Apple’s Face ID could further enable mass surveillance based on biometric data

In the age of smartphones, smart cities and the internet of things, privacy is one of the biggest concerns. Biometric data collection forms one of the biggest enablers of violation of this right, creating a tremendous potential for surveillance. In India, fingerprints have been stored in the UIDAI database, while DNA profiles are soon proposed to be stored as well. Apart from such governmental collection of biometric data, an increasing concern is with the biometric data in the possession of private persons. The latest concern that arises is with Apple’s Face ID technology. While smartphone users are excited with Apple’s latest launch — the iPhone X, privacy advocates are extremely concerned with this new feature, which uses a 3D image of a person’s face to authenticate. So much so that   US Senator Al Franken has written to Apple CEO Tim Cook questioning the privacy and security protections of this new feature. [caption id=“attachment_4047845” align=“alignleft” width=“380”]  Image: Apple.[/caption] The fallibility of biometric authentication The increasing convenience of technology has led to an increasing lowering of security and privacy for the people. There can be no clearer evidence of this than with biometric authentication. This is a feature that is certainly convenient — there is no longer a need to remember umpteen passwords and passcodes. But the dangers arise with the ease with which biometric information can be revealed and replicated. The ease with which fingerprints can be compromised is well known. Facial recognition data can just as easily be disclosed. Early facial recognition technology could be defeated using pictures or videos of the person. Apple’s ‘3D’ image **resolves this issue** , but it is very much possible to recreate a 3D model of a person’s head from their picture. Thus, every time you put up your photograph, you are disclosing facial recognition data. Yes, making a 3D print of a person’s head is more difficult than replicating their fingerprint, but it is very much possible. Another simpler possibility is to defeat it using masks. Another issue arising with Apple’s technology is that persons like the police, robbers and other miscreants need only to hold your iPhone against your face to gain access to it. The entire Apple-FBI fight to prevent easy access becomes near redundant with this one new feature. Surreptitious surveillance possibilities Apart from the possibility of individual access, the new feature can, in future, allow surveillance. The Touch ID, for instance, needed the person to actually put their finger on the phone in order to authenticate. With Face ID, a person need not even intend to authenticate, merely looking at their phone would activate it. The Face ID is intended to be used not only for access, but also for acts like downloading apps and using Apple Pay. Its common use on other Apple devices like the iPad, Macbook, etc., furthers its surveillance possibilities. Government agencies abroad are already known to be using facial recognition to monitor people. Through Apple’s devices, they can possibly direct Apple to conduct surreptitious surveillance of people using FaceID, possible identify a specific person based on his facial data, and force Apple to reveal their location through their GPS data. This is a particular concern since Apple also possesses the hardware, such as photography and videography capabilities, to do this. Is Apple’s Privacy Policy adequate? Apple states that the data is stored physically on the device, and not remotely on the cloud. There is a sense of security in this, but it is unclear what happens if Apple changes its mind and decides to access or transfer this data. Apple’s Privacy Policy, after all, gives it permission to share the data it collects with third parties, service providers and governmental, judicial and other authorities.  There are no special provisions preventing access to biometric data, whether by Apple, third parties, or the government. In short, the question is whether individuals have any real control over their biometric data in Apple’s possession. Looking at the **Whatsapp-Facebook privacy case** , if Apple changes its mind on the use of the data, will users be given a real choice to withdraw their consent and prevent the collection and storage of their biometric data? [caption id=“attachment_4047851” align=“aligncenter” width=“825”]  The sensors in the Notch supporting FaceID[/caption] Third party data? Yet another issue that arises is the possible storage of third party users’ facial data. For instance, if Apple’s Face ID is ‘always on’, i.e., it is perpetually scanning for a face to recognise, then it may store raw data of third parties nearby, or persons attempting to access the phone. Such persons also need rights over such data, such as to have it deleted. Apple isn’t a western-country concern alone Apple’s new feature is definitely a bigger concern in the Western countries, where Apple has approximately 40 percent market share among users. In India, on the other hand, Apple has approximately 3 percent of the market share. While this is perhaps not as immediate a concern in India, this is certainly an indication of authentication of the future, and potential of future surveillance, much like that enabled by Aadhaar. Mass surveillance in India has perhaps not reached the same extent as US’s NSA and Upstream, but the possibility certainly exists. There is no information on the status of Indian mass surveillance projects like the Central Monitoring System, NETRA, NATGRID, etc., but it is certainly on the cards. The right to privacy and mass surveillance Though mass surveillance in India is not regulated, it is unfortunately not prohibited either. Specific interception and surveillance in India is legal. Protections against it are limited to procedural safeguards under the IT Act and in cases like PUCL v Union of India (telephone tapping case). The newly recognised right to privacy does create hope for protection against such activities, but this is yet to be crystallised w.r.t surveillance. The Aadhaar privacy case may shed some light on this. In the meanwhile, in view of the increasing risks with biometric data and surveillance, it is necessary for people to exercise extreme caution with what data they share, whether on social media sites, or with their smartphones. The author is a lawyer and writer specialising in cyber law, she is also a certified information privacy professional.