In the world of overt surveillance cameras automatic facial recognition has recently been under the spotlight. Only in the last few weeks we have seen the publication of a high profile and independent report highlighting concerns about the use of live time facial recognition by the Metropolitan Police. Her Majesty’s Inspector of Constabulary Fire and Rescue Services HMICFRS released its annual report ‘A State of Policing’ suggesting that the police should invest more in technologies such as facial recognition. We’ve seen the House of Commons Select Committee on Science and Technology report criticise the government’s approach to regulating the police use of AFR in their latest report. The Information Commissioner has also added her voice to the AFR debate in a recent blog.
Whereas AFR continues to command headline attention, to exclusively look towards AFR and indeed ‘Biometrics’ with regard to surveillance cameras is to risk missing a wider point of concern. The capability of overt state surveillance in public places is growing. There are now more drones carrying cameras in our skies, more body worn cameras walking our streets, a more modern ANPR infrastructure watching our cars, more CCTV cameras on police dashboards - far more cameras probably exist now than when my role was created in 2012.
What next? Algorithms that can identify someone by how they walk (gait analysis), lip reading technology, artificial intelligence technology that can predict fights and sensors that can detect explosives and radiation. These are all technology that’s in development and what they all have in common is that they’re linked to surveillance cameras.
I’ve always supported the notion that we should harness technology and the police should be allowed to exploit the potential which exists within technology to make us safe. Some of these technologies do make people feel safe and I recognise that.
The key point however is that the use of technology enhanced surveillance has to be conducted and held to account within a clear and unambiguous framework of legitimacy and transparency. This will ensure that in pursuit of delivering a safe society, such use does not go beyond that which is necessary and proportionate in a free society.
As the leading regulatory voice on the use of overt surveillance cameras by the police I am heartened that the courts are giving due consideration to the issue of police use of AFR, something which I have been highlighting for debate for some considerable time. I very much look forward, together with others, to the outcome of those particular proceedings to help take us all forwards.
So, what is the state of surveillance?
On the National Surveillance Camera Day I launched a compliance assessment (survey) of the overt surveillance camera capabilities of all police forces in England and Wales. This was to get a deeper understanding of the current and aspirational police surveillance camera capabilities and of the issues which their use gives rise to (and a repeat of the survey I carried out in 2017). As the final returns continue to come in to my office, I commend all those Chief Officer’s and Police and Crime Commissioners for their support to this work. They too seek better guidance.
In my view ‘surveillance’ is an ‘investigatory power’ when exercised by the state whether such conduct be overt or covert in nature. As such it should be considered, appropriately legislated for and regulated as being such.
Voices from within Government and as well as those outside have been calling for a public debate on the use of AFR. In support of those voices I would go a step further and say that we need an independent review commissioned and conducted of the statutory and regulatory framework which governs the investigatory power of overt surveillance camera use by the state.
The growing capabilities of overt surveillance technologies, the proliferation of cameras in society, the increasingly crowded regulatory space and the voices of concern are such that these matters are increasingly ‘a question of trust’ for society.
As a deliberate segue, when I consider the excellent report delivered by Lord David Anderson QC in 2015 (a Question of Trust) reviewing the law and regulation of surveillance, I find so many potential answers to the dilemmas which government officials are facing. This report placed the regulation of all investigatory powers under a single regulatory body (the Investigatory Powers Commissioner’s Office) which has within its structures, independent judicial figures, legal advisors and an inspection regime, all of whom are skilled and experienced in the subject of, you guessed it, surveillance.
I am particularly drawn to Lord Anderson’s 5th principle in that report calling for “a single body of law, and a single system of oversight, for equivalent investigatory activities conducted by different public authorities”.
If I have learned one thing from my experience within the National Surveillance Camera Strategy it is that the framework which delivered my role and the rules by which overt state surveillance is conducted has to evolve and be future proofed by being principle based. The days of fragmenting the regulation of state surveillance on the basis of whether a camera is being used ‘covertly’ or ‘overtly’ are gone in my view.
