The UK's Home Office is building a "national facial matching service"

The UK Home Office plans to give police and immigration officers access to a “national facial matching service” in a move dubbed “dystopian.”

Plans for the “facial search” system were revealed in a government notice about an upcoming “technical integration workshop” for police IT teams.

"The Strategic Facial Matching (SFM) Project is delivering infrastructure, software services and data migration to create a new national facial matching service to be used for law enforcement purposes" it said.

The Home Office plans to build on the technical and operational frameworks that currently allow 35 police forces and immigration enforcement units to carry out mobile fingerprint scanning. 

The face search system will be delivered as an API interface to the Home Office’s existing, cloud-hosted “Biometrics Services Gateway” (BSG.) 

“The modality of face”

It said that such mobile biometric services could be “extended into the modality of face” by “exploiting the ubiquitous imaging capability now omnipresent in smartphones… Subsequent developments will be enabled by means of either a new BSG API or adaptations to an existing BSG API.”

This will allow officers to carry out the self-service identification of people in Britain via facial recognition, using a mobile application or device.

The government hopes to have a “minimum viable product” ready for Retrospective Facial Recognition (RFR) in Spring 2024 it said in a June 27  prior information notice, a statement describing a future opportunity. 

The Home Office also emphasised that police have “prioritised” the development of “Operator Initiated Facial Recognition (OIFR).

(Law enforcement contacts of The Stack have previously described extensive testing of retrospective facial recognition by individual forces, and the Metropolitan Police are public about already having completed a minimum viable product, but this is a joined-up national effort…) 

Cloud-hosted technologies...

When complete, the police facial search system will enable highly sensitive data to be shared via externally exposed APIs.

The facial search functionality will be served through the “BSG”, cooked up by the Home Office Biometrics (HOB) department. 

This gateway is “designed, built and managed in-house” and includes cloud hosting that is “a non-proprietary, adaptable and scalable internal interconnect between HOB systems, including but not limited to those which provide biometric storage and search” the notice revealed. 

It did not say where this is hosted but the Home Office is a significant AWS customer (it has spent £188 million with AWS via just one procurement framework, G-Cloud,  alone since 2020) and runs multiple containerised applications on EC2 via the department’s EBSA platform. 

AWS, notably, like other cloud providers, offers facial recognition via its "Rekognition" SaaS, which claims to be able to identify nine emotions: HAPPY | SAD | ANGRY | CONFUSED | DISGUSTED | SURPRISED | CALM | UNKNOWN | FEAR

See also: Home Office may put child abuse database on the cloud

HOB offers outward-looking APIs that provide connectivity to other systems including “users of biometrics services” in the Home Office. The examples given in the tender are HM Passports and Migration & Borders. 

Other agencies, including local police forces, can access the biometrics data, and “foreign government partners” can connect to carry out “international biometric exchange” under the so-called Prüm Convention.

In Britain, police and immigration already use a mobile fingerprint check service called HOB Strategic Mobile or Rapid Search, which delivers biometric data via a BSG API. The face match API is part of an upgrade to this service but represents a significantly more controversial step forward in the widespread deployment of facial recognition. 

Officials have carried out market engagement activity on the Strategic Facial Matching project and will now meet with “policing suppliers and/or in-house IT” at a technical integration workshop, which is intended to “provide a forum to walk through the updated interface documentation” and "enable the market to understand any necessary development and testing that may be required to support this interface in the future.”

Bureaucracy and biometrics… 

The UK’s independent biometrics commissioner (Professor Fraser Sampson, who described part of his job as deciding “whether or not facial recognition should become a cornerstone of policing in this country”) resigned in late 2023 in the face of legislation that would have abolished his role. The government then installed former Metropolitan Police Commander Tony Eastaugh as the new biometrics commissioner. 

In his last annual report, published in January 2024, Professor Sampson, flagged the “importance of meaningful oversight and regulation” amid “acceleration in the capability and reach of surveillance technologies.”

