Facial recognition overkill: How deputies cracked a $12 shoplifting case

On a Saturday afternoon in late November 2017, a woman walked into a Wilco Farm store in Oregon, stuffed a $130 pair of Georgia Boots in her purse and walked out.

About 24 hours later, she turned herself in to the Washington County jail.

Her about-face didn't come from a revelatory change of heart or divine intervention -- it was facial recognition, the same kind of technology that lets you unlock your iPhone XS.

The speedy investigation was made possible by Amazon's Rekognition, facial recognition software that let the Washington County Sheriff's Office create its own searchable database of county jail mugshots. A WCSO deputy watched a surveillance recording of the woman pilfering the boots, grabbed pictures of her face from the footage and imported them into the sheriff's office's new tool. He quickly got back a digital lineup of mugshots and found a possible match.

When the deputy spoke to the woman the next day, she admitted to the crime and was charged with second-degree theft.

Facial recognition represents a watershed in policing tactics, sometimes letting authorities like the WCSO solve investigations in hours instead of days. Agencies including the Federal Bureau of Investigation now use facial recognition databases, while other police forces are looking into the technology, raising the prospect of broader adoption in law enforcement.

Watch this: Facial recognition: Get to know the tech that gets to know you

05:11

But the use of such sophisticated technology -- able to rapidly analyze millions of images using computer vision and deep learning -- on such a petty crime raises questions about its application. Are police officers bringing a laser gun to a knife fight? There are also fears of Big Brother-style mass surveillance of the public, which is why civil liberties groups are working to stop police from using the technology.

This clash of community safety versus personal privacy has quickly turned facial recognition into a controversial issue.

Mundane crimes

But behind this debate, WCSO officials confirmed they've mostly trained this sophisticated and controversial tool on mundane crimes, including one in which a woman stole a $12 gas tank from an Ace Hardware store, a CNET investigation into WCSO police reports found. That revelation from one of Amazon's only known Rekognition law enforcement partners  could undermine the company's promotion of the software for solving major crimes, like finding missing children. It raises questions about the value of facial recognition for everyday policing. Plus, it highlights how minimal legislation on the technology lets police use facial recognition for just about any case they want.

Via public records requests, CNET reviewed seven sheriff's office reports that showed facial recognition being put to use in making an arrest. According to those reports, Rekognition played a role in five cases in identifying suspects who refused to give their names when approached by deputies. In those cases, suspects were arrested for crimes that included trespassing and theft of a bicycle. In two other reports, facial recognition helped solve shoplifting cases: one for the pair of $130 boots and another for that $12 gas tank.

Matt Cagle, a lawyer for the American Civil Liberties Union of Northern California, has called for an end to facial recognition in policing. He said these police reports prove that the use of this tech is "unnecessary."

"The investigation of petty crimes does not justify the creation of a massive facial recognition database like this one," he said.

Deputy Jeff Talbot, Washington County's public information officer, said WCSO has made arrests on "crimes on multiple levels" using Rekognition, not just minor offenses. He added that the office has developed internal policies to account for the use of facial recognition and properly trains deputies who use the tool. Those policies, he said, have been shared with several elected officials and are available to the public.

Talbot said that the software has made deputies far more efficient and that his office's work could serve as a model for the responsible use of facial recognition by police.

"Are we solving 500 crimes a year using this technology? Absolutely not," Talbot said. "But do we think this is an important piece of technology that we should be utilizing while doing it responsibly? Absolutely."

Amazon declined to comment for this story.

The company has highlighted Rekognition's use by nonprofits, including Thorn, the International Centre for Missing & Exploited Children and Marinus Analytics, to find potential leads on missing children and human trafficking victims.

"New technology should not be banned or condemned because of its potential misuse," Michael Punke, Amazon Web Services' vice president of global public policy, said in a blog post last month. "Instead, there should be open, honest and earnest dialogue among all parties involved to ensure that the technology is applied appropriately and is continuously enhanced."