I simply posit the view that some overt surveillance camera applications whether in themselves or combined with other technologies are so progressively intrusive in their capabilities that they can be the equal of some covert surveillance activities in terms of the intrusion caused.
I really do believe that it is time government recognised overt state surveillance as being an investigatory power rather than simply a data protection issue. An informed and esteemed independent reviewer would I am sure provide such clarity as to the way forwards.
Implicitly my role is to raise the standards of public surveillance operation, to ensure that the public are better informed, more confident and safer, to ensure that the state is clear and accountable for acting within legal and ethical boundaries. That stakeholders and industry have clarity in leadership and standards, and to help inform the evolution of laws and regulation that contribute to keeping us both safe and free. After all, these are questions of trust too.
Sign up for email alerts for the my blog and also follow me on Twitter.
4 comments
Comment by David Johnston posted on
I think your article raises some interesting questions and moral if not legal dilemmas.
I do however question whether this needs to be broken down further.
It does seem to me that this is very similar to the debate on communications data.
That is to say, someone needs to collect and store this data passively so that it is available at a later time if there needs to be some examination of the data to hunt for evidence (or exculpatory material).
On that point, let us not forget that this 'surveillance' by cameras, is a double edged sword in that it can operate for both prosecution or defence.
The use of cameras as a 'passive' surveillance tool are a good crime prevention tool in their own right and arguably, when recording in passive mode, they are benign but a deterrent.
I would argue, that this is not surveillance at this point (as the collection of comms data is also not at the point of transit or collection, viewed as surveillance). At this point, this is merely passive data which as i say, has some probative crime prevention benefit in its own right.
Perhaps then it is the use of the data collected by the cameras which requires further scrutiny?
As you state, public bodies such as local authorities, intelligence agencies, the police and other law enforcement agencies, are subject to stringent oversight by the IOC and the provisions of the Investigatory powers act.
Therefore, the camera is not the issue, it is the use of the data or images it collects which we need the discussion on.
The current legislation is very robust and has some degree of future proofing built into which is i believe, technology agnostic.
In line with your quote from David Anderson QC, this single body of legislation ought to be sufficient to govern and oversee both overt and covert surveillance.
You point to increasing technology which today makes things possible which only 5 years ago, were science fiction. This is also happening in other areas of life such as genetics and life science.
Perhaps a solution would be to set up an independent ethics body represented by citizens and experts from both sides of the privacy lobby to consider the intended use by agencies or others on this data?
My wider concern on the use of cameras (not touched on in your article) but is perhaps more worrying, is the increased use of cameras to collect information on the publics habits and use of spaces for advertising and revenue collection.
I recently received a fixed penalty notice for spending more than 2 hours in a motorway service station because i felt tired.
Most public carparks are now covered by some form of private surveillance to collect revenue.
The large social media companies including, Facebook, Google and many others, have opaque terms and conditions which can allow them to operate your device camera remotely and without your knowledge of further consent.
We know from recent events on the privacy debate, that these companies do not have to comply with any of the oversight or regulation that applies to government or public bodies.(IP Act Police act etc).
It is this increased area of surveillance without any controls that deeply concerns me and it is this area which i believe, requires further and immediate attention.
David Johnston QPM
Previously Head of NTAC (GCHQ)\ Commander Homicide Scotland Yard
Comment by Tony Porter posted on
David.
Hello. Thanks for your considered comments. I concur with your concerns about the private sector and it’s regulation.
A key issue for me is the emerging links between private and police. The use of AFR between police and retail centres is a case in point. This type of surveillance ( use of AI) is dynamic and interactive - and not passive. Perhaps this is in part the difference between optical sensor ( camera ) surveillance and other forms ( comms ).
