India's NCRB extends deadline to submit bids for Automated Facial Recognition System

India’s National Crime Records Bureau (NCRB) has extended the deadline to submit bids for the Automated Facial Recognition System (AFRS) to March 27, 2020, due to “administrative reasons.” The bids would be opened on March 30. This is the sixth time that the deadline for submitting bids has been extended, with the previous deadline being January 31, 2020. Before that, the deadline was January 3, but it was postponed then as well, due “administrative reasons”. The initial deadline to submit bids was August 16 — meaning that NCRB hasn’t been able to go past the bidding process for more than 5 months now.

The AFRS is a centralised web application, and is expected to be the foundation for “a national level searchable platform of facial images”. MediaNama has reached out to NCRB to understand the specific reason(s) for extension. The database of facial images will be created by using passports, data from the Crime and Criminal Tracking Network and Systems (CCTNS), and the Interoperable Criminal Justice System, among other things, NCRB had said in a tender document.

In July 2019, the NCRB had held a pre-bid meeting with vendors willing to bid to develop the AFRS, who raised queries regarding the future integration of AFRS with other systems, and how the system would deal with cases of plastic surgery. Prospective bidders had also said that requirements to qualify for developing the AFRS could hardly be met by domestic companies, and in turn give an edge to bigger international firms.

Concerns surrounding surveillance, violation of privacy: When NCRB had announced its plans of developing a centralised facial recognition system, it sparked concerns surrounding state surveillance, and privacy. Advocacy group, the Internet Freedom Foundation (IFF), had written to the organisation, stating that the proposed surveillance tool was unfathomably detrimental to Indians’ privacy, while highlighting that it lacked legality, and had no safeguards and accountability.

In response, NCRB had justified the legality of AFRS on the basis of a CCTNS Cabinet Note from 2009, where a system, akin to the AFRS, was envisaged. Based on this note alone, the Bureau said that the AFRS has cabinet approval, and is hence, legal. While responding to a legal notice sent by advocacy group, Internet Freedom Foundation in July, NCRB had also said that the AFRS will not be integrated with the Aadhaar database.

No data protection law in place: It is also worth mentioning that the department is planning to deploy a national level facial recognition system when India doesn’t have a data protection law. Moreover, the Personal Data Protection Bill, 2019, which is currently being deliberated upon by a Joint Parliamentary Committee, has carved out exemptions for government agencies to adhere with provisions of the Bill. This suggests that when the AFRS is eventually deployed, there is a possibility that the NCRB might be able to collect, store and process biometric data of Indians without necessarily adhering to the provisions in the Bill.

Facial recognition systems are being implemented despite their legality being questioned: In a time when the lack of legality behind deploying facial recognition surveillance systems has been questioned, it hasn’t stopped the central government, various state governments, and police from using these systems:

Earlier this year, we reported that the Indian Railways is in the process of installing Video Surveillance Systems (VSS), equipped with a facial recognition system, in 983 railway stations across the country. In fact, South Western Railway is planning to implement this system at its railway stations from February 2020.
The Telangana government piloted a facial recognition app in its civic elections on January 22, and claimed that it could address the issue of voter impersonation. The All India Majlis-E-Ittehadul Muslimeen (AIMIM), had urged the state’s election commissioner to withdraw the use of such systems, to no avail.
Certain police forces in India are already using facial recognition systems to scan people at large gatherings, with the most recent instance of its deployment being at Prime Minister Narendra Modi’s rally in Delhi, in December 2019.
Police in Telangana have been asking for “suspects’” fingerprints and facial data to match against a database of criminals, although, as we had earlier reported, these cases often don’t involve an executive order, or explicit consent from the person whose biometric data is being demanded.

EU mulling banning facial recognition, few cities in the US already have: While the use of facial recognition systems continues to gain prominence, the European Commission is currently deliberating banning the use of facial recognition across, for a minimum of five years.