The rise and regulation of thermal facial recognition technology during the COVID-19 pandemic

As the current COVID-19 pandemic sweeps the globe and dramatically alters society, governments and corporations are turning to novel uses of biometric technologies to limit contagion and maintain economic opportunities. Technologies that may have once seemed like the province of science fiction—such as thermal facial recognition, remote fever detection, or smartphone-based immunity certificates—are now not only possible but also already in use. This raises important questions about the potential privacy implications of the widespread collection and use of such personal data. While multimodal biometric surveillance technologies such as these may prove useful in slowing the spread of SARS–CoV-2, we caution that the ability of governments and corporations to leverage these technologies will likely persist beyond the current public health emergency. Just as many of the privacy concessions made in the USA Patriot Act have become permanent since the emergency circumstances of September 11, 2001, the privacy-limiting technologies unleashed during this pandemic may well persist unless policies are enacted now to regulate their use and ensure responsible oversight. Recognizing that these emergent technologies may become entrenched long after this public health crisis subsides, we focus here on the case of fever checks and thermal facial recognition technology to illustrate the current state of the technology, existing policies related to its use, and suggestions for proactive policies to govern its deployment during and beyond the present pandemic. While SARS–CoV-2 (the virus that causes COVID-19) is particularly pernicious due to its high rate of asymptomatic transmission, identifying symptomatic individuals is nevertheless crucial to containing its spread.1 Among a growing list of COVID-19 symptoms, fever (defined as a body temperature above 100.4°F/38°C) is one of the tell–tale symptoms of infection.2 As the pandemic has gained momentum, government agencies and corporations are increasingly turning to fever checks as a mechanism for gauging the potential presence of SARS–CoV-2 among citizens, travelers, and employees. This includes using traditional thermometers as well as infrared cameras that assess internal temperature by measuring the energy emanating from the inner corner of the eye and running the data through a machine learning algorithm—technologies that have been used with limited success in previous pandemics.3 Such remote thermal detection would be particularly useful in situations where it is impractical to take individuals’ temperature (such as in a crowd), but existing studies cast doubt on the ability of these technologies to accurately and consistently measure core temperature.4 Fever check technologies are known to misidentify individuals under certain conditions that may elevate core temperature (such as through recent exercise) or lower it (such as having been in the cold for an extended time or having used medicine to mask a fever).5 Additionally, researchers considering the asymptomatic transmission of SARS–CoV-2 and its incubation period alongside data on the sensitivity of thermal scanning technology have estimated that 46 per cent of infected travelers may escape detection.6 Despite the potential inaccuracies and limitations of these technologies, they have been widely adopted for the purpose of detecting COVID-19 symptoms. While the Americans with Disabilities Act prohibits companies in the USA from requiring workers to submit to medical exams, the Equal Employment Opportunity Commission recently announced revised rules that permit employers to take workers’ temperatures regularly and withdraw employment offers if a newly hired worker received a COVID-19 diagnosis.7 Even before that announcement, Amazon had begun supplementing traditional thermometers with thermal cameras to monitor employees’ temperatures at several warehouse locations, as well as to check for fevers among employees and customers at their Whole Foods stores.8 Anyone flagged as febrile must undergo a second forehead thermometer check to verify temperature. At the time of this writing, other examples of mandatory fever checks have ranged from several cruise lines9 and grocery stores,10 to jails,11 co-working spaces,12 the White House,13 statewide employee testing,14 numerous cloud technology firms,15 hospitals,16 hotels,17 and some European borders.18 Liechtenstein has partnered with Swiss researchers to institute a voluntary campaign in which users’ wearable bracelet technology will collect temperature (as well as breathing and heart rate) data to monitor and curb coronavirus transmission.19 Emirates Airlines is even conducting blood tests (for SARS–CoV-2 antibodies), along with temperature and heart and respiratory rate monitoring, on prospective passengers prior to boarding.20 In China, which experienced the earliest wave of infections, state law enforcement agents have conducted temperature checks at highway checkpoints,21 and in some cases state officers have forcibly entered private residences to perform these checks.22 In South Korea, officials have begun conducting fever checks and limiting travel certificates to the USA only for those who registered a body temperature below 99.5°F/37.5°C.23 Thailand also recently employed fever-detecting cameras into its biometric border screening system to measure travelers’ temperatures and notify border officers of febrile individuals.24 Clearly, fever check technology—particularly remote fever detection—is becoming ubiquitous throughout the post-COVID-19 world. In such exceptional times, one could argue that fever checks offer substantial population health benefits with limited long-term impacts on personal privacy. Yet, several private companies have integrated thermal imaging with facial recognition technology. Despite the aforementioned limitations of thermal detection technology and known shortfalls of facial recognition technology,25 firms around the world are marketing such multimodal biometric