Enhanced Drivers Licenses (EDLs) have been with us for a while now, and it would appear that we’re starting to see the ‘advantages’ of EDLs in British Columbia (BC). Before getting into the how facial recognition and EDLs are being used, let’s back up and (briefly) outline what makes these new licenses special. As I wrote in “Now Showing: EDL Security Theatre“:

As of June 1, 2009, Canadians and Americans alike require an Enhanced Drivers License (EDL), a NEXUS card, a FAST card, a passport, or a Secure Certificate of Indian Status to cross a Canadian-American land border. In Canada, only Ontario, Quebec, B.C. and Manitoba have moved ahead to develop provincial EDLs; the Saskatchewan, New Brunswick and Prince Edward Island governments have all decided not to provide these high tech, low privacy, cards to the constituencies (Source). To apply for an EDL in a participating province, all you need to do is undergo an intensive and extensive 30 minute face-to-face interview at your provincial equivalent of the Department of Motor Vehicles. Your reward for being verbally probed? A license that includes a Radio Frequency Identification (RFID) tag and a biometric photograph. The RFID tag includes a unique number, like your Social Insurance Number (SIN), that is transmitted to anyone with an RFID reader. These readers can be purchased off the shelf by regular consumers, and number your EDL emits is not encrypted and does not require an authentication code to be displayed on a reader. Effectively, RFID tag numbers are easier to capture than your webmail password.

As part of the EDL process in BC, there is a capturing of facial biometric data to better authenticate license holders. I noted that I was confused about how effective such a system might be without a mass adoption of the EDL a few months ago,

and then it was revealed that the new ‘more secure’ (non-EDL) BC drivers licenses would all require capturing facial images in a way that images could be analyzed and (presumably) integrated with the analysis techniques one submits to when getting an EDL. The ‘security’ of EDLs was brought over to other licensing environments in order to actually ‘guarantee’ the security that the EDL supposedly offers. In particular, the new (non-EDL) licenses include

holographic overlays and laser-engraving or raised elements such as the cardholder’s image and signature…The B.C. government said the cards will incorporate technology that analyzes characteristics that do not change, such as the size and location of cheekbones and the distance between the eyes. This “facial recognition technology … will enable ICBC to compare a cardholder’s image with their existing image on file and with the corporation’s entire database of millions of images.” (Source)

Fast forward from February 2009 to December 2009, and we have the first confirmed case of ICBC’s facial recognition system detecting a high-profile fraud case. Richard Ernest Wainright renewed his (non-EDL) license and a ‘short time later’ the facial recognition system found a probable match between the Wainright identity and the Richard Ernest Perran identity, with Perran being associated with various illegal activities. This led to the police ultimately investigating Perran and discovering the personal information of 1,400 income assistance clients, and has provoked internal government reviews and an investigation by the Information and Privacy Commissioner of BC. As of December 4, 2009, Perran has not been charged with any wrongdoing.

While this might appear as a definite ‘good thing’ it would seem as though the technology deployed by ICBC is (a) not meeting the expectations that had been set for it; (b) the Perran case is being used to confirm facial recognition’s necessity or (at least) its utility. To begin, I had come to believe (perhaps erroneously) that the identification system was supposed to operate, effectively, on site when the new license was to be issued. As I read the article from the Times Colonist, it seems as though there is a delay period between detection and action. I would suggest that this likely has to do with problems that were found with the recognition system during the BC EDL trials (Phase One summarized here); when looking at the publicly released documents

we found that every time that the system has identified a duplicate applicant based on facial recognition that it incorrectly identified the duplicate; every ‘flag’ has actually been an error. Further, as I understand it the facial technologies compress the face to a 2D image, which substantially reduces the accuracy of detecting duplicates reliably. (Source)

I noted in February that, “[f]or privacy advocates, the integration of facial recognition at the receipt of licenses means that the state can potentially create a massive facial database that could subsequently be used for non-driver’s license purposes (e.g. running a captured image of a criminal through the standardized database). Further, it speaks to the likelihood of ‘function creep’, as the technologies used alongside the EDLs are incorporated into ’standard’ licensing procedures.” We’ve seen the extension of facial recognition technologies into non-EDL environments, though to date no transparency (that I’ve found) about false positive rates, general errors, costs of resolving errors, etc. Instead, the public is being ‘sold’ on the effectiveness of the recognition system, which belies its past, massive, failures.

We see further public relations gestures that the technology is effective from ICBC’s Adam Grossman, when he states

…the technology is already getting results.

“It’s still fairly early for us,” he said. “But it’s certainly enabling checks that were not previously possible and uncovering instances of fraud that would not have previously come to light.”

Grossman said the technology is being used by more than 30 jurisdictions in the United States, and called it “the new security benchmark for government-issued documents.” (Source)

Remember that the EDL, and its associated technologies, are the consequence of an American policy initiative that the Americans themselves are unable or unwilling to comply with in significant numbers. Canada’s provinces have been pressured to accept the EDL and its associated securitization processes (though many have resisted such pressures) – we are members of the ‘new security benchmark’ as a consequence of a foreign nation forcing it upon us, not because it was something that we sought out. To suggest that our membership, and detection of this one case, makes facial recognition analysis the equivalent of a gold standard is absurd; we have an unstated number of ‘successfully identified’ fraud cases and this one high profile case. There is no information on false positives. There is no information on the cost of this new program, versus the number of cases correctly identified. In effect, there is not enough substance behind the statement that including facial recognition is useful for the sentence’s validity to be confirmed. Perhaps this is just reminiscent of my memories of Ontario’s welfare crackdowns in the 90s, where huge volumes of government resources were poured into fighting ‘welfare fraud’ at a loss, but I would love to see BC journalists actually challenge some of the government’s security-related statements before just accepting them – some critical engagement on the part of the media is needed on this technology, and dreadfully lacking!