There’s a case in Missouri where someone spent 17 months in jail due to faulty facial recognition. The facial recognition software used? Amazon Rekognition, whom I’ve discussed previously.
But was Amazon Rekognition used properly, and was the police department even allowed to use it?
““Our terms of service prohibit the use of Rekognition’s face comparison feature by police departments in connection with criminal investigations, and we expect our customers to comply with those terms. However, police departments may use Rekognition for other permitted purposes. We do not access customer content without their agreement so we do not know exactly how the St. Louis Police Department chose to use Rekognition or whether any use case violated our terms, but we will fully investigate any additional information that comes out during the litigation,” an AWS spokesperson said.”
Add to this the advice from Amazon that submitted images be of high quality, not “grainy, blurry, taken from a distance and from above the suspect’s face.” Oh, and not with a hood over the person’s forehead and a medical mask over the person’s face.
But that policy didn’t stop the victim from amending his complaint to include Amazon as a defendant.
Why? Because Amazon has a lot more money than the relevant police department.
But should a software vendor be liable when someone misuses the software…and wasn’t supposed to use the software in the first place?
If your firm has questions about competing with Amazon, or other biometric vendors, you should use Bredemarket’s analysisservices. Book a free meeting below to discuss your analysis needs.
We know the damage that can happen when people steal passwords. But other stolen information can do harm, including facial templates.
Non-password authentication
I’ve been writing some use cases around the common “selfie plus ID” method.
Usually you use facial recognition plus a government-issued ID (such as a driver’s license) to enroll in the system and verify your identity. (Although you could use other factors.)
Usually you use only facial recognition (against the template stored from enrollment) to authenticate your identity. (Again, you could use other factors, even a password.)
If the identity mechanism is centralized, you don’t store a password, but instead store a biometric template.
The threat of theft
What happens when—not if—the central storage is hacked?
Even if the storage is decrypted (you did encrypt the data at rest, right?), all may not be lost. Biometric templates from one vendor may not be usable by another vendor’s system.
But even in the worst case scenario in which someone steals and reuses someone’s biometric template, it’s practically useless if the system guards against presentation attacks (liveness) and injection attacks. With those guards, you need more than a valid template to get into a system.
And for those who respond that decentralized identity is the perfect solution…edge devices can be hacked also.
The threat to privacy
But those are just the technical issues. You have to deal with the business issues.
Because the theft exposes personally identifiable information, which may result in legal issues.
Depending upon local law, you have to inform your users of the breach, potentially disclosing what data was breached.
What now?
Are you ready to deal with the business consequences?
Regarding the argument (Bredebot’s, or mine?) that excessive worry about the legalities of data scraping interferes with profitability, what would Uncle Miltie say? (Friedman, not Berle or Bradley.)
“That [corporate executive] responsibility is to conduct the business in accordance with their [employer] desires, which generally will be to make as much money as possible while conforming to the basic rules of the society, both those embodied in law and those embodied in ethical custom.”
He didn’t say “make as much money as possible,” period. There’s a caveat that you kinda sorta gotta obey the law.
Note that Friedman also cited “ethical custom.” Shady but abiding by the law didn’t fly in Friedman’s worldview.
I’m fond of saying that business issues outweigh technical issues. Perhaps I should revise that statement to note that legal issues outweigh both.
In 2022, Eddie Merlot’s Restaurant in Bloomfield Hills, Michigan was sued by former employees, alleging discrimination on the part of General Manager Curtis Nordeen. In response to the lawsuit, the restaurant issued a simple reply:
“Eddie Merlot’s is a discrimination-free workplace. We take these allegations seriously and on advice of counsel, we have no further comment on this pending litigation.”
The restaurant wouldn’t even say whether Nordeen was still an employee.
Four years later, Nordeen is not an employee (but the circumstances of his departure are not known), and after Nordeen counter-sued, the case is tied up in appeals.
This is a clear case in which business and legal interests diverge.
The business doesn’t want to lose customers due to negatively publicity, so it would be proactive and either say (depending on the circumstances) that it kicked Nordeen’s posterior to the curb, or that Nordeen is an honorable man who was unjustly accused.
Instead, Eddie Merlot’s said nothing of substance. No mention of names or circumstances. Just “we take these allegations seriously.” No frivolity allowed!
From a legal perspective, the silence is understandable. While this is a civil case, not a criminal one, the Miranda language that “anything you say can and will be used against you in a court of law” still applies. If Eddie Merlot’s fired Nordeen, then they obviously knew he was discriminating, and the restaurant should have known earlier, and therefore it owes the victims trillions of dollars. (‘Cause Merlot ain’t cheap.)
But from a business perspective?
Google Gemini.
Your business is hurt when one of your former employees is saying this:
“Valentine’s Day a lot of people come here and eat. They make over a quarter million dollars just that weekend, and it’s 70 percent Blacks that they don’t want to see. Stop coming here, stop spending your money where they don’t want you.
