Catherine Crump's guest appearances

Catherine Crump

TED Talks News and Politics

Climb In Consulting

Blue Jersey Radio

BCLT's Expert Series

Al Gore

Mark Cohen

Hillary Clinton

John Martin

Steven Goldstein

Chris Christie

Michael Smith

Doug Herbert

James Whelan

Dennis Kucinich

Peter Barnes

Sean Downey

Carla Katz

John Koza

Dean Miller

OwlTail

Using publicly available information, Clearview AI built a massive database of faceprints for commercial use and police use. Did they have the right to do so? Not in Illinois at least. What does this important case mean for those outside of Illinois? And how will other states be looking to provide similar protections?   More on Catherine Crump.   SPEAKERS Catherine Crump, Wayne Stacy   Wayne Stacy  00:00 Welcome, everyone to the Berkeley Center for Law and Technology's Experts series podcast. Today we are talking about biometric privacy and the intersection of First Amendment and privacy law. To guide us through this discussion, we have the director of the Samuelson Law, Technology, and Public Policy Clinic. Catherine Crump. Catherine has been at the clinic since 2014, and is one of the nation's leading experts on this topic. So with that in mind, Catherine, can you start us down this discussion about Clearview AI?   Catherine Crump  00:33 We're going to talk today about a really interesting new ruling from an Illinois State Court, which issued a decision in which the ACLU and other organizations sued a company called Clearview AI for violating an Illinois law famous to those of us in the privacy world called the Illinois Biometric and Identification Privacy Act, and specifically for building a massive database of face prints it scraped from the internet, and then it sells access to these images to police departments who want to use them for facial recognition. So this really is a decision that pits privacy and free speech against each other.   Wayne Stacy  01:14 I just want to make clear to the listeners, that clear view is collecting all this information from public sources.   Catherine Crump  01:22 Yes, yes, that's right. So the Clearview AI product really shook the privacy community. It was actually the subject of a really well publicized New York Times article by a reporter named Kashmir Hill, it was in the magazine. And so it's a private company. And what it does is it scrapes photos off the public Internet, and yes, they're publicly available, right? So you know, when you get a picture taken of you at a law firm event, or maybe someone posts something on a public page of Facebook, all of those photos are available for viewing. And so what Clearview AI did, is it harness the power of the internet to gather all of these images. And to create a truly massive database of publicly available images. I think it's said it had something like 3 billion such images. And then it created face prints of those, right, which are a particular way to calculate facial geometry to create a unique imprint of people. So what was really what was really remarkable about this was that it's just vast in scope compared to the biometric database has been created before. So it's not like no one hadn't used this technique. In the past, you know, law enforcement has been doing facial recognition for probably 20 years, at least. But it's always done so on carefully controlled databases. So for example, DMV photos. And so this was different because it involved a private company, creating a truly massive database of photos online. And so it was just bigger in scope than anything anyone had seen before.   Wayne Stacy  02:55 I think back to the classic Fourth Amendment cases: you put your garbage on the streets, and the police can rummage through it. This resembles the garbage case, because I'm making these pictures publicly available. Why can't people just use them?   Catherine Crump  03:13 So I think it's different because of the scale at which it can be done. Right? So I mean, another way to think about it is it's true for a long time, when you walk down the public street, particularly in a, you know, major metropolitan area, you're going to be captured by video surveillance cameras everywhere, right? The difference is that in the past, law enforcement had to put in a lot of effort to really analyze footage, right. So most footage was recorded, but it was never looked at by anyone. Right? Maybe if a crime was committed, law enforcement agents would go back and pull the particular footage and put some effort into viewing it. But this really automates the process of being able to identify people. And so you know, for the most part today, people still have anonymity walking around on the streets. But this could allow people to identify anyone in a much broader range of cases. It's not hard to imagine the abuse scenarios here, right? The product initially was available not just to law enforcement agencies, but to private company. And it's not hard to imagine, for example, it being used for stalking, you know, someone's looking at photos of someone's ex, something people have been known to do on the internet after breakups already, right? Imagine being able to do that of a broader range of photos, or even stalking strangers. So it was just a huge expansion of the use of this technology. So I think I think that's one of the privacy differences here.   Wayne Stacy  04:31 But I know Clearview settled in on an argument that well where we're providing this information to police forces to find criminals that had already committed crime. So they really leaned heavily on public safety and that they were they were the the good people in this fight. And really not the folks scraping and invading everyone's privacy. How do you respond to that?   Catherine Crump  04:55 Well, yeah, and I think I respond to that by saying actually, I think it's true, right? They said that there are public safety benefits to facial recognition technology. You can solve crimes with technology that couldn't be solved before. And it's worth acknowledging that at the same time facial recognition technology, many would argue isn't ready for primetime. So for example, they're well known problems with it related to bias, and particularly racial bias. Because a lot of the algorithms that were developed to analyze face matches were based originally on photographs of primarily white people. The technology is known, for example, to have a harder time recognizing faces of black people. There are a few known stories of false identifications by police officers based on this technology, and they all involve black men. And so I think it's complicated. It's a complicated issue. And this technology poses both some some civil liberties and some civil rights risks.   Wayne Stacy  05:49 The lawsuit wasn't about Beatty and bias, it was just a more broad attack that you can't collect publicly available pictures.   