Germany

Biometrics and body politik: The rise of automated surveillance in Germany

Machine-readable humans

As technology has made our lives easier, it has also numbed us to the potential threats that can be posed by new forms of “convenience”. Putting one’s iPhone in front of your face to unlock it with FaceID, instead of entering a short string of numbers, is an alluring prospect for some, but the impact of the development and proliferation of human-sensing technologies has broad societal repercussions, particularly for society’s most vulnerable.

We are subjected to distributed-yet-persistent digital surveillance, where sensors that are able to discern minute details from our bodies have been installed all around us. Because no two sets of fingerprints or irises or voices are exactly the same, each human body contains physical identifiers that are unique to the individual. Using computer vision technology combined with algorithmic decision making, biometric identity management and access control systems capture and analyse our permanent, immutable characteristics, and are being increasingly used for automated surveillance.1 These systems, while claiming to differentiate, classify and categorise people, are however flawed due to biased data and technical limitations. Though constrained by various limitations, the systems have become increasingly adopted by both companies and governments to streamline surveillance.

With biased assumptions built into training of models, and flawed labelling of training data sets,2 this class of technologies often do not differentiate between who is surveilled; anyone who passes through their sensor arrays are potential subjects for discrimination.

Surveillance does not happen in a vacuum. The use of biometric and automated access control mechanisms is increasing globally at an alarmingly high rate: India's compulsory Aadhaar biometric ID system has records from well over a billion individuals, while 23 million people were blocked from travelling in China last year due to their low social credit scores.3 Biometric access has now become a gatekeeper to both basic services and the freedom of movement.

Automated facial recognition in action

Biometric surveillance and access control involves the computational analysis of parts of a person’s physical attributes – fingerprints, facial features, retina or voice. In order for a system to recognise one’s immutable characteristics, they must compare input against a database to identify key features. When the result of a facial feature map leads to a particular conclusion about the subject being surveilled, which is dynamically generated by an algorithm, this is known as “automated facial recognition” (AFR).

Sometimes this AFR takes the form of verification: is a person who they say they are (or, more accurately, do the physical characteristics being “scanned” by a system match the system’s records for this person)? In other cases, however, biometrics are used to analyse or extrapolate an aspect of a person’s identity. An automated biometric system might be looking to see if a person is a child or adult, or seek to classify one’s ethnicity and age. Other, more invasive forms of AFR might be assessing someone’s sexual orientation,4 or assigning a score pertaining to the likelihood that they will commit a crime.5

Over the past few years, both the German government and the European Union (EU) have turned to biometric systems as they deal with a humanitarian crisis. Political instability brought about by the Syrian civil war and the rise of ISIS threatened the lives of millions of people, triggering one of the largest mass migrations of externally displaced persons in the 21st century. As millions of people fled war-torn lands, Europe witnessed a massive influx of refugees and asylum seekers. In 2015, the German government granted asylum to one million refugees,6 a decision that would further galvanise xenophobia through political propaganda, and, within two years, propel a far-right political party into a strong position of political power.7 The government’s response to the crisis was to create a new biometric identity system for refugees, a system that was eventually integrated into a new EU-wide biometric identity management surveillance system that went far beyond its original intent. By 2019, biometric surveillance and algorithmic policing had become normalised to the extent that members of the European Parliament (MEPs) voted in favour of the creation of a biometric database that would centralise law enforcement, immigration and other information on over 350 million people.

Surveillance-as-a-service: Bodies and borders

Biometric sensors often use new algorithmic processes to leverage existing infrastructure. In Germany, where there are 6,000 CCTV cameras8 scattered throughout the country’s roughly 900 train and metro stations alone, existing capacity for a widespread surveillance network is already in place. Unlike in the past, however, when there were not enough humans to watch all the recorded video, meaning that much footage was seen only in cases where evidence of crime was needed, recent advancements in computer-vision AI can now “watch” CCTV footage in real time and automatically notify authorities when something “suspicious” has occurred.9

Sometimes, seemingly benign uses of new technologies can show how ill conceived technology implementation can be. AIgorithmic-driven biometric systems are inherently problematic not only because there is so much cultural and ethnic diversity in humanity, but also because, in a day and age where characteristics like gender are fluid, such systems may be built on data sets that are developed using binary parameters and rudimentary perceptions of performativity-based gender analysis.