“Until Eddie Merlot’s does something about Curtis Nordeen, we’re not supporting it, we’re boycotting it. Not just this location, but all locations.
“If you boil down the controversies about Flock Safety…and other investigative software packages, some of them come down to…data sharing issues.”
But in the end it doesn’t matter, because as long as there are still buyers for Flock Safety’s products, Flock Safety will continue to sell them.
Until they don’t.
“The Los Angeles Police Department…stopped working with [Flock Safety] over concerns about the data’s use, according to an LAPD official.”
Not cancelled entirely, but suspended temporarily.
“Dean Gialamas, LAPD’s chief information officer, told several news outlets that the LAPD is seeking more protections around the information collected by the agency.
“’The sticking point is around having very clear terms about who owns the data, what happens with the data once they collect it,’ said Gialamas.
“He said the LAPD would stop using Flock ‘until we can get those data, privacy, security and sharing concerns ironed out through a contractual relationship.’”
You will recall that in the state of Washington, those issues of ownership were murky. Jose Rodriguez requested camera data from the City of Stanwood, but Stanwood claimed they didn’t have the data but Flock Safety did. Except that Flock Safety claimed that the data was the property of Stanwood. Oh, and the relevant records had been auto-deleted. (There were also some issues regarding whether those records were “public record.”)
Will Los Angeles and Flock Safety reach a definitive agreement that clearly specifies who owns the data…and who can receive the data? From Los Angeles’ perspective, it doesn’t want its data to go to Immigration & Customs Enforcement (ICE).
“It is ORDERED, pursuant to N.J.S.A. 43:6A-13, that former Appellate Division Chief Judge Carmen Messano, retired on pension and having given consent, is hereby recalled by the Supreme Court for temporary service within the judicial system other than the Supreme Court effective September 1, 2026 through March 1, 2027, or until further Order, to serve as a Special Adjudicator in the matter of State v. French G. Lee (A-6-2025) (090662), as set forth in the Court’s Order of June 29, 2026.”
Significantly, the defense cited two recent reports that cast doubt on the old notion that fingerprint match determinations are infallible.
“Before trial, the defense moved to bar fingerprint testimony, relying heavily on two major scientific critiques: Strengthening Forensic Science in the United States: A Path Forward (NAS Report) (2009) and Forensic Science in Criminal Courts: Ensuring Scientific Validity of Feature-Comparison Methods (PCAST Report) (2016). The trial court denied the motion without conducting an evidentiary hearing. Defendant was convicted.”
How?
Once the higher court determined that fingerprint evidence requires review, it set up the mechanism for that review.
“Rather than immediately reversing the convictions, the Court:
“Appointed a Special Adjudicator(Hon. Carmen Messano, retired Chief Judge of the Appellate Division) to conduct a plenary hearing and develop a full record.
“Directed the adjudicator to determine:
“whether the fingerprint evidence satisfies State v. Olenowski (Olenowski I), 253 N.J. 133 (2023);
“whether limitations/guardrailsshould govern fingerprint testimony; and
“if so, what those guardrails should be—explicitly including potential revised model jury charges.”
No idea when this hearing will take place.
Who?
Ballotpedia has an entry for retired judge Carmen Messano.
“Carmen Messano was a judge for Part E of the New Jersey Superior Court Appellate Division. He assumed office on November 20, 2006. He left office on May 23, 2023.”
And Messano has at least one celebrity case to his name.
“Carl Lewis Cannot Run
“On Monday May 2, 2011, three appellate judges Philip Carchman, Ronald Graves and Carmen Messano upheld New Jersey Lieutenant Governor and Secretary of State Kim Guadagno’s decision to remove nine-time Olympic gold medalist and former New Jersey State Senate candidate Carl Lewis from the 2011 ballot because he failed to show he could meet the four-year New Jersey residency requirement. This ruling came after Lewis filed a federal complaint against Guadagno, claiming her initial decision, which found him ineligible, was in error.”
“The Supreme Court has appointed a retired chief judge of the Appellate Division to chair the panel that investigates allegations of unethical conduct against judges, Chief Justice Stuart Rabner announced today.
“Effective Sept. 1, Judge Carmen Messano succeeds retired Justice Virginia A. Long as head of the Advisory Committee on Judicial Conduct (ACJC).”
But his future work will focus on fingerprints and ACE-V.
Which raises the question of whether this case will move to the feds if the state denies fingerprint evidence. But I’m not sure if there’s a federal law that applies to this case, which involves two September 2018 burglaries of a Moorestown, New Jersey restaurant.
On Wednesday I shared the post “Is Fingerprint Evidence ‘Fryed’ in New Jersey?” My post concerned a mandated hearing on the admissibility of fingerprint evidence in court. This hearing has not yet been held, so there are no new standard that govern (or bar) the use of fingerprints to convict or exonerate people.
