From: Subject: Date: To: Cc: Lauren Bartlett lauren.bartlett@usc.edu Re: UBTOS/Virdi security technology & biometric scanners at USC April 24, 2020 at 4:06 PM Katherine Lippert lippertk@usc.edu USC Public Relations uscnews@usc.edu Hi Katherine. Chris Ponsiglione sent me the following information in blue (please attribute it to Chris): - What would be an example of a ‘demonstrated need’ that would allow a student to be exempt from facial recognition registration? Residents are expected to scan either their fingerprint or face to verify access. Notwithstanding the current pandemic either is acceptable. Residents requesting exemptions for physical or emotional needs would be referred to the Office of Disability Services. Residents requesting exemptions for other needs would be referred to Student Affairs. Either of those offices would have the authority to grant an exemption at their discretion. We don’t have anything additional to add beyond this and what previously was provided. Regards, Lauren From: Lauren Bartlett Date: Friday, April 24, 2020 at 3:33 PM To: Katherine Lippert Cc: USC Public Relations Subject: Re: UBTOS/Virdi security technology & biometric scanners at USC Hi Katherine. I’ll check and get back to you. Regards, Lauren From: Katherine Lippert Date: Friday, April 24, 2020 at 11:58 AM To: Lauren Bartlett Cc: USC Public Relations Subject: Re: UBTOS/Virdi security technology & biometric scanners at USC Hi Lauren, Thank you for relaying these responses from Chris. I do, however, want to follow up and clarify a couple of items from this reply. I’m still wondering: - What capabilities did UBTOS products offer that swayed the university to work with them over other companies? - How much money has USC paid UBTOS so far and how much is it contractually obligated to pay in the future? How long will the existing contract be in place? obligated to pay in the future? How long will the existing contract be in place? - What UBTOS “secondary security” systems were in place on campus housing between 2013-2015, before fingerprinting technology was implemented? Is that technology still in place? - What “secondary security” systems are in place on the rest of campus? - How does the FR system function to make identifications if an original facial scan is not stored to reference and give entry access? How does the system "recognizes" a person if it doesn't store their face. Does it store key data about a face, such as distance between eyes, nose and eyes, etc? - What would be an example of a ‘demonstrated need’ that would allow a student to be exempt from facial recognition registration? - UBTOS says it has contracts with a variety of government agencies, but those agencies say they can't find any such contracts. Does that raise questions for the university, particularly about the integrity of a company that could have access to student biometric data? I appreciate your time and attention to these matters. Best, Katherine Lippert On Apr 24, 2020, at 10:38 AM, Lauren Bartlett wrote: Hi Katherine. I shared your inquiry with Chris Ponsiglione, Director, USC Housing, Auxiliary Services, who is our current expert on how the university uses biometric technology. (Leo Boese retired from the university a number of years ago). To bring you up to date with information we shared with the Daily Trojan in February in response to an inquiry from them, Chris provided the following information at that time (to be attributed to him): “Our residence halls use both student IDs and biometric technology to ensure no one who isn’t authorized to enter those buildings have access. We started using fingerprint identification in 2015 and facial recognition was added in 2017. The vast majority of identification in 2015 and facial recognition was added in 2017. The vast majority of students choose fingerprint technology, while some choose facial recognition technology. The facial recognition system doesn’t store data or provide analytics. Both fingerprint technology and facial recognition technology are considered state of the art, so we give students the option to use whichever one they prefer. Card reader technology isn’t as secure; a card could be stolen or otherwise used improperly. The information is accessible to Student Affairs and the Department of Public Safety when needed.” I shared with Chris the information you sent that was attributed to Leo Boese. The following is what Chris sent to me to share with you and attribute to him: “The issue is what type of data we’re talking about. The system does not store data on a person’s face or fingerprint that can be recalled or shared. For example, we cannot provide data on a person that could be used by another party to scan faces and identify them or review their fingerprint and identify them. The system does record entry data and we separately log guest information. The system does not record exit information. Mr. Boese’s statement that we could know how many people are in a building is incorrect. We would be able to see when they entered and list all the times they entered. We would not know when they left. This is the same data that is available from card swipe entrances as an example.” And Chris provided the following answers to your questions (please attribute it to Chris): Why did USC choose to work with UBTOS? UBTOS was selected from a groups of vendors providing similar biometric verification systems based on a combination of system capabilities and cost. How long has USC been engaged in a contractual relationship with UBTOS for facial recognition technology? Please list all the places on USC property where this technology is used. Housing has had secondary security in place since early 2013 after several issues of violence in the community and a shooting on campus in November 2012. Secondary security is present at all on campus locations and at the University Village. How much money has USC paid UBTOS for its services to date, and how much is it contractually obligated to pay in the future? We have an annual maintenance agreement. Why does USC’s statement say that the technology does not store data when its own past statements, the manufacturer’s description of the device, and experts in the field all contradict that? The technology does not store facial recognition and fingerprint data. It does store transactional data similar to any access control system. Is any data actually being stored and, if so, what is being stored and how is it being used? Data logging transactions are stored and used when necessary for properly authorized investigations by DPS, Title IX or Student Affairs. If any data is being stored, how long is it retained, who has access to it, and for what