The National Bureau of Investigation (NBI) has discovered within its activities a possible information security incident involving personal data and has made a report on the incident to the National Police Board. The alleged incident took place during the processing of personal data in a service for which information security or compliance with data protection legislation may not have been ensured in advance in a sufficient manner.
The incident was discovered by the NBI on Thursday 8 April. On the basis of initial information from the NBI, the National Police Board decided to report the matter to the Office of the Data Protection Ombudsman and submitted the report on Friday 9 April.
The information security incident is related to the testing of facial recognition technology carried out in early 2020 by the NBI's unit responsible for combating the sexual exploitation of children. The duties of this unit include pre-screening child sexual abuse material received from international stakeholders.
The police have a legal right to process biometric facial images under the conditions set out by law if the processing is necessary to perform a statutory police duty.
– The unit tested a US service called Clearview AI for the identification of possible victims of sexual abuse to control the increased workload of the unit by means of artificial intelligence and automation. The identification of the victims depicted in the images and videos examined by the unit is crucial to safeguarding the victims' rights, and to interrupting any crime in progress or detecting an offence already committed, says Head of Cybercrime Centre, Senior Detective Superintendent Mikko Rauhamaa of the NBI.
During the trial period, the unit made around 120 searches in the software, which makes use of pictures of persons on social media. The pictures entered into this software had been edited by the unit to only depict the face of those who needed to be identified. There was one 'hit' during the trial period, and it led to cooperation with social authorities. No criminal investigation has been started or other actual police action taken as a result of the hit.
After using the software for the duration of the trial period, it was concluded that Clearview AI was not suitable in Finland for that particular cooperation between authorities.
– One of the statutory duties of the NBI is to further develop methods of combating crime. The unit concerned was exploring tools for reducing the workload and enhancing the effectiveness of police processes to enable immediate intervention in any exploitation in progress. In this particular case, the software was not suitable for the police, Mikko Rauhamaa says.
The NBI continues to investigate the matter.