Google Gemini.
But that isn’t the only time friction ridge admissibility was strongly challenged.
There is a case in which a Frye challenge succeeded in blocking friction ridge evidence from a Maryland state court.
Not that it mattered in the end.
State of Maryland vs. Bryan Rose
Judge Susan Souder issued a 30 page decision in this case, from which I will quote extensively. But not that extensively.
And before I do, I want to put this on the forensic timeline.
Souder’s decision was issued after the Brandon Mayfield misidentification, in which Mayfield was incorrectly identified as a terrorist in Spain.
Souder’s decision was issued before the National Academies of Science report on forensics, which resulted in significant cases on how fingerprints are examined and results are reported.
So bear this in mind. A highly publlcized case had shattered the notion that fingerprint matching decisions are infallible (“100% certainty”), but the forensic discipline had not yet moved toward an alternative.
A man was shot and killed on January 5, 2006, and Bryan Rose was arrested on January 18. At this time, the evidence against Bryan Rose consisted of latent prints on a stolen car, which two crime lab technicians linked to Rose’s known prints. The technicians relied on the Analysis Comparison Evaluation – Verification (ACE-V) methodology, and this reliance was central to the challenge.
“Both sides have requested that the Court determine the issue of reliability of the ACE-V methodology, and consequent admission vel non of the latent fingerprints, without reference to the specific fingerprint evidence in this case.”
In other words, the ruling was not based upon the facts in this particular case, but the use of ACE-V itself.
So what were the arguments for and against the admissibility of ACE-V?
“Defendant contends that ACE-V is not a methodology which has been subjected to scientific testing. As a result, the error rate in latent print identifications is unknown. Absent an error rate, reliability of the methodology is unproven. A fundamental problem, according to Defendant, is that the subjective comparisons in ACE-V involve psychological phenomena known as “confirmation bias.” Further, Defendant argues that the “standards” for latent fingerprint identification are inadequate.
“The State principally relies on the history of acceptance of fingerprint identification evidence. Maryland courts have found fingerprint identification to be admissible in the past. Recent court challenges to fingerprint identification evidence have been rejected. Finally, the State claims that the ACE-V methodology is generally accepted in the relevant technical community.”
Those words “generally accepted” should be noted. As Judge Souder noted elsewhere in her decision:
“Under the Frye – Reed test, a party must establish first that a technical or scientific method is reliable and accepted generally in the scientific community before the court will admit expert testimony based upon the application of the questioned technique.”
But general acceptance is not enough. The method must also be reliable.
Turning to ACE-V itself, Judge Souder noted:
“The ACE-V method ‘includes both qualitative and quantitative analysis’ according to The Scientific Working Group for Friction Ridge Analysis, Study and Technology hereafter referred to (;SWGFAST).”
In Judge Souder’s view, the qualitative nature of analysis and the other steps in ACE-V caused her to question the scientific basis of the process. Things seemed a little loose.
“Mr. (Stephen) Meagher testified in this case that he is able to make identifications today that he would not have been able to do thirty (30) years ago.”
I’ve known Meagher during and after his time in the FBI, but if Meagher were using a scientific method, why would his experience matter?
There were a lot of other details that I skipped over, but you can click on the link above if you’re interested.
A two-day Frye hearing was heled on May 29 and 30, 2007.
On October 19, Judge Souder reached her decision.
“In conclusion, the proof presented by the State in this case regarding the ACE-V methodology of latent fingerprint identification showed that it was more likely so, than not so, that ACE-V was the type of procedure Frye was intended to banish, that is, a subjective, untested, unverifiable identification procedure that purports to be infallible. After impartial scientific testing, the establishment of an error rate and of objective criteria which when applied, are documented and can be verified, it may be that latent print identification opinion testimony as offered in this capital case will qualify for admission under Frye-Reed. The State did not meet that burden in this case and, consequently, shall not offer testimony that any latent fingerprint in this case is that of the Defendant. In this case, the State did not show by a preponderance of evidence that a fingerprint examiner can reliably identify a fingerprint to an individual to the exclusion of all others using the ACE-V method.”
The decision pretty nuch crrippled the State’s case, and the State eventually dropped all charges against Rose.
United States v. Brian Keith Rose
But that didn’t mean the end of the prosecution, because the U.S. Department of Justice stepped in.
We’ve seen this before. Remember when the State of California failed to convict the four officers involved in the beating of Rodney King? After that happened, the federal govvernment charged the men, and two of the four were convicted.
In the Rose case, the federal government filed new charges in its case, United States v. Brian Keith Rose.