technologies as effective tools for combating the pandemic. Collectively these companies’ claims, which have yet to be systematically evaluated in the empirical literature, suggest clear benefits of combining thermal detection with facial recognition capabilities to detect and track potentially infected individuals. For example, police in China are currently using devices from Hanwang Technology that claim to identify an individual’s name within a second upon detecting a temperature over 99.5°F/37.5°C.26 The company claims that the technology is 95 per cent accurate, even in a group of 30 individuals or among people wearing masks.27 China-based firms SenseTime and Sunell are also selling similar technology.28 Sunell recently unveiled a body temperature detection network camera that they assert is able to identify individuals, collect real-time biometric data, and trigger a warning system upon detecting an unusual temperature.29 Additionally, Chinese startup Rokid has developed multimodal biotechnology that includes thermal-imaging wearable glasses, a technology they are currently marketing to US hospitals and local municipalities.30 These smart glasses, which Rokid suggests can be paired with facial recognition software, use an infrared sensor that Rokid claims can detect temperatures of up to 200 people as far away as 3 m, and they are already being used in China in national parks, schools, and by national authorities.31 In Singapore, Ramco Innovation Lab is promoting its integrated thermal imaging and facial recognition technology to launch an attendance tracking system that will ostensibly enable organizations to track employees and visitors with elevated temperatures.32 This multimodal technology includes contact tracing that sends notifications to event attendees if any person exhibits COVID-19 symptoms and uses facial recognition to capture both an employee’s presence and their temperature. A visitors feature also sends notifications to management when anyone with an elevated temperature enters the premises.33 The company touts that this contactless tracking system can be integrated with sliding doors, kiosks, and turnstiles to mitigate SARS–CoV-2 exposure by restricting access based on temperature range and recommending testing of flagged individuals, and they will share contract-tracing data with health agencies if mandated by the government.34 Beyond Asia, Australia recently reached a deal with drone manufacturer Draganfly to develop ‘pandemic drones’ equipped with thermal recognition technology that they say can monitor temperatures, heart rates, and respiratory patterns, as well as sneezing and coughing in coronavirus hotspots.35 In the UK, Silent Sentinel is marketing a line of what they describe as highly sensitive, high-resolution fever detection cameras that can be deployed as a standalone system or part of a network to conduct precise temperature detection and profiling.36 In Italy, the government recently purchased kits from Beijing-based biotechnology company Polysense with optional integrated thermal facial recognition technology to monitor populations at airports, train stations, schools, shopping centers, and on public transportation to aid COVID-19 containment efforts.37 The Polysense devices also purport to offer optional biometric features, including infrared technology, the ability to store up to 65,000 facial images, and integrated gate and door access protocols.38 While studies suggest that multimodal biometric systems increase overall identification accuracy compared with individual component technologies, their deployment has been limited historically by cost constraints.39 As the examples listed above indicate, however, the rapid progression of the current coronavirus pandemic has sufficiently alarmed governments, corporations, and other institutions to justify aggressive investment in such technologies. Within this emergency context, it may seem reasonable to integrate thermal scanning with facial recognition technology as an effective and efficient means to identify and track infected individuals.40 We argue, however, that the emergence of this type of multimodal biometric system blurs the lines between ‘over-the-skin’ and ‘under-the-skin’ surveillance in ways that demand closer scrutiny and potential regulation. While traditional biometrics such as fingerprinting have relied on external features, thermal facial recognition offers a physically unobtrusive way to obtain both external and internal biometric information purely via external scan.41 Thus, the privacy it thermal facial recognition may be as a technology, as it is and other of biometric data a blood or for or or temperature This a biometric that be now on a once the technology is already In the the of novel multimodal biometric surveillance may be as a to health and by to contagion and the of such data the personal information it may for and suggests the for responsible at this We suggest a to what thermal facial recognition technology to it accurately and it can be deployed and Just as the use of for pandemic tracing can personal and health information about individuals, the of individuals’ temperatures could private health information based on body temperature over time or and that to identifying in ways that are as this technology to This is the of biometric technologies. We currently not the of information that can be using data by these technologies. suggests that in data may for these data to be used in a that increasingly and such caution as they are clear are in it is likely that data and law enforcement agencies could use such data to information about health conditions or in ways that may individuals’ Even if temperature is limited to a such as to a grocery or train in the of an immunity questions about the and accuracy of some thermal detection technologies and their with multimodal biometric surveillance While some firms claim an ability to between in body temperature by by is that such are or will be in system the US and would regulate thermal detection devices for medical use, but the recently announced that it