What the Fawkes: Facial Recognition, Digital Masking, and AI
For technology leaders, the key management question is not whether facial recognition can work, but when its use is defensible under policy, law and brand risk. The business case often starts with convenience, security or fraud reduction, yet the same capability can quickly become a source of regulatory exposure, discrimination claims and reputational damage if data collection, model training and usage boundaries are weakly governed.
This makes decision rights central. CIOs, security leaders and legal teams need clear rules on who can approve biometric use, what evidence is required, which populations are out of scope, and how opt-in, retention and deletion are enforced. If the organisation cannot explain those controls in plain language, it is effectively outsourcing risk to the vendor or the business unit that wants the tool most urgently.
The more strategic trade-off is portfolio discipline. Biometric initiatives compete with other identity, access and fraud investments, but they carry unusually high downside if public trust is lost. Leaders should ask whether the same outcome can be achieved with less intrusive controls, whether the use case is customer-facing or internal, and whether a narrow pilot can produce a defensible benefits case before any scale-up. Metrics should include not only detection rates, but complaint volumes, override rates and audit findings.
A practical next step is to treat facial recognition as a governed exception, not a default capability. That means cross-functional review, documented human oversight, periodic bias testing, and a withdrawal plan if legal or public conditions change. The harder question for the board is whether the enterprise can set a biometric policy that is both commercially useful and durable enough to survive scrutiny from regulators, employees and the public.
In recent years, facial recognition technology has gone through cycles of falling in and out of favor, adding to complex questions about artificial intelligence and privacy. Neither facial recognition nor AI is new, but the ways they are applied opens up business potential as well as liability.
An interview for an upcoming InformationWeek series on generative AI shed additional light on the intersection of these technologies and why the public may need proactive deterrents for both.
Ben Y. Zhao, professor of computer science at the University of Chicago, led a team that worked on a tool called Fawkes, which is meant to disrupt unknown third parties from creating facial recognition profiles to track individuals by using images found on social media. The conversation with Zhao on Fawkes, and his later work on Nightshade, will appear next week on InformationWeek.
The name of the Fawkes tool was derived from Guy Fawkes, whose likeness was adopted in the form of a mask as a symbol by hacktivist group Anonymous and others who seek to maintain anonymity while engaging in various forms of protest.
The Fawkes tool was developed around the time Clearview.ai got sued for scraping data from social media to flesh out its facial recognition database and tools, which were sold to law enforcement.
Related:FTC Prescribes Ban on Rite Aidโs AI Facial Recognition Use
Not long after that lawsuit, Clearview.ai was back in headlines, this time offering its services to Ukraine for the potential use of facial recognition to spot Russian agents.
This exemplifies some of the back and forth associated with facial recognition. Meta bowed out of facial recognition for tagging photos on Facebook. The Federal Trade Commission banned Rite Aid from using facial recognition for five years after it was discovered the pharmacy chainโs use of biometric technology unjustly target and tagged minorities as potential shoplifters.
And those are just some recent steps in this dance between innovating with AI and facial recognition and addressing the issues they raise. Over the past five years there have been discussions of facial recognitions risks, the liability concerns associated with AI, as well as potential uses of facial recognition that do not violate civil rights while responsibly respecting individuals.
This particular dilemma between privacy, security, and opportunity dates back even further. The rush of interest in biometrics that arose after the Sept. 11 terrorist attacks — just a few years shy of a quarter century ago — never completely went away. The effort to identify potential attackers became paramount, a natural reaction steeped in a desire to restore a sense of safety.
Related:Clearview AI Offers Face Recognition AI to Ukraine
This led to a boom of business for companies that promised to sift through digital images to catch bad actors. This also opened the door for potential authoritarian abuses. Regardless, businesses continue to look for ways to make facial recognition part of the identification equation. But is that viable in a world where the right to privacy and the right to be forgotten continue to gain momentum and strength?
This episode of DOS Wonโt Hunt explores the tension at that intersection of AI, security, facial recognition, and lessons that could still be learned from Guy Fawkes and other masks.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.