NYC Mayor Considering a Subway Security System That Can’t Differentiate Between a Laptop and a Handgun

Evolv Technology claims that its AI-powered sensors can automatically detect handguns and other weapons with “the highest degree of accuracy,” and has already deployed the devices in school districts in South Carolina and Indiana. But at a meeting of the Urbana School District Board of Education in November, Kevin Rabinowitz, a salesperson for the security company, was asked about whether there’s a setting that allows the weapons detectors to detect handguns as threats, but not Chromebooks, which had been setting off the detectors about 60 to 70 percent of the time.

“There are settings you can put it on to miss the Chromebooks,” Rabinowitz said, “but you’ll also miss some handguns.” He specified that “you’ll miss the subcompacts, which is a difficult give-and-take.”

In the aftermath of last week’s subway shooting, New York City Mayor Eric Adams expressed a desire to install security screening technology in the subway. When asked about Evolv, Fabien Levy, a spokesperson for the mayor’s office, told Motherboard that the mayor “is willing to test and analyze numerous forms of technology in a legal, responsible way to protect New Yorkers.” Adams did not specifically name Evolv, but the company is testing its setup at a city-run hospital in the Bronx, making it a presumed front-runner for such a plan. “Of course, any technology that could possibly be utilized in the subways would be coordinated with the governor’s office and the MTA before ever being used and would need to complement existing technology already present in our subways,” Levy said.

In marketing materials and company sales pitches, Evolv stresses the frictionless experience of going through one of its scanners, which do not require people to empty their pockets or be wanded down by security personnel. They also promote lower labor costs because customers only need one or perhaps two security guards manning the tablet, which alerts them to potential threats. Evolv’s scanners are already being used at sporting events, museums, and similar venues around the city and the country.

“If that perpetrator walked through our system, we would have identified he had a gun on him,” Evolv CEO Peter George told the Wall Street Journal, referring to the subway shooting. “We were born to solve this exact problem.”

But some experts who have tried to find out whether Evolv’s technology actually does what it promises in real-world settings have said they can’t find any evidence of it.

“There haven’t been any peer-reviewed studies, tests, or audits” of Evolv’s system, said Daniel Schwarz, a privacy and technology strategist for the New York Civil Liberties Union. When Motherboard asked Evolv if any such studies or tests have been done, Evolv pointed Motherboard to the “Department of Homeland Security Safety Act Designation, which provides legal liability protections for sellers of qualified anti-terrorism technologies (QATTs) that could save lives in the event of a terrorist attack” and a designation by the National Center for Spectator Sports Safety and Security which Evolv says was “performed at a customer site and in a live environment and included live screening.”

But Donald Maye, the head of operations at IPVM, which tests security equipment against the marketing claims made by companies selling them, says those studies don’t conduct the types of testing that would verify Evolv’s public claims, and ones future customers, especially ones outside of the special event space, might need. 

Maye says his findings are that Evolv is not being transparent about the system’s limitations. “Fundamentally, what you see in our reporting, is what they are showing from a sales and marketing standpoint does not align with how the system actually operates with an end user,” Maye told Motherboard. He said he found it “difficult to believe a CEO would guarantee it would detect that weapon even when he’s not being specific about the setting or environment the system is deployed in.”

By Evolv’s telling, the company offers state-of-the-art passive scanners using millimeter wave technology that detects shapes of objects on people’s bodies, and then uses artificial intelligence to identify certain shapes as weapons. Rather than having one security guard per scanner as with traditional metal detectors, Evolv’s system only requires guards to be stationed at tablets that show photos and alerts when possible weapons are detected, who will then deal with the situation themselves by stopping and wanding or frisking the individual in secondary screening. 

“We've written all the signatures for all the weapons out there,” Evolv’s George told Gothamist. “The magic is in the ability to discriminate between a phone and a firearm.” When asked how the company has “all the signatures for all the weapons,” an Evolv spokesperson told Motherboard, “We have a database of tens of thousands of examples of weapons signatures—which we have built in consultation with our customers—specific to the weapons that are top of mind to security experts and have been used in mass casualty incidents, including IEDs, and 3-D printed ghost guns.” 