Prevailing winds

The origins of Germany’s biometric identity registries coincided with the large uptick in refugees and asylum seekers into Germany and the EU in 201310 that had been triggered by the war in Syria and other instability. An EU system centralised the identity of those seeking asylum in the EU along with their fingerprints into a unified database called the Eurodac system. The system, and its Automated Fingerprint Identification System (AFIS), were created to facilitate the “Dublin Regulation”, which stipulated that refugees apply for protection in (and only in) the first European country that they arrive at. All asylum seekers, regardless of the location of their asylum claim, would now also have their fingerprints and photos aggregated in the Eurodac.11

While EU legislation was rolling out its biometric registry for refugees, Germany was developing its own plans. In December 2015, the German cabinet approved a measure establishing the creation of identity cards for refugees.12 Former German Interior Minister Thomas De Maiziere, who oversaw the issuance of the new identity card, was a proponent of a form of social engineering. He alarmed advocates when he spoke about the need for “Leitkultur”, the idea of instilling dominant (German) cultural values in refugee seekers.13

The implementation of biometrics would soon reach German citizens. Documents revealed by the German media in 2016 showed a draft plan by the Interior Ministry to deploy AFR in areas ranging from shopping malls to train stations and airports.14 The plan received some push-back at the time from opposition parties and the media. In June the following year, a resolution from the Conference of Independent Data Protection Authorities of Federal and State Governments (DSK) stated the threat to society posed by AFR technology in no uncertain terms: the “use of video cameras with biometric facial recognition can completely destroy the freedom to remain anonymous in public spaces. It’s practically impossible to evade this kind of surveillance, let alone to control it.”15 Despite such a warning, the technology was not put on hold.

One high-profile case from 2017 that shocked the nation saw a German army officer publicly named Franco A. charged with a terror-related plot to assassinate German officials all the while posing as a Syrian refugee (the charges were later dropped for lack of evidence).16 Prosecutors disclosed that the man was looking to frame refugees in a “false flag” attack and thus further degrade public opinion toward asylum seekers.17 Because the army officer and would-be terrorist had been able to enrol for asylum seeker services posing as a Syrian, the government decided that biometrics could prevent a repeat of the incident. Yet another biometric regime was implemented for refugees and asylum seekers, as the government proclaimed “no more Franco A.s”.18 This system saw the roll-out of speech analysis, which the government claimed could analyse linguistic dialects to verify a place of origin.19

In 2017, an AFR pilot project deployed by the Interior Ministry, German federal police departments and Germany’s Deutsche Bahn rail company20 was introduced into one of the capital’s sprawling metro systems. Known as Safety Station Südkreuz, the programme enrolled 300 individuals who volunteered to have their faces used to help train the system in exchange for a EUR 25 Amazon voucher.21.

In other parts of Germany, individual states have implemented their own AFR schemes. Section 59 of a 2019 Saxon police law, titled “Use of Technical Means in Order to Prevent Serious Cross-border Crime”, created a new security zone 30 kilometres into Saxony from the Czech and Polish borders. The civil society group Digital Courage22 warned that “the planned border surveillance places large parts of Saxony under some sort of state of emergency,” adding that this was a “statement of distrust toward our Czech and Polish neighbours”23 and “by implementing these changes, the Saxon Judiciary and Police will take on characteristics of a preventive state.”24

In line with the DSK’s 2017 statement, certain elements of the German government seem to be coming around to the idea that algorithmic governance is a pressing issue. In June 2019, while speaking at an AI conference in Dresden, German Chancellor Angela Merkel again addressed the need for automated decision-making technologies to be deployed under more formal governance oversight mechanisms: “We need [regulation], I’m convinced of that. Much of that should be European regulation.”25 Unclear, however, is how Germany will balance privacy, the politicisation of domestic security issues and EU data-sharing regulations.

By January 2019, the Schengen Information System (SIS II) alone contained nearly 240,000 fingerprints,26 a further expansion of AFIS.27 In April 2019, MEPs passed legislation establishing the creation of the Common Identity Repository (CIR). A shared Biometric Matching Service will provide “fingerprint and facial image search services to cross-match biometric data present on all central systems”.28 ZDnet, quoting EU officials, reported how the CIR will create new rules for data sharing and “would include the Schengen Information System, Eurodac, the Visa Information System (VIS) and three new systems: the European Criminal Records System for Third Country Nationals (ECRIS-TCN), the Entry/Exit System (EES) and the European Travel Information and Authorisation System (ETIAS),”29 giving law enforcement agencies unprecedented access to personal information such as names and biometric data. The CIR will combine law enforcement, immigration data and other data into a searchable database containing the records of 350 million people who live in and travel to Europe.

Throughout the same time period when the new biometric identity management systems were created with the aim of policing groups like refugees along Germany’s eastern border, a new and highly troubling domestic threat began to emerge. The rise of well-trained, highly organised, overtly violent far-right groups have evaded surveillance and in certain cases – like that of Franco A. – actually attempted to carry out atrocities while on the government’s payroll. In fact, more than 400 cases of right-wing extremism in the German army alone were under investigation as of April 2018,30 and by mid-2019, Germany’s domestic intelligence service, the Federal Office for the Protection of the Constitution (BfV), was aware of 24,100 right-wing extremists in Germany, more than half of whom were thought to be "violence-oriented”.31 While refugee dialects were being analysed, the messages of the violent right-wing movement were finding new, home-grown adherents.