to to the and use of systems for body temperature for use where such devices not an in of the public health emergency While the that remote temperature devices only be used on one at a time in with a temperature this is as a a inaccuracies may individuals who are flagged to or and may have for In the event that individuals’ health are in the of multimodal immunity such could be in In the have that the collection and use of biometric information by that could as a for multimodal biometric technologies during and beyond the present pandemic. with the of and have that the use of thermal and facial information for fever the of of these not to the collection of thermal facial data for Among such the is Act which the use, and of biometric information by to from individuals prior to scanning for biometric information and a of the employed to the biometric The law also a of for individuals biometric information or used in of the of the such individuals the of biometric information in includes any of capture that on biometric such as facial or eye this law would regulate any technologies that use facial recognition technology to capture the temperature of a facial would ostensibly the aforementioned thermal facial recognition systems deployed by governments using from companies like Sunell and however, this of is limited to For example, that by to biometric information within a certain this not In to the of an biometric information privacy law in the collection of biometric information through an of the Act which privacy on the use of personal information by that have at in have personal data on at individuals, or of their from the of personal data. In the of personal information to biometric which includes any that can be with other identifying data to individual such as health data and facial which are would within the of this The law to of which of their personal information are to collection and the of collection prior to the time of also have the to of the and of access to any information from and of any such have the to of the of their personal the includes any of personal information from the to a for may this to share thermal information from fever which likely the recent of smart thermometer data for and the of fever tracking While the a private of for certain of the the of this is the by have a private of only if of their personal information are to access due to to use reasonable The of personal information not biometric individuals with private upon the of their facial or thermal it is the of the to about for other of the may to a range of information from fever checks due to its of data in to facial data, it enforcement to Beyond a of policies have some to regulate multimodal biometric surveillance in ways that may the use of thermal facial recognition technology during the COVID-19 pandemic. For example, that thermal recognition technologies are to of and through the Commission Act of the Act or or in or where an includes any that causes substantial to a and a includes any or that is likely to a While is to govern the collection or use of thermal is substantial to of personal information The has numerous companies that the collection and use of their personal information or the privacy of their personal the has privacy such as the use of or for to privacy within the the has also begun such as privacy that to and information the use of to regulate collect and use other of personal the could use this law to ensure that companies their policies for the collection and use of thermal information to and the thermal information from Additionally, may offer to regulate the use of fever checks or facial recognition technologies. While the aforementioned in Equal Employment Opportunity Commission have employers to for COVID-19 in their the Americans with Disabilities Act from employees based on this studies have that facial recognition Such such as or may be in such as employment and The of and has for such fever detection systems are to have these similar may to their use. The public use of facial recognition technology also a to about privacy under the have that individuals have reasonable of privacy once they have entered the public and that in not a under the that to as even in an to the is under the that if to their it is not to use thermal facial recognition to track While the the of privacy to in have that its to privacy by surveillance technologies may not this In the that it had from the that not a in the the that the of a upon is from the of a upon The in that the collection of public data through information had implications for individual that and and the and of its not it any of that previous cases about surveillance have been they not focus on and that the of surveillance for of novel have also that surveillance and ways in which the of surveillance that facial recognition technology may to of and and they these into may such Additionally, the of at privacy in public a of public privacy that is under the and by existing Such are particularly important for individuals and who may be by technologies, including and At the access to thermal detection information by may also be to under the Act of the of to a to and other for individual into of or by a US can be to for access to medical and health may thermal data if they within such the current pandemic a public health requiring rapid by state governments to As of of and the government have for this time of to can or even this have public health emergency that and to to emergency These range from and restricting of to limiting and In some public health emergency the to to an effective to a emergency. have this to rules to centers, to of to to and Additionally, public health emergency enable the to or during a emergency. In permit the to or during an In are to or both and that with an effective to an like and permit to and during The substantial by public health emergency has been effective in the For example, during the of a public health emergency and state and that from As a able to particularly to Despite their it is that are clear for emergency under state public