Data Security and the Implementation of Face Recognition in Indonesia

/ News

In order to improve its services, PT Kereta Api Indonesia recently just launched its facial recognition feature for its boarding process. A feature that should ease up queue time later became a public concern over its safety and urgency reason to bring up such a feature. Are Indonesians ready for facial recognition to be a standard? Or is it too soon for both customers and companies?

Whatever the technology is, socialization in implementing a technology is very important.

That is a tweet tweeted regarding the facial recognition that was implemented by PT KAI in 2023. Passengers who want to use Kereta Api Jarak Jauh (KAJJ) or the long distance train now have two boarding options: either the manual ticket system or face recognition. Although PT KAI said that there are two options given to their passengers, the reality is a bit yes, but no.

Another X account tweeted that those who do not wish to use face recognition can only enter the boarding area 10 minutes before the train leaves. In response to this issue, PT KAI said that in some stations, some gates are exclusive only for face recognition, such as the south gate in Gambir Station and the north gate in Bandung Station. Passengers who want to avoid face recognition need to take a reroute to another gate.

The issues.

Judging from many tweets concerning the new feature that PT KAI implemented, there is a lack of socialization from them to their passengers. Not only about socialization but there is a concern regarding data security, especially data leakage.

Take a look at another country in Asia that is known for its face recognition policy, China. In 2019, there was a data leakage concerning face recognition. This news came from Forbes. They reported that SenseNets’s (a Chinese company that operated security software for face recognition) data is fully available for everyone to access.

SenseNets quickly closed the leakage by putting a firewall in front of these data, nonetheless, all data were already leaked.

The European Union and face recognition.

To ensure the safety of the people of the EU, in 2022, the European Union through guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement, the EU banned face recognition in public spaces. The EU also makes sure of the need for a guarantee of protection towards face recognition, AI face recognition, and other similar technologies to protect people’s data with a legal framework.

Below are the details:

  1. Remote biometric identification of individuals in publicly accessible spaces
  2. AI-supported facial recognition systems categorizing individuals based on their biometrics into clusters according to ethnicity, gender, as well as political or sexual orientation or other grounds for discrimination
  3. Use of facial recognition or similar technologies, to infer emotions of a natural person
  4. Processing of personal data in a law enforcement context that would rely on a database populated by collection of personal data on a mass-scale and in an indiscriminate way, e.g. by “scraping” photographs and facial pictures accessible online.

The thing about face recognition is that it is yet another attempt to store people’s crucial data, and there is always a chance for that data to be leaked. Storing people’s data through face recognition could also lead to government or other sectors’ surveillance through cameras, and this can be a breach of someone’s privacy.

Taking accountability.

Biometric authentication is usually used for important matters, such as bank related issues, and boarding for a train is not categorized for that category. PT KAI can be sued if any of those biometric data get leaked. Passengers should also know that they have every right to reject the requirement to scan their face in order to board their train.

A cyber security expert, Pratama Persadha said that organizations will also be subject to fines 10 times higher than individuals according to article 70 UUD PDP if there is any data leakage. The urgency to implement face recognition seems not to exist in the present moment for the train boarding system in Indonesia.

Adding more crucial data will only create bigger invitations for mischievous actors to strike and steal data. It is worth remembering that there is no 100% protection against cyber security. Mitigation and other means to protect and enhance an organization’s protection against cyber attacks should be taken as a serious matter.

Read our other works:

• Indonesia Upcoming 2024 Election Cyber Problems
• Security by Design Approach Can Save Your Company
• Accessibility Against Cyber Security

References: