Tag Archives: security industry association

Two articles on facial recognition

Within the last hour I’ve run across two articles that discuss various aspects of facial recognition, dispelling popular society notions about the science in the process.

Ban facial recognition? Ain’t gonna happen

The first article was originally shared by my former IDEMIA colleague Peter Kirkwood, who certainly understood the significance of it from his many years in the identity industry.

The article, published by the Security Industry Association (SIA), is entitled “Most State Legislatures Have Rejected Bans and Severe Restrictions on Facial Recognition.”

CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=664901

Admittedly the SIA is by explicit definition an industry association, but in this case it is simply noting a fact.

With most 2021 legislative sessions concluded or winding down for the year, proposals to ban or heavily restrict the technology have had very limited overall success despite recent headlines. It turns out that such bills failed to advance or were rejected by legislatures in no fewer than 17 states during the 2020 and 2021 sessions: California, Colorado, Hawaii, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, New York, Oregon, South Carolina and Washington.

And the article even cited one instance in which public safety and civil libertarians worked together, proving such cooperation is actually possible.

In March, Utah enacted the nation’s most comprehensive and precise policy safeguards for government applications. The measure, supported both by the Utah Department of Public Safety as well as the American Civil Liberties Union, establishes requirements for public-sector and law enforcement use, including conditions for access to identity records held by the state, and transparency requirements for new public sector applications of facial recognition technology.

This reminds me of Kirkwood’s statement when he originally shared the article on LinkedIn: “Targeted use with appropriate governance and transparency is an incredibly powerful and beneficial tool.”

NIST’s biometric exit tests reveal an inconvenient truth

Meanwhile, the National Institute of Standards and Technology, which is clearly NOT an industry association, continues to enhance its ongoing Facial Recognition Vendor Test (FRVT). As I noted myself on Facebook and LinkedIn:

With its latest rounds of biometric testing over the last few years, the National Institute of Standards and Technology has shown its ability to adapt its testing to meet current situations.

In this case, NIST announced that it has applied its testing to the not-so-new use case of using facial recognition as a “biometric exit” tool, or as a way to verify that someone who was supposed to leave the country has actually left the country. The biometric exit use case emerged after 9/11 in response to visa overstays, and while the vast, vast majority of people who overstay visas do not fly planes into buildings and kill thousands of people, visa overstays are clearly a concern and thus merit NIST testing.

Transportation Security Administration Checkpoint at John Glenn Columbus International Airport. By Michael Ball – Own work, CC0, https://commons.wikimedia.org/w/index.php?curid=77279000

But buried at the end of the NIST report (accessible from the link in NIST’s news release) was a little quote that should cause discomfort to all of those who reflexively believe that all biometrics is racist, and thus needs to be banned entirely (see SIA story above). Here’s what NIST said after having looked at the data from the latest test:

“The team explored differences in performance on male versus female subjects and also across national origin, which were the two identifiers the photos included. National origin can, but does not always, reflect racial background. Algorithms performed with high accuracy across all these variations. False negatives, though slightly more common for women, were rare in all cases.”

And as Peter Kirkwood and many other industry professionals would say, you need to use the technology responsibly. This includes things such as:

  • In criminal cases, having all computerized biometric search results reviewed by a trained forensic face examiner.
  • ONLY using facial recognition results as an investigative lead, and not relying on facial recognition alone to issue an arrest warrant.

So facial recognition providers and users had a good day. How was yours?

Words matter, or the latest from the Security Industry Association on problematic security terms

I may have accidentally hit upon a post series.

In my previous installment of “Words Matter,” published a little over a month ago on November 12, I described how Simon A. Cole made a distinction between words such as “decision,” “interpretation,” and “findings” when talking about how forensic results are described. The passage of time, and the perceptions that change over time, affect how words are used.

There are other examples of how perceptions change over time. Those of us who were alive in the 1960s may remember how the cigarette advertisement phrase “you’ve come a long way, baby” was initially perceived as a liberating, feminist phrase.

Similarly, those of us who were alive in the 1960s may remember that the Washington Redskins were infamous for being the last NFL team in the modern era to add a black player to its roster. The fact that the Washington Redskins were the Washington REDSKINS was not a matter of concern for most people. (Now is the time for a confession: even today, I own a Washington Redskins keychain and a Washington Redskins cup. But I don’t flaunt my ownership of these items.)

Let’s move to the tech world, in which terms that were OK with most people a few years ago are now questionable. The Security Industry Association has compiled a list of some common security terms which, in the SIA’s view, exhibit “language bias.”

Now I’ll be the first to admit that the SIA’s view is not a universal view. There are a number of people who would reply “get over it” if someone objected to one of these terms. (At the same time, there are a number of people who wonder why these terms were ever adopted in the first place.)

I’ll confess that, with the exception of master/slave, I hadn’t really thought about the offensiveness of these terms. And I wondered if the proposed replacement terms would prove to be clunky and unusable.

Well, in my opinion, the SIA did a pretty good job in proposing some new terms that are workable without being offensive. Take the SIA’s proposed replacement for master/slave, for example. The SIA’s proposal to remove the “language bias” that references slavery in the United States and other nations is to substitute the word “primary” or “commander” for “master,” and “secondary” or “responder” for “slave.” The replacement terms convey the security meaning well.

Here are some other proposed terminology changes from the SIA:

  • Change “blacklist” to “blocklist.” Heck, this is just a one letter change.
  • Change “whitelist” to “allowlist.” Perhaps it seems a teeny bit clumsy on first reading, but this would definitely work.
  • Change “black hat” and “white hat” to “bad hat” and “good hat,” or alternatively to “malicious hacker” and “ethical hacker.” Incidentally, the alternative terminology effectively dodges another issue that is unrelated to race or sex bias, namely whether “hacker” and “malicious hacker” are synonyms.
  • For connectors, change “male” and “female” to “plug” and “socket.” This probably conveys the meaning better than the original terms did.

Now the Security Industry Association is just one entity, and I’m sure that other entities are coming up with other terms that replace the older terms. As of today, Wikipedia lists 11 different replacement pairs for master/slave alone, including primary/secondary (BIND), primary/replica (Amazon and Microsoft, among others), provider/consumer (OpenLDAP), and others. There are also multiple alternatives to blacklist/whitelist, including the aforementioned blocklist/allowlist, and other pairs such as deny list/allow list and block list/allow list (with spaces).

All of these suggestions are going to float around and compete with each other, and various trade associations, governments, and other entities are going to adopt one or more of these, causing people who do business with these associations/governments/entities to adopt them also. And there will be the usual debate in those places where standards, like sausages, are made.

After all of these standards battles are complete, which set of terms will prevail?

That’s easy.

LOS ANGELES – MARCH 14: Guest arrives for the 2019 iHeartRadio Music Awards on March 14, 2019 in Los Angeles, California. (Photo by Glenn Francis/Pacific Pro Digital Photography). By Toglenn (Glenn Francis) – This file has been extracted from another file: Taylor Swift 2 – 2019 by Glenn Francis.jpg, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=81523364

The terminology adopted by Taylor Swift will be the terminology that will be adopted by the rest of the world.

Sorry, SIA, but the general population cares much more about what Taylor Swift believes. Perhaps if SIA changed its acronym to TAYLOR, things would be different.

Swift (not to be confused with the Society for Worldwide Interbank Financial Telecommunication) is today’s Oprah Winfrey, and unlike Winfrey is referenced by cybersecurity practitioners.

And she can write a catchy chorus.