Biometrics and Surveillance Camera Commissioner speech at NPCC CCTV Conference March 2022

CCTV

One of the ironies of surveillance is that it’s such a fast-moving area it’s hard to keep

an eye on.

A year into my appointment I thought it might be helpful to highlight 4 themes from year, each is followed by a surveillance question for you:

Biometric Surveillance is not just data protection

David Fuller was convicted of two counts of murder at Maidstone Crown Court last

December. Fuller reportedly videoed himself sexually abusing 100 corpses over a period

of decades, from very young children to elderly women, retaining the images in his

home.

DNA played a key role in the investigation but that’s not why I’ve put him up here. Had

he conducted a DPIA and followed policies for capturing and retaining sensitive personal

data Fuller would have been 100% compliant with the letter of the law - because our

DP only protects the living.

Fuller’s conduct was just about the most egregious and intrusive imaginable, violating

elemental levels of human dignity and respect. The trial judge told him: “Your actions

go against everything that is right and humane”. Indeed – but they don’t go against GDPR.

There were calls for mandatory installation of CCTV in hospital mortuaries – but any

DPIA would be the same and cameras wouldn’t even be covered by the Surveillance

Camera Code as they’re not in public space and not operated by a ‘relevant authority’

(currently limited to the police and local authorities).

Biometric surveillance is not just data protection. If people think they’re being watched

or having their conversations listened to by the state and therefore decide not to speak,

not to protest, not to meet up in public, not to travel – that effect on their fundamental

human rights is profound but it’s nothing to do with data protection.

What do Fuller’s grotesqueries tell us about wider Human Rights? Well again the case

raises some interesting questions - Art 3 ECHR for example creates an absolute right to be

protected from inhumane and degrading treatment – including by the police. But again it

only extends to the living – last year also saw a case of police officers taking photos of

murder victims – hideous professional conduct issues yes, but a Human Rights Impact

Assessment would have produced similar results to a DPIA.

Surveillance question – how far do your CCTV polices and practices assume that everything that matters is covered by data protection compliance?

Legitimate and accountable surveillance is about what’s legally permissible yes, but

increasingly it’s about what’s acceptable – to us as citizens and communities. In my

view the point at which legality and acceptability converge is ethics - where we find the

second key surveillance concept to dominate last year.

Xinjiang Surveillance

Most of our public bodies have ethics committees, ethics champions - the Policing

Minister asked the House of Lords in January “aren’t we the national ethics committee?”

Some organisations even have strap lines about putting ethics at the heart of everything

they do. In policing we know ethics is at the centre of the National Decision-Making

Model and, according to the College of Policing, that means it’s at the heart of all policing

decisions – including presumably procurement.

These facilities spread across the Xinjiang Province in Northern China are designed, built

and operated to deal with one group of people: Uyghur Muslims. In order to carry out

their functions they rely heavily on surveillance, state-of-the-art surveillance, designed and

sold by state-run surveillance companies.

Last December, giving the judgment of the Uyghur Tribunal, Sir Geoffrey Nice QC found

that “Hundreds of thousands of Uyghurs – with some estimates well in excess of a million

- have been detained and subjected to acts of unconscionable cruelty, depravity and

inhumanity. Sometimes up to 50 have been detained in a cell of 22 square metres,

observed at every moment by CCTV.”

The judgment went on “Many of those detained have been tortured - detained men and

women have been raped - one detainee was gang raped by policemen in front of an

audience of a hundred people all forced to watch [while others] were raped by men

paying to be allowed into the detention centre for the purpose.”

Not everyone agrees with me, but I think this raises some ethical questions. Let’s

pause and look at a few.

You wouldn’t employ an individual surveillance operator who had designed, built and

worked in one of these appalling places so why would you employ a company that

designed, built and operated them?

How much public money is it ethical to contribute to the design, building and operation

of these facilities? How much tax revenue should we hand to the surveillance companies

that are owned and controlled by the same State which the Tribunal found to have been

directly responsible for genocide using their surveillance technology to perpetrate it?

How is partnering with such companies and enriching their owners “putting ethics at the

heart of everything we do”?

Many public authorities have bought and installed surveillance systems from such

companies – largely, it seems to me, on the basis that the cameras offer “value for

money”. Well, I suppose it’s an exchange of values for money - but that isn’t quite the

same thing and there are different ways of counting cost. I’d like to know from those authorities “how does this sit with the professional and personal ethics of your own officers and staff? Have you asked them?”

It’s interesting how our supermarkets have been very successful at driving improvements

in animal welfare. By insisting suppliers meet minimum standards in relation to the

humane treatment of animals the retail sector has made ethics a condition of entry to

that market. Next time you’re in a supermarket you might want to look up and check

whose camera system is monitoring your every moment - and then reflect on the ethics

of having commercial contracts which properly include very high standards for the

supplier’s treatment of free-range hens but absolutely nothing about human rights abuses.

This seems somewhat asymmetrical.

And this isn’t about product boycotting - the bigger point here is that the systemic nature

of our surveillance capability means people need to have trust and confidence in all of it

- not just in the police or public bit, but in the whole ecosystem of surveillance. And

that means we have to be more vigilant if we’re to maintain public trust for our own

State surveillance. We need to be careful whose corporate company we keep.

