Crime Unmasked: Security, Surveillance, and the Post-Industrial Face/Off

By Mark

Fezzik: Why are you wearing a mask? Were you burned by acid or something like that?

Man in Black: Oh, no, it’s just they’re terribly comfortable. I think everyone will be wearing them in the future

The Princess Bride, William Goldman 1987

What’s in a face? These days, a lot.

Public CCTV systems and private surveillance cameras are widely adopted now, ensuring that anyone in an urban environment will almost certainly be captured on camera at some point (or many points) in their day. Border services, state police, and state drivers’ license services use facial recognition and other biometric systems. Law enforcement ties facial recognition software with mugshot databases, and intelligence agencies do, um, whatever they do… Social media gladly absorbs our facial biometrics every time somebody tags us Tebowing.[i] And it turns out Facebook wasn’t bullshitting when they chose that name. Facebook now has the world’s biggest book of faces, and we all happily wrote it for them. More on this in a minute.

In the old days, disguises were a little easier. Before video surveillance and facial recognition software, relatively simple stuff had a good chance of working. For example, recognize this famous early 20th-century psychotherapist?


Founder of the Salzburg’s Jungian Orgone-Hypnotherapeutic Oedipel Regression School?



Did I say famous psychotherapist? What I meant to say was total Hitler. A US Secret Service artist doctored the top photo in 1944 as an example of what Hitler might look like if he went into hiding. (Both images from the National Archives at College Park Maryland/Image Source: Wikipedia)

The disguise techniques in this doctored Hitler photo are simple. By adjusting the hairstyle, adding glasses, and totally changing up Hitler’s world-famous facial hair situation, the disguise is enough to throw viewers off significantly. Of course, a lot of the subterfuge depends on the fact that Hitler maintained some memorable physical characteristics as part of his extremely public persona. More thorough disguising might include changing the hair color, changing the clothing, simple make up or prosthetics, and so forth.

Now, things are changing. As effective as these disguise techniques are on humans, most facial recognition software wouldn’t be fooled for a nanosecond. The weaknesses of human facial recognition and software facial recognition are different. Humans are evolutionarily primed to recognize faces. In fact, our brains want to see faces so much that we project faces onto inanimate objects. Humans don’t have much trouble recognizing that they’re looking at a face, so we aren’t faked out by the kind of changes to angle or lighting that would cause software to forget it’s looking at a person at all. But humans are really good at recognizing faces because we’re also social (and visual) creatures. We have a highly-evolved recognition capability, but subconscious social cues can impact how we process the information.

We may subconsciously feel quite different about a male with a beard than the same male without. We may make completely different assumptions based on subtle differences in facial dimensions and expression. The superficial physical characteristics we associate with “race” can impact recognition considerably.[ii] These natural biases are just processing shortcuts. Some researchers suggest that the subconscious racial bias in facial recognition can be decreased through simple awareness.[iii] Others suggest that the more familiar or intimate you are with people of another race, and the more positive the interactions, the more accurately you’ll be able to identify people of that other race.[iv] A lot of small factors in environment, appearance, observer state of mind, or context can throw off recognition considerably. Trying to maintain a high degree of accuracy in recognition is fatiguing for humans, and what we expect to see plays a big role in what we end up seeing.

So, we’re masters of combining quick facial recognition with a multitude of social, non-verbal, linguistic, and contextual cues, but we use processing shortcuts based on these cues. These shortcuts help us interpret situations faster, and avoid unnecessary processing effort. Imagine you go to a Starbucks at La Guardia, and you’ve never seen the dreadlocked barista before. A couple hours later, you jump on a plane to France. Unbeknownst to you, so did he. He’s got a barista job lined up at Charles de Gaulle, which suits him well because he speaks perfect French. He doesn’t even mind that his new employers want him to get a haircut and shave. When you get to Paris, you go to the first coffee shop you see, and are greeted by the same guy. Except, now he’s wearing a different uniform, he’s clean-shaven with a high and tight haircut, and he greets you in flawless French. Does your brain immediately recognize that this French barista’s facial structure is a perfect match with the American barista’s from a few hours ago? Or, does your brain take a processing shortcut, and assume (quite reasonably) that this French barista with a different haircut is a different person who happens to look similar to the American barista?

