It is interesting that although we have been using facial recognition and two-factor authentication for smartphones and apps for quite some time, the technology garners opposition and even complete bans. However, physical identification from personal facial characteristics remains one of the best ways forward for secure access, especially in critical infrastructure and high-security applications. 

Privacy and equity concerns

Some facial recognition technologies learn in the field, collecting and storing information on physical characteristics that identify individuals. Systems without clearly defined parameters may have biases and high error rates, depending on how analytics are configured to gather information. With clearer images and greater detail, as well as the advent of artificial intelligence (A.I.) in video surveillance, systems can collect data with a granular level of detail—and that information needs to be protected.

Concerns over privacy and civil liberties as well as equity over gathered images have heightened, even as refined facial recognition systems roll out in mainstream public spaces. The Transportation Security Administration (TSA), a longtime proponent of facial recognition, has deployed biometrics scanners as an opt-out screening method at more than 80 locations, with plans to expand to more than 400 airports in the coming years. TSA says an individual’s photo is deleted after their identify is verified and that its technology follows standards developed by the International Organization for Standardization and privacy-­by-design principles that embed data protection into products and services in planning and creation. 

As installations of the second-­generation Credential Authentication Technology (CAT-2) by TSA were developing, Congress proposed a physical security industry-­opposed reauthorization bill for the Federal Aviation Administration (FAA) that sought to stop deployment at U.S. airports. (CAT-2 units take photos of passengers in real time.) The FAA Reauthorization Act of 2024, Securing Growth and Robust Leadership in Aviation Act, passed without the FRT amendment to pause use of the technology.

What integrators need to know

Darron Parker, executive vice president of sales for IDIS Americas, Coppell, Texas, said states such as Illinois and Texas have introduced specific regulations addressing the deployment of facial recognition technology. This, he said, is influencing how manufacturers develop their software and affecting what systems integrators can offer to customers.

“In Illinois, for example, legislation prohibits security software from having the ability to implement facial recognition. If a product has the capability, it must be disabled or removed entirely, even if it isn’t actively used,” he said. “This represents a shift in how manufacturers design their solutions and poses a challenge for integrators seeking to meet evolving legal requirements.”

Parker added that the FCC’s ban on future product authorizations from manufacturers such as Hikvision, City of Industry, Calif., and Chinese company Dahua Technology is reshaping the competitive landscape. Another development is the growing use of analytics engines to support compliance with regulations like Europe’s General Data Protection Regulation.

“For example, active privacy masking technology, which automatically anonymizes human images in real-time, has been introduced by several manufacturers, including IDIS Americas. This allows organizations to maintain CCTV coverage while ensuring compliance with privacy requirements,” Parker said.

Manufacturers are responding by developing technologies and software to alleviate potential biases and prioritize data protection. In addition to privacy by design, many are adhering to privacy by default, another level of data protection that automatically enables stringent privacy settings at system activation. They also avoid using field-trained analytics, which are susceptible to high error rates and the potential for low-quality or dirty data that leads to inaccuracies. Human programming avoids these pitfalls.

Technologies are encrypting and securely storing personally identifiable information, and manufacturers are identifying users using facial templates and data points instead of actual images. In addition, privacy can be protected by tools that digitally cloud the user’s identity while keeping core access control data in place.

Paulius Jurcys, an entrepreneur and senior lecturer at Vilnius University, argues that it’s time to rethink who really owns our data. He outlines a human-centric model where data is private by default and controlled by individuals, not platforms. 

“Ownership of data has become a central issue in the A.I. era. Public debates increasingly call for personal data to be recognized as personal property. Our data is a central pillar of our digital identity,” Jurcys said.

Security is about weighing the best options based on the risk, environment and the desired outcome, and, in high-security and increasingly hostile environments, facial recognition technology may be the best way to protect life and property. Facial recognition continues under scrutiny, but as the technology focuses on privacy and securing personal information, it will soon become a familiar face for robust physical security.

Jeerawut/stock.adobe.com