What we know about Maryland’s controversial facial recognition database

When police had difficulty identifying the man whom they believed opened fire on a newsroom in Maryland, killing five people, they turned to one of the most controversial yet potent tools in the state’s law enforcement arsenal.

As The New York Times reports, Anne Arundel County Police Chief Timothy Altomare’s department failed to ID its suspect through fingerprinting. The department then sent a picture of the suspect to the Maryland Coordination and Analysis Center, which combed through one of the nation’s largest databases of mug shots and driver’s license photos in search of a match.

That database is the source of some debate. Maryland has some of the most aggressive facial recognition policies in the nation, according to a national report from Georgetown University’s Center on Privacy & Technology, and that practice is powered by one central system: a pool of face data known as the Maryland Image Repository System (MIRS).

For facial recognition searches, Maryland police have access to three million state mug shots, seven million state driver’s license photos and an additional 24.9 million mug shots from a national FBI database. The state’s practice of face recognition searches began in 2011, expanding in 2013 to incorporate the Maryland Motor Vehicle Administration’s existing driver’s license database. The Maryland Department of Public Safety and Correctional Services (DPSCS) describes MIRS “as a digitized mug shot book used by law enforcement agencies throughout Maryland in the furtherance of their law enforcement investigation duties.”

According to the Georgetown report, “It’s unclear if the [Maryland Department of Public Safety and Correctional Services] ‘scrubs’ its mug shot database to eliminate people who were never charged, had charges dropped or dismissed, or who were found innocent.”

In a letter to Maryland’s House Appropriations and Senate Budget and Taxation Committees in late 2017, DPSCS Secretary Stephen T. Moyer notes that the software “has drawn criticism over privacy concerns.” In that report, the state notes that images uploaded to MIRS are not stored in the database and that “the user’s search results are saved under their session and are not available to any other user.” DPSCS provides these details about the software:

MIRS is an off-the-shelf software program developed by Dataworks Plus. Images are uploaded into the system from MVA, DPSCS inmate case records, and mugshot photos sent into the DPSCS Criminal Justice System-Central Repository (CJIS-CR) from law enforcement agencies throughout the State at the time of an offender’s arrest and booking. Members of law enforcement are able to upload an image to MIRS and that image is compared to the images within the system to determine the highest probability that the uploaded image may relate to an MVA and/or DPSCS image within MIRS.

In the 2017 fiscal year, DPSCS paid DataWorks Plus $185,124.24 to maintain the database. The report declined to answer questions about how many users are authorized to access the MIRS system (estimates in The Baltimore Sun put it at between 6,000 and 7,000 individuals) and how many user logins had occurred since 2015, stating that it did not track or collect this information. On a question of what steps the department takes to mitigate privacy risks, DPSCS stated only that “the steps taken to protect citizen’s privacy are inherent in the photos that are uploaded into the system and the way that the system is accessed.”

In 2016, Maryland’s face recognition database came under new scrutiny after the ACLU accused the state of using MIRS without a warrant to identify protesters in Baltimore following the death of Freddie Gray.

Last year, Maryland House Bill 1065 proposed a task force to examine surveillance techniques used by law enforcement in the state. That bill made it out of the House but did not progress past the Senate Judicial Proceedings Committee. Another bill, known as the Face Recognition Act (HB 1148), would mandate auditing in the state to “ensure that face recognition is used only for legitimate law enforcement purposes” and would prohibit the use of Maryland’s face recognition system without a court order. That bill did not make it out of the House Judiciary Committee, though the ACLU intends to revisit it in 2018.