Software has the opposite problem: it won’t get faked out by context because context is outside of its scope. Every time the software looks at a face, it processes the data from algorithmic scratch. Software is not impacted by fatigue or social factors that can throw off humans. The software only needs to recognize that it’s looking at a face. This is still a weakness, since relatively simple obstructions, or changes to angle and lighting can cause the software to fail to understand that it’s looking at a face, or make it fail to capture enough data points to return a reliable match. Nevertheless, if the camera and software can collect good enough imagery, it will successfully compare measurable signatures against known records, and the engineers are always improving these systems. Hitler can dress up like Sigmund Freud, but he has to do more than lose the Chaplin mustache to fool a good facial recognition system: he’d need to change the geometric structure of his face. That’s been done, but it’s a little bit harder.

Whether digital or biological in nature, facial recognition has always been a fundamental component of policing, crime control, and justice systems. As unreliable as witness identification can be, it’s still treated like the gold standard in court testimony. Facial recognition systems can be used to stop somebody at customs, or track down a parolee caught on tape in a new offense. Facial recognition can confirm the identity of terrorists from CCTV or propaganda materials, or identify abusers in child pornography. Facial recognition can identify who threw Molotov cocktails at the riot police, or establish who was driving the car when it T-boned a FedEx truck under the watchful eye of the traffic camera. Retailers will use this software to determine when a known shoplifter or fraudster is entering the store. Nightclub staff will know if the guy trying to get in today was banned a few months ago for poor behavior. In other words, from an investigative and security standpoint, there are many situations where it is useful to be able to sift through many thousands of “potential” images, and narrow down the options to a handful, or perhaps just one, high-confidence match. That’s what humans can’t do, at least not without spending many exhausting hours visually scanning through photographs trying to evaluate similarities, and doing only a middling job of finding matches after all that effort.

Assuming it’s reliable enough (which in many cases it still is not), software capable of rapid facial recognition is a big development for security and law enforcement. But everything has its drawbacks. Firstly, the privacy issues are not trivial. Facial recognition systems work better with ever-larger samples of images on file. More data on file means the software can better compare newly-collected images with images of known individuals. This means that anybody who uses and maintains facial recognition systems is probably going to want more face data on everyone, always. Secondly, from a security standpoint, facial recognition creates a powerful infrastructure for individual identification. However, as with other high-tech security systems, overreliance on this infrastructure based on assumptions about its technical reliability might lead to other problems in the longer-term.

If facial recognition systems become the cornerstone of a security program, then an attacker with a reliable method of spoofing or bypassing facial recognition is at an advantage. If the system IDs somebody’s face as definitely not a terrorist, the human screening personnel may be influenced by these high-tech systems to fast-track that individual through the screening process based on the software’s approval. It’s true that CCTV and facial recognition systems are rapidly improving, but the better and more ubiquitous these tools become, the more easily you can hoodwink the humans if you know how to beat the technology.

The sense that these systems are highly reliable because they’re automated, also provides human security staff with precisely the excuse they need to relax their own vigilance. Designers try to remove intuitive human biases from automated facial recognition systems, and this is a simultaneous benefit and drawback. It’s a benefit because it addresses the ways humans don’t perform well at the same task, and majorly scales up facial recognition capabilities. It’s a drawback in that its reliability is contingent on technical factors that can be defeated in ways a vigilant human might not be. Overreliance on the machine can be a problem. If the humans aren’t careful, all an adversary has to do is defeat the technology and the human element will come right along. Worse, when humans over-rely on a specific security technology, they may not even know if the technology is being regularly beaten by adversaries. If the alarm doesn’t go off, there’s obviously no cause for alarm.

Just as the technology behind surveillance and facial recognition is always improving, so are the options for circumventing it. We may still be far from Philip K. Dick’s “Scramble Suit,” or William Gibson’s “Mimetic Polycarbon Suit,”[v] but the options for disguise have been improving considerably. Cryptographer and security guru Bruce Schneier, among others, pointed out a couple cases of criminals using realistic theatrical masks several years ago. Since then, this kind of disguise has become better and more accessible. Criminals are definitely interested.

In 2010, a Chinese guy in his early twenties snuck onto a flight from Hong Kong to Vancouver BC well-disguised as an elderly Caucasian US citizen. He’d donned an “expertly crafted” silicone theatric mask, and had apparently forged or used an accomplice’s legitimate boarding pass and airline credit card to board the flight. His mask and “old guy” costume of glasses, cap, and cardigan were apparently quite convincing, but some people got suspicious when they noticed his hands looked much younger than the rest of him, and his movements weren’t quite natural. Alarms were definitely raised when people on the flight noticed an old white guy going into the lavatory and emerging a Chinese Abercrombie cashier.

Perhaps he would have continued the ruse, but it appears the subterfuge was only intended to get out of China, not sneak into Canada. Canada Border Services received a tip from Air Canada corporate security while the plane was still in the air, and when CBSA confronted the imposter on arrival, he immediately requested asylum.