Blindspots and camouflage

Originally, fingerprints of asylum seekers and visa applicants in Europe were entered into a highly restricted database, searchable by only certain law enforcement agencies under specific protocols.32 Over time, however, biometric records were repurposed for more general security screening. The infusion of biometric surveillance in German society has taken a few years and in many cases occurred in a piecemeal fashion. What was once billed as a system to verify refugee identity and status has built up an invasive capacity; the ability to police the most vulnerable has given way to a European-wide access control mechanism based on immutable physical characteristics.

When policies are reactive to hyperbolic rhetoric, the result can be turning a blind eye to actual threats to a peaceful society. On 2 June 2019, Germany was shocked by a politically motivated assassination of an outspoken pro-immigration politician by a man who, despite a long history of anti-immigrant violence, was not present on the “watch list” of the BfV.33 Walter Lübcke, a regional leader from Merkel’s CDU party, was shot in the head by a handgun at close range outside his home in Kassel in central Germany’s Hesse. The same month, the BfV reported that a group of 30 extremists, most of whom were associated with Germany’s police or military, had used police databases to compile a list of the names and addresses of 25,000 people, most of whom were active in various political parties and, according to Deutsche Welle (DW), Germany's public international broadcaster, supported "pro-refugee" policies.34

Despite calls from policy makers and AI experts, public figures must do more to educate themselves and the public regarding the shortcomings of this new technology. Some of this education involves a critical re-evaluation of what AFR fundamentally is. “Decision makers need to highlight policy around data sourcing and consent,'' said Adam Harvey,35 a Berlin-based researcher and artist who studies AFR. “They need to understand that AI products are data-driven products and therefore data sets are part of the product, not an externality.”

Conclusion

Despite the push by some of Germany’s leaders to increase the cultural assimilation of refugees, the worrying prospect of a society-wide surveillance state powered by biometric access control mechanisms now looms large over the entire German society. In a country where 20th century atrocities still loom large, evident in discussions on education,36 and in the recent offer of reparations to Holocaust survivors,37 the country’s approach to how it deals with the world’s most vulnerable38 is a new test of a nation’s resilient openness. With the rise of an automated infrastructure, individuals and advocates must be vigilant to safeguard human rights protections. Depending on the system design for algorithmic decision making, certain attributes – like being a police officer or member of the military – may lower the risk score of an individual, yet the number of enlisted extremists is mind-blowingly high.

The non-unified approach by German states and the federal government to both domestic laws and EU obligations put the most vulnerable at risk of having their rights eroded by algorithmic bias and automated discrimination. As biometric systems enter our lives, we also run the risk of normalising invasive surveillance. AFR can also lead to automated human rights abuses, or at least can take humans out of the loop in safeguarding against decisions to ensure that human rights are upheld. In 2018, a record number of refugees were deported from Germany to other EU countries.39 If this trend is exacerbated by xenophobic policy making or reliance on biased data sets, innocent people may be deported or denied entry into Germany.

German activists working on such issues have warned that “in a free democracy, there is no place for mass surveillance.”40 Ubiquitous AFR can also have a chilling effect on people’s actions, as the prospect of “always being watched” by the state can “nudge” our actions for fear of reprisal. Such systems do not appear overnight, however, and the slippery slope from “security” to draconian social control is often paved with seemingly mundane technological steps. Yet once biometric databases like the CIR are accessible by enforcement agencies, regulatory oversight is needed to protect (and deter) against adversarial and unsanctioned actions.

Advocates should see this as a local, regional, national and international issue. Once a person’s biometrics are entered in a database, they in many ways are at the mercy of automated systems. Perhaps the only way for someone to be completely safeguarded from automated biometric bias is for the systems to not exist at all.

Action steps

While biometrics are increasingly being used for surveillance, identity management and access control, such a deployment entails cooperation of a wide range of actors. For activists, this means pressurising companies, appealing to governments and lobbying members of parliament.

1. Transparency: “There may be many more data sets that we don’t yet know about that are private,” noted Adam Harvey, the AFR researcher.41
2. Direct advocacy: Activists can put pressure on private companies who may seek to sell their biometric access control technologies to governments. Advocacy, geared towards boycott calls, labour-based organising such as employee walk-outs, and other direct-action campaigns have been shown to be effective in some cases.42
3. Research: By unmasking the origins of data sets and procurement practices for the data contained in the data set,43 advocates can learn more about potential biases in data procurement, labelling and use.
4. Legislative lobbying: Create model legislation and replicate strategies used by cities like San Francisco44 to ban AFR use by municipalities.
5. Strategic litigation: Contest the constitutionality of regulations by governments to prevent the aggregation of various aspects of their surveillance infrastructure.
   
   

Footnotes