Catherine Crump  05:57 Not quite. Um, so this is a lawsuit, interestingly brought by the American Civil Liberties Union and its local affiliate and some other organizations against Clearview AI in state court in Illinois. And its theory was that the law violated a Basic Identification Privacy Act BIPA, and that is a state law that prohibits private entities from collecting biometric identifiers unless it informs the person whose identifier is collected, that it is being collected and informs them of the purpose of collection and the length of time of collection, and then actually gets written consent from the subject of the biometric identifier. So this is like a just a state law claim under BIPA that what Clearview AI did violated that state statute. I think there's little doubt that Clearview did violate the statute. It does make sort of a half hearted argument that photos weren't meant to be counted. But actually, the court is able to rely on pretty extensive precedent to dismiss that and say, in this case, Clearview AI scraped images off the public Internet, that certainly includes people in Illinois. And it doesn't inform that this has happened, let alone asking for consents.   Wayne Stacy  07:11 I guess one of the questions, is this the scope of this case, the decision going to be limited to Illinois? Or will it have nationwide impact?   Catherine Crump  07:19 So that the the Illinois law only protects the rights of people in Illinois, but one of the Clearview's arguments was that it didn't have a way actually to distinguish between photos it got off the internet from people of Illinois and elsewhere. And so the practical effect of holding it liable under BIPA would be to make its business model fail nationwide. And the court essentially says, you know, whether or not that's the case, it's sort of too bad for you, right? It's your obligation under this law to make sure that as to people from Illinois, you follow its precepts, you're selling your software in Illinois, you have sufficient contacts here. And therefore, the fact that you heedlessly gathered these images from around the internet, you know, without regard for the state law is actually not the court's problem or the law's problem. It's your problem. The most interesting issue in the case actually was Clearview's motion dismiss was the most serious argument. There's actually a First Amendment argument, which I think is pretty broadly interesting. And actually there were there were dueling groups of faculty Amicus on on both sides of this. Clearview AI argued that, hey, it's collecting photos available on the internet. And that's an act of gathering information, which is protected by the First Amendment and that it's basically a search engine, right? So just like Google is protected by the First Amendment for gathering information, organizing and letting you search it. So too Clearview AI should be protected by the First Amendment. And it argued that actually the BIPA violated the First Amendment because it was a content based restriction on speech and should be subject to strict scrutiny. And it drew some support for that argument from sort of stalwarts of the First Amendment community. So for example, Floyd Abrams, was featured in The New York Times for representing Clearview AI in this case, and also well known constitutional law professors, Eugene Volokh and Jan van Bauer filed an amicus brief in support of Clearview, essentially endorsing these arguments that what the law is doing is is prohibiting gathering information, and that triggers strict scrutiny under the First Amendment.   Wayne Stacy  09:23 It seems that the court wasn't that impressed with the strict scrutiny argument.   Catherine Crump  09:28 It wasn't. And of course, the ACLU, an organization most prominently associated with the First Amendment, at least traditionally, was on the other side of this arguing for the privacy rights. So it argued that this is essentially a case about conduct, right? That gathering someone's biometric identifier is an act of conduct right to the statute doesn't prohibit you from for example, creating a search engine that searches photos, what it prohibits is extracting the biometric identifier of the face prints from the image and then places limits on doing that. So the ACLU does admit that this burdens speech to some degree, but it essentially says that there's an important interest on the other side, namely the state's interest in promoting privacy and also protecting people's biometric identifiers, right? Your face is not something you can easily change. And so once your biometric fingerprint is compromised, there's no way to get it back. And the court accepted these arguments. It essentially said, it's not a content based restriction on speech, a biometric identifier isn't a type of content, right? It's a thing out in the world, and that although the law might need to satisfy intermediate scrutiny, it was satisfied given the privacy interests at stake. And it seemed important to the court that the law didn't ban collecting biometric identifiers, right? It contained a procedure you have to follow namely, notice and consent that wasn't followed here. So anyway, this is this is one of many cases that Clearview AI has spawned, someday someone can potentially teach a whole class on Clearview AI and the courts. But this is the most recent chapter.   Wayne Stacy  11:04 So how does this get resolved eventually?   Catherine Crump  11:07 Well, you know, I think I think BIPA is an interesting model. It's followed around, and I think we'll have to follow around the country to see how this is going. I think Illinois, is in some senses, it is creating sort of the strictest privacy regime in this area in the nation. And I do think these issues, will just have to be litigated. Right. There's legitimate first amendment questions here about how you apply the first amendment to this particular technology. Then I have to say, I started off my career as a litigator for the ACLU working on first amendment issues. So I'm sympathetic to the issues on both sides. But I think there are serious privacy issues concerned allowing a private company to create a massive unregulated database of people's face prints. And so I see Illinois as having a strong regulatory interest here.   Wayne Stacy  11:54 Do you see other states following in their footsteps, if this goes well for them?   Catherine Crump  12:01 I don't know. I mean, we'll see. The tech industry certainly doesn't like this model. And so I think they may be more on guard about this in other states than they were when this has passed in Illinois, but we'll have to see how it transpires.   Wayne Stacy  12:17 Well, thank you for your time today. It's an interesting case, and I'm sure we'll have several opportunities to talk about it over the next couple of years.   Catherine Crump  12:24 Well, thanks for having me. I enjoyed it.