A lot of the other cases with these disguises have (unsurprisingly) involved bank robberies, or theft of other high-value assets. It’s a lot harder to rob a bank than it used to be. In fact, nowadays it’s harder to get away with robbing a bank than robbing virtually anywhere else. In the US, banks maintain all kinds of physical security, alarms, marked notes, cash drawer limits, dye packs, planted tracking devices, CCTV, sometimes armed security, and plenty of other security stuff. Local police and the FBI tenaciously investigate bank robberies. Penalties are serious, and the offender/s is almost always captured on camera. All this effort to combat bank and large cash robbery has made it one of the highest-risk crimes: clearance rates for bank robbery are more than twice the rate of other property crimes, at around 60%. In the US, only homicides are cleared more often, and if anybody dies in a US bank robbery, it’s usually  the perpetrator.

Armed robbers have long used disguises, but given the pervasiveness of high-quality surveillance systems in modern banks and other places with high-value assets, and given the fact that law enforcement puts a lot of effort and resources into scouring through any evidence they can recover, it’s really no surprise that high-risk robbers would be interested in these masks. In 2010, a Caucasian bank robber made headlines when he knocked off six banks using a high quality silicone theatrical mask that made him convincingly appear to be African American. The cases keep trickling in.


Image Source: Splash News

One of the more ambitious scenarios involved a team of robbers in New York City who all wore high-quality theatric masks while robbing a cash depot. To compound the trickery, they not only switched races but also donned NYPD outfits. The disguises were convincing enough that clerks had no clue the robbers were wearing masks. These guys apparently took several components of their plan from the Ben Affleck movie “The Town,” including use of bleach (ostensibly) to ruin DNA evidence, showing a clerk a picture of her home to prove they were serious, and masks. But their masks were better, and they had full-body coverage with gloves, hats, sunglasses, and so forth. They had even worn the disguises for their pre-operational surveillance: when the robbers’ van was noticed by some witnesses days prior to the heist, they described the occupants as white. The robbers were so pleased with the masks that they wrote a note to the legitimate special effects company that made them, Composite Effects, to praise their realism.


You can probably see where this is going…


Yup… (Image Source)

It was virtually impossible to ID these guys from video or witness statements, but they ended up caught because they used a relatively old technology: their blackmail photo of the clerk’s house was left behind. That photo was developed at a drugstore and traceable to a specific customer. Investigators got that customer’s cell phone number from the store records, and from that critical lead they proceeded to roll up the whole crew. Theatric disguises have been done across the pond too. In 2009, two guys tricked a professional special effects studio to alter their appearance with liquid latex, wigs, and prosthetics, supposedly for a music video. The effect was good enough that one of the robbers joked “even mum wouldn’t recognize me,” while they were still getting the makeup applied. Then they immediately went and robbed the Graff diamond store, making off with over $50 million dollars of jewels in one of Europe’s biggest heists.

They got caught too, mostly because the getaway car crashed and they left behind a pre-pay phone the police were able to trace back to somebody in the group. Turns out, the same special effects studio was also tricked into disguising the robbers in Britain’s largest cash heist to date, the 2006 Securitas cash depot robbery. That one netted nearly $70 million in pound sterling notes. In 2011, an early-adopter in Dallas apparently used a theatric mask to rob a bank. A North Carolina robber who was actually a young black male, knocked off several banks in 2015 with a theatric silicone mask disguising him as an older white guy. In 2016, a young fugitive on drug trafficking charges tried to fool police by answering his door as an elderly man. Back in 2014, an African American bank robber (and murderer) in Philly was caught because the management of the theatrical mask maker, Quebec’s Realflesh, received a tip from an American customer who’d heard about the robberies in Philadelphia. Master mask designer Ian Marier looked at the surveillance footage and immediately recognized his own handiwork, a $1500 custom job. From there, investigators traced purchases and deliveries, and zeroed in on the perpetrator.

It’s not exactly an epidemic yet, but these high-quality disguises are obviously appealing for some criminals, and they’re already pretty effective. In some cases, nobody recognizes that the perpetrators are using disguises at all, and the masks really do make it nearly impossible to identify their wearers based on CCTV footage or even witness observation. When people are caught using these, it’s usually some factor besides the mask: identifying getaway vehicles, recovering other traceable evidence left behind, human intelligence, tips from professional special effects companies, or tracing purchases from those same companies. Ultimately, the masks do what they’re supposed to do. These criminals are only getting caught because they’re doing high risk stuff that gets a lot of police attention, and these high-risk scenarios provide many opportunities for a seemingly-minor error to give the cops a good lead. If these disguises were used in crimes where the main factor is eyewitness identification, or in crimes where police priorities, resources, and expectations of encountering a disguise are lower, they’d be successful a lot more often.