purposes can it be used other than to gain admittance to the dorms? Data logging transactions are stored and used when necessary for properly authorized investigations by DPS, Title IX or Student Affairs. There is no authorized investigations by DPS, Title IX or Student Affairs. There is no expiration set. What are the opt-out procedures in place for students living in areas equipped with this technology? How are students made aware of these procedures? Students can have their ID verified as an alternative option with a demonstrated need for this accommodation. Students have told me that in the wake of the COVID-19 pandemic, finger print options were removed and they were required to register for facial recognition (if they hadn't already.) Is this correct? If so, please explain why this policy was enacted. Based on direction from Student Health, the fingerprint readers were taken off line to reduce touch contact in line with social distancing guidelines. Regards, Lauren From: Katherine Lippert Date: Wednesday, April 22, 2020 at 1:58 PM To: Eddie North-Hager , USC Public Relations Subject: Re: UBTOS/Virdi security technology & biometric scanners at USC Dear USC Media Relations, Thank you for clarifying USC’s formal position on its use of facial recognition technology on campus. However, I still have many questions. The purpose of this email is to request, again, an interview with a representative from USC who oversees the facial recognition systems deployed in undergraduate residence halls. I would need this interview to take place no later than the close of business on Friday, April 24. In this email, I am also providing you with the main findings of what I plan to publish based on my reporting so far. I’d prefer to discuss these findings with a USC representative who is knowledgeable about the subject, but at the very least I’d appreciate written comments and, of course, corrections of any point you believe to be in error. Again, my deadline is the close of business this Friday, April 24. My story largely focuses on the company UBTOS USA INC., which reports holding a contract with USC for facial recognition devices, and a series of inconsistent statements from USC officials regarding the university’s use of the technology. I expect my story to be published on Annenberg Media and likely in at least one other publication beyond USC. In the university’s response to my request for an interview, Eddie North-Hagar indicated “the facial recognition system doesn’t store data or provide analytics.” However, in a 2017 interview when the technology was implemented, Leo Boese, then USC’s associate director of safety and security indicated that, in case of an emergency, the system would allow administrators or law enforcement to identify how many students and their guests were in the dorms at any given time. According to experts, in order to be able to identify this information — and, indeed, to make facial identifications in the first place — at least some data must be stored. In addition, for administrators and law enforcement to know how many students were in a dorm, that information would have to be retrievable remotely. Finally, the manufacturer of the device USC uses, the UBio Pro-X, says in its description the highlighted features of the device include 2GB of RAM and a “massive memory” to store 1,000,000 identity templates, 10,000,000 event logs and 20,000 image logs. I have spoken with students on campus about the university’s policy to require registration with these systems. Some students indicated they had been given an opportunity to opt-out of the facial scans upon request, others said they were unaware of their ability to opt-out and preferred not to use the technology. In light of the COVID-19 outbreak, students remaining in the dorms indicated that the fingerprint option for entry was removed and facial recognition became a requirement for entry to their rooms. I have found no official USC policy indicating how students may opt-out of the facial recognition registration. I also reached out to members of faculty and staff with expert knowledge of the technology and spoke to them about their concerns about its use on campus. They are primarily concerned about the possible uses of student photos and facial recognition data, in addition to the inconsistencies in the statements made by USC about data storage. There are also concerns about the company UBTOS itself. The small group of publicly listed UBTOS clients where USC is included also includes the Los Angeles Police and Sheriff’s Departments, the Department of Defense and the Department of Justice. Every single one of those government entities said they have no record of any contract with the firm. Freedom of Information Act and Public Records Act requests were submitted to each public entity listed as a client for UBTOS, seeking records of their communications regarding or existing contracts with the company or any of the surveillance technology manufacturers UBTOS partners with as a wholesaler, none reported business dealings with the company. Here are some questions I would like to give the university the opportunity to answer. Why did USC choose to work with UBTOS? How long has USC been engaged in a contractual relationship with UBTOS for facial recognition technology? Please list all the places on USC property where this technology is used. How much money has USC paid UBTOS for its services to date, and how much is it contractually obligated to pay in the future? Why does USC’s statement say that the technology does not store data when its own past statements, the manufacturer’s description of the device, and experts in the field all contradict that? Is any data actually being stored and, if so, what is being stored and how is it being used? If any data is being stored, how long is it retained, who has access to it, and for what purposes can it be used other than to gain admittance to the dorms? What are the opt-out procedures in place for students living in areas equipped with this technology? How are students made aware of these procedures? Students have told me that in the wake of the COVID-19 pandemic, finger print options were removed and they were required to register for facial recognition (if they hadn't already.) Is this correct? If so, please explain why this policy was enacted. If there is further relevant policy or information I missed, please let me know. Again, I would much prefer an interview with a person overseeing USC’s facial recognition system, and I hope that we can arrange a time to talk as soon as possible. My deadline is close of business this Friday, April 24. Thank you for your time. Sincerely, Katherine Lippert