Few people probably noticed the changes to one of the software features in Google Pack last month. Fewer still have considered the privacy implications.
Picasa, a photo management and sharing system, launched a facial recognition system. Users tag their photos, and the software searches through pictures to find the same people and place tags on them too.
Google, who owns Picasa, has had these capabilities for a couple years now since they acquired Neven Vision.
Theoretically a user could pick off other people's photos from Flickr or Facebook, upload them to their Picasa account and tag them, and then use it for surveillance purposes for shots in various other settings. Compatibility features with Flickr allow easier transfers of files.
Raeanne Young of the Center for Democracy and Technology asks,
What’s to stop a zealous prosecutor from searching the state’s digital database of driver’s license photos for people under 21 whose online Flickr photos show them engaged in underage drinking? What’s to stop an employer from doing the same with a photo taken by a video camera in the lobby of the building where you went for your job interview?
Business competitors could monitor the comings and goings of unknown clients at corporate offices, and gain intelligence about corporate strategy. Social advocacy groups or reporters could photograph protests, rallies, or public meetings, and scan the crowd instantly for persons of interest.
Users with less malicious intent could still create privacy issues if they remove the default settings and make their tags public. Child predators could potentially gather enough information with tags to pose a threat.
Picasa claims the service is only available in the United States, but I'm not sure how they would avoid international users registering using a concocted American location.
Law enforcement groups already use these techniques, but usually with some oversight and procedural restrictions. The most famous one here would be Passport Canada's Facial Recognition Project.
Aside from user misuse, there are privacy concerns for Google themselves.
Dave Jeyes at TechBlorge says,
The Privacy Policy says that you can opt out of the service, but they may keep offline backup copies in their archive. Google says that it never shares personally identifiable information, but what is more personal than your facial recognition profile, even if it isn’t attached to your name?
There are some limitations with Picasa's software. It's not entirely accurate, and usually works best when the target is facing the camera. But cell-phone cameras are so proliferative these days that acquiring appropriate photos is the least of challenges.
A writer at the Google Subnet Blog says,
The new tool does make it far easier to tag and organize photos (as anyone who has spent time labeling dozens of pictures after a recent vacation can attest). But it also adds to the huge amount of private information Google is privy to–not only does Google know your Web surfing (Chrome), e-mail (Gmail), and document-sharing (Apps) habits, as well as whether or not you've had time to mow your lawn (Google Earth), but now they know you and your friends' faces and names. It's pretty cool and pretty scary.
This is very frightening. Thanks for making me aware of this, Omar
The concerns noted above are precicely why I deleted it on noting that the software operated remotely. What I look at or reasearch is not as sacred to me as providing a visual record of my friends and family. Given our track record what we are assured is inviolate never is. Example 1) a drive with all U.S. Service personell was lost. 2 Credit card companies were using unsecured third parties to store data. etc.