By Phil Pennington, RNZ

Police have been quietly setting up a $9 million facial recognition system that can take a live feed from CCTV cameras and identify people from it.

This would push New Zealand into new territory for tracking citizens.

It will be run by a non-police contractor - US firm Dataworks Plus - and collect 15,000 facial images a year, with that expected to expand up to 10-fold.

Some of this information is contained in an Official Information Act (OIA) response that Police provided to Stuff last year but tried to withhold from RNZ last week until a complaint was made to the Ombudsman.

RNZ made inquiries with other agencies after revealing that the Internal Affairs Department has been - quietly, too - setting up a $20m passport processing system.

Both the department, and the police, are using some of the world's most powerful facial recognition software, NeoFace, developed by NEC, a Japanese company with $44 billion in revenue a year.

Both said they did not tell the public as these are mere upgrades, and neither did a Privacy Impact Assessment - though Internal Affairs told the Privacy Commissioner about NeoFace, while the police did not.

Reports - parliamentary annual reviews - show since 2014 the police have spent more than $9m on an Automated Biometric Information System (ABIS), in two phases.

ABIS 2 will go live later this year, run by Dataworks Plus, or South Carolina, which supplies facial recognition to a lot of US police departments.

A US Senator last month accused Datawork of running systems that discriminated against black people.

The tender that Dataworks won for Police here, does not mention "Māori" or "public" or "privacy" - in relation to specific safeguards on the public's privacy - a single time in scores of pages.

It does refer to "ethnicity", but only as one of 31 fields of information the police have demanded the new system must supply.

Yet the Privacy Commissioner has stated: "Any organisation or business using facial recognition technology needs to undertake a high level of scrutiny over how accurate it is and how thoroughly it has been tested for use in New Zealand."

The tender said: "It is mandatory that the system provides an interface to import digital images from media sources". Police have not responded to an RNZ request to explain what media sources they mean.

Driver licences, CCTV

Police are setting up ABIS under their Serious and Organised Crime with the stated aims of cutting crime, and reducing investigation time by identifying suspects more quickly.

However, its sweep appears much wider than that.

Though the focus will continue to initially be using the new system to match still photos from within the police's own files, under a section titled "Future needs", the 2018 tender said police may want to use it to scan people's photos from their "passport photos, drivers licence photos, etc".

Police said any change to what NeoFace can do, beyond search still photos, would need executive approval.

Police have previously denied they would use the system on driver licence photos.

The tender also said the system must be able to "import CCTV feed" to identify people.

Police have previously said the new system "is not designed to continuously run against live-streamed CCTV" - in an OIA response last December to the Taxpayers' Union.

Elsewhere the tender said: "It is mandatory that searching can be conducted dynamically in real-time using multiple fields."

This appears to fly in the face of a police statement in the December 2019 OIA response:

"The new facial recognition system that police is introducing is designed to only search still images of suspects against the police database."

NeoFace has all the extra capability in spades - "a fully integrated biometric image-to-image" multi-modal system, as police describe it.

NEC has designed and strongly promotes NeoFace to identify people, processing 1000 faces per minute in real-time on live feeds, and to combine identification with surveillance in one platform - one of its marketing lines has been, "We watch over you. Every single one".

Facial recognition is marketed as a security and speed boon - whether for cutting airport queues, or reducing reliance on PIN numbers, but mostly for identifying "persons of interest".

Some surveys in the US have found strong support for its use.

RNZ has asked police to clarify what their future strategy is.

Earlier, police told RNZ in a statement that they used "NEC to assist with facial comparisons and bio-metrics for fingerprints".

"It enables Police to compare still images of unidentified suspects, where those images have been submitted as part of an investigation.

"It is not used in the analysis of any livestream or live surveillance footage.

"Facial comparisons are confirmed by qualified forensic practitioners."

The tender shows the new police system must be able to handle up to 70 people online at any one time.

Police have promised the Privacy Commissioner better engagement with him and the public over facial recognition technology.

Police briefed the commissioner's office in July, months after signing up the US facial recognition operator.

The commissioner's office says police gave it details of assurance work they had done.

It says police noted they hoped to develop better governance, engagement and public transparency over their use of new tech.

'Future substantial increases'

The tender shows police already have 1.5 million images of 800,000 people, having first set up the existing image management system in 2009.

A further 50,000 images a year are expected to be put into the vastly more powerful new system, including of fingerprints, scars and tattoos.

As for the 15,000 facial images, that is only a base number.

This number excluded "capture of additional images which will arise from inter-agency identity management work (drivers' licences, passports)".

