From Oregon Capitol News. by Jacob Szeto:
An estimated 1.8 million faces processed through DMV facial recognition
PORTLAND, Ore.- Smile, it confuses the cameras. No, really it does. That is why the next time you get your picture taken at the Department of Motor Vehicles (DMV), you will be instructed to do just the opposite.
In the fall of 2008, the Department of Motor Vehicles started using facial recognition software to tag biometric data to each person who is issued a DMV I.D.
Pairing biometric data with Oregonians’ faces is now a DMV requirement to help battle identity theft. The requirement was part of a package of bills passed in 2005 to stem meth use in Oregon.
The system was mandated to start in 2008 and since has taken biometric data from approximately 1.8 million Oregonians.
As the law states that anyone issued a DMV I.D. must submit to the biometric data collection, virtually all Oregonians will someday soon be part of the DMV facial recognition database.
According to DMV public affairs officer David House, 940 suspected cases of identity theft have been reported to authorities to date, many of which were minors trying to obtain a fake I.D.
While the DMV has not kept track of how many of the 940 reports have resulted in convictions, House did highlight one case in which 37-year-old Adam Williams was convicted on 17 felony counts and sentenced to 96 months of prison. Williams was arrested on accusations of theft of services, identify theft, second-degree forgery, criminal possession of a forged instrument and possession of fictitious identification.
House puts the cost of the new facial recognition software at “no more” than 52 cents per issued I.D. That translates to a total expense of $936,000 or about $1,000 per suspected identity theft report.
A 2011 Javelin Strategy and Research survey found that costs to victims of identity theft were $631 on average. The consumer cost is much lower than the amount actually stolen because most victims are covered by their bank or credit card company, and thus most of their cost is time spent resolving the issue.
Using the average consumer cost, the facial recognition system has saved potential Oregonian I.D. theft victims about $600,000, $300,000 short of creating a net gain.
Not everyone is comfortable with the state mandating that citizens submit their biometric data. The American Civil Liberties Union (ACLU) has been speaking out against such laws, not only in Oregon but in other states following similar paths.
The ACLU worries about the reliability of the software and the potential for mission creep.
“You have a massive database of people that have done nothing wrong being searched for a tiny percentage who have,” said ACLU Executive Director David Fidanque.
When speaking of the effectiveness of the program in fighting identity theft, Fidanque stated that he doesn’t think anyone tracks the performance and that “legislators could care less.”
In particular, privacy advocates worry about how the data will be used, specifically because facial recognition is a surveillance technology and potentially could be used to identify people at protests, political rallies, or other situations.
The 2005 Oregon law states that the biometric data “may not be made available to anyone other than employees of the department [ODOT] acting in official capacity.”
But Oregon law does allow law enforcement to access DMV photos, just not the biometric data stored by the DMV. Considering the necessary information to conduct facial recognition analysis is the photos themselves, any law enforcement with facial recognition software could utilize the DMV database to run their own analysis within Oregon law.
House states that it’s not as simple as it sounds. He says the DMV interprets the law as meaning “law enforcement can view a photo, but cannot amass their own database,” something not explicitly stated in the law itself.
If law enforcement had access to the DMV photo database, it could be used reliably with their own similar software because the Oregon law requiring facial recognition data has standardized the photo database for the software to work.
Indeed, use of this database by law enforcement is not confined to some Orwellian novel. In 2009, the FBI utilized North Carolina’s now standardized database to catch a murder suspect. Although the FBI was not allowed to collect and store the photos, the analysis was done in-house by the North Carolina DMV.
One local company stood to be a winner from the state law. Digimarc, a Beaverton-based security company, secured contracts with many states before selling its I.D. business to L-1 Identity Solutions for $310 million in 2008.
Digimarc lobbied for the Oregon law and was later awarded the no-bid contract to implement it. In Oregon, Digimarc not only won the biometric processing contract but I.D.-making services as a whole. Between L-1 and former Digimarc, Oregon has paid the company $3.1 million since 2009.
A number of states have been implementing the technology to meet the requirements of the Department of Homeland Security Real ID Act, which sets minimum standards for state issued identification cards, including proof of identity.
Since taking over the Digimarc facial recognition business, L-1 has landed contracts with about 40 states, some worth upwards of $60 million, and the U.S. Department of State for passports, a $195 million contract.