Using publicly available information, Clearview AI built a massive database of faceprints for commercial use and police use. Did they have the right to do so? Not in Illinois at least. What does this important case mean for those outside of Illinois? And how will other states be looking to provide similar protections? More on <a href="https://www.law.berkeley.edu/our-faculty/faculty-profiles/catherine-crump/" rel="nofollow" target="_blank">Catherine Crump</a>. SPEAKERS Catherine Crump, Wayne Stacy Wayne Stacy  00:00 Welcome, everyone to the Berkeley Center for Law and Technology's Experts series podcast. Today we are talking about biometric privacy and the intersection of First Amendment and privacy law. To guide us through this discussion, we have the director of the Samuelson Law, Technology, and Public Policy Clinic. Catherine Crump. Catherine has been at the clinic since 2014, and is one of the nation's leading experts on this topic. So with that in mind, Catherine, can you start us down this discussion about Clearview AI? Catherine Crump  00:33 We're going to talk today about a really interesting new ruling from an Illinois State Court, which issued a decision in which the ACLU and other organizations sued a company called Clearview AI for violating an Illinois law famous to those of us in the privacy world called the Illinois Biometric and Identification Privacy Act, and specifically for building a massive database of face prints it scraped from the internet, and then it sells access to these images to police departments who want to use them for facial recognition. So this really is a decision that pits privacy and free speech against each other. Wayne Stacy  01:14 I just want to make clear to the listeners, that clear view is collecting all this information from public sources. Catherine Crump  01:22 Yes, yes, that's right. So the Clearview AI product really shook the privacy community. It was actually the subject of a really well publicized New York Times article by a reporter named Kashmir Hill, it was in the magazine. And so it's a private company. And what it does is it scrapes photos off the public Internet, and yes, they're publicly available, right? So you know, when you get a picture taken of you at a law firm event, or maybe someone posts something on a public page of Facebook, all of those photos are available for viewing. And so what Clearview AI did, is it harness the power of the internet to gather all of these images. And to create a truly massive database of publicly available images. I think it's said it had something like 3 billion such images. And then it created face prints of those, right, which are a particular way to calculate facial geometry to create a unique imprint of people. So what was really what was really remarkable about this was that it's just vast in scope compared to the biometric database has been created before. So it's not like no one hadn't used this technique. In the past, you know, law enforcement has been doing facial recognition for probably 20 years, at least. But it's always done so on carefully controlled databases. So for example, DMV photos. And so this was different because it involved a private company, creating a truly massive database of photos online. And so it was just bigger in scope than anything anyone had seen before. Wayne Stacy  02:55 I think back to the classic Fourth Amendment cases: you put your garbage on the streets, and the police can rummage through it. This resembles the garbage case, because I'm making these pictures publicly available. Why can't people just use them? Catherine Crump  03:13 So I think it's different because of the scale at which it can be done. Right? So I mean, another way to think about it is it's true for a long time, when you walk down the public street, particularly in a, you know, major metropolitan area, you're going to be captured by video surveillance cameras everywhere, right? The difference is that in the past, law enforcement had to put in a lot of effort to really analyze footage, right. So most footage was recorded, but it was never looked at by anyone. Right? Maybe if a crime was committed, law enforcement agents would go back and pull the particular footage and put some effort into viewing it. But this really automates the process of being able to identify people. And so you know, for the most part today, people still have anonymity walking around on the streets. But this could allow people to identify anyone in a much broader range of cases. It's not hard to imagine the abuse scenarios here, right? The product initially was available not just to law enforcement