That's not O.J. Simpson

Rekognition, which Amazon introduced in late 2016, works by mapping out a person's face and analyzing how many of its  features match those of other faces in a database. The same kind of technology is used by Apple's Face ID, by Facebook to find people in photos and by US Customs and Border Protection to check people's identities at airport kiosks.

One of the biggest benefits of this technology is that it's not fooled by a new haircut or a different pair of glasses, things that might throw off the naked eye. For Washington County, Talbot said, the tech gives deputies an advantage in finding potential suspects they may have missed otherwise.

Several agencies, including the FBI and Maryland's Department of Public Safety and Correctional Services, use facial recognition databases that search driver's license photos and mugshots. In one high-profile incident last year, Maryland authorities used their database to identify the suspect in a mass shooting in Annapolis after the man refused to identify himself when captured.

Makers of police body cameras have also looked into using facial recognition, which could be deployed for real-time identification of people on livestreaming video.

With little legislation guiding facial recognition in policing, both Google and Microsoft have held off on providing their versions of the technology to authorities. Amazon, meanwhile, has decided to work with law enforcement, which includes a pilot program with police in Orlando, Florida, and marketing of Rekognition to US Immigration and Customs Enforcement. WCSO, which has about 600 employees and patrols parts of a 606,000-person county just west of Portland, has also found itself at the center of the brewing controversy over facial recognition because of its relationship with Amazon.

Before Washington County started using Rekognition, Talbot said, hours and sometimes days were taken up trying to identify pictures of potential suspects. Deputies would send internal emails to colleagues, provide bulletins to other local departments and post faces on social media and a Can You ID Me? website. They'd also manually review mountains of mugshots.

In the cases of suspects who refused to give their names when arrested, using their fingerprints to get a match could add hours to an investigation -- assuming they're in the state system.

These methods are still being used, but Chris Adzima, a senior information systems analyst at the sheriff's office, embraced Rekognition. He placed an archive of 300,000 mugshots from the Washington County jail management system on an Amazon Web Services cloud server. Adzima then connected those mugshots to Rekognition to create a tool on the sheriff's office's internal web service, allowing deputies to submit pictures and find potential matches in less than a minute.

Adzima described the system as "an extraordinary bargain," costing $400 to set up and $6 a month for web services, according to emails the ACLU published last year from its own public records requests on Rekognition.

Illustrating the popularity of the new tool, 152 unique users made 1,004 facial recognition queries using WCSO's system last year, according to the agency's annual audit of its Rekognition system.

WCSO's system, though, is far from perfect. A slide in a Washington County training presentation pointed that out by showing a 93.5 percent match between O.J. Simpson and a mugshot of a white male with a mustache. It's erroneous matches like these that alarm civil liberties groups, who say police may use information like this to make false arrests or unfairly target minority communities. To highlight that point, the ACLU released a study last year that found that Rekognition incorrectly matched 28 US Congress members with mugshots of criminals.

Talbot said the ACLU study mischaracterized how Washington County uses Rekognition, saying the tool is used only as a digital lineup to gain potential leads in an investigation, not a form of evidence. That's why WCSO policy doesn't allow deputies to arrest someone based solely a Rekognition match; they are required to investigate further to verify a suspect's identity.

He confirmed that most cases solved using Rekognition are property crimes, in which video surveillance at a store or home is available. The second most common use is identifying people that refuse to provide their names, he said. Most major crimes don't include video footage and aren't typically stranger-on-stranger incidents, he said, reducing the need for Rekognition in those cases.

While Rekognition has been used primarily for lower-level crimes so far, Talbot noted that crimes are rarely isolated, so an arrested suspect in one of these lesser cases may have an outstanding warrant or has been arrested for a similar crime in the past.

He disagreed that Washington County's use of the technology would lead to blanket surveillance, saying that an internal tool to speed police work is nothing close to the dystopian scenario civil liberties groups are portraying it could become.

Addressing concerns of mass surveillance, he said: "We're not, we never have and we never will."

