The Vermont Department of Motor Vehicles is violating a state law by maintaining a facial-recognition database of all driver's license photographs — one that it has made widely available to police, according to the American Civil Liberties Union of Vermont.
The ACLU is calling on the DMV to suspend the practice, which the civil rights group says flouts a law designed to safeguard Vermonters' privacy and is "subject to abuse" by law enforcement. The organization also plans to ask the legislature to launch an independent investigation of the DMV and to tie future funding to internal reforms.
"The DMV's use of facial-recognition software is illegal," ACLU staff attorney Jay Diaz said in an interview. "They're violating the public trust by not telling people up front that in order to get a driver's license, you've got to give up your privacy."
The department has amassed a database of 2.7 million images of people who applied for a driver's license or another ID. DMV Commissioner Robert Ide said that facial-recognition technology, which uses software to compare photos for matches, has assisted in at least 25 fraud or identity theft cases.
"We think we are very responsible custodians," Ide said. Vermonters "should have absolute confidence in how we are accepting and carrying through our responsibility."
The commissioner, who took office in 2009, told Seven Days he was unaware of a 2004 state law that specifies the DMV "shall not implement any ... processes for identifying applicants for licenses, learner permits, or non-driver identification cards that involve the use of biometric identifiers." Lawmakers at the time were concerned about the DMV using Big Brother-type technologies, including facial recognition, House Transportation Committee recordings show.
Ide referred legal questions to Assistant Attorney General Tom McCormick, who said that at some point a "determination was made" that the 2004 law does not prohibit the program. Asked to cite a law or a legal opinion to support that, McCormick did not provide anything.
"The software is not used to identify applicants," McCormick said of the people who get driver's licenses. "It is used to ensure that, within the universe of persons who possess licenses, permits or ID cards, there are no persons with multiple credentials."
Diaz said McCormick's explanation doesn't pass legal muster. "Even the most skilled lawyer can't argue with a straight face that they are not breaking the law," he said.
The DMV launched the program using $900,000 in federal grant money. The technology identifies individuals by examining facial features — such as the position of the eyes, the shape of cheekbones and size of the jaw — that cannot easily be altered and don't change with age. Every night, software scans images of the day's license applicants on the lookout for individuals with multiple identities. Most leads are benign — applicants might have changed their names, for example.
The DMV bills it as a tool to prevent criminals from obtaining driver's licenses under others' names. "DMV uses facial recognition to protect your identity," the webpage for the program reads.
When the program rolled out in December 2012, DMV director of operations Michael Smith told Seven Days that it would "not be used to identify people for other law enforcement purposes."
But DMV higher-ups debated, in that same year, whether to allow police to access the facial-recognition database, according to records obtained by the ACLU and reviewed by Seven Days.
"Personally, I think it seems like a good idea," DMV project manager Michael Charter wrote to colleagues. "However, this may be the one piece most likely to stir up the tinfoil-hat crowd."
The DMV went ahead. Glen Button, a since-retired DMV director, reached out to law enforcement in the same month the technology launched, saying it "may be of assistance to you during a criminal investigation ... Please contact staff in the DMV."
Cops have since used the DMV database at least 118 times, the records show. Users include Vermont State Police and local agencies in South Burlington, Burlington and Middlebury, along with the U.S. State Department, the Pennsylvania Criminal Intelligence Center and the Missouri Department of Revenue.
Police investigating cases involving burglary, drug dealing, possession of stolen property, retail theft and homicide have turned to the DMV. Typically, the department will run a suspect's photo, either from mug shots or surveillance images, through the system looking for matches.
That practice makes all Vermonters potential suspects in a virtual lineup, said Diaz. He also said, "It's really hard to see that this has all been about identity theft. The fact is, they lied about it."
The Vermont DMV is not alone. Government agencies have facial-recognition programs in at least 36 states, and, in all but three, lawmakers never voted to approve them. Bureaucrats foisted the technology on a largely unknowing public, according to The Perpetual Line-Up: Unregulated Police Face Recognition in America, an October report by Georgetown Law's Center on Privacy & Technology. Facial-recognition databases include images of more than 117 million Americans — nearly one in two adults.
That's an unprecedented encroachment into the privacy of citizens who have done nothing wrong, critics say. Only people who have been charged with crimes end up in fingerprint databases. In 2014, the Vermont Supreme Court ruled that you had to be convicted of a crime in order to be required to submit a DNA sample.
Several studies have shown that facial recognition software is less accurate than fingerprinting. A report coauthored by the Federal Bureau of Investigation noted that African Americans are more likely to be misidentified by the technology. The U.S. Government Accountability Office said in a 2016 report that the FBI has not studied whether systems used by its state partners are accurate. Most systems — including Vermont's — have never been audited to determine whether they are working properly.
"Misidentification is a real risk," one of the Georgetown report's authors, Clare Garvie, said in an interview.
Police could eventually use facial-recognition databases to identify people they see in live video surveillance, she said. Six government agencies, including the Los Angeles Police Department and transit authorities in Chicago and Dallas, have either bought or expressed interest in software with that capability, Garvie said.
The Georgetown center recommends requiring law enforcement agencies to obtain a search warrant to access databases. The Vermont DMV does not mandate that practice.
In fact, it was the center's report that revealed the Vermont DMV is sharing images with the FBI. Documents the ACLU subsequently unearthed show that the DMV's collaboration with law enforcement is more extensive.
The DMV says it has tight protocols for access. A cop has to document a case on a form, and DMV staff screen requests. The DMV then forwards info about any matches to police.
"It is a highly controlled atmosphere," Ide said. "The process to document a request and to check the request and to do the actual run does not happen quickly."
Yet it appears that lawmakers once went out of their way to ensure that the DMV had no such capability.
The language barring the agency from using "biometric identifiers" was tacked onto a 2004 bill that required photos on all driver's licenses. Vermont was the last state to give up the photo-free paper variety, yielding to post-9/11 pressure to upgrade security measures.
The biometrics provision appears to have attracted little attention outside of hearings held by the House Transportation Committee. But the committee's discussion made clear that officials involved were worried about technology such as facial recognition and retina scans.
"The main issue and question is, we're creating this electronic database of digital photos that can easily be put into a facial-recognition system," former state representative Steve Darrow, a Putney Democrat, said during a January 2004 committee meeting, according to a recording. "Does it really stay in Vermont? Can the feds come in and say, 'Hand it over; it's valuable?' You have to make sure you've got the loopholes closed."
Then-DMV commissioner Bonnie Rutledge, at the same hearing, told the committee that she took seriously the worries about future use of biometrics.
"We did draft up some language to be put in this bill that would require legislative approval if we ever went to anything that looked like biometrics," Rutledge said.
The law, meanwhile, appears to have been all but forgotten.
Ide said that no lawmakers or residents have ever complained to him about the facial-recognition program.
But East Montpelier resident David Tucker, 63, said he feels the DMV is violating his rights. Tucker visited the Montpelier branch to renew his license this year. He was mystified when a staff member told him to take off his eyeglasses to be photographed.
"I said, 'I wear these all the time,'" Tucker recalled. "He said, 'Yeah, but I need you to take them off; it makes the facial-recognition software work better.'"
Its existence was news to Tucker. After agreeing to pose sans glasses — he said he felt he had no choice — he began to research the program.
"The default should be that I have a right to privacy," Tucker said. "And in this day and age, that should include an image of my face or any other way they could identify me in some kind of random search."