India plans facial recognition tool to detect faces with masks, sparking privacy concerns

A government-sponsored facial recognition surveillance system, billed as India’s largest such effort to date, is proposing to detect faces when covered with masks, or even modified by plastic surgery. 

According to a fresh tender issued last week by the National Crime Records Bureau, a body under the Home Ministry, the surveillance tool will process more than a crore facial images, and will also integrate with existing centralised crime databases like CCTNS. 

The requirement to detect faces with masks comes despite several studies repeatedly showing that face masks severely reduce the accuracy rates of facial recognition systems. 

Perhaps the only respite, which also helps in keeping this centralised tool from enabling a full-blown surveillance of the type China subjects its Uyghur population to, is the fact that this project does not involve the installation of CCTV cameras nor will it connect to any existing CCTV camera anywhere. 

Of course, that could change subsequently, as we have seen. Incremental intrusions is a favoured government approach worldwide when it comes to matters that involve privacy ‘invasions’. 

This is not the first time that the NCRB has tried to build a surveillance system like this. In fact, it has already released two iterations of the tender documents over the last two years and held multiple meetings with companies that wanted to develop the facial recognition system. 

Sources in the NCRB said that Indian companies were not very happy with the qualification criteria laid down in the previous tender documents since many of them believed that it favoured bigger foreign firms. 

“If you look at the latest RFP, you’ll see that the eligibility criteria is such that it favours Indian companies and limits international companies from participating in the tender process,” a senior government official told Entrackr on condition of anonymity.  

For instance, authorised agents, licensees or collaborators of foreign firms are prohibited from bidding for the development of the tool and while a bidder should have annual revenue of at least Rs 50 crore in each of the last three years, DPIIT recognised startups are exempt from this requirement.  The system will be built at an estimated cost of Rs 20 crore. 

An NCRB spokesperson did not respond to an immediate request for comment. 

To be sure, this requirement of detecting faces even with a mask on was first proposed to the government last year by Innefu Labs, a Delhi-based facial recognition company that counts the Delhi Police among its customers. 

This reporter was the first to report in September 2020 details about an internal meeting that took place between the NCRB and the companies that were willing to build the system for the government. Everything from the use of the system on children to concerns about foreign companies building such a large scale surveillance tool was raised at the meeting. 

Companies like Japan’s NEC, EY, TCS, and public sector undertakings like BECIL, C-DOT and Bharat Electronics have previously shown interest in building this system. 

India currently has no data protection law to safeguard the sensitive personal data of Indians from the government or private companies. And experts say that the deployment of facial recognition systems is in violation of citizens’ right to privacy. 

It is also worth noting that the Personal Data Protection Bill which has been delayed for several months now has left wide-ranging exceptions for government agencies. 

The Delhi-based digital rights group Internet Freedom Foundation called the system “illegal”, emphasising that facial recognition systems in the country currently have no basis in law. The system, IFF said, could facilitate “state-sponsored mass surveillance” of Indian citizens.  

IFF's facial recognition tracker, Project Panoptic first tweeted about NCRB's tender.

Another key issue with laws involving intrusions into citizen’s private space has been the almost inevitable lapses in following the letter of the law. This has been seen in the way phone tapping laws have been (mis)used, or even access to financial data. Multiple government agencies claiming ‘special’ powers in such matters do not help matters at all. In the government system, not being mentioned is certainly not seen as being excluded by these agencies. 

The technology is nowhere close to being infallible, with incorrect facial recognition matches even leading to the arrest of innocent people in the US.

It is also problematic that the narrative on such intrusions can be easily managed by governments. Simply by highlighting every instance where these have helped solve a crime, for instance. By limiting information only to such cases, it can easily convince people that the system is too important not to have. 

But more so problematically, people are currently practically crying out for more surveillance on the premise it will help reduce crime and deter criminals. That narrative seems impossible to shake off for now, with the wide and even bipartisan political support it has.