The millions of photos that have been taken for Massachusetts-issued driver’s licenses and other official ID cards are regularly scanned using facial recognition software that hunts for matches with pictures of suspects sought by law enforcement.
A growing number of law enforcement agencies across the country are running similar searches. Critics say the practice raises the specter of privacy invasion and warn that inaccurate matches could subject innocent people to unwarranted investigation.
They also say that government has moved quietly, providing little, if any, notice to the public before using such technology.
“When you go to the DMV to get your license, you do not expect your photo to be part of what has essentially become a law enforcement database used for criminal investigations,” said Kade Crockford of the American Civil Liberties Union of Massachusetts.
Advertisement
State officials defended their use of the technology.
“Facial recognition is a valuable tool for identifying suspects, and one that we use with appropriate discretion,” said State Police spokesman David Procopio. “It can help solve serious crimes, and bring justice to victims, and prevent further crimes from being committed.”
State officials also said there are safeguards in place to address concerns about privacy and the technology’s accuracy.
For one, most law enforcement agencies are not allowed to directly scan the Registry of Motor Vehicles database themselves, officials said.
“Law enforcement at the local, state and federal levels may provide an image of a suspect associated with an investigation and request that the image be compared with the RMV’s database of facial images,” Massachusetts Department of Transportation spokeswoman Jacquelyn Goddard said in an e-mail “These are official, case-specific requests.”
She said that the actual scanning of the RMV’s database of photos is performed jointly by the Massachusetts State Police Compliance Unit and the Registry of Motor Vehicles Enforcement Services Unit, “which consists of staff trained to handle highly sensitive and confidential matters.”
Advertisement
She said the system finds potential matches and it is up to the investigative agency to determine if there is a match. The agency’s practices are “consistent with federal privacy laws,” she said.
In 2015, law enforcement agencies submitted 258 requests to scan the state’s trove of RMV photos — or the equivalent of about one request per weekday.
Of that total, 102 requests were from local law enforcement agencies, 84 from state law enforcement officials, and 72 from federal agencies. (The Transportation Department said it did not have a list of the names of the agencies that submitted the requests.)
In their requests, the agencies submitted a total of 331 images, which turned up 101 potential matches.
The RMV first got its facial recognition software in 2006, and its existence has been disclosed before. But officials have described it as a system to fight license-related identity fraud — to ensure, for example, a person does not have multiple licenses under different names.
Its broader use for other types of criminal investigations had flown under the radar, Crockford said.
“The lack of transparency is seriously troubling — that this has taken place without any public discussion or, to my knowledge, legislative action,” said Crockford. “Maybe the Massachusetts public and legislators think it’s totally appropriate for this to be happening, but I doubt it.”
Regardless, she said, “policies around these issues should not be developing in secret.”
Advertisement
Separately from the RMV photos, law enforcement agencies also use facial recognition technology to scan a database of police booking photos they have collectively compiled over the years.
More than 5,000 analysts and officers from 376 law enforcement agencies have access to a database of 2.6 million photos of people who were arrested and booked in Massachusetts, said Procopio.
Some of the database’s photos — including side or profile views, or photos of people’s tattoos or other distinguishing marks — are not useful for facial recognition software purposes, he noted.
Agencies with access include not only local police departments, but also federal agencies such as the Federal Bureau of Investigation, which gain access to the database via the Commonwealth Fusion Center.
Law enforcement officials use facial recognition scans of the database “to further criminal or counter-terrorism investigations,” said Procopio.
“Any potential match provided by the technology between a suspect image and a prior booking photo is categorized as just that — a potential match only,” he said. “All image matches must be further corroborated by other investigative means.”
He said training sessions are offered regularly for officials who access the database, which is part of a broader statewide law enforcement intelligence-sharing network that was created in 2004.
Crockford questioned whether it was appropriate for police to store photos of people who are arrested for relatively minor offenses, like trespassing, or those who wind up not being convicted.
“Plenty of people are arrested falsely and the charges are dropped soon after they’re booked,” she said. “So the idea that simply being arrested is justification enough to include you in a forever digital dragnet does not make sense.”
Advertisement
A report published in October by Georgetown Law’s Center on Privacy & Technology found that nationwide the driver’s license and ID photos of at least 117 million people — or half of American adults — across at least 26 states can be searched using facial recognition software for law enforcement purposes.
That estimate, however, didn’t account for Massachusetts because the authors of the report said they were not able to verify if law enforcement here were allowed such access.
The report’s authors noted that law enforcement’s use of facial recognition technology can be beneficial and said they did not want to see use of the technology stopped altogether.
“It has been used to catch violent criminals and fugitives,” the report said. “The law enforcement officers who use the technology are men and women of good faith. They do not want to invade our privacy or create a police state. They are simply using every tool available to protect the people that they are sworn to serve.”
But the report called for lawmakers to adopt rules to improve oversight of law enforcement use of facial recognition, which the report described as largely unregulated.
The report noted concerns raised by a 2012 study that facial recognition may be less accurate on photos of black people.
“With only a few exceptions, there are no laws governing police use of the technology, no standards ensuring its accuracy, and no systems checking for bias,” Clare Garvie, a co-author of the report, said in a statement when the report was released. “It’s a wild west.”
Advertisement
Facial recognition has turned up false positives before, prompting police to investigate the wrong person just because they looked like someone else. And it’s happened in Massachusetts.
The Globe in 2011 detailed how a Natick man received a notice from the state Transportation Department telling him his license had been revoked. But he later uncovered that it was due to an error. Facial recognition technology had mistakenly flagged his image as a possible case of fraud because he looked like another driver.
It took the man 10 days of bureaucratic struggle to prove who he was and get his license back.
Matt Rocheleau can be reached at matthew.rocheleau@globe.com. Follow him on Twitter @mrochele