BIS Considering New Export Restrictions on Facial Recognition Devices and Other Biometric Surveillance Equipment

On July 17, 2020, the US Department of Commerce, Bureau of Industry & Security (“BIS”), published a Notice of Inquiry (“Notice”)¹ seeking public comments on potential changes to items controlled for crime control and detection (“CC”) reasons under the Export Administration Regulations (“EAR”)² and the related licensing requirements. Among other possible changes, BIS may expand export licensing requirements for devices, software and technology related to facial recognition and biometric systems. The Notice has significant implications for businesses engaged in industries related to biometrics, as it involves emerging and advanced technologies having important commercial applications. Comments in response to the Notice are due by September 15, 2020.

Background on Increased Scrutiny of Crime Control Technologies

The latest Notice is part of a long-anticipated effort by the Commerce Department to update its controls to address advanced technologies and products used for “surveillance, detection and censorship.”

BIS has long maintained licensing requirements on goods, software and technology based on foreign policy reasons grounded in human rights concerns under the EAR.³ These controls have long applied to items listed on the Commerce Control List (“CCL”) and controlled for CC reasons (“CC items”), including crowd control and protective equipment of various kinds, various “implements of torture,” protective equipment and limited categories of biometric equipment such as fingerprint analyzers, and related software and technology.

However, BIS’s last comprehensive review of items controlled for CC reasons was in 2008. In the intervening years, there have been a number of calls to impose new export controls, but under US and EU laws and through other multilateral mechanisms, on emerging technologies used in surveillance and CC based on foreign policy and human rights grounds. This has included an increased focus on advanced and emerging technologies, including mass surveillance systems, advanced biometric analysis systems, and related software and technology. In response to bipartisan congressional inquiries regarding continued licensing of such products in contexts that raise increasing human rights concerns, Commerce Department officials have made a number of statements in recent years indicating an intention to update controls.

The Notice indicates BIS’s intent to update the list of CC items on the CCL and amend the related licensing requirements. As a result, new items may be added to the control list, and licensing requirements applicable to existing items may be expanded to cover new destinations.

US export controls on CC items apply to most destinations,⁴ although the Notice provides several indications that BIS has particular concerns with respect to China. Notably, BIS specifically notes that, in addition to law enforcement and public safety uses, crowd scanning technology can be used in ways that “facilitate the abuse of human rights” and cites China as an example.⁵

Request for Comments

BIS is seeking public comments, including from industry and trade organizations, non-governmental organizations, government agencies and academia, on CC items that may be considered for new licensing requirements.

In particular, BIS is seeking comments on its proposal to add the following items to the CCL to be controlled for CC reasons:

1. Facial recognition and other biometric systems;
2. Non-lethal visual disruption lasers (“dazzlers”), which are non-lethal weapons using a laser to illuminate and temporarily disable sensors or human vision with flash blindness; and
3. Long-range acoustic devices, which are acoustic hailing devices used to send messages and warning tones over longer distances or at higher volumes than normal loudspeakers.

The new controls may extend to components, software and technologies related to the above-mentioned items. These items are mostly EAR 99 items now, meaning they are not on the CCL and hence are not controlled for most destinations, including China. BIS is also seeking public comments regarding certain items that are already controlled for CC reasons,⁶ for which continuation, removal or scope modification may be requested through this process.

Regarding these potential changes to the CCL, BIS is seeking input on (1) performance criteria and other information that may distinguish purely or predominantly consumer or commercial applications from those purely or predominantly used by law enforcement or security services and/or for government activities raising human right concerns; (2) the impact of adding to, modifying or removing items from the CCL on US support of human rights throughout the world; and (3) the impact that changes of controls would have on the competitiveness of US business and industry.⁷

As facial recognition and other biometric systems for surveillance appear to be a key focus of the Notice, below we discuss the relevant parts of the Notice in detail.

Facial Recognition Systems

According to the Notice, a facial recognition system identifies or verifies a person’s identity from a digital image or a video frame by comparing selected facial features from an input image to the features of faces stored in a database. The main components of a facial recognition system include (1) input cameras, (2) data storage, (3) processing computers and (4) the software algorithms needed to model facial images. After noting that commercial applications of facial recognition have gained “widespread user acceptance,”⁸ BIS further explains that facial recognition is increasingly being used in crowd-scanning systems, not only for law enforcement and public safety-related reasons but also to facilitate the abuse of human rights.

Regarding the scope of future control, the Notice broadly references “facial recognition devices,” “input components,” “software” and “technology.” Among other things, BIS has indicated a particular interest in the following items: (1) “facial recognition software” and (2) high-resolution cameras that provide inputs to a crowd surveillance system. These cameras are currently classified as EAR99, and BIS is interested in the implications of placing them under new controls, the appropriate technical criteria for controls and other criteria that would help differentiate between police and intelligence end uses versus commercial end uses.

Other Biometric Systems

According to the Notice, items related to two biometric technologies are currently controlled on the CCL—fingerprint and voice print. To expand the existing controls, BIS is considering two alternative methods: (1) add other specific biometric technologies, which would require a “piecemeal review of biometric methods and products,” or (2) extend controls to all biometric systems, subject to the limitation that “only those types of systems that identify a person without the individual’s cooperation, conscious interaction or possibly even awareness.”⁹

Under the ”piecemeal” approach, BIS would continue to identify methods and products that warrant control based on technical criteria. BIS seeks input from industry on what additional technologies (e.g., iris, vein, earlobe, gait and heartbeat technologies) warrant control, which specific technical criteria should be considered in establishing controls and what impact such controls would have on US industry competitiveness and leadership. Interested parties could consider whether there are potential differences between these technologies as to commercial versus governmental uses.

Under the more comprehensive approach, the Notice indicates BIS is considering extending controls to all biometric systems to the extent they identify a person without the individual’s cooperation, conscious interaction or awareness. BIS cites as examples a closed circuit camera running facial recognition software or a surreptitious audio monitoring of public space. BIS also noted that, under this approach, the new control would not apply to systems that verify whether the person attempting to gain access to premises or devices has the authority to do so. Similarly, fingerprint, iris and voice authentication items may not be controlled based on their specific commercial applications. BIS is seeking input as to whether the comprehensive approach would be superior to “targeting individual modalities, and if so, what specific technical criteria would be appropriate.”¹⁰

Key Considerations for Business

The Notice has significant implications for businesses in the relevant fields. Even though the Notice refers explicitly to China, CC controls have much broader application, and there is no indication that any new control would be limited to transactions involving that country. In addition, as acknowledged by BIS, many items being considered for control have widely accepted commercial applications. Potentially impacted businesses should consider submitting comments to BIS before the comment period closes.