Have a Vermont ID? Up until late May, your photo was regularly searched by face recognition software to see if you are — or look like — someone of interest to police across the country. In essence, you were unwittingly enrolled in a nationwide criminal line-up — simply by applying for a Vermont identification card.
On May 23, the American Civil Liberties Union (ACLU) of Vermont sent a letter to the Department of Motor Vehicles (DMV) explaining that the facial recognition program is illegal, endangers personal privacy and data security, disproportionately impacts people of color, chills First Amendment freedoms, and is ineffective. Thankfully, on May 25, Gov. Phil Scott suspended the program until the attorney general had a chance to review it. Attorney General T.J. Donovan has reviewed the program and agrees it should remain suspended indefinitely because it violates state law. We’re glad to see that, so far, Vermont’s governor and attorney general are not friends of Big Brother.
The suspension of the program is a welcome first step, but much more is needed to ensure the will of Vermonters, as expressed in state law, is followed.
In 2004, Vermont passed a law prohibiting the DMV from using biometric markers, such as face recognition, to identify applicants for licenses, permits, or other ID cards. This ban was suggested by the then-DMV Commissioner Bonnie Rutledge specifically to require legislative approval prior to the DMV adopting any such system in the future.
But in 2011, the DMV spent $900,000 on a face recognition program with no legislative authorization.
When it was implemented, the ACLU rightly voiced concern because face recognition technology is inaccurate, infringes on basic privacy expectations, and is ripe for abuse. In response, the DMV assured the public that “the only purpose of this is to protect people from identity theft.” Access to the data is “very, very, very tightly controlled,” promised DMV Commissioner Robert Ide last year.
But in the absence of formal rules, transparency, or accountability, it turns out these were empty promises.
According to records obtained by the ACLU, DMV ran over 120 face recognition searches for external agencies, primarily police departments, since 2013. Most were agencies outside of Vermont, including ICE (U.S. Immigration and Customs Enforcement), the FBI, the State Department, and many state law enforcement and regulatory agencies.
The agencies sent photos for all manner of alleged offenses — everything from trespassing to murder. Some sought DMV face recognition searches for people not accused of any crime — immigrants, people involved in “suspicious circumstances,” the alleged girlfriend of a fugitive, and a Vermonter who asked “unusual” questions at a Vermont gun shop. And no matter how trivial, the DMV rubberstamped every request we reviewed.
In response to these requests, the DMV provided the photos and sensitive personal information of up to 50 Vermonters, merely asking external agencies to destroy records they do not use. The ACLU found no evidence that DMV verifies the data security practices of external agencies or confirms the destruction of unused records.
In short, the DMV has been running error-prone biometric searches on innocent Vermonters, for police purposes. It has sent photos and additional information, which may include social security numbers, current addresses, and other personal information, to agencies around the country for criminal and noncriminal investigations, without notice, constitutional protections, or adequate data security measures.
The program’s initial suspension is a good start, but additional steps are needed to close it down permanently. Anyone who has had their DMV photo and information sent to external agencies pursuant to a facial recognition request should be notified. An accounting of the program’s past and the data security practices of agencies that received DMV records must be conducted. And, the program must be officially dismantled to ensure the DMV does not retain the 2.7 million digitally mapped photos of innocent Vermonters for future use.
If the program is to be revived, given its secretive illegal history and widespread use for police purposes, Vermonters should demand a comprehensive review by their elected representatives, the inclusion of strong protections for Vermonters’ civil and constitutional rights, and a robust public discussion about the risks of face recognition. Vermonters deserve a voice in deciding if the privilege of a Vermont ID should come at the cost of being enrolled in a perpetual, nationwide criminal line-up.
Editor’s note: Clare Garvie is co-author of “The Perpetual Line-Up: Unregulated Police Face Recognition in America.”