Despite an instruction by the Data Protection Commissioner, the police of the Hanseatic city does not want to do without its new face recognition system. In four weeks, the Administrative Court will rule about the dissolution of a specially created database. Without waiting for the verdict, the state government withdraws the sharpest sword from the top data protector.
Even after the deletion order by Johannes Caspar, the Commissioner for Data Protection and Freedom of Information, the police in Hamburg continue to use a face recognition system. This was written by the red-green senate in response to an inquiry by the left-wing faction in the Hamburg parliament. Since 18 December 2018, a further 92 searches have been carried out in image and video files. This brings the total number of searches for suspects to 782.
After the G20 summit, the police set up a “Special Commission Black Block”. To identify suspected criminals, the department has copied 3.57 terrabytes of police image and video material into a “Face Recognition Software System” (GAS). A further 9.90 TB of non-police material comes from a portal set up by the Federal Criminal Police Office for voluntary upload. The GAS currently contains more than 15,000 videos and 16,000 images.
Pictures of ID treatment
The platform used in Hamburg comes from the German company Videmo. When importing the raw data, the software uses eye and ear distances, nose shape, mouth angle and hairline to calculate all the faces it contains. Each individual face is stored as a known or unknown identity of the person concerned in another reference database and used for further processing. The order to delete the data protection officer Johannes Caspar refers to this reference database.
To identify individuals, the police use photographs of identification treatments collected during the G20 summit. They are also included to the reference file and then searched in the image and video data. In this way, the police want to prove further crimes to the people concerned. About one third of all searches in the face recognition system were carried out with known suspects.
According to Caspar, images from people fingerprinted and photographed that do not originate from the G20 summit are also used. Further photos are taken from the POLAS information system of the Hamburg police and the INPOL file, which the Federal Criminal Police Office (BKA) runs together with the state criminal police offices.
Hardly any success at the BKA
The state government does not write which individual INPOL databases are involved. Photographs stored in the category “Politically motivated crime – Left” would be possible. However, the images from INPOL were transferred to the Hamburg system manually and not automatically, emphasises the Senate.
The investigators then searched for the identities of unknown suspects in the Face Recognition System (GES) of the BKA. The police INPOL file is also queried. About 5.6 million photographs of about 5 million people are stored there.
The use of the GES increases significantly every year; in 2018 the federal and state authorities carried out more than 40,000 searches and identified around 1,000 people. According to the Senate, the Hamburg police commissioned the BKA with 75 searches after the G20. However, hits on persons were only achieved in three cases. Every fifth picture was not suitable for a GES search and had to be sorted out.
No legal remedy possible
In an interview with Netzpolitik.org, Caspar described the face recognition technology as a “new dimension of state investigation and control options”. The image material collected in public space without suspicion allows “conclusions on patterns of behaviour and preferences of the individual”.
The Data Protection Commissioner justifies his deletion order with a considerable encroachment on the rights and freedoms of a large number of affected persons who are stored in the system. The biometric recording therefore affects “masses of persons who are not suspected of having committed an offence and who at no time were”.
Without knowledge, the facial models of the recorded persons are mathematically calculated, stored and searched. The police use this information to create profiles of their location, behaviour and social contacts. A legal remedy is not possible as the people are not informed about the processing of their data.
Data Protection Commissioner should only be allowed to issue warnings
Even after the dissolution of the “Special Commission Black Block”, the police will continue to use the face images. The interior authority of the city of Hamburg has therefore filed a complaint against Caspar’s order in January. A hearing before the Administrative Court is scheduled for 23 October. The procedure is so important that the losing party is likely to appeal.
Without waiting for the verdict, the Senate is also taking political revenge. Johannes Caspar had used his power of to instruct the police for the first and only time after the G20 summit. Although he handled this sharp sword with caution and in no way inflationarily, he is to be deprived of his competence under the new police law.
In the draft of the law, the state government writes that a power of the Data Protection Commissioner to give orders to the police “cannot be reconciled with the need for constant availability of lawfully collected data and data processing equipment”. Caspar should be satisfied in future with issuing a complaint or warning.
Image: Ameisenscheiße, CC-BY 2.0, Thorsten Schröder