"Legislation changes will see future substantial increases" in image capture.

The tender did not specify what changes.

Dataworks Plus was required to show how it would double the capture, or even raise it 10-fold.

The system must also be able to turn images into a digital photo line-up.

The Privacy Commissioner's guidelines state: "Collecting biometrics from people should be done directly, and transparently. You shouldn't collect a biometric from somebody without them knowing."

The "inter-agency" work police mention would have to include Internal Affairs for passports, and NZ Transport Agency / Waka Kotahi for driver licence photos.

Internal Affairs has signed a new $20m deal to use NeoFace, for 10 years in a system supplied and run by a huge US company, DXC Technology.

Internal Affairs said it did not share its photo data. Its privacy threshold test convinced it that it did not need to do a full privacy impact assessment, it told RNZ.

"This was because this is a replacement project for current software technology and there is no sharing or matching of personal information held by different organisations or currently held in different datasets.

"Our Chief Privacy Officer shared this threshold assessment," the Privacy Commissioner said.

Another agency using NeoFace is Immigration.

"INZ uses the NEC algorithm to match facial images supplied by the applicant. It is not used for any other purpose," Immigration New Zealand told RNZ.

These were checks on visa and electronic transport authority photos, to combat fraud, it said.

It ran a privacy impact assessment on the system when it began in 2016.

This work is integral to an inter-agency identity management upgrade costing at least $27m. RNZ is seeking more details about this.

The inter-agency upgrade began in 2015, well before the government in 2018 began a two-year $5m consultation on how people want to be identified online.

"With more and more aspects of our lives taking place online it's critical the Government takes a lead to ensure New Zealanders have control of how and who uses their identity information," Government Digital Services Minister Megan Woods said at the time.

Councils and biometrics

As for CCTV networks, the police's main access since 2013 has been through some of their District Command Centres to public-facing CCTV, for instance, run by councils, OIA documents show.

In Auckland, they have access to more than 3000 Auckland Transport cameras and have expressed interest in running facial recognition on them.

"There is no biometric or facial recognition on any AT cameras," the agency told RNZ.

However, its new advanced cameras have that capability.

Auckland Transport expects to add 500 more of these cameras in the next 12 months, "for traffic management and safety at our facilities".

Increased police access to privately operated CCTV - such as businesses run - as a control measure for Covid-19 has been the subject of a research grant.

That grant went to Safer Cities, a consultancy that is advising Auckland Council on adding and upgrading cameras at 11 public sites. RNZ is seeking details of where and how many.

Under a similar Safer Cities banner, Wellington City Council used NeoFace's maker NEC for digital work including providing real-time information to emergency services, beginning in 2011. RNZ has asked the council where that programme got to.

Christchurch City Council has used "citizen engagement" input from DXC, which often works closely with NEC, such as on Internal Affairs' NeoFace system, DXC says in online PR material.

At least three US city councils have banned any use of facial recognition tech.

Secure, but not necessarily here

All the New Zealand agencies said people's image data was being kept secure and they, or the tender documents, cite the Privacy Act.

However, the police tender did not include "keeping the data in this country" within a long list of what was mandatory for its new system; keeping the data here, this was described only as "desirable".

In addition, the tender allows for various non-police but "public safety" organisations to access ABIS if they are on police premises, including: Fire and Emergency, Victim Support, community patrols, and Neighbourhood Support.

Annual reviews show a top police inspector went to a "Five Eyes" police agencies' meeting on biometrics in 2017-18.

Immigration New Zealand's rules in 2016 said any "outsourcing providers" would be required to delete any biometrics collected upon the successful secure transfer of data to INZ.

The facial recognition systems run on AI algorithms that learn as they go.

Police have not signed up to New Zealand's new charter to guide algorithm use, though another 21 government agencies have.

The Ministry of Business, Innovation and Employment which harbours Immigration also has not signed up; Internal Affairs has signed.

The Government Chief Data Steward and Chief Digital Officer said in a 2018 report that the safe and effective use of operational algorithms required greater consistency across government.

US facial recognition law researcher Claire Garvie of Georgetown University told a New Zealand conference on biometrics last year that US police were very keen to attach the technology to live CCTV footage to identify people in a crowd, though currently they mostly used it to match still photos, though even that is becoming highly controversial.

Very few laws or rules expressly covering facial recognition's use existed either in the US or in New Zealand, she said.

Earlier this year, NEC promoted a Covid-19 mobile app that could notify healthcare workers and update a "management portal" if a person was symptom-free, with data stored on Amazon Web Services.