Facial recognition software, an invasive Covid-19 tracing app, linking biometric data like fingerprints and DNA – the wish-list of the Slovenian police is long. At the nineth stop of our AlgoRail through Europe, Lenart J. Kučić reports how the police has continuously increased its power by overstepping its limits and having it legalized afterwards.

When Slovenian civil society activists and privacy experts read the 2019 AlgorithmWatch report on face recognition in the EU, they were surprised to find Slovenia listed among the countries where the police use face recognition.

The police had been using a piece of face-recognition software called Face Trace to find suspects using open source investigation methods (such as searching social media and other online sources). A tabloid article relating to such a practice was published in December 2015 – four years ahead of the AlgorithmWatch report on face recognition. After a thorough research of the Slovenian media archives for this feature, I found one even earlier mention of Face Trace, where a journalist talked to the police operator who was responsible for face recognition in 2014.

Encounter in police database

There are many examples of the usage of facial recognition by the police. In January 2017 a woman contacted a journalist writing for the national television website MMC. She was stopped by the traffic police. She did not carry her ID and the police officer brought her to his car to confirm her identity on the police computer. She gave her personal information and her photos appeared on the screen. She expected to see her official photos but she also noticed photos that she only published on her personal Facebook profile.

The police declined to confirm or deny that they gathered pictures from social media profiles in their database of photographed persons. Their spokesperson then suggested to the journalist that the police officer may have also checked publicly available photos on the internet during the procedure. They claimed that everybody could access the information on social media and provided a lengthy legal argument on why a citizen must always carry a valid ID to avoid such police procedures and paying a fine.

It is possible to conclude that Slovenian police has been using a face recognition software since 2014. The police also confirmed to me that they use face recognition systems to compare, for example, police sketches to pictures in their database of photographed individuals. However, it is likely that faces from the police database of photographed individuals are used, too. This is important because the database could contain photos from personal social profiles and mass public events.

We are using conditionals because we do not know for certain what photographs the police actually keep in their database. Official answers provided by the police remained ambiguous during our investigation and the Information Commissioner has not yet decided to investigate the matter and evaluate the use and content of police databases (such an inspection is scheduled for this year, according to the Commissioner).

Hacking the law

In addition, the police is often allowed to interpret the legislation as it best suits their needs – without much opposition from the public, politicians, or privacy experts. “The police always follows the same pattern. First, their representatives dramatically demonstrate all the new threats to the public life: international terrorism and organized crime, migrant crisis, and online threats – from pedophilia to cyber attacks. Next, they express their frustrations and concerns because they cannot efficiently fight the bad guys who have all the latest tools and no legal restrictions on how to use them. So they wait for every opportunity to amend the existing legislation and expand their powers,” explained a public official who took part in several negotiation rounds with the police and requested anonymity.

The police always presents a very ambitious wish-list, our source said. Some claims are clearly not realistic and would never pass the legislative process: weakening the encryption on communication apps or using drones for mass surveillance. But they can be used in negotiations with the Information Commissioner and other privacy advocates. Fine, let us not touch the encryption, says the police. But we still need to amend the outdated law on duties and powers of the police and include, for example, biometrics. After biometrics is mentioned in the legislation the police can interpret this as a legal basis for using face recognition.

Such hacking of the legislative process by the police is not merely hypothetical. The Slovenian Information Commissioner confirmed that the police informed them about the use of face recognition software Face Trace back in 2014. The police claimed that the Commissioner agreed to their suggested uses of the product. But the Commissioner’s office actually issued several critical comments regarding the use of biometric methods and face recognition between 2015 and 2019. A new law on the duties and powers of the police, introduced in 2017, then allowed the police to use biometric and face recognition tools, and thus provided a legal framework for the use of the Face Trace software. The police is now allowed to automatically combine face recognition with other biometric data like fingerprints and DNA profiles.

No public pressure?

The police, nonetheless, did face some opposition. The Slovenian Human Rights ombudsman and the Information Commissioner filed a formal complaint to the constitutional court in 2017. They claimed that the new law on the duties and powers of the police legalized some excessive and inadmissible measures for gathering personal data without sufficient protection of citizens who have not been accused or suspected of any wrongdoings.

There are some problematic aspects regarding the implementation and use of Artificial Intelligence (AI), algorithms and automated decision-making systems (ADM) in Slovenia. During our research for the previous Automating Society report, very few civil society organizations or individuals addressed the social impacts of automation on society. In addition, conferences about AI are usually sponsored and organized by commercial companies and industry groups who want to promote their solutions. On top of that, NGOs are often underfunded and do not have enough staff to cover all relevant topics. Consequently, the police faces almost no opposition when handing in their “wish-list” to the government.

Authoritarian tendencies

Soon after the pandemic of Covid-19 broke, earlier this year, the Slovenian government started using the crisis as an excuse to expand police powers significantly.

The method was similar to previous attempts of legislation hacking. In March 2020, the Slovenian government proposed a first draft of the “Act on the intervention measures to mitigate the consequences of the communicable disease SARS-CoV-2 (Covid-19) for citizens and the economy”. The draft also included two articles that dramatically increased the powers of the police.

Article 103 suggested that police could – among other measures – use face recognition when stopping and identifying individuals, enter their houses or apartments, limit their movement as well as collect and process protected personal information. Article 104 suggested that the police could trace the location of mobile phones of individuals without a court warrant. All the suggested measures were introduced under an emergency procedure – without any consultations or public debates. The Information Commissioner thus described the anti-corona measures as an attempt to potentially “establish a police state”.

Article 104 was eventually removed from the amended act because of strong criticisms from the public and the opposition political parties. However, article 103 remained and the “Covid Act” was adopted in April 2020. Furthermore, the government insisted that contact tracing applications were necessary to help health officials stop the pandemic. They also suggested that citizens would have to install such an application when traveling across the country.

It takes many small steps to build a – partly automated – surveillance infrastructure. The Slovenian police has been consistently taking such steps and the “Covid Act” has most likely legalized most of the items on their “wish-list”, from face recognition to contact tracing.

That’s it for this ninth stop of our AlgoRail through Europe, on which we want to learn more about how algorithmic systems are used in our European neighborhood. Next week we are going to report from Switzerland.

This story was shortened by  Julia Gundlach. The unabridged story was  published on the AlgorithmWatch website.

The blog series AlgoRail is part of the Automating Society Report 2020 by Bertelsmann Stiftung and AlgorithmWatch, which will be published this fall and is coordinated by  Dr. Sarah Fischer. In addition to journalistic stories like this one, the report gives an overview of various examples of algorithmic systems as well as current debates, policy responses and key players in 15 countries.  A first issue of the report  was published in January 2019.

This text is licensed under a Creative Commons Attribution 4.0 International License