It feels like we’re truly living in the future, but that may not always be a good thing. Kerala police are planning to adopt Artificial Intelligence-based drones, capable of facial recognition and identification, after the new technology is introduced at the 11th CoCon, an international conference on cyber security, data privacy and hacking, scheduled to be held in Kochi in October. But data security and internet rights activists say that there are pressing concerns that need to be explored before such an initiative can be inflicted on the unsuspecting public.
At CoCon, an International Cyber Security and Policing Conference where the technology is to be first unveiled to the public, a small and rather alarming demonstration of the technology’s abilities has been planned.
Capabilities of the drone
Manu Zachariah, co-founder of CoCon, tells TNM, “We’ll have a drone with a hi-definition camera, it will do facial recognition of the people gathered there and match to a server, which will in turn get in to the dark web, internet or a database which they already have and search for matching patterns. If a username and password related to that person has been compromised in the past, or if there’s any publicly available information, they’ll try to extract it and show it on the screen or to the audience [at the conference]. This is not in any way breaking any rule, in the sense that we are not getting into any restricted database. The only information accessed is openly available information.”
He goes on to explain, “Let’s say you have a username and password with LinkedIn, and the LinkedIn data is compromised [by hackers], and posted on the internet. That information will stay on the internet for say one week or two weeks. In that period, our bots pick it up and store it locally. We have the collection of almost all the leaks that have happened, and from that we are searching. We are not breaking into any system, but whatever has been made publicly available, we are maintaining a copy. The same system or model is what the police are trying to implement.”
When asked about privacy concerns around such technology, Manu says that it’s better to have such technology in the hands of the law enforcers, as opposed to anti-social or criminal elements in society.
But can we just take it for granted that such technology in the hands of the state, particularly police, is automatically a good thing?
Police naturally seem to think so. The Kerala police proposes to use such technology for VIP security, near airports and highly protected zones.
Manoj Abraham, Inspector General of Police, Thiruvananthapuram Range says, “This drone is basically like any ordinary drone, but with connectivity to the database of all the people with criminal backgrounds. With Artificial Intelligence (AI), we will match the pictures. Now, if the drone is being operated and we have a VVIP visit, we will operate the drone there and the moment it flies above them and the pictures are transmitted, the AI will match the pictures with the available database, and give an alert that such a wanted person is sitting in the audience of this event.”
When asked about accessing information available on the internet, Manoj says, “We will be taking information from the internet as well, but we require it only for the people on the wanted list, or are absconding. It depends on the purpose. For VVIP visits we require for one category, for crowd control in Sabarimala, it will be different, on the traffic front it will be different. The database will differ.”
Privacy, legal and ethical concerns
But when asked about the police using information dumped on the internet by hackers and leakers, Manoj’s response is slightly cagier. “Basically, if hackers are putting something, or individuals are putting something online, if it’s on the internet, it is always a safe bet to know that this information is available. It’s available to everybody. Whatever is available to everybody on the internet, it will naturally come out. If something is freely available on the net, its available to everybody.”
Amber Sinha, senior program manager at The Centre for Internet and Society, says that there are legal and ethical questions at stake here. “So, they will look at data that has been shared online, possibly information that has been illegally obtained by hackers. A principle in criminal law is that ‘the fruits of the rotten are also rotten’. If there is illegally obtained evidence, let’s say even if the law enforcement agencies themselves have not obtained it through an illegal means and the information is in the public sphere, but it was potentially illegally obtained information, there are clear provisions under criminal law which talk about its admissibility in courts. There isn't a law against carrying out investigations based on such information, but its probative value in courts is a concern. Unfortunately, in India, there are a lot of dilutions of that in practice, by police and courts themselves. Often-times, even if illegally obtained evidence is used, it is admitted, which is not very good for the rights of the accused. Those kinds of procedural irregularities exist, which is why something of this nature is so concerning.”
He continues, “Accessing data that has been available on the internet through hacks creates more data confidentiality and privacy concerns. It is bad enough that they have been available in the public sphere, now for law enforcement to start using this information, that further exaggerates the privacy breach that has occurred.”
Amber also talks about the concerns with rolling out drones enabled with facial recognition technology. “There are problems that exist with such technology at various levels. There are serious questions about its accuracy. There are also serious privacy implications: it is not that only people who are suspects or where there’s reasonable cause to surveil someone that they are being surveilled. This is a case of mass surveillance. Everybody’s face is being scanned and they’re trying to match it against the database. It creates serious questions of surveillance, how this information will be stored, and how it will be secured.”
Manoj says, “The data of people who don’t match the criminal database won’t be stored, but basically the drone camera will stream whoever is passing by. That’s not recorded, only if the face is a match to the criminal database will that data be stored. We can’t store so much data, that’ll be huge terabytes of information.”
But Amber says that there’s more to be unpacked on this front. “These cameras don’t automatically just match faces to a database. There’s some processing involved, where each person’s face is sequenced, and that sequencing is matched to the information available in these databases. What happens to this sequencing and processed information? Whether everyone’s data is stored or not, there’s still some amount of processing that’s taking place, and there needs to be more transparency around this process.”
While police stress that what they’re doing is fully legal, Amber says, “The reason why they’re saying its legal is because there aren't proper surveillance reforms and we don’t have a proper data protection law in place.”
Pranesh Prakash, Policy Director, Access to Knowledge, Openness, Internet Governance and Freedom of Speech at the Centre for Internet and Society, says that such a move should really only be rolled out after public debate and discussion with various stakeholders, like public citizenry, activists and academicians working in the field to fully understand the power of such technology, its implications and the ways it can be used or misused in the future with further technological advancement.