Lawful, ethical, publicly-acceptable surveillance needs a systemic approach – and a

systemic approach means focusing on the integrity - of the surveillance systems and

practice as a whole - and the standards of everything and everyone in it. Because, in a

systemic setting, if you infect one part, you infect the whole.

Surveillance question - How far do your surveillance partners reflect your professional code of ethics and your own professional values?

The past year has shown as never before that what’s acceptable to the citizen matters –

not just here but globally. And what’s acceptable to the citizen is changing – so too is

your surveillance relationship. This has been understood by a celebrated son of this

great city we’re in today, someone who’s arguably done more to promote discussion of

contemporary public issues than most – of course I’m talking about Banksy.

Banksy

The headline behind this slide is “terminally ill dad arrested by 6 police officers for

mooning at a speed camera.”

Darrell Meekcom, 55, reportedly protested against a speed camera in Kidderminster last

year. His wife and carer conducted her own surveillance and filmed officers wrestling

the terminally ill man to the ground and handcuffing him. Footage of the incident went

viral. Shortly afterwards this mural appeared in his home town.

Whether this was the real Banksy or one of his followers as rumoured doesn’t matter -

this story provides a powerful illustration of a few surveillance issues:

Not all public space surveillance is welcomed – the COVID 19 pandemic

provided some very good examples last year - the public reaction to it can

be instant and enduring.

The “surveillance relationship” between the police and the citizen means that

the citizen is often surveilling you, sharing images at a speed and scale

we’d never have imagined a decade ago.

In addition, the police and public services are increasingly dependent on

citizen-generated images from a whole range of devices and sources.

The first public communication from many police forces now is often an appeal, not ‘for

witnesses’ but for surveillance images.

We now see the police needing not just images of the citizen but images from the

citizen. This has profound implications for the ‘surveillance relationship’. Investigations

might use extracts from high street CCTV, but they also rely on image captures from

dashcams, GoPros, ring doorbells and car parks. Increasingly the police are reliant on

the product of an aggregated surveillance capability made up of hundreds of sources,

most of them privately owned.

If one part of the system has been alienating the citizen with what are perceived to be

unethical partners, untested technology, untrusted processes, mass retention of photos -

or generally disproportionate intrusion into their lives they may be less inclined to assist

when another part of the system needs their help.

And another aspect of this new surveillance relationship is to remember that citizen generated data may be unreliable, deliberately misleading or even maliciously intended.

Surveillance question – How would your surveillance relationship with the citizen be depicted by Banksy? You don’t need to spraypaint it on a wall but at least think about it.

You can’t do a surveillance conference without mentioning AI which brings me to the 4th

and final thing from my first year. The importance of transparency and explainability. AI

in surveillance comes in many forms and excites a mixture of fascination and fear.

There are many reports of genies getting out of their bottles, the rise of the machines

and a dystopian future running out of control.

The lawful and ethical application of AI is much wider than a surveillance issue – if you

want a brilliant summary and haven’t already done so, maybe listen to the BBC Reith

Lectures, also from last year.

But of all the use cases, novel applications and scare stories, just about the most

terrifying thing I’ve come across in AI surveillance capability is this:

“Hello Barbie”

Forget Harpy and other ‘loitering munitions’ this is the most frightening thing I’ve seen in

AI exploitation full stop.

An interactive doll produced for the English-speaking market, equipped with speech

recognition systems and AI-based learning features, operating as an IoT device!

Mercifully this toy is no longer marketed owing to concerns about system and device

security and you could run an entire conference on smart toys alone - but for now just

think about the issues raised by having an interactive, AI-enabled doll connected to a

developing child at one end and to the internet at the other. If you’re struggling to see

why that is so ghastly from a surveillance perspective read Nicole Perlroth’s “This is

How They Tell Me the World Ends”.

Back to transparency and explainability. I have heard people say the AI in their

surveillance tech is just “too complicated” to explain, and that even their designers and

programmers don’t really understand how it works. Well, if you’re spending the public’s money on it and you’re abiding by your legal obligations to demonstrate that you’ve avoided bias - and discrimination - that won’t do. If you’re relying on automated decision-making that won’t do, and if you’re claiming

ethics to be at the heart of your every decision, you’ll need to prove ethical functioning

of your AI.

Transparency and explainability are two keystones of public accountability – if your tech

is too opaque or unintelligible for the citizen who’s funding it - and purportedly benefiting

from it, the problem isn’t the citizen.

Surveillance question – How have you assured yourselves that all your AI-equipped, internet connected devices used for continuous and invasive monitoring, such as video surveillance are secure?

What about all your other data-intensive systems that collect

mobility data and drive behavioural information (GPS; Wi-Fi tracking devices; RFID

technology; Intelligent Transport Systems and “event data recorder” devices)?

In summary - here’s what I’ve learned over the last year:

There’s a significant element of data protection and human rights engaged in

biometric surveillance. But it’s not just data protection – any more than facial

recognition is just photography or DNA sampling is just chemistry.

Be careful whose corporate company you keep - Conduct ethical pen tests as

often - and sincerely - as your technical ones - and be as attentive to the ethical

standards of your contractors as you are to your own.

Take care with your Surveillance Relationship with the citizen – you’re going to

need each other. Remember - you’re only a part of a much larger system of surveillance capability - no

one wants to be responsible for the weakest part of that ecosystem. Look after your bit.

Never connect dolls to the internet.