“This need for oversight is exemplified in the government’s ambition to embed facial recognition technology in UK law enforcement,” he wrote.

In his report, the outgoing commissioner fired several parting shots, complaining about bureaucracy that was far from the “Rolls Royce service I had expected” and also warned that “there is very little evidence of penetration testing when considering the cyber security of equipment.”

(Fraser in his 2022 annual report warned starkly: “We are morphing from a standard police surveillance model of humans looking for other humans to an automated, industrialised process… we are seeing facial recognition technology that can identify who you are with greater accuracy at a greater distance, and some which purports to read emotions, assess sexuality or even predict the likelihood of your being convicted of a criminal offence in the future. I remain unconvinced about some of those claims, but I do not think we are very far away from seeing some of those capabilities being relied upon in support of some significant decisions affecting individuals, their freedoms and their fate.”)

His replacement Eastaugh, a Home Office veteran with a central role in the government’s response to the politically sensitive issue of immigration enforcement, is now mostly focused on reviewing the police’s use of DNA samples – with no mention of facial recognition on his job description.

Regulation vs innovation

Sara Chitseko, Pre-Crime Programme Manager at Open Rights Group, told The Stack that legislation was urgently needed to protect privacy.

“We are seeing the expansion of facial recognition technology across public spaces from shops and concerts to train stations and protests.

“Despite the known discriminatory outcomes of such technology, the Home Office now wants to give power to individual police officers to scan our faces against a national database” she said.

“ This dystopian march into a surveillance state is happening without public or parliamentary scrutiny. We urgently need legislation to safeguard our privacy and restrict the use of this intrusive technology…”

How the UK safeguards biometric data

The Home Office did not issue an on-the-record comment.

Government officials said the Biometric Services Gateway only facilitates transactions between biometric data stores and does not store personal data itself. The use of facial recognition technology is governed by data protection, equality, and human rights laws, and published police policies. 

The government says that it can only be used for a policing purpose regarded as necessary, proportionate, and fair, with oversight from a number of regulators and other bodies, including the Biometrics and Surveillance Camera Commissioner, the Information Commissioner, HMICFRS and the Equality and Human Rights Commission.

 “The facial matching API substantially reuses the technical, commercial, and operational approach to provide mobile fingerprint identification services delivered by the Home Office Biometrics Programme in collaboration with police forces and industry partners. This has been in successful service with police forces for several years” an official said.

How is facial recognition used?

In the UK, the police deploy facial recognition technology in three ways. 

The first is Retrospective Facial Recognition (RFR), which is used after an event or incident as part of a criminal investigation to identify suspects via CCTV, mobile phone footage, dashcam or doorbell footage and social media. These images are compared against pictures of people who’ve been arrested before. This tech has been used to smash drug-running rings and catch serious criminals, including rapists and burglars.

Welcomed by law enforcement, it has nonetheless proved contentious. 

In a paper published in Modern Law Review in late 2023, Daragh Murray, Senior Lecturer in Law at London’s Queen Mary University, described RFR as a “surveillance capability that may fundamentally alter the balance of power between the state and its citizens.”

He wrote: “Retrospective facial recognition (RFR) marks a step change in police surveillance capability that has received surprisingly little attention… [Deployment] will give rise to a serious interference with a number of human rights and is likely to be the subject of legal challenge.”

Secondly, Live Facial Recognition (LFR) enables police to identify wanted people. The technology can pick faces out of live video footage of crowds and compare their images to a specific list of people wanted by the police. 

It has been used to arrest sex offenders at a football match and the Coronation of King Charles, when a wanted suspect was spotted,  identified and then sent back to prison for breaching the terms of his release.

The third and method of facial recognition is the previously mentioned Operator Initiated Facial Recognition , which the Home Office describes as a “mobile app that allows officers, after engaging with a person of interest, to photograph them and check their identity where they are not sure, without having to arrest them and taken them into custody. "

If you’ve got information about the government’s face match service or views you’d like to share, please contact our editor Jasper Hamill.