health emergency For emergency after a public health emergency the can the for time of on the In and is time only the can the emergency As a these the that be in to the pandemic. At the the for and in to its in the collection and use of personal such as biometric through the This to develop national privacy that for the collection and use of personal The has several as a for for national policies but to such with a national privacy The limitations on the collection and use of personal policies for individuals, of data of privacy management and and Despite in the the USA a national privacy and not with these As we and to use multimodal biometric technology like thermal facial recognition to pandemic are a of we can take to its public health potential limiting its on individuals’ privacy. The is to thermal detection is an and effective way of containing spread and if it is to facial recognition technology with thermal detection on the it may be to the purpose of biometric data collection and the to which they will be and the technology these what will we measure the accuracy and of such technologies to the at tracing contagion through a population in to such data be used purely on a to detect the presence of the after the emergency has and will we when that data will be will they be by and for As we such questions during the present we can upon existing to policies that will multimodal biometric technology for the of of these technologies clear to the public and to the agencies and companies their technology they have devices to to privacy in the Additionally, we can to the the Commission Act and that with the information and European These clear to individuals when and facial recognition data are being and data management that individuals are and what the and benefits may be to that use limitations and data data and regularly the of the accuracy and of any and a for and for individuals data are around technology and use currently and we to such before these technologies become entrenched in the world. At as multimodal biometric technologies in the unusual of this it to be thermal detection is an and effective way of containing spread and it is to facial recognition technology with thermal detection A recent by the the for of temperature screening technologies and that those must be deployed in a and optional This that to could existing by to public and access by requiring a of health on the that temperature in public are an effective mechanism for containing that remote thermal detection is to assess the presence of febrile individuals in public and that may prove effective in identifying and infected individuals from public is it to such information to personal through facial is the of tracking an individual’s if contact tracing is already in or public health officials that facial recognition technology with thermal detection is to virus transmission, testing assess the accuracy and of of its component facial recognition, fever detection, infrared before it of such technologies also the to which they have privacy into the of the technology example, by limiting the of data to be and and over data companies biometric data be about the in which they to collect data during an also offer for Just as of the a to of multimodal biometric collection be that or personal data will be We also that notify when thermal recognition technology is in use. in that individuals that biometric data are being with of what will be and for long the data will be the thermal recognition technology used by the facial recognition or information beyond the of collection and temperature the that on public and to through the facial recognition technology or a fever a fever check not an on the as that will the of Additionally, the aforementioned or voluntary mandatory checks on the that voluntary to are effective mandatory that anyone temperature access to or (such as for benefits or in be some other means of that or For companies using thermal facial recognition technology to monitor employee health and employees undergo a that long their biometric data will be and what policies are in it is that they are beyond the for a temperature. For example, will the employee have the to the or be a fever will they be to a testing will they be for companies using thermal facial recognition thermal cameras alongside a contact tracing such as the Ramco technology be data in to the privacy of the of fever detection not identifying Beyond however, the of biometric data privacy that biotechnology companies by on of of of for companies to be by what a not and that in a companies and thermal facial recognition technology can now through of the capabilities of the technology in a way that is to of Additionally, to we of individuals’ temperature over thermal recognition technology to be integrated with other multimodal biometric technologies, such as that collect and share health information with government data must be in as the of immunity certificates suggests the ability to the post-COVID-19 we to which biometric data are and effective for they will be used and in and beyond the and what we can to ensure are in Despite that thermal imaging technology is at present to the spread of SARS–CoV-2 any similar governments and firms around the world are widely it as part of a multimodal biometric surveillance to curb the pandemic. We not the of the present to the of technologies that will have privacy implications once they become is at this when the technologies are and we these privacy and demand and We be that governments and corporations may use these technologies to collect temperature and other biometric data alongside other personal like is the time to technologies with privacy in alongside proactive and for the As governments in the USA and to under economic and public the demand for detection and contact tracing systems will to the public and private have to these and to curb the spread of In a by such technologies like thermal facial recognition will to in a high of of and and proactive many of the to information is and may be We are to the for and also from the