AWS Machine Learning Blog

Some Thoughts on Facial Recognition Legislation

Facial recognition technology significantly reduces the amount of time it takes to identify people or objects in photos and video. This makes it a powerful tool for business purposes, but just as importantly, for law enforcement and government agencies to catch criminals, prevent crime, and find missing people. We’ve already seen the technology used to prevent human trafficking, reunite missing children with their parents, improve the physical security of a facility by automating access, and moderate offensive and illegal imagery posted online for removal. Our communities are safer and better equipped to help in emergencies when we have the latest technology, including facial recognition technology, in our toolkit.

In recent months, concerns have been raised about how facial recognition could be used to discriminate and violate civil rights. You may have read about some of the tests of Amazon Rekognition by outside groups attempting to show how the service could be used to discriminate. In each case, we’ve demonstrated that the service was not used properly; and when we’ve re-created their tests using the service correctly, we’ve shown that facial recognition is actually a very valuable tool for improving accuracy and removing bias when compared to manual, human processes. These groups have refused to make their training data and testing parameters publicly available, but we stand ready to collaborate on accurate testing and improvements to our algorithms, which the team continues to enhance every month.

In the two-plus years we’ve been offering Amazon Rekognition, we have not received a single report of misuse by law enforcement. Even with this strong track record to date, we understand why people want there to be oversight and guidelines put in place to make sure facial recognition technology cannot be used to discriminate. We support the calls for an appropriate national legislative framework that protects individual civil rights and ensures that governments are transparent in their use of facial recognition technology.

Over the past several months, we’ve talked to customers, researchers, academics, policymakers, and others to understand how to best balance the benefits of facial recognition with the potential risks. It’s critical that any legislation protect civil rights while also allowing for continued innovation and practical application of the technology. Those discussions led to the development of our proposed guidelines for the responsible use of the technology, which we’d like to share today. We encourage policymakers to consider these guidelines as potential legislation and rules are considered in the US and other countries.

1. Facial recognition should always be used in accordance with the law, including laws that protect civil rights.

The uses of facial recognition technology must comply with all laws, including laws that protect civil rights. There should be no ambiguity that existing laws (for example, the Civil Rights Act of 1964 and Fourth Amendment of the U.S. Constitution) apply to and may restrict the use of this technology in some circumstances.

Our customers are responsible for following the law in how they use the technology. The AWS Acceptable Use Policy (AUP) prohibits customers from using any AWS service, including Amazon Rekognition, to violate the law, and customers who violate our AUP will not be able to use our services. To the extent there may be ambiguities or uncertainties in how existing laws should apply to facial recognition technology, we have and will continue to offer our support to policymakers and legislators in identifying areas to develop guidance or legislation to clarify the proper application of those laws.

2. When facial recognition technology is used in law enforcement, human review is a necessary component to ensure that the use of a prediction to make a decision does not violate civil rights.

Facial recognition is often used to ‘narrow the field’ from hundreds of thousands of potential matches, to a handful; it is this capability that benefits society in many ways by making it easier and more efficient to complete tasks that would take humans far more time. However, facial recognition should not be used to make fully automated, final decisions that might result in a violation of a person’s civil rights. In these situations, human review of facial recognition results should be used to ensure rights are not violated.

For example, for any law enforcement use of facial recognition to identify a person of interest in a criminal investigation, law enforcement agents should manually review the match before making any decision to interview or detain the individual. In all cases, facial recognition matches should be viewed in the context of other compelling evidence, and not be used as the sole determinant for taking action. On the other hand, if facial recognition is used to unlock a phone, or to authenticate an employee’s identity to access a secure, private office building, these decisions would not require a manual audit because they would not impinge on an individual’s civil rights.

3. When facial recognition technology is used by law enforcement for identification, or in a way that could threaten civil liberties, a 99% confidence score threshold is recommended.

Confidence scores can be thought of as a measure of how much trust a facial recognition system places in its own results; the higher the confidence score, the more the results can be trusted. When using facial recognition to identify persons of interest in an investigation, law enforcement should use the recommended 99% confidence threshold, and only use those predictions as one element of the investigation (not the sole determinant).

4. Law enforcement agencies should be transparent in how they use facial recognition technology.

To create the greatest public confidence in responsible law enforcement use of facial recognition, we encourage law enforcement entities to be transparent about their use of the technology and to describe this use in regular transparency reports. Such reports should indicate if and how facial recognition technology is being used and detail safeguards that have been put into place to protect citizens’ privacy and civil rights.

This type of reporting can help balance public safety and civil rights concerns, and help enable effective oversight and accountability of law enforcement use of facial recognition technology. AWS will continue to engage with policymakers, civil society and local community groups, and our law enforcement customers to help define these reports and how they should be provided.

5. There should be notice when video surveillance and facial recognition technology are used together in public or commercial settings.

There have been concerns about facial recognition technology and its potential use in connection with video monitoring in public or commercial settings. In many cases, this has already been addressed by states that have laws regulating the use of video cameras in public or commercial premises, such as shopping centers and restaurants. AWS supports the use of written, visible notices at these premises where video surveillance, including facial recognition, is in use.

AWS also supports the creation of a national legislative framework covering facial recognition through video and photographic monitoring on public or commercial premises, and we encourage deeper public discussion and debate about whether the existing video surveillance laws should be reviewed and updated. Our view is that facial recognition technology and video/photo surveillance should be covered by the same notice framework.

Standardized Testing

AWS has always been, and will remain, supportive and committed to investing in the development of standardized testing methodologies that seek to improve accuracy by removing bias from facial recognition technology.

Technical standards that establish clear benchmarks and testing methodologies are a proven way to address design issues in software, and we believe they are equally applicable here. AWS encourages and supports the development of independent standards for facial recognition technology by entities like the National Institute of Standards and Technology (NIST), including efforts by NIST and other independent and recognized research organizations and standards bodies to develop tests that support cloud-based facial recognition software. We are engaging with the NIST and other stakeholders to offer our direct assistance towards this effort. We also support efforts by members of the academic community to establish independent and trusted criteria, benchmarks, and evaluation protocols around facial recognition services. We encourage other groups from the technology industry, government, and academia to support and participate in these initiatives. We also invite researchers interested in these topics to apply for AWS Machine Learning Research grants, with which we are funding many research initiatives in this space.

Moving Forward

New technology should not be banned or condemned because of its potential misuse. Instead, there should be open, honest, and earnest dialogue among all parties involved to ensure that the technology is applied appropriately and is continuously enhanced. AWS dedicates significant resources to ensuring our technology is highly accurate and reduces bias, including using training data sets that reflect gender, race, ethnic, cultural, and religious diversity. We’re also committed to educating customers on best practices, and ensuring diverse perspectives in our technology development teams. We will continue to work with partners across industry, government, academia, and community groups on this topic because we strongly believe that facial recognition is an important, even critical, tool for business, government, and law enforcement use.

– Michael Punke, VP, Global Public Policy, AWS