The Population and Immigration Authority illegally shared in the past seven years the facial images of millions of Israelis with an unnamed government agency.
The actions of the Interior Ministry division were disclosed in an official report published last week by Roy Friedman, the head of the Israel National Cyber Directorate’s Identity and Biometric Applications Unit.
This practice began in 2015 and ended only in March, after Friedman learned of in a meeting with the population authority that included a representative of what the report refers to only as a “government agency.” Friedman wrote that a database of “reduced-quality” images is a biometric database for all intents and purposes, and that transferring this to another agency was an illegal contravention of the principles guiding Israel’s biometric identification project. Friedman said he will monitor the situation until the lapse is corrected.
Regarding the possession of a further biometric database containing facial photos, Friedman said that this conforms with the law, but that the issue has remained unresolved for more than two years. The cabinet was expected to discuss Sunday the extension of the national biometric database.
The law regulating the use of this database authorizes the population authority to retain reduced-resolution images for employee use. Since the law was passed, the technology has improved, and using low-quality images is now equivalent to using high-resolution ones. This was found by Friedman’s unit as well as by the Population and Immigration Authority, which now possesses a genuine biometric database.
Last May, the website of the business newspaper Calcalist reported that the population authority had set up a biometric database consisting of low-quality face scans, in violation of the law, but was trying to fix this.
The information about this database surfaced during monitoring by the Cyber Directorate’s Identity and Biometric Applications unit. The population authority told Friedman that the database was set up for the use of service providers at its offices. In three separate reports, Friedman demanded that the agency put things in order or shut down the database. The Population and Immigration Authority told him that service providers have a real need for these low-quality photos, which help them in carrying out their job, particularly when applicants come to one of their offices with no identifying documents.
- Israel Advances Use of Face-recognition Cameras in Public
- Don't Turn Israel Into a Surveillance State
- Why Every Democracy Should Fear Israeli Spyware
In preparing his current report, Friedman discovered that an additional database was set up, this time on the computers of border control agents. This database was also passed on to the “other agency” on a routine basis and kept there for seven years. The Interior Ministry division said it had stopped this transfer, and that the need to keep these photos in the border control system will be examined at a meeting with Friedman.
In a written statement to Haaretz, the division said that “Population and Immigration Authority professionals work daily with the head of the Biometrics Applications Unit,” referring to Friedman, “and this issue came up at one of their meetings. It was dealt with immediately.”
In January, in the course of Friedman’s examination of the border control apparatus, he was given documents outlining all the components of their database. He discovered that population authority staff keep lower quality biometric photos to identify passengers. Friedman criticized the agency, saying the practice was illegal and a system-wide solution must be found. He added that he had discovered that for several years, images of Israelis had been illegally shared with another agency as a routine part of border control. They were collected at that agency in huge numbers.
After Friedman notified the population authority of this violation, it announced in February that it was immediately desisting from transferring photos to that agency. In a meeting in March, the authority said that no other agency had received such photos from them or from the state agency. Friedman asked the authority to inform him of the extent and nature of the information that was transferred, as well as clarifying the mechanism of deletion of that information by the state agency.
Haaretz has learned that the other agency is not the Israel Police, which have denied receiving this database. The police have tried gaining access to this database on several occasions and are in possession of the photos of people with driving licenses. Their database contains personal and demographic information, as well as a photo, as well as photos of other permits. The cabinet approved last week a police request to set up biometric cameras in public spaces, for “the foiling and prevention of serious crime, or the prevention of bodily harm or property damage.” These cameras will be set up at the entrance to communities at the discretion of the police.
“We were promised that the collection of data was meant to prevent identity theft,” says Zvi Devir of the Digital Rights Movement. “We were told the information would not be transferred to any other agency. So they promised. Reports by the head of the Biometrics Applications Unit repeatedly prove how wrong the basic assumptions underlying this law are. It’s time we stopped cutting the Interior Ministry and the biometrics unit slack. In addition to the unregulated database held by the Population and Immigration Authority there are now two additional illegal ones, the one with photos of passengers and the ‘ghost’ one of that government agency, which has covertly copied the photos of people leaving or entering the country since 2015. The attorney general must intervene and demand the deletion of the illegal database of that agency immediately,” Devir said.
The final decision on extending the ordinance regulating the biometric database for another three years will be made by the Knesset. This means that Israel will continue to collect fingerprints, on a voluntary basis, until 2025, in contrast to the Interior Ministry’s declaration that this will be halted. The reason for the extension is that the state has not yet acquired the necessary facial recognition systems. A team that examined the extension of the ordinance concluded that a two-year extension was sufficient, but Interior Minister Ayelet Shaked and Interior Ministry Director General Yair Hirsh decided that three years were necessary. Friedman’s report last week says that when the current ordinance expires in June, all ID documents issued from then on will be valid for 10 years, with new fingerprints no longer kept in the database. His recommendations will be brought to a Knesset committee for approval, as well as to a joint committee convened to examine the issue before a Knesset vote is held.