Aguascalientes, Baja California Sur, Coahuila, Chiapas, Ciudad de México, Guanajuato, Morelos are some of the Mexican states that use facial recognition technology.

In Mexico, the police agencies of 15 states have acquired facial recognition equipment with capabilities for mass surveillance, a form of biometric identification that is currently banned for police use in several U.S. cities, such as Oakland, San Francisco, Boston, and Portland, due to its potential to violate human rights.

As recently as October, the European Parliament voted to restrict the use of artificial intelligence for law enforcement, including facial recognition, after warning of biases that facilitate discrimination against people of color, members of the LGBT community, and other vulnerable populations, such as children, the elderly, and women. The European Commission will now have to decide whether or not to issue a legislative proposal and explain why.

While other countries are having this kind of discussion, Mexican authorities use facial recognition technology on a discretionary basis. This is the case in the Mexican states of Aguascalientes, Baja California Sur, Coahuila, Chiapas, Ciudad de México, Guanajuato, Morelos, Nuevo León, Puebla, Quintana Roo, Sinaloa, Sonora, Tamaulipas, Veracruz, and Zacatecas.

For this investigation, Empower reviewed public contracts, security reports, press releases, audits, and social networks of the respective state secretariats of public security and prosecutors’ offices. In addition, 130 requests for public records were submitted and dozens of public inquiries, originally made by citizens, were consulted.

It should be noted that the states of Morelos, Sonora, and Tamaulipas were included among the 15 states with police agencies that use facial recognition technology, but these three did not acquire it for use on public roads.

According to the result of public bid EA-IT20-2020, in 2020, the Morelos State Public Safety Commission acquired multibiometric equipment and other items for use by the Juvenile Criminal Justice System for a total of 1,023,123 MXN. The provider was private security company Servicios Integrales Magavel, S.A. de C.V., incorporated in 2019 by Miriam Emilia Zamora Valdez and Lilia Morales Reyes, according to the Public Registry of Commerce.

Meanwhile, in 2019, the Sonora State Secretariat of Public Security (SSP) launched an app called Credencialización Segura (Safe Credentialing), capable of authenticating municipal officers and SSP employees by means of smartphone cameras.

Local media also reported that the Sonora State Police has a portable device capable of identifying the faces of detainees. This information was requested by Empower through the National Transparency Platform, but no response has yet been received.

As for Tamaulipas, its Attorney General’s Office has made public its use of facial recognition technology by publishing that they were able to confirm the identity of a Gulf Cartel leader who was killed in October, named Ariel Treviño Peña, “El Tigre,” through the use of facial recognition software. Information on this acquisition is currently classified.

The lack of transparency about such purchases prevents human right defenders, journalists, and citizens from knowing not only the destination of public money but also how we are surveilled.

“Of course we are talking about covert surveillance, science that takes sensitive data that affects human rights. Citizens should know how, when, and where these tools are operating, especially in a dangerous context in which you know that the government can use that information against people who are a nuisance to them,” says Grecia Macías, an attorney at the organization R3D: Red en Defensa de los Derechos Digitales.

R3D launched a campaign in 2020 called “No nos vean la cara,” which literally translates as “don’t look at our faces,” but also means “don’t try to fool us.” In this campaign, R3D points out how governments use these tools in an opaque, arbitrary, erratic, and discriminatory manner.

While some states hide their acquisitions for AI surveillance, others promote them as an institutional achievement. Such is the case of Quintana Roo, whose Secretariat of Public Security claims to use this technology in order to strengthen the police by identifying faces of people that are wanted for a crime, as well as to improve the response capacity of its agents.

“A multibiometric information system pushes the state to the forefront in the handling and management of biometric data with the possibility of detecting any person through fingerprints or facial recognition by consulting databases of the National Public Security System or Plataforma México,” assures the Quintana Roo state government in a Facebook video published on June 25.

Angela Alarcón, campaigner for Latin America and the Caribbean at the organization Access Now, says this narrative that appeals to public safety is widely used to justify the operation of surveillance technologies, but that it is not supported by the facts.

“The truth is there is no evidence that this technology improves the security of the states, on the contrary, there have been cases where innocent people are wrongly identified as wanted persons,” explains Alarcón.

