has left the public wondering whether they have the right to say “no” to the increasing widespread application of facial recognition. Zhu Wei, deputy director of the Research Center for Communication Law at the China University of Political Science and Law, stressed that institutions must abide by the principle of informed consent in facial data collection and ensure users’ rights to have the data deleted. Of more concern is the blurred boundaries of technology applications. There was enormous fuss over a study published in 2017 when a new algorithm developed by data scientists in Michal Kosinski’s team at Stanford University was claimed to be able to accurately distinguish whether a person is gay or straight by analyzing facial photos.
The accuracy of identifying male sexual orientation was as high as 91 percent, and that of female sexual orientation was 83 percent. Even further, through analyzing the facial distinctions of the photo, a person’s political views, intelligence quotient, criminal tendencies, and whether they have specific personalities or characteristics could be defined. Needless to say, there was immense skepticism at the time, and other researchers debunked the study afterward, according to media reports.
Recently, one station along Beijing Subway Line 2 began a pilot program to use facial recognition for security checks. Lao said she disagreed with this application, saying it was not just a simple contradiction between the right of personal privacy and public safety. “Facial recognition involves the collection of important biological data for individuals, and organizations or institutions must prove the legitimacy of this practice before the collection of the data. They should consult the public, go through a strict public hearing process and verify the efficiency of facial recognition technology,” Lao said. “In fact, you will have to sacrifice most or all of your privacy rather than a little privacy,” she noted.
According to the report Digital Society Index 2019 conducted by Dentsu Aegis Network, misuse of personal data has driven consumer distrust of the tech industry. In China, the commercial territory for facial recognition technology is expanding and industry insiders believe that protection of user privacy not only depends on the self-discipline of enterprises, but also on the establishment of government-guided unified standards for the whole industry.
During a recent meeting held by the National Committee on Biometric Recognition, the reporter learned that a working group to establish national standards for facial recognition had been formally established, which signals that the first national standards for facial recognition technology in China are on the horizon.
Old Version
