Protecting Biometric Identities

November 24, 2023

In this feature, Simon Randall, CEO of Pimloc, and Rebecca Spayne of Security Buyer address the escalating risks associated with biometric data acquisition, its management, and its utilisation

As you are undoubtedly aware, the risks tied to large-scale biometric data collection have markedly increased in recent years, with a particularly pronounced surge in the last six months due to the proliferation of generative AI. This heightened risk entails malevolent actors and individuals gaining access to biometric data, whether from CCTV or other sources, making it considerably easier to initiate phishing attacks, data breaches, and related issues.

Beneath these concerns, we observe three significant trends that are shaping customer demands, requirements, and the interest of our channel partners. Firstly, there has been an extensive expansion in the deployment of cameras worldwide, particularly in Europe but also in the United States and other regions. CCTV has become cost-effective and is transitioning to cloud-based solutions. Access to AI and analytics has become more accessible, making it both simple to capture footage and easier to identify, monitor, track, and extract data from individuals. Concurrently, we are witnessing a proliferation of complex regulations and policies, extending beyond GDPR in Europe, which began approximately four to five years ago, to encompass the United States and other countries. We are also seeing the adoption of policies governing the handling of healthcare, transport, and public safety data.

As a result, organisations deploying CCTV, dash cams, and body-worn cameras must now consider a range of new liabilities. On one hand, there is a growing imperative to ensure the safety and security of individuals. On the other hand, the liabilities and risks associated with capturing and managing this data are undeniably on the rise. Thirdly, there is a notable shift in attitudes and awareness among the public. Citizens are increasingly conscious of surveillance and the challenges posed by new AI technologies and facial recognition. This has spurred active dialogue in the media and among consumers. Consequently, whether operating a retail store, a hospital, a train station, an airport, or working with local law enforcement, organisations find themselves operating in an environment where careful consideration and planning are essential when deploying security systems.

The intersection of these three factors has given rise to a new context where the level of detail and thought required for security system deployment is significantly heightened. On the flip side, there exists a substantial opportunity to enhance safety, security, and operational efficiency. We firmly believe that the industry’s greatest challenge lies in striking a balance between safety, privacy, and efficiency in the realm of large-scale monitoring systems. The accessibility and performance of these systems have improved, but achieving this equilibrium has always posed a challenge. Historically, privacy and security have often been viewed as diametrically opposed. In this new era with AI, DeepFakes, and similar technologies, we advocate that businesses must successfully achieve both objectives.

They must monitor their environments to ensure safety and observe how individuals interact in potentially hazardous settings, such as train tracks or specific areas within hospitals. However, this must be accomplished without encroaching upon individual privacy and freedoms. This transitional period necessitates the exploration of privacy-enhancing solutions that unlock the value of video data. This enables the utilisation of analytics for effective business management while simultaneously safeguarding individuals. It represents a convergence of security operations and other facets of the business.

This intersection of security and privacy presents a compelling challenge. Furthermore, there is an intriguing possibility of using privacy-preserving technologies to enable large-scale surveillance while safeguarding the identities and biometric data of most individuals. In retail and warehousing, AI deployment has become quite prevalent, with numerous cameras and real-time analytics focusing on people counting and flow. However, incidents still require selective data extraction, anonymisation, and thoughtful video management.

Similarly, in transport and mobility, the emphasis is primarily on safety and security. Existing video feeds in security centers can be anonymised and redistributed to other departments to facilitate more efficient resource planning, enhanced environment layouts, and restricted area monitoring.

In the healthcare sector, from clinical research trials to hospital treatments, the need for patient safety and the monitoring of protected wards is critical. Ensuring the safety of nurses and doctors, especially in high-incident areas like the Accident and Emergency department, is vital in environments governed by stringent policies and legislation. Balancing privacy and security in these domains involves various approaches to enable real-time monitoring while safeguarding patient and employee biometric and personal data.

In the realm of public safety, CCTV, body-worn cameras, dash cams, and door cam footage play pivotal roles in investigations. Handling witness and victim data, managing it through the evidential chain, and promoting transparency are crucial aspects. Privacy-enhancing technologies prove valuable for enabling police forces to share positive examples of their activities with local communities, particularly concerning stop and search procedures. In the age of AI and DeepFakes, transparency and accountability are poised to become increasingly significant.

In addition to the existing legislative framework, numerous new regulations are emerging. These include the EU AI Act and the Digital Services Act, alongside a multitude of bills being passed in various US states. Staying abreast of these policy requirements has become crucial. Another prominent theme is the issue of international data transfers. Data sovereignty has gained immense significance and is a critical consideration for many implementations. Ensuring a comprehensive understanding of data location, system integration, management, and sovereign protection has become paramount.

Furthermore, the advent of generative AI presents challenges. While not entirely straightforward, it has become more feasible to extract someone’s biometric data, whether a few facial images or audio samples, and input them into generative systems to manipulate, misuse, or alter their appearance and speech. This raises intriguing questions about the future of video evidence. CCTV and dash cam footage have evolved into the de facto standard for objective evidence. However, as an industry, we must contemplate how to enhance the authentication of videos as they progress through the evidential chain. Ensuring the legitimacy and authenticity of video footage, from the moment it is captured in a store to when it is redacted and submitted for legal proceedings, is a paramount concern…

Read the full exclusive and more in our latest issue here.