India is trying to build the world’s biggest facial recognition system

In July, Bhuwan Ribhu received some very good news.

The child labor activist, who works for Indian NGO Bachpan Bachao Andolan, had launched a pilot program 15 months prior to match a police database containing photos of all of India’s missing children with another one comprising shots of all the minors living in the country’s child care institutions.

He had just found out the results. “We were able to match 10,561 missing children with those living in institutions,” he told CNN. “They are currently in the process of being reunited with their families.” Most of them were victims of trafficking, forced to work in the fields, in garment factories or in brothels, according to Ribhu.

This momentous undertaking was made possible by facial recognition technology provided by New Delhi’s police. “There are over 300,000 missing children in India and over 100,000 living in institutions,” he explained. “We couldn’t possibly have matched them all manually.”

Locating thousands of missing children is just one of the challenges faced by India’s overstretched police force in a nation of 1.37 billion people.

India has just 144 police officers for every 100,000 citizens, compared to 318 per 100,000 citizens in the European Union. In recent years, authorities have turned to facial recognition technology to make up for the shortfall.

New Delhi’s law enforcement agencies adopted the technology in 2018, and it’s also being used to police large events and fight crime in a handful of other states, including Andhra Pradesh and Punjab.

But India’s government now has a much more ambitious plan. It wants to construct one of the world’s largest facial recognition systems. The project envisions a future in which police from across the country’s 29 states and seven union territories would have access to a single, centralized database.

National database

The daunting scope of the proposed network is laid out in a detailed 172-page document published by the National Crime Records Bureau, which requests bids from companies to build the project. Interested parties had until October 11 to submit their proposal.

Currently unnamed, the project would match images from the country’s growing network of CCTV cameras against a database encompassing mug shots of criminals, passport photos and images collected by agencies such as the Ministry of Women and Child Development.

The platform would also enable searches based on photos uploaded from newspapers, images sent in by the public or artist sketches of suspected criminals. It would also recognize faces on closed-circuit cameras and “generate alerts if a blacklist match is found,” according to the tender document.

Security forces would be equipped with hand-held mobile devices enabling them to capture a face in the field and search it instantly against the national database, through a dedicated app.

The new facial recognition platform “can play a very vital role in improving outcomes” when it comes to identifying criminals, missing persons and bodies, according to the document published by the National Crime Records Bureau. It will also help police forces “detect crime patterns” and aid in crime prevention, it adds.

India’s crime rate is high, particularly within the poor areas dotting urban centers. In 2016, there were 709.1 offenses per 100,000 people in 19 big cities, compared to the national average of 379.3, according to the most recent official figures.

A foreign company

It is not known how many companies have submitted bids to install India’s national facial recognition system, nor how long the government will take to consider their applications.

About 80 representatives of vendors took part in a pre-bid meeting, which took place in the National Crime Records Bureau’s Delhi office at the end of July, according to minutes of the meeting seen by CNN. They discussed how the national database would be integrated with local police platforms and whether it should be able to identify people who have had plastic surgery.

“To be eligible to bid, a company has to have completed at least three facial recognition projects globally,” explains Apar Gupta of the Internet Freedom Foundation, an NGO which has put forward a legal notice to cancel the call for bids. “This disqualifies most Indian companies.”

The successful bidder will most likely be a consortium made up of a foreign company and a local partner — another requirement featured is for at least one of the bidding parties to be based in India.

IBM, Hewlett-Packard Enterprise and Accenture have all shown interest, according to Sivarama Krishnan, who leads cybersecurity at PricewaterhouseCoopers India. CNN reached out to all three companies, but none of them were willing to comment.

Having a foreign company set up such a critical part of India’s security apparatus could raise “national security issues,” worries Gupta.

In 2018, a controversy erupted when Ajay Maken, an opposition politician in New Delhi, accused the local government of having awarded a contract, through an Indian company, to provide nearly half of the CCTV cameras it plans to install in the capital to Prama Hikvision, a joint venture between Chinese company Hikvision and Indian company Prama Technologies, citing the risk for espionage.

Ashish P. Dhakan, Prama Hikvision’s CEO, confirmed that the company was supplying more than 140,000 CCTV cameras to New Delhi and has started installing them earlier this year.