The federal judge, U.S. District Judge Catherine C. Blake, also held a hearing (under Daubert rules) on the admissibility of ACE-V. However, Blake ruled in late 2009 that ACE-V was admissible. This prompted Rose to reach a plea deal to escape the death penalty, and he was eventually sentenced to 40 years without the possibility of parole.
So much for Judge Souder’s ruling.
And one more thing
In both the Rodney King and the Brian Rose cases, charges were filed at both the state and federal level. Doesn’t that constitute double jeopardy, which is prohibited by the Fifth Amendment to the U.S. Constitution?
It doesn’t.
Double jeopardy only applies if the same sovereign state (California, Maryland, or the United States) charges the same defendant twice. Since the charges were filed on separate sovereign states, double jeopardy does not apply.
Oh, and here’s a song about palm prints.
“Cold Steel Handle.” Google Gemini/Lyria. Public Domain.
I’ve previously discussed the case of Archie Williams, who was freed from prison by the Innocence Project (we’ll return to them later). Williams was sentenced to life in prison without parole in 1983 for a rape and stabbing he did not commit. So how was he freed?
“Commissioner Kimble ordered a status conference at which the court clarified it would invoke its power to obtain the truth in Williams’ case and make sure all possibilities had been explored. Because, in part, of the availability of the NGI fingerprint database and advanced technology, while maintaining their procedural objections, the state agreed to run the test. On March 14, 2019, fingerprint experts at Ron Smith & Associates, in conjunction with the Louisiana State Police Crime Lab, submitted the suitable fingerprint lifts taken from the crime scene into NGI. This search led to an identification of a known individual, Stephen Forbes, a man who had committed similar sexual assaults in the same neighborhood as the victim in Williams’ case.”
Ron Smith is no longer with us (although his associates are), but the Louisiana State Police Crime Lab obviously is, and their match decision of Stephen Forbes (deceased) was legally persuasive.
“Commissioner Kinasiyumki Kimble of the 19th Judicial District Court of East Baton Rouge, Louisiana, vacated the wrongful conviction of Archie Williams.”
A feel-good story. But is fingerprint evidence always reliable?
Frye (and Daubert) challenges
There are two methods, used in different states, to challenge whether a piece of testimony is legally admissible. According to Bredebot, the older of the two standards is the Frye standard.
“The Frye Standard (The “General Acceptance” Test): Think of Frye as the old-school, tried-and-true method. It’s often called the “general acceptance” test. Basically, if a scientific technique or principle is generally accepted by the relevant scientific community, then it’s good to go. It’s like saying, “Hey, all the smart people in this field agree this is legitimate, so we’ll allow it.” This standard is still used in a good number of states, and it’s a bit more conservative. It doesn’t delve into the nitty-gritty of the scientific method itself, but rather whether the scientific community has embraced it.”
Which brings us to a recent ruling by the Supreme Court of the State of New Jersey in the case of State v. French Lee. As JD Supra reports:
“A Morgan Lewis team represented the Innocence Project’s national strategic litigation team, serving as amici in the case of State v. French Lee urging the New Jersey Supreme Court to appoint a Special Adjudicator to assist the trial court in assessing the reliability and admissibility of fingerprint evidence and to draft a model jury charge governing the evaluation of such evidence and related testimony. In a landmark, unanimous decision, the Supreme Court agreed, ordering a hearing on the admissibility and reliability of fingerprint evidence and further action to ensure the reliability of such evidence in future trials, marking a significant development in forensic standards for criminal trials in the state.”
Lee was convicted of burglary in the original trial based upon latent fingerprint evidence. When the evidence was challenged…
“The state relied on more than 100 years of judicial acceptance of fingerprint evidence under the Frye standard, emphasizing its history in New Jersey and federal courts. The trial court admitted the evidence without a pretrial hearing.”
Higher courts, however, ruled that the reliability and admissibility of fingerprint evidence must be assessed.
Perhaps the assessment will determine that fingerprint evidence is admissible provided that certain safeguards are implemented: for example, that the latent examiner is not subject to bias before making their forensic examination, or perhaps the blind secondary verification is implemented.
Or the assessment may regard fingeprint evidence as inadmissible, or not sufficient on its own merits to result in a conviction (in other words, just like facial recognition and DNA).
I cannot emphasize this enough; this is potentially a big deal.
What are vendor responsibilities?
It’s attractive to some biometric vendors to pass the buck and say, “This is not my problem. Let the agency worry about it.”
But as I’ve said before in Biometric Update, vendors must disclose responsible uses of biometric data. And that includes designing biometric systems that conform with laws and practices, including the removal of bias from biometric match decisions.
But the technology vendors can only do so much. Agencies themselves must implement policies that remove bias. It’s of no benefit if the vendor’s solution incorporates blind secondary verification if the agencies don’t use it, or even worse instruct their forensic examiners to “confirm that this guy we arrested is the one who committed the crime.”
Bredemarket 