agencies, but to private company. And it's not hard to imagine, for example, it being used for stalking, you know, someone's looking at photos of someone's ex, something people have been known to do on the internet after breakups already, right? Imagine being able to do that of a broader range of photos, or even stalking strangers. So it was just a huge expansion of the use of this technology. So I think I think that's one of the privacy differences here. Wayne Stacy  04:31 But I know Clearview settled in on an argument that well where we're providing this information to police forces to find criminals that had already committed crime. So they really leaned heavily on public safety and that they were they were the the good people in this fight. And really not the folks scraping and invading everyone's privacy. How do you respond to that? Catherine Crump  04:55 Well, yeah, and I think I respond to that by saying actually, I think it's true, right? They said that there are public safety benefits to facial recognition technology. You can solve crimes with technology that couldn't be solved before. And it's worth acknowledging that at the same time facial recognition technology, many would argue isn't ready for primetime. So for example, they're well known problems with it related to bias, and particularly racial bias. Because a lot of the algorithms that were developed to analyze face matches were based originally on photographs of primarily white people. The technology is known, for example, to have a harder time recognizing faces of black people. There are a few known stories of false identifications by police officers based on this technology, and they all involve black men. And so I think it's complicated. It's a complicated issue. And this technology poses both some some civil liberties and some civil rights risks. Wayne Stacy  05:49 The lawsuit wasn't about Beatty and bias, it was just a more broad attack that you can't collect publicly available pictures. Catherine Crump  05:57 Not quite. Um, so this is a lawsuit, interestingly brought by the American Civil Liberties Union and its local affiliate and some other organizations against Clearview AI in state court in Illinois. And its theory was that the law violated a Basic Identification Privacy Act BIPA, and that is a state law that prohibits private entities from collecting biometric identifiers unless it informs the person whose identifier is collected, that it is being collected and informs them of the purpose of collection and the length of time of collection, and then actually gets written consent from the subject of the biometric identifier. So this is like a just a state law claim under BIPA that what Clearview AI did violated that state statute. I think there's little doubt that Clearview did violate the statute. It does make sort of a half hearted argument that photos weren't meant to be counted. But actually, the court is able to rely on pretty extensive precedent to dismiss that and say, in this case, Clearview AI scraped images off the public Internet, that certainly includes people in Illinois. And it doesn't inform that this has happened, let alone asking for consents. Wayne Stacy  07:11 I guess one of the questions, is this the scope of this case, the decision going to be limited to Illinois? Or will it have nationwide impact? Catherine Crump  07:19 So that the the Illinois law only protects the rights of people in Illinois, but one of the Clearview's arguments was that it didn't have a way actually to distinguish between photos it got off the internet from people of Illinois and elsewhere. And so the practical effect of holding it liable under BIPA would be to make its business model fail nationwide. And the court essentially says, you know, whether or not that's the case, it's sort of too bad for you, right? It's your obligation under this law to make sure that as to people from Illinois, you follow its precepts, you're selling your software in Illinois, you have sufficient contacts here. And therefore, the fact that you heedlessly gathered these images from around the internet, you know, without regard for the state law is actually not the court's problem or the law's problem. It's your problem. The most interesting issue in the case actually was Clearview's motion dismiss was the most serious argument. There's actually a First Amendment argument, which I think is pretty broadly interesting. And actually there were there were dueling groups of faculty Amicus on on both sides of this. Clearview AI argued that, hey, it's collecting photos available on the internet. And that's an act of gathering information, which