“There is no evidence anywhere in the world, including India, to indicate that Hikvision’s products are used for unauthorized collection of information,” he told CNN. Hikvision has never conducted, nor will it conduct, any espionage-related activities for any government in the world.”

It is not the company’s only project in India. In 2018, Hikvision completed a network of surveillance cameras and command and control centers in Deesa City, Gujarat, according to a press release. In early October, it inaugurated India’s largest CCTV factory near Mumbai, with more than 2,000 employees. It describes itself a “market leader” in India for video surveillance solutions.

Hikvision has come under increasing scrutiny in the United States. In early October, it was included on a blacklist of 28 Chinese companies and government offices essentially barred from buying US products or importing American technology over their alleged role in facilitating human rights abuses in China’s Xinjiang region.

‘Technologically challenging’

Experts doubt whether India can carry off such an ambitious project in such a short time. The system is expected to go live less than eight months after the contract is signed, according to the call for bids.

“A more realistic time frame would be 12 to 18 months,” says Krishnan, who describes the project as “technologically challenging.”

Creating the centralized platform will not be the hardest part. “India already has a national database with photos of all the criminals prosecuted in the country, which is regularly updated by law enforcement agencies in the states,” he explains. “It will just need to be linked up to the country’s CCTV system.” A pilot project carried out in New Delhi proved this was feasible, Krishnan says.

Blanketing the country with enough surveillance cameras — especially advanced ones equipped with facial recognition technology — will be a much bigger challenge, he believes. India lags behind other countries in terms of installed security cameras.

New Delhi has 10 CCTV cameras per 1,000 people, compared with 113 in Shanghai and 68 in London, according to data compiled by consumer website Comparitech. The figure is far lower in India’s rural areas, home to 66% of the country’s population.

“Many villages in the countryside don’t have a single surveillance camera,” says Krishnan.

But the country is catching up fast. New Delhi is about to have 330,000 new cameras installed, said the deputy chief minister of the capital, Manish Sisodia, in July as he kickstarted the process. The project has been touted as a way to improve women’s safety in India’s largest city, which in recent years has been the site of a number of high profile sexual attacks.

Facial recognition cameras were recently introduced in Bangalore airport and are being trialed in Hyderabad airport, according to Reuters. New Delhi airport also recently started using the technology to speed up security checks.

“A dozen of India’s largest cities are now pretty extensively covered, and 24 more are in the process of expanding their CCTV capabilities,” says Krishnan. He adds that most railway stations are now also equipped with surveillance cameras, and the government plans to have them all covered by 2021.

“This is meaningful in India: most citizens will at some point in their life walk through a railway station,” he said.

No legal safeguards

For privacy advocates, this is worrying. “India does not have a data protection law,” says Gupta. “It is also not planning to adopt a specific legal framework for the new facial recognition system, which means it will essentially be devoid of safeguards.”

He worries India’s facial recognition system could become a tool of social policing, used to punish petty offenses such as public littering or to control the whereabouts of ethnic minorities.

Further down the line, it might even be linked up to Aadhaar, India’s vast biometric database, which contains the personal details of 1.2 billion Indian citizens, enabling India to set up “a total, permanent surveillance state,” he adds.

CNN reached out to the National Crime Records Bureau but did not receive a response.

India has a history of privacy issues. In 2017, India’s Supreme Court issued a landmark ruling, decreeing that a right to privacy is part of the fundamental rights enshrined in the country’s constitution.

The ruling paved the way for the draft Personal Data Protection Bill, which was presented to government last year but hasn’t been introduced to Parliament yet.

Rights activists had argued that fingerprints and retinal scans collected under Aadhaar violated an individual’s right to privacy.

Their fears about an invasion of privacy appeared to be confirmed in early 2018 when Aadhaar suffered an alleged breach after reporters said they were able to buy access to citizens’ personal details for as little as $8.

Seeking to temper criticism of its prized new program, the government added new security measures. Later that year, in a separate ruling, the Supreme Court found the database did not violate the right to privacy.

The court did, however, introduce new restrictions on how Aadhaar information could be used, including measures preventing corporate bodies from demanding data.

Caught between the need to improve its policing outcomes and to protect its citizen’s privacy, India will be walking a tightrope when it comes to building its national facial recognition database.