Face for sale: Leaks and lawsuits blight Russia facial recognition

When Anna Kuznetsova saw an ad offering access to Moscow's face recognition cameras, all she had to do was pay 16,000 roubles ($200) and send a photo of the person she wanted spying on.

The 20-year-old - who was acting as a volunteer for a digital rights group investigating leaks in Moscow's pervasive surveillance system - sent over a picture of herself and waited. 

Two days later and her phone buzzed. 

The seller had forwarded the paralegal a detailed list of all the addresses in the Russian capital where she had been spotted by cameras over the previous month, her lawyers said. 

"It was really incredible," said Sarkis Darbinyan, a lawyer for Roskomsvoboda, the group behind the investigation. "We got a report of all her movements in Moscow."

The incident is now under police investigation. 

Far from an aberration, the incident is at the centre of one of several lawsuits brought in recent months by rights activists against the Russian authorities over their use of face recognition.

The rise of cloud computing and AI technologies have popularised the technology globally, with supporters saying it promises greater security and efficiency. 

But the backlash is growing, too, as critics say benefits come at the cost of lost privacy and increased surveillance. 

Stalkers and burglars

With more than 105,000 cameras, Moscow boasts one of the world's most comprehensive surveillance systems. It became fully operational this year and authorities say it has cut crime and helped the city enforce coronavirus lockdown restrictions. 

But rights activists say cameras have been used to monitor political rallies and a lack of clear rules allows for abuse.

Kuznetsova replied to one of several ads offering facial recognition records on Telegram, a popular messaging app, according to her lawyer Ekaterina Abashina, who also works for Roskomsvoboda. 

Then all it took were a couple of messages, with no questions asked about how the results would be used or by whom, said Abashina.

Kuznetsova was sent 79 snapshots that positively identified her in the city, alongside times and addresses.

Recurring locations gave a clear picture of her home, work and daily habits - handy for anyone with ill intent, be it a burglar or an abusive ex-partner, said Abashina. 

"Any crazy guy can stalk you using this; criminals can check when and where you go and steal from your apartment or hurt you ... anything can happen," she said.

Moscow's Department of Technology (DIT), which manages the surveillance program, said reports of illegal access to the system were rare and sent for investigation.

Neither the Investigative Committee, Russia's version of the FBI, nor the city police force, replied to requests for comment.

After the case became public, authorities placed two police officers under investigation for abuse of office and violation of privacy, according to local media, but rights activists said the incident is symptomatic of a far wider problem. 

Read more: Evan Greer: facial recognition is a uniquely dangerous form of surveillance

Surveillance state

Current regulations do not clearly define how and when police can access the cameras nor establish mechanisms for judicial or public oversight, said Darbinyan. 

"What we have right now is a system that doesn't have any kind of control," he said.

Kuznetsova and Roskomsvoboda have filed a suit seeking to pause facial recognition until clear rules are in place, as well as damages, with the case set to be heard in December.

They are not alone. 

In July, lawyer and activist Alena Popova and opposition politician Vladimir Milov filed a lawsuit with the European Court of Human Rights (ECHR) complaining facial recognition was used last year to monitor a rally.

Gathering demonstrators' data violated their right to privacy and freedom of assembly, Popova said, calling it a hallmark of "surveillance states". 

"With the help of this system, you can control the political opposition," said Popova, whose petition urging a nationwide ban on the technology garnered more than 100,000 signatures. 

The DIT said its recordings did not contain any personal data - only images. 

Law enforcement officers could apply to access the recordings and use the footage to identify someone by matching facial scans with pictures of wanted people, it said in an emailed statement.

"Giving access to others is illegal and a criminal offence. The DIT, together with the security forces, monitors the situation and, in cases of illegal access ... informs the law enforcement agencies," the department said.

The ECHR lawsuits follows a domestic complaint that was dismissed in March, when a Moscow court ruled the city's facial recognition system did not violate the privacy of its citizens.

More to come

Despite all the challenges, authorities plan to install still more cameras in Moscow and beyond, according to local media - prompting "serious concern" at Human Rights Watch.

Few in Moscow seem to agree. 

In a September survey by the Levada Centre, an independent Russian pollster, just 7% voiced concern about civil rights and democratic freedom.  With more than 105,000 cameras, Moscow boasts one of the world's most comprehensive surveillance systems.

In a September survey by the Levada Centre, an independent Russian pollster, just 7% voiced concern about civil rights and democratic freedom. 

A month earlier, it found about half of Muscovites approved of the technology, saying facial recognition helped fight crime.

"We are not Luddites, we understand that there can be a helpful use of this technology," said Darbinyan. 

"But still we need rules and guarantees, because there is no safe place in big cities right now." 

(Reporting by Umberto Bacchi @UmbertoBacchi, Editing by Lyndsay Griffiths. Thomson Reuters Foundation)