In 2019, a man named Guillermo Federico Ibarrola was arrested for six days in Buenos Aires, Argentina, for a crime he didn’t commit. The local police facial recognition system issued an alert after mistaking him for the perpetrator of an aggravated robbery. “They could have ruined my life,” Guillermo told A24 News after his release. Cases like his serve as examples of the risks faced by populations in other countries with facial recognition surveillance systems.

In Mexico there are two federal laws for the protection of personal data: the General law for the protection of personal data in possession of government entities and the Federal law for the protection of personal data in possession of individuals, which also covers companies.

But R3D’s Macías points out that there is no regulatory framework that addresses the use of surveillance tools. “There are international agreements, basic principles on privacy protection, and so on, but there is nothing specific in Mexico,” she says.

Special cases in Mexico

During research for this article, it was found that the state of Querétaro reserved from transparency all information related to the technology used for police operations.

Nayarit was also not included in the main list. Even though the State Attorney General’s Office acquired a security system with facial recognition capability in 2020, it was bought to control access to its offices, according to an invoice issued by the company Soluciones Integrales YDOSK, S.A. de C.V.

This company, which received 369,339 MXN from the Attorney General’s Office of Nayarit, sells computer and communications equipment. Soluciones Integrales YDOSK was incorporated in 2002 by Manuel Uribe Ramírez and María Luisa Uribe Ramírez in the city of Tepic, according to the Public Registry of Commerce.

Another state that didn’t make it on the main list is Hidalgo, because, although it does have facial recognition technology, it’s not used for public security purposes. In February, Governor Omar Fayad announced on social media that the state has a biometric immunological identification system, which serves to facilitate the “mobility and access of people to businesses and public spaces, anywhere in the country or abroad, with only the visualization of their faces.”

Finally, although this article was focused on identifying purchases made by state agencies charged with security and criminal justice issues, an active contract was also located in the border city of Juárez, Chihuahua.

In 2020, Juárez awarded a public contract to Quatro Desarrollo Móvil, S.A. de C.V. to operate the Traffic Safety Violation System. According to contract DCA/TM/222/2020, Juárez requested hand-held devices with fingerprint sensors and facial recognition. The company will receive between 6,667,722 MXN and 16,669,305 MXN, to be settled once the contract expires on December 31, 2021.

Quatro Desarrollo Móvil is dedicated to the development, commerce, and installation of software, hardware, mobile applications, and website design, although its own webpage is “under construction.” This company was founded in 2015 by Guillermo Antonio Orozco Salomón, Gilberto Arturo Castellanos Pacheco, Raymundo Cardona Villarreal, and Pablo Barrera Zúñiga in Chihuahua, Chihuahua. The state was not included in the main list for this article only because the aforementioned contract was signed at the municipal level.

Actions against mass biometric surveillance

“There are two types of surveillance; one is mass surveillance and the other is targeted. Let’s not be confused; we are all being spied on with mass surveillance,” says Gisela Pérez de Acha, lecturer at the University of California, Berkeley, who specializes in cybersecurity.

Pérez de Acha notes that it is increasingly easy for companies and governments to store large amounts of data in case it becomes relevant in the future. This scenario may place citizens in a vulnerable position and is reason enough to actively participate in the discussion, according to Jorge Sebastián Sierra, member of the Center for Internet Security and collaborator at the Border Center for Journalists and Bloggers, where he teaches about digital security.

“I think we lack the culture to understand the scope of biometric data collection,” says Sierra, who sees risks in the use of biometric data, such as identity theft, as well as the persecution of journalists, activists, and opposition politicians. “When you think about facial recognition, it opens a Pandora’s box, because it is already collecting data without your consent and you can’t just walk in the streets with a mask on all your life.”

So what can we do to push back against the implementation of mass biometric surveillance technologies like facial recognition? Specialists recommend that we begin by informing ourselves through the work of organizations and journalists that are critical of the official discourse. They also urge us to pressure legislators to demand regulation in favor of human rights; to approach and support NGOs that defend digital rights, such as R3D, which is filing injunctions to prevent governments from storing, processing and sharing our biometric data; and, finally, to demand accountability from the governments and companies involved in the acquisition of these technologies.