Shoplifting, bike theft and trespassing

During an incident last April, Washington County authorities were called to an apartment complex at 1:33 a.m. by the apartment manager, who complained about a man banging on a door. Deputies warned the man repeatedly that he'd be arrested if he didn't leave, but he refused. Soon after, he was arrested and put in handcuffs.

The police report continued:

"I asked the male what his name was but he still would not answer. I could not get the male to answer any of my questions, at times he would reply with an insult or tell me to shut up. I took a picture of the male and ran it through the Facial Recognition program, which identified him as [name]."

The man was charged with second-degree trespassing, a misdemeanor. Deputies spoke to the woman who lived at the apartment. She told them she had slept with the suspect a few times but stopped wanting to see him. She didn't want to press charges.

The case highlights two arguments over the technology. On the one hand, some may conclude that deputies could've just asked the woman in the apartment who the suspect was without relying on a sophisticated facial recognition database. On the other, some may see authorities' ability to quickly identify a potentially dangerous suspect as a major benefit -- a takeaway from the Annapolis shooting. Also, Talbot said some suspects refuse to identify themselves because there are warrants out for their arrest.

The arrest was one of five CNET reviewed that involved suspects who wouldn't identify themselves. None of those cases were for major crimes. In another report, a deputy used facial recognition to identify a man who wouldn't give his name after he was caught stealing a bicycle intentionally left outside by police as bait.

A shoplifting case in March helped highlight the value of facial recognition in solving crimes, though the incident was far from significant. A worker at an Ace Hardware store reported that an unidentified woman had stolen a $12 tank of gas. The employee provided surveillance footage of the theft, which deputies used to identify a suspect. A few months later, the deputy on the case saw the suspect driving in the same car reportedly used in the theft, confirmed her identity using her driver's license and got her to admit to stealing the gas tank. She was charged with third-degree theft.

CNET reviewed two additional police reports that used the technology but didn't result in a match. In one case, a man attempted to obtain a credit card at a local Walmart using a forged driver's license. No results came back from the facial recognition software and the case was suspended.

In another incident, a car dealership said a man used someone else's identity to buy a $55,800 Dodge Ram truck. Facial recognition used on video surveillance came up empty. The suspect and vehicle were found instead by turning on the GPS tracker in the truck.

Both those cases show that facial recognition is no cure-all against criminals, though there are efforts to make the tech more powerful.

Facing the future

Several police agencies have contacted the WCSO to learn about its use of facial recognition, according to emails disclosed in public records requests from both CNET and the ACLU. In one example, the Clackamas County Sheriff's Office, which neighbors Washington County, had extensive conversations with WCSO officials about facial recognition and started testing its own tool.

But pressure from the ACLU and others has certainly gotten law enforcement's attention.

In one email CNET reviewed, a Clackamas County official wrote last May: "I did hear about the ACLU and others challenging Wash Co's use of the technology and the sheriff's response. If CCSO were to use this technology, it should expect to be subject to the same type of criticism."

A new frontier for facial recognition is paring the technology with real-time surveillance. That concept is already being used in China to track the public. In a tamer usage, Orlando police teamed up with Amazon to pilot use of Rekognition in surveillance cameras. For now, the program is only being used to track a few volunteer officers.

In its policy guidelines for using facial recognition, Washington County lays out one potential use for real-time surveillance. If deputies have probable cause that a felony suspect they already identified will be at a specific place at a specific time, or they believe an identified suspect is about to engage in a terrorist act, they can use Rekognition in real time.

WCSO's Adzima cautioned that this capability isn't actually possible yet, since it would require setting up a network of security cameras. But the ACLU's Cagle noted that this policy is "a case study in mission creep," showing how quickly facial recognition tools can turn into public surveillance.

"One only need to look at their policy to see how this database can be expanded and abused," Cagle said. "That policy suggests there are bigger plans afoot for this program."

Want to learn more about facial recognition? Read all about it at CNET's Facial Recognition 101.  

Editor's note: CNET has removed the names and other personal details of civilians cited in police reports and images to protect their identities.

Originally published March 18, 5 a.m. PT.
Update, March 19: Adds information on ACLU study.