Maye says he first became interested in testing Evolv’s system when the company included temperature checks with its scanners, a technology IPVM was especially interested in during the height of the pandemic. On an initial call with Evolv executives, Maye said they asked the company detailed technical questions but “didn’t get the types of answers we were hoping for.” Maye entered prolonged negotiations with Evolv to test their system, but after much back and forth Evolv ultimately declined to do so and cut off all communications with IPVM.

A spokesperson for Evolv said its own customers test their products first before deciding whether to enter a lease agreement to use the scanners and that “maintaining the confidentiality of this data is a best practice intended to maximize public safety.” 

As a result, Maye has had to rely on publicly available documents, marketing materials, and public records requests for his research. And he says there are concerns in those materials with Evolv’s system, especially in an environment like the New York City subway where millions of people will be passing through carrying all sorts of objects every day. 

Traditional metal detectors have different sensitivity settings depending on where they’re being used, which is why your belt buckle will trigger the alarm at, for example, the airport but not at the sports stadium. Although Evolv regularly disputes any comparison with metal detectors, the company’s sensors also have sensitivity settings for different environments. It presents an obvious trade-off between setting off the alarm when no weapon is present at higher sensitivity settings and letting potentially dangerous objects through at lower settings. 

Evolv’s solution seems to be to let people adjust to its current limitations. For example, at the Urbana school district meeting, Rabinowitz said at other schools, students learn which objects regularly set the detectors off and then stop bringing them. “If I have this giant water bottle at home that sets it off every time, I’m going to keep it at home so I don’t have to go to this secondary screening,” he said. “The good part is it’s the same people coming in every day, for the most part, and they catch on and don’t want to be that person that has to go to the secondary screening.”

Maye provided Motherboard with a copy of an email he obtained through a public records request from September 2020 from Douglas Mansel, aviation security manager at the Oakland International Airport, which uses Evolv for employee screenings. Explaining Evolv’s limitations, Mansel wrote getting the “sensitivity setting correct for the airport/employee environment” as a lesson learned deploying Evolv. Mansel also noted the system “is not an explosives detection machine per se” and “if an employee (or law enforcement during a test) walks through with a brick of C4 in their hands, the Evolv will not alarm. But it is working properly!”

Chromebooks pose a specific problem because of the way the hinges are designed which, incidentally, are shaped a bit like a gun. This was a problem for Urbana officials because students use Chromebooks. Rabinowitz’s proposed solution was to have a table beside the Evolv detectors where students could put their Chromebooks, walk through the scanner, then pick their Chromebooks back up.

When asked specifically about these false positives, an Evolv spokesperson said, “We regularly hear from customers that Evolv Express alarm rates on non-threat items are an order of magnitude lower in comparison to metal detectors, and we proactively work with our customers to help them develop protocols (AKA ‘concept of operations’ or ‘conops’ in the security world) around the people, processes and technology they are using to keep people safe in their unique environments.”

These flaws are perhaps manageable risks in controlled, predictable environments like a school where students are already subject to security protocols. But it’s hard to believe installing thousands of these machines across the hundreds of subway stations in the city to have a system that may or may not detect a handgun properly is a solution to the subway’s security issues. It’s equally implausible that any amount of machine learning could reliably distinguish between weapons—a vague and constantly-changing category as technology evolves—from innocuous items without inconveniencing subway riders on a daily basis with invasive pat-downs and bag checks.

But such a plan if enacted would certainly be exceedingly costly. Urbana School District ended up not buying Evolv’s system, instead opting for competitor CEIA. One of the reasons was cost, as five of CEIA’s Opengates cost $65,000 to purchase while Evolv was charging $203,000 for a four-year lease on four systems. It’s a lot to spend on a security solution that might not even work.