I think you raise an interesting point re an independent ethics panel. I do see more robust regulation and ethics being incorporated into a stronger principle based code that covers emerging technology but gives space for that tech to grow and emerge
Thanks again and good to hear from you.
Comment by Kevin Hamilton posted on
Dear Tony & David,
It has been insightful reading both descriptions and viewpoints regarding the current 'state of surveillance'.
I write to you both, not as a degree holder nor from a professional body. I hold a double B English GCSE and an NVQ3 in Electrical Engineering. I write to you both not only as a citizen, but as a Security Engineer that has worked with this emerging technology for 14 years.
The entire framework surrounding CCTV & surveillance requires a complete makeover with some serious thought. The current guidance provided by government & ICO is conflicting, poorly provided & very out dated in correlation to the speed in which this technology has evolved. The industry is heavily unregulated not just on the larger scale as you both refer too but to the smaller scale homes/SME's.
As the demand for CCTV has risen exponentially this has opened up the floodgates to very cheap equipment available to the general public, who unbeknown believe they are getting a bargain, non the wiser of the serious issues they could face.
The biggest issue for me are the network privacy issues (insecure remote access - who is really watching? Simply visit http://www.insecam.org to see for yourself). There are also many other reports of well known Wi-Fi doorbells or internal Wi-Fi "CCTV" cameras having serious privacy vulnerabilities & implications. CCTV by definition is supposed to be 'Closed-Circuit' therefore inaccessible to unauthorised persons no matter how advanced the technology becomes.
My second biggest issue... I quite like the initiative you have created Tony 'Secure by design, Secure by default', this is great but you're missing a key ingredient...
It is not the professional installers that are the problem here at least not most, I interact with many of them daily across the country... it's your unqualified, inexperienced, 'have a go' installers that are a major problem. "4 camera cctv installed for £350" you may find swamping the Facebook buy/sell sites... this is bad news for the uneducated buyer.
Here is just one example I received via email on 2/8/19.
"Hi Kevin,
You came round to my property on behalf of my landlord to look at having cameras installed. I understand he wasn't happy with your quote?
However, we've since had cameras installed but it's not good news for my landlord. The cameras are not recording, there's no HDD! I've explained this to them and they've asked me to get someone in who is professional who would have a look at it?
I found your business card and would really appreciate if you could come down just to have a look to see if you can fix the missing part? My landlords have been done over, put politely and would love to hear from you
Kind regards
Name removed"
I would like to see (and I'm sure many other professional engineers) the CCTV industry licensed & regulated for qualified or proven competence persons which includes network security, as I can assure you, the cheaper CCTV market will not make the 'secure by design' grade and continue to thrive. I'm not going to publicly call out these dreadful manufacturers in the fear of a lawsuit but any professional installer will know exactly who I refer to and refuse to install this equipment.
David, you are Commander of Homicide Scotland Yard. I can't even begin to imagine what you have experienced throughout your career and for that I commend you. I can imagine however, as I've assisted the Police on many of occasions for evidence retrieval, how frustrating and time consuming it can be when trying to view some CCTV footage and the image quality is still that of the early 2000's.
Poor quality CCTV is still being provided up and down the country not installed within any of the NSI/SSAIB guidance, it's the uneducated population getting ripped off who may urgently require this footage particularly when an incident occurs and the Police require footage to proceed with a case. These problems can all be resolved if the industry was respected enough so that systems can be designed correctly and fit for purpose.
Crime across the country, right now is so high, every single day I see at least 5 reports of robbery/theft in my local area and the police simply do not have the resources to investigate these crimes. A local CCTV Network initiative have got together to assist the police close to home. Recently someone came under hot water due to publishing CCTV images of minors committing a crime of vandalism. Within an hour the victim received names of the children's parents and the post was taken down. Soon after, this sparked a large debate as to wether or not these images should have been published and were in fact against the law. The Police could not attend the incident and the above provided a result albeit against ICO guidance. An online poll was created with the following questions and results:
Should CCTV images of minors be allowed to be uploaded to social media in the event of them carrying out a crime:
Yes:700+
No: 10
This is becoming a serious issue which is rife across social media, the vague rules & guidance is there but who is actually monitoring it? The police appear to favour this tactic as it speeds up the process no questionable doubt, however if in court it can be proved by the defence that this evidence was used unlawfully then this provides a simple way of dropping all charges with the potential of counter charges to the plaintiff who simply wanted to know who damaged their property? Proper, clear, easy to understand guidance is urgently required for the public.
