Facial Recognition: Balancing Security vs. PrivacyImplementing Technology at Airports Raises Concerns
Airports across the globe are increasingly leveraging facial recognition technology to verify and authenticate passengers. But some privacy advocates have raised concerns, especially in India, where several airports are ramping up facial recognition programs.
The technology has been introduced in recent years at some airports in the U.S., U.K., Japan, Dubai and elsewhere. In India, several airports - including those in Bangalore, Delhi and Hyderabad - are now rolling out the technology for use by passengers on a voluntary basis.
Some privacy experts in India express strong concerns that the nation lacks privacy regulations that would impose penalties for the misuse of the biometric data by the government or private industry.
"The biggest challenge is ensuring data privacy of the passengers, as the data garnered through biometrics is vulnerable and can be commercially exploited and sold if there is not tighter security controls and it's not governed appropriately," says Rahul Sharma, country president, India, at the International Association of Privacy Professionals.
A major concern is that facial recognition data gathered at airports might be used by the government for research or offered for sale for use by private industry without passengers’ permission, says Brian Brackeen, CEO at Kairos, a Singapore-based software company.
Given the potential impact of artificial intelligence, including facial recognition, on society, Alan Woodward, a computer science professor at the University of Surrey, says the time for robust public debate is now.
“I personally think there should be a much greater public discussion about the use of AI in a variety of fields: law enforcement, medicine, transportation and many others,” he says. "Each has safety implications and that at the very least should cause scrutiny." (See: AI Surveillance Tech Promises Safety, But at What Cost?)
Indian Airport Activity
Certain airports in India, including those in Bangalore, Hyderabad and Delhi, have begun the process of authenticating passengers voluntarily through facial recognition, which is part of their digital transformation journey. Airports in Pune, Kolkata and Cochin are the next in line for this technology.
The initiative of implementing facial recognition at India’s airports, known as the Digi Yatra Policy, is overseen by the Ministry of Civil Aviation, which says its goal is to offer air passengers a “seamless, hassle-free and paperless journey experience.”
The Digi Yatra Policy states that once passengers submit official proof of identification, an image of their face is scanned. “If the passenger chooses to register through Aadhaar, then images of their face and iris are captured and matched with their Aadhaar biometrics,” says Suresh M. Khadakbhavi, CISO at Bangalore International Airport. “Once confirmed, the passenger receives a 72-character token number from Unique Identification Authority of India. This token gets stored on the passenger’s profile.”
Nandita Mathur, chief strategy officer and head of engineering, at Q3 Technologies, a biometric facial recognition solutions provider, says the technology has undergone vast improvements.
“We first capture full-attention images of persons whom we are going to recognize through facial recognition system,” she explains. “A database is then created with face encodings of the images [128 landmark points are used for face encodings].”
With real-time video stream, frames are captured and are ingested in a machine learning algorithm, Mathur says. “In every frame, the algorithm recognizes faces and extracts individual face images for further analysis,” she says.
Khadakbhav, the airport CISO, says the Digi Yatra program is designed keeping in mind the fundamentals of privacy.
“The data is stored with airports only until a certain time, post which the data gets purged out of the system,” he says. “As airport operator, we will not store your data but the profile gets stored in a Digi Yatra central platform, which is secure platform.”
The Global Scenario
In the United States, Delta Airlines launched an end-to-end to biometric terminal leveraging facial recognition for international departures at Atlanta’s Hartsfield-Jackson Airline in November 2018, the airline says.
Facial recognition projects are in various stages at airports in San Jose, California; Orlando, Florida; Miami, Los Angeles and New York among others, according to Business Traveller.
Tokyo Narita Airport aims to introduce facial recognition in spring of 2020, according to a report in Japan Times. Facial scans will be captured at a self-service kiosk.
In Qatar, Hamad International Airport is introducing an end-to-end biometric system, while Dubai International has been working with Emirates on a “smart tunnel,” Business Traveller reports.
“Our approach to identity management is unique and holistic, in that we foresee widescale deployment of biometric capability across both mandated and voluntary passenger touch points while addressing customer data privacy concerns in line with relevant local and international regulations,” Badr Mohamed al-Meer, COO at Hamad International Airport, told the news media last month.
The International Air Transport Association says some 71 percent of airlines and 77 percent of airports worldwide are investing in a biometrics program.
“Biometric recognition using the One ID concept modernizes the airport experience for passengers and improves the efficiency and security of identification processes,” IATA Director General and CEO Alexandre de Juniac tells Business Traveller. “Using global standards for digital identity and data exchange will move us a big step closer to a hassle-free airport experience for passengers.”
But privacy advocates say the use of facial recognition technology at airports raises serious concerns.
“Facial recognition presents numerous challenges in today’s context in India, primarily because this technology can violate people’s right to privacy,” says Pavan Duggal, cybersecurity advocate and chairman of International Commission on Cybersecurity Law. “Right now, there is no legal framework that regulates or enables the use of facial recognition,” Duggal tells Indian news media outlet News18.
But India's Ministry of Electronics and Information Technology had earlier stated that in the absence of any law around data protection, data will be regulated according to Section 43A of the Information Technology Act, 2008. It states that a “body corporate” will pay compensation up to Rs 5 crore ($705,000) when it is “negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person.”
Sharma of the IAPP points out, however, that “this applies only to private companies. What happens if the government is at fault? We definitely need a better and more evolved law which takes into account all stakeholders involved.”
Civil Liberties Issues
Facial recognition poses a potential threat to basic civil liberties, privacy advocates argue.
“People don’t expect to have their identity, their location, and who they associate with logged every time they step outside and walk down the street,” says Matt Cagle, an attorney for the Northern California chapter of the American Civil Liberties Union. “That’s the kind of world that automated face surveillance would usher in,” he tells the Los Angeles Times.
Khadakbhavi, the CISO at Bangalore International Airport, offers this response: “Of course a law around privacy will give more confidence to users and keep away privacy concerns. But for now, we are confident of the security measures we have implemented.”
Facial recognition data is encrypted and only temporarily stored, he notes. The Bangalore airport has implemented a series of security measures to ensure proper implementation of the technology as well as sanctity of data. Khadakbhav explains the security measures taken to safeguard data in the platform: “The data is stored in a way that a hacker will not get name and phone number of a passenger together. Also, only certified devices can have access to data.” So far, only Air Vistara has agreed to participate in government’s Digi Yatra facial recognition program.