is protected by the First Amendment and that it's basically a search engine, right? So just like Google is protected by the First Amendment for gathering information, organizing and letting you search it. So too Clearview AI should be protected by the First Amendment. And it argued that actually the BIPA violated the First Amendment because it was a content based restriction on speech and should be subject to strict scrutiny. And it drew some support for that argument from sort of stalwarts of the First Amendment community. So for example, Floyd Abrams, was featured in The New York Times for representing Clearview AI in this case, and also well known constitutional law professors, Eugene Volokh and Jan van Bauer filed an amicus brief in support of Clearview, essentially endorsing these arguments that what the law is doing is is prohibiting gathering information, and that triggers strict scrutiny under the First Amendment. Wayne Stacy  09:23 It seems that the court wasn't that impressed with the strict scrutiny argument. Catherine Crump  09:28 It wasn't. And of course, the ACLU, an organization most prominently associated with the First Amendment, at least traditionally, was on the other side of this arguing for the privacy rights. So it argued that this is essentially a case about conduct, right? That gathering someone's biometric identifier is an act of conduct right to the statute doesn't prohibit you from for example, creating a search engine that searches photos, what it prohibits is extracting the biometric identifier of the face prints from the image and then places limits on doing that. So the ACLU does admit that this burdens speech to some degree, but it essentially says that there's an important interest on the other side, namely the state's interest in promoting privacy and also protecting people's biometric identifiers, right? Your face is not something you can easily change. And so once your biometric fingerprint is compromised, there's no way to get it back. And the court accepted these arguments. It essentially said, it's not a content based restriction on speech, a biometric identifier isn't a type of content, right? It's a thing out in the world, and that although the law might need to satisfy intermediate scrutiny, it was satisfied given the privacy interests at stake. And it seemed important to the court that the law didn't ban collecting biometric identifiers, right? It contained a procedure you have to follow namely, notice and consent that wasn't followed here. So anyway, this is this is one of many cases that Clearview AI has spawned, someday someone can potentially teach a whole class on Clearview AI and the courts. But this is the most recent chapter. Wayne Stacy  11:04 So how does this get resolved eventually? Catherine Crump  11:07 Well, you know, I think I think BIPA is an interesting model. It's followed around, and I think we'll have to follow around the country to see how this is going. I think Illinois, is in some senses, it is creating sort of the strictest privacy regime in this area in the nation. And I do think these issues, will just have to be litigated. Right. There's legitimate first amendment questions here about how you apply the first amendment to this particular technology. Then I have to say, I started off my career as a litigator for the ACLU working on first amendment issues. So I'm sympathetic to the issues on both sides. But I think there are serious privacy issues concerned allowing a private company to create a massive unregulated database of people's face prints. And so I see Illinois as having a strong regulatory interest here. Wayne Stacy  11:54 Do you see other states following in their footsteps, if this goes well for them? Catherine Crump  12:01 I don't know. I mean, we'll see. The tech industry certainly doesn't like this model. And so I think they may be more on guard about this in other states than they were when this has passed in Illinois, but we'll have to see how it transpires. Wayne Stacy  12:17 Well, thank you for your time today. It's an interesting case, and I'm sure we'll have several opportunities to talk about it over the next couple of years. Catherine Crump  12:24 Well, thanks for having me. I enjoyed it.


                Catherine Crump | Privacy vs. First Amendment: Which will drive the future of your biometric data?
            

LEAD

Hosted by Jeff Gardner and Jason Springer. Each week, we bring you New Jersey's latest political buzz, interviews with newsmakers, and your stimulating calls.

Blue Jersey Radio - 5/5/09 Our guest is ACLU's Catherine Crump, lead counsel in Christie FOIA case