While India’s security forces have hit the streets to clamp down on anti-CAA demonstrations, police in Delhi have relied heavily on technology. The Delhi Police resorted to its Automated Facial Recognition System (AFRS) software—initially set up to track missing children—to surveil a political rally headlined by Indian Prime Minister Narendra Modi.
The technology allows the police to match photos of subjects against a set of large databases. In the case of the rally, police officers matched attendees to video footage collected at the ongoing protests, allowing for the identification of potential rabble-rousers.
While the intention may seem understandable, the video surveillance and tracking of these ‘suspects’ has no legal basis. At present, the century-old Identification of Prisoners Act (IPA), only allows for the capture of fingerprints of prisoners as long as they are in jail. Once a prisoner is acquitted, the authorities are required to erase the record. In reality, authorities rarely comply with even this.
If the Union government has its way, however, this is set to change. Drastically.
For over two years now, the National Crime Records Bureau (NCRB)—the technology and statistical arm of the Ministry of Home Affairs (MHA)—has been working to amend the IPA. It aims to widen the scope of collection of all key biometrics, its storage, and the duration for which this data can be stored.
According to a high-ranking official working closely with the NCRB, the division’s Central Finger Print Bureau submitted nine amendments to the IPA. The home ministry has assimilated these in the form of a new Bill —the Identification of Prisoners and Arrested Persons Bill, 2020. It will likely be tabled in the Monsoon session of Parliament, which begins in July, the official said. Another official involved in the drafting of the Bill confirmed this, saying it would also legitimise this sort of data as evidence—something that has previously been a grey area.
If passed in its current form, the Bill will provide legislative backing far beyond the mere collection of fingerprints. The biometrics it will include range from foot and palm prints to photos, iris and retina images, voice samples, and even vein patterns.
Crucially, the Bill allows police agencies to collect biometric samples of not just prisoners and arrested persons but also individuals summoned for interrogation, as per section 41A of the Code of Criminal Procedure. “We can’t arrest some people. However, cops may want to examine biometrics to check the antecedents of the person,” the official explained. The Ken reached out to high-ranking NCRB officials for comment, but they declined to confirm or deny the Bill’s existence.
The collection of these biometrics will depend on the nature of the crime. The law would provide for time limits for storage of these biometrics, official sources said. “Not every biometric will be stored. The law will provide for what to collect and when,” the official said.
The Bill would tie in beautifully with the NCRB’s surveillance ambitions. In July 2019, the crime bureau issued a tender to set up a national AFRS. Under the AFRS, the crime bureau will link facial recognition tech to a series of databases. These include Crime and Criminal Tracking and Network Systems (CCTNS), a country record of criminals and their modus operandi.
Should the Bill pass, the video surveillance and tracking of criminals and suspects—including the capture of all facial features—will automatically be legalised, with the NCRB at the forefront of it all.
The all-seeing eye
The current lack of legislation surrounding surveillance hasn’t deterred states and intelligence agencies from pushing the envelope. Over the past years, trawling social media posts and chats, unauthorised access to call records, and the use of facial recognition and fingerprints to identify suspects have all become commonplace.
Telangana, for example, has built a ‘state of the art’ surveillance system, which brings together citizen records from voter ID databases, drivers licences, vehicle registration, ration cards, and other social schemes. The collated data set is called the ‘Integrated Information Hub’.
In Hyderabad, the police force employs a mobile app called the TS COP. Using a suspect’s name and a photo clicked by the police, the app can trawl several state databases—voter IDs or ration cards, for instance—and check one’s ID and police records.
All of this, says Supreme Court advocate Prasanna S, is illegal.
Traditionally, police and other law enforcement agencies have relied on mobile call data and financial transactions data for investigation and tracking of individuals. In security parlance, this is known as structured data. The problem with this, though, is co-relating these scattered inputs, said a senior executive with one of the security advisory firms.
Which is why the security establishment is now fixated on unstructured data—anything you can’t put in a spreadsheet, such as social media posts, speeches, photos, etc.
The goal for agencies is to integrate both structured and unstructured data to have a comprehensive view of individuals or situations.
“Take the anti-CAA protests, for example. If someone is using an alarming keyword in one or two conversations, agencies won’t bother. But if I write a lot about CAA—maybe 100 times— then that profile is picked up,” said a senior executive with a consulting firm. Facial recognition technology can then be used to warn agencies if the identified person is moving towards certain geographies, the executive adds.
While this is already possible, the Identification of Prisoners and Arrested Persons Bill makes it legal. And leading this descent into a surveillance state is facial recognition.
Face-off
The face is a unique identifier, and facial recognition is much easier to do than fingerprint and iris scans, said a government official who is involved in technology projects of MHA. In the future, facial recognition will become the biggest identifier, the official said.
