France set to roll out nationwide facial recognition ID program

France is poised to become the first European country to use facial recognition technology to give citizens a secure digital identity – whether they want it or not, according to Bloomberg.

Saying it wants to make the state more efficient, President Emmanuel Macron’s government is pushing through plans to roll out an ID program, dubbed Alicem, in November, earlier than an initial Christmas target. The country’s data regulator says the program breaches the European rule of consent and a privacy group is challenging it in France’s highest administrative court. It took a hacker just over an hour to break into a “secure” government messaging app this year, raising concerns about the state’s security standards.

None of that is deterring the French interior ministry.

“The government wants to funnel people to use Alicem and facial recognition,” said Martin Drago, a lawyer member of the privacy group La Quadrature du Net that filed the suit against the state. “We’re heading into mass usage of facial recognition. (There’s) little interest in the importance of consent and choice.” The case, filed in July, won’t suspend Alicem.

Digital Identities

With the move, France will join states around the world rushing to create “digital identities” to give citizens secure access to everything from their taxes and banks to social security and utility bills. Singapore uses facial recognition and has signed an accord to help the U.K. prepare its own ID system. India uses iris scans.

France says the ID system won’t be used to keep tabs on residents. Unlike in China and Singapore, the country won’t be integrating the facial recognition biometric into citizens’ identity databases. In fact, the interior ministry, which developed the Alicem app, says the facial recognition data collected will be deleted when the enrollment process is over. That hasn’t stopped people from worrying about its potential misuse.

“Rushing into facial recognition at this point is a major risk” because of uncertainties on its final use, said Didier Baichere, a governing-party lawmaker who sits on the Parliament’s “future technologies” commission and is the author of a July report on the subject. Allowing mass-usage before putting in place proper checks and balances is “ludicrous,” he said.

No Consent

The Android-only app with the blazon of the French republic, which Bloomberg was able to consult, will be the only way for residents to create a legal digital ID and facial recognition will be its sole enabler. An ID will be created through a one-time enrollment that works by comparing a user’s photo in their biometric passport to a selfie video taken on the app that will capture expressions, movements and angles. The phone and the passport will communicate through their embedded chips.

Opponents say the app potentially violates Europe’s General Data Protection Regulation, which makes free choice mandatory. Emilie Seruga-Cau, who heads the law enforcement unit at the CNIL, the country’s independent privacy regulator, said it has made its concerns “very clear.”

Security is another worry. Authorities say the security of Alicem is at the “highest, state level.” Yet in April, Robert Baptiste, a hacker who goes by Elliot Alderson on Twitter, was able to access one of the government’s “highly secure” apps within 75 minutes, raising questions about the resilience of the state’s online security.

‘Bug Bounty’

“The government shouldn’t boast that its system is secure, but accept to be challenged,” Baptiste said “They could open a bug bounty before starting, because it would be serious if flaws were discovered after people start using it, or worse if the app gets hacked during enrollment, when the facial recognition data is collected.”

Opposition lawmakers worry about the integration of facial recognition into laws to track violent protesters like during Yellow Vests demonstrations. Drago, who’s challenging government plans on privacy and consent issues, said the absence of a debate “lets the state move ahead, without roadblocks.”

Meanwhile, facial recognition tests are multiplying. Live camera surveillance in the streets of Wales was judged legal this month by a London court. Germany, The Netherlands and Italy use it for fast tracking borders checks. In August, Sweden’s Data Protection Authority fined the municipality of Skelleftea for testing facial recognition on high school students to measure attendance. Apple Inc. trivialized its use as a biometric to unlock mobile phones.

Front-Runner?

The EU’s new Commission, whose mandate begins in November, has among its goals the building of a “Europe fit for the Digital Age.” An internal policy document by the Commission detailed the steps the EU should take to master Artificial Intelligence technologies, including facial recognition.

“The wide-spread use of an equivalent of a public DNA is a challenge for regulators,” said Patrick Van Eecke, a privacy and data specialist at DLA Piper in Brussels. “You can look at France’s use of facial recognition for digital identity in two ways: it goes too far in terms of privacy, or they’re using the most secure new technology. Are they a front-runner or are they overstepping the mark?”