Romanian spies want to spot faces in a crowd - illegally, say human rights groups
Romania's intelligence service is about to build a system to identify people taking part in street protests or talking on Facebook or Skype, according to four local human-rights groups.
In an open letter published on Monday, the groups said the system would be capable of running facial recognition on three million people. It could also intercept online traffic without the consent of the users and will have unrestricted access to all public databases containing information about citizens.
The system, dubbed SII Analytics, "uses European funds to impinge on European rights", they said, describing the endeavour as a "Big Brother project".
However, a Romanian intelligence-service spokesman told ZDNet in an email: "The system does not collect new data. It only analyzes existing data, based on algorithms."
The intelligence service also said that SII Analytics is necessary to handle threats such as "terrorism, illegal migration, organized crime, all of which require a quick reaction" from the agency.
"The platform aims to considerably enhance the speed of searching information in already existent databases."
The local human-rights groups said the official purpose of the project, as listed in its description, is reducing waste in public payments, cutting fraud, preventing abuse, and providing more efficient governance.
They argue that European funds for the project were accessed to develop e-governance, which has nothing to do with facial recognition or tapping internet traffic. Also, the intelligence service has no competences in e-governance, the NGOs wrote.
They also said the platform's access to facial information on three million people would most likely be based on their ID and passport pictures, to which the intelligence agency already has access.
The project would allow intelligence operatives to find 100 people within 15 seconds, using face-recognition technology. It would also let them perform searches in the field on mobile devices.
The local human-rights groups described a scenario where an agent or a policeman would take pictures during a protest, and all those individuals would be identified immediately and fined.
They also fear that the system could eventually automatically aggregate pictures posted on Facebook and link them with those already in the state's databases.
The specs of the project also include four traffic access point (TAP) devices. They could, in theory, be used to record metadata, according to signatory the Association for Technology and Internet.
Another issue the human-rights groups draw attention to is related to database aggregation. They say agents could perform complex information searches across multiple platforms, such as those of the police, national health insurance organisation CNAS, or the ANAF revenue service. They would be able to find links between people, their income, the cars they own, and their phones.
That type of database aggregation is illegal, they said, bringing as an example the case Bara vs CNAS and ANAF. The European Court of Justice ruled that "a public entity cannot offer the data it collects to another public entity, on the basis that it might prove useful at some point".
The human-rights groups also fear that the system would not only be used to prevent terrorism, but that without oversight agents could use it for their own personal agendas.