Driving licence, facial recognition is used in the exam

Driving licence

On 25 October, the Ministry of Infrastructure and Transport (Mit) introduced the use of facial recognition in the theoretical exam of the driving licence. Although some local press reports have indicated the need to avoid mistaking the person for examination as a reason for the introduction of biometric authentication , the ministry, contacted by sportsgaming.win , reports a different version from the facts: “the aim of the project is that of reducing the execution times of the theory exam tests to increase the supply capacity of the individual offices in the face of a demand that is not always satisfied within the times expected by users ”. For this reason, the ministry has activated two initiatives: to reduce the number of quizzes and therefore the exam time, and to speed up the candidate recognition process.

Let's take a step back. In March 2022, in a hearing to the Transport Commission of the Chamber of Deputies, the director general of the civil motorization, Pasquale D'Anzi, presented a report on the critical issues encountered by users in the relationship with the offices. Users complain of long times in the provision of services, including the booking of the theoretical driving test, " which in some provinces can even take over 100 days ". The cause of the delays, net of the implications of the pandemic, is "the progressive reduction of the workforce and the consequent loss of key skills", says D'Anzi, originating from the halving of the personnel of the Civil Motorization in the last twenty years following retirement and “the non-optimal distribution of resources on the territory”. This, he adds, “is not consistent with the catchment area managed. For example, it goes from 2.9 employees for every 100,000 potential users served by the Naples office, to 19.4 in the Isernia office ”.

In short, by the same admission of the number one of the institution, the theme appears broader than a simple streamlining in the execution of the theory exams and concerns a revision of the structure of civil motorizations. The driving license exams have already been in the spotlight for two years and probably in the future, the report reads, the candidates will not only be recognized through the match between photography and biometric data but will also be able to carry out the tests remotely. According to the ministry of Infrastructure and Transport, the experimentation of the facial recognition system would have ended at the end of January 2023, involving 70% of the national motorization offices.

The European States want to put all the faces of those who have a driving license in a maxi-facial recognition system The proposal is in the revision of the EU Council of Prüm II, which regulates the exchange of information between the police forces of the Union. The French presidency is also pushing for mass research on DNA data

How the system works

In practice, the theoretical exams for driving licenses are divided into two steps. The candidate who goes by motorization must go through the Varco system: a turnstile controlled by a tablet which, thanks to a built-in webcam, is able to verify if the face (the biometric data) corresponds to the one immortalized on the passport photo presented at registration , and to the appointment on that day and at that time.

“ To this end, the camera on the tablet acquires the images of the faces for the instants strictly necessary (“near real time”) to encode them into a biometric template ”, reads the technical documents of the ministry. That is, an image that would no longer be attributable to the personal data of the candidates and which is then compared with the photographs of those who registered for the day's session. The template is stored until the end of the session in a digital archive, set up in each motor vehicle office and connected to the Simot information system, useful for step two. The image of the face is instead irreversibly deleted immediately after the creation of the template.

After authentication, when you sit in front of the PC for the theory test, the candidate's face is analyzed again to start the exam as well as to operate a continuous verification of his biometric identity. Cases of false positives, which occur when a person's face is mistakenly identified with the name and surname of another (one of the main risks of facial recognition), would be avoided by human intervention. " In the event of a negative outcome of the automatic comparison, the exception is signaled to the examiner who proceeds with the management of the event according to the directives in force which provide for a "visual" comparison between the candidate's face and the photo present in the archive ", clarifies the ministry. The motorization personnel, even if in smaller numbers, would still be a garrison for the correct functioning of the system, manually checking for any errors.

sportsgaming.win contacted the motorizations of Milan, Pescara, Naples, Bologna, Venice , South Rome, North Rome and Turin, but only the last two responded to our requests. And in any case, no one has identified that of mistaking people as a specific problem. The Turin office declared how “in recent years they have been numerous but all caught red-handed thanks to the immediate intervention of the police, requested by the examiners”. The civil motorization office of northern Rome informs that there have been some episodes of mistaken person at the beginning of the experimentation of the system but does not provide further numbers on cases of this type in recent years or how many complaints have been presented to the police.

Creating a European digital identity is more complicated than expected The Commission has awarded tenders for 63 million euros to develop a wallet in which to store our identity documents, along the lines of green pass apps. But everything else is still arguing. Businesses fear technological lock-ins. The giants of the web are against the European Council. And Spid risks remaining out of the game

Privacy and proportionality

The contract for the acquisition of the facial recognition system was awarded to the company Smi Technologies and Consulting, subject to the stipulation of a framework agreement for the supply of 135 candidate kits (costing 524 euros each) consisting of a thin client (a computer used in practice only for this purpose) and a monitor with webcam. The total value of the contract is 86,302 euros.

In the risk analysis present in the technical documents, the dicastery defines the risk of biometric forgery, accidental loss of data as well as theft or exchange of biometric identity of candidates undergoing a theoretical driving license exam as "low". On the other hand, the risk of unauthorized access or processing that is not permitted or does not comply with the purposes of data collection is "Medium": potential risks, says the ministry, "which can occur as a result of unauthorized access to the system or due to incorrect conduct (malicious or negligent) of those in charge/in charge" and who "are profiles to be supervised with extreme attention".

Certainly the risk of attacking the motorization systems from the outside cannot be excluded, but neither is the internal one. In the March hearing, D'Anzi underlined how "the undersizing of staff within the offices does not allow for the implementation of those policies of rotation of the resources involved in the provision of services to users, useful for mitigating the risks deriving from the potential establishment of relationships of interest between employees and citizens/professional operators". The lack of employees in the territorial motorization offices is therefore a theme that, at least for now, the dicastery seems to buffer also through the introduction of biometric technologies. The ones who benefit from this new method of authentication, says the ministry, “are the candidates, because they access the test more quickly and stay for a shorter time; and the office which, with the same human and instrumental resources deployed, will increase its productivity by 40%.

From what sportsgaming.win was able to reconstruct, the Guarantor for the protection of personal data was not consulted before the start of the trial but would have opened an investigation to analyze not only the privacy profiles of the new biometric authentication under consideration, but also compliance with the proportionality criterion of the tool. Indeed, the European GDPR regulation requires that the use of such invasive systems as facial recognition, based on the acquisition and processing of biometric data, be justified by the impossibility of alternatives. In 2019, the French association La Quadrature du Net had taken the school office of the provinces of Marseille and Nice to court for having installed a facial recognition system at the entrance of some schools with the aim of authenticating students and monitoring their school attendance. In February 2020, the administrative court of Marseilles accepted the association's appeal, specifying how the violations by the school offices concerned not only the aspect of consent, which according to the regulation must always be provided freely, but also the proportionality of the instrument. There are other, less intrusive ways of knowing whether students are going to school, and it could be the same for candidates for driving tests as well.