UPDATED: RCMP Wants Facial Recognition 'As an Option'

UPDATE: Two days after we first contacted the RCMP for comment, and one day after this article was posted, Canada's federal police force has answered some of the questions raised in this story. Their response confirms the reporting below.

"The RCMP does not currently have an approved project plan to implement a facial recognition system," the statement we received by email states, although the new fingerprint system will "allow the RCMP to implement facial recognition as an option."

The RCMP does currently maintain a database of facial images voluntarily sent by "police agencies," but "they are not being used or accessed by the RCMP at this time," the emailed statement continues. Despite pushing ahead with the procurement process for the technology needed to access such a database, the RCMP spokesperson wrote: "There is currently no policy on the retention of facial images, including purging rules," and that these questions will be addressed when RCMP policy is "finalized."

The RCMP statement noted that the law enforcement agency has not consulted the Office of the Privacy Commissioner with regards to this project, but is part of a biometrics working group, along with numerous other national security agencies such as the Canadian Security Intelligence Service and Canada Border Services Agency, created by Defence Research and Development Canada's Centre for Security Science.

The Royal Canadian Mounted Police is aiming to upgrade its automated fingerprint identification system (AFIS), and this time, Canada's top cops want the system to have facial recognition search capabilities.

Even more concerning, available documents suggest that the plan flies in the face of Canada's existing privacy guidelines for facial recognition technology.

The AFIS renewal contract is set to run until 2021, according to a 2015 letter of interest, but there is "no planned implementation time" for the facial recognition aspect, according to another letter of interest published on Wednesday. Instead, a successful bidder for the AFIS contract only needs to "support" facial recognition capabilities, should the RCMP decide to implement them.

Despite this ambiguity over when facial recognition will be used, the RCMP has some pretty clear ideas about how it should be used. According to a previously released document, the RCMP would like to store and analyze surveillance and cellphone video, "or other non-controlled, poor-quality sources." The RCMP also expects that these videos may only contain partial facial images. It's unclear from where, or how, the RCMP plans on acquiring cellphone video.

According to the document, the RCMP will perform one-to-one searches (using one image to confirm the identity of one suspect), as well as one-to-many searches—fishing expeditions involving large databases of photos. If a photo does not contain an identifiable person, then it should be stored in an "unknown photo database repository," according to the letter of interest, which the RCMP can later query.

"What is the criteria for adding photos to that database?" Asked lawyer Micheal Vonn, policy director of the British Columbia Civil Liberties Association, who said she isn't aware of any such RCMP repository. "If they are going to just download all manner of photos and videos into the repository without strict inclusion or exclusion criteria, that is a problem. For example, people marching in a demonstration should not be videoed and have their images placed in an RCMP unknown photo database [to be used as] a repository of suspects."

Provisions in Bill C-51 that allow for an unprecedented level of information sharing between federal agencies under the aegis of national security, Vonn said, pose additional dangers. "If the RCMP used a national security rationale for commandeering, say, the passport database, it's got much more photos of Canadians than it would have in their mugshots."

The RCMP declined to comment within Motherboard's publishing timeframe, and we will update this article if we hear from them.

Watch more from Motherboard: Inhuman Kind

In a 2013 report prepared by the Office of the Privacy Commissioner of Canada (OPC), the nation's top privacy watchdog listed several guidelines for facial recognition. Two of them include stipulations to record and store descriptions of biometric data instead of images themselves to ensure they're not re-analyzed improperly, and to stick to one-to-one searches to minimize the risk of false matches or data breaches. By stating that they wish to maintain a database of images, and perform one-to-many searches, the RCMP appears to be disregarding both of these guidelines.

"We were not specifically aware of this letter of interest," Tobi Cohen, OPC spokesperson, wrote me in an email. "The issue of facial recognition did come up in a Privacy Impact Assessment (PIA) from the RCMP in relation to body worn video cameras. In our response to the PIA last fall, we indicated that the RCMP would have to update its PIA and assess the privacy risks if it were to apply facial recognition technology to any footage collected. At the time, the RCMP indicated it was not contemplating such a thing."

"If the RCMP were to use facial recognition in any capacity, we would expect to receive a PIA on the program," she added.

Facial recognition technology has been used in Canada by passport authorities for years in order to detect fraud, beginning in 2009. That program has been undergoing PIAs since 2004, according to an OPC report, years before it was actually implemented.

Despite shopping around for a company to supply them with facial recognition-ready technology, it appears as though the RCMP is not following the lead of other government agencies in terms of their concern for citizen privacy.