In some Indian cities, such as Hyderabad, this is already the case.
Similarly, the Mumbai Police use a network of roughly 20,000 camera feeds, mostly concentrated in South Bombay, to keep an eye on criminals and suspects. As part of a pilot programme being run in certain areas, software tags each face captured by the police CCTV network and stores the data for three days, an executive with a facial recognition solutions provider told The Ken. The amount of data stored at any point in this project runs into Petabytes, the executive said. One Petabyte equals 1,000,000 Gigabytes.
This data makes it possible for security agencies to go back and identify individuals should the need arise.
The NCRB, though, has plans that go far beyond what individual states or agencies have implemented, seeking to realise the full potential of electronic and video surveillance. The system will add images, the AFRS tender document says, from newspapers, raids, those sent by people, sketches, etc., to the criminal’s repository. These will be tagged for gender, age, tattoos and other identifiers for future searches.
It also plans to integrate its AFRS solution with massive databases such as passports, driving licences, and, according to an executive at a leading global security solutions provider, even social media. Already, says an executive from a large technology company, there is technology available to directly integrate the AFRS-like system with internet platforms such as YouTube or Facebook.
The system will also be linked to another massive dataset called the Interoperable Criminal Justice System, ICJS. Being implemented by the National Informatics Centre (NIC), the ICJS aims to link prisons (including visitors data), prosecution, courts and police records, passports, drivers licences, vehicle registration, medico-legal cases, and more.
“As and when needed we can integrate the databases such as voter ID or other citizen databases, most of which is managed by NIC,” said the government official involved in MHA projects.
Various intelligence agencies and security forces could also fall under this data gathering and sharing umbrella. Like the Central Bureau of Investigation (CBI), National Investigation Agency (NIA), Railway Protection Force, and the Border Security Force, for instance.
This system, if operationalised, could prove to be a miniature version of the National Intelligence Grid (NATGRID), said the government official. NATGRID was meant to be a master database of information for security and intelligence agencies. It was proposed in the aftermath of the 26 November 2008 terror attacks in Mumbai. The project hasn’t taken off yet for various reasons, political buy-in being one of them. Since late 2019, though, there have been murmurs that it will be operationalised shortly.
A loaded weapon
While the proposed Bill is key to unlocking all of this, what is less clear is whether the legislation will have any safeguards. This is vital with any new technology, but doubly so when the privacy of over a billion people is at stake.
During the anti-CAA protests, several state police forces besides Delhi’s used facial recognition to identify protestors, regardless of whether they were peaceful or not. It is a tactic to influence an individual’s behaviour and deter them from taking part in these protests, said Vidushi Marda, legal researcher with Article 19, a UK-based human rights organisation with a special focus on freedom of expression.
“These are not criminals, and hence they are not on the blacklist. But because the agencies are identifying ‘suspects’, they are creating a new list which is being done in an opaque manner,” said Marda.
The proposed Bill could end up legitimising the profiling and tracking of suspects in its current form.
According to SC advocate Prasanna, the proposed legislation may be simply struck down in a court of law, even if the government manages to pass it in the parliament. He explains that any law must stand the following validity tests: that the law has a legitimate purpose, it is necessary to achieve the purpose, and whether it is a proportionate response to this purpose. The government will not be able to justify the new Bill on these grounds, he said.
The technology itself has proven unreliable, further muddying the waters. In some states, the poor quality of images fed into the facial recognition application has led to no results or, more worryingly, inaccurate matches. The images taken from NCRB’s Crime and Criminal Tracking Networks and Systems (CCTNS), for example, often fetch no results owing to their poor quality, according to an executive with a Bangalore-based tech solutions provider. CCTNS is an integrated online platform that links the records of 14,000-plus police stations nationwide.
Indeed, this is no outlier. Remember Hyderabad Police’s experiments with facial recognition? As per Hyderabad Police’s 2019 annual report, its facial recognition unit generated 2,543 alerts. Of that, only 273 were accurate alerts. Just 32 individuals were traced.
One person working closely with the Telangana police also highlights the shortcomings of the present facial recognition technology. For one, it works better indoors and in a controlled environment. The cameras also need to be mounted at a height of around 4 metres to be effective—this isn’t possible on roads and in public spaces.
Already, the technology has come under scrutiny everywhere from Europe to the US. San Francisco has explicitly banned the use of facial recognition technology by law enforcement agencies. At the same time, the European Commission is also looking to put curbs on the usage of facial recognition data. It is important to note here that in the US, UK, and several other democracies, unlike in India, intelligence agencies and surveillance activities have parliamentary oversight, said Srinivas Kodali, a legal researcher and privacy advocate.
With doubts lingering over the motives, capabilities and effectiveness of the facial recognition tech, India stands on the precipice of an Orwellian future.