CCTV Analytics & Deep Learning Technology if used correctly could make our country thrive!! There is the dark side unfortunately and it requires some serious nurturing and I believe this is the battle Tony is fighting.
In a world that's getting smarter, AI is a double edged sword and it's happening right under everyone's noses, look at Alton Towers for pure example. Their high tech Avigilon system is capable of locating a missing child from its last known location to its current location within a matter of seconds, amazingly even if that child is currently ascending Oblivion!
It's also capable by using facial recognition to determine as to wether or not a person is barred from the site perhaps. Facial recognition can operate with images over 10 years old... so how long is a corporation allowed to hold CCTV analytical data on a person? The ICO state no longer than required, in the instance someone is barred how long is no longer than required? 1,2,4,8,16,32 years? Humans have a right to be forgotten in the United Kingdom, I think it's fair to say a firm rule needs to be applied to all organisations & government storing facial recognition images for future use.
Personally, I have no problem with Police Forces using AFR technology provided that it's being operated correctly for its purpose and not causing harm or distress to members of public going about their daily lives. Overt or Covert either way it's happening and the public deserve the right to know how this data will be used. How far back on the PND does this technology go? What information exactly will be provided to the Police? Will any of this data be stored for future use or be reconciled with other databases? In other words and for example because I'm sure it's certainly possible... Will the Police AFR reconcile with the UK Border ePassport systems to provide immediate information on a person not known to the Police or vice versa. I don't believe for one moment that the ePassport simply scans your passport photo for a facial recognition match, that data is being stored on the grounds of national security and the ePassport gates are a very simply method to gather your current facial biometrics along with key identity data. Having said all of that, for a country that's on a severe terror alert, AFR is very clever and has its place but transparency is urgently required.
I agree David, social media giants do have some serious control and data gathering methods, you only need to research Cambridge Analytica to realise this technology was/is? being used for 'Psychological Warfare', however... I have the option to turn off my phone when I see fit, unfortunately the man in East London couldn't protect his identity as he was charged with disorderly conduct and fined £90 for walking down the street. Go figure?
I really could go on for quite some time but I'll wrap it up there (it's now 4am and I have work in 3 hours!), you both make very interesting points and I hope I've thrown a few more into the mix.
I'd certainly be interested to talk further re an independent ethics body as I can certainly speak for both sides of the coin. One thing is for certain, I anticipate being within the CCTV industry for at least another 30-40 years so this is something of a very keen interest to myself.
Kind regards
Kevin Hamilton
Hamisec UK Limited
kevin@hamisec.uk
*Disclaimer: I have used Alton Towers as an example as the very large site hosts the most advanced analytical CCTV System in the world 'Avigilon' (to my knowledge). I am aware of the system capabilities but can not confirm which analytics are in use and the above are examples only.*All content provided is either my own opinion from experience or my own research.*
Comment by Tony Porter posted on
Kevin
So many interesting points. I shall let the reader consider their merits unfettered by my comments. But thank you.
Just one point - you are correct the Secure by Default doesn’t include all the industry. However we are complementing this initiative with an installers and consultants ‘ kite mark’. This will mean we have covered the whole spectrum of the industry from manufacturers through to end users. The motivation for compliance is the SCc Buyers Guide which informs the buyer what to look out for. That aim being to use the power of the pound to influence.
Once again - thanks for the helpful and insightful thoughts.