You can bet the FBI and Scotland Yard are all over this for the big heists. FBI works bank robberies in the US, and that’s one of the reasons it’s so hard to get away with. Some big robberies (and enough small ones) have already been pulled off with these disguises. Investigators are becoming more aware, and they’ve certainly got some of the theatrical mask makers in the rolodex already. No doubt at least a few people in homeland security, customs + border security, transportation security, counterterrorism, and other security-relevant fields are becoming aware of the potential for terrorists, smugglers, or others to use them for illegal entry.

We here at aren’t necessarily in the business of telling public agencies how to do their jobs, but if I’m the FBI, I’m assigning somebody to regularly research the retail offerings of high-quality mask makers (or work with them directly), to enter the designs into the “Interstate Photo System (IPS).” That system consolidates millions of mugshots and other legally-acquired facial images of Americans. In the medium term, FBI also wants to get up to a third of Americans (and probably more) in searchable facial recognition databases, including millions who have not been arrested. That’s a more ambitious and legally-ambiguous proposition. One upside is that local police can now get tie-ins to the FBI system, so if they’ve got good enough surveillance footage of a suspect, the software will provide a ranking of most likely matches to known offenders in the IPS. The push to eventually include everyone in these databases is a valid point of debate, but since the masks aren’t real people, it wouldn’t hurt anybody’s privacy to put those in the system.

But the 4th Industrial Revolution tells us that these kinds of “supply side” measures are probably just a stopgap solution. At the moment, there are probably a maximum of a few hundred mask designs commonly sold by major vendors. For now, it might be possible to track some of these designs using facial biometric software and people knowledgeable about the theatric mask industry. However, tracking where all these disguises come from, or maintaining reliable databases of all possible designs, will eventually become impossible.

Today, there are probably a few dozen professional theatric mask studios that sell these masks to the public. Customers like these masks because they’re super cool. The vast majority of customers aren’t criminals at all: between theater, indie film, pranks, advertising, and art projects, the mask makers have a healthy base of legitimate costume clients. The artists that make these masks take pride in their skill, and giving them a hard time would be a poor move: this sub-genre of the special effects industry is closely linked to Hollywood, and some of the most skilled mask designers and artists have background in professional makeup and SPFX. Legitimate industries and consumers will continue to need private artists and studios with the skills to make these products.

Shutting the mask makers down (or making them deal with super-strict regulations) would be pointless in the long term anyway. Eventually, a combination of accessible technologies and the spread of information will make high quality disguises more available to the public on a hobby basis. There are already quite a few independent special effects artists, makeup artists, DIYers, and industrial artists capable of making high quality disguises. It’s painstaking work, but it’s a relatively low-tech method that’s been around a long time. It typically involves taking a cast of the intended wearer’s face or head to ensure ideal internal fit, then using a mold and sculpting techniques to shape the external surfaces. Latex, and especially silicone, provide best fit and most natural-looking results (though they are notoriously hot to wear). Custom paint jobs finish the external skin tone and details, and each individual hair is laboriously sewn into the mask for a lifelike appearance. Eye holes are as small and well-fitted as possible to ensure pass-ability. With properly customized fit and a little talcum powder, a modern theatric mask can be donned in a couple minutes or less. The best ones are all hand-made, and production doesn’t require any particularly suspicious materials or tools. This innocuous supply chain is a problem for trying to track and control artisanal masks. The key factor for artisanal mask making is skill, not unusual tools or materials.

Artists started making lifelike masks for show business decades ago. Once they were good enough, the intelligence agencies got in on it too. Fortunately, the Free World had a leg up. The intelligence agencies of many countries were serious adversaries, but during the Cold War only we had Hollywood. CIA specialist Tony Mendez (of “Argo” fame)[vi] was (appropriately) an artist before he joined up in 1965. Apparently, in one operation involving assistance from Hollywood SPFX expert John Chambers, he combined masks and other techniques to disguise a black CIA officer and an Asian diplomat as two white businessmen.

This is a little more impressive considering they did this in Laos, during the Vietnam War, and in an area crawling with foreign intelligence officers. They even got the disguised guys past an armed checkpoint. Mendez says this high-level intelligence caper somehow saved the United States $4 billion, which sounds like a pretty good return on investment. In comparing this handiwork to the Tom Cruise “Mission Impossible” movies, Mendez told a reporter that “If you were to ask me was it as good as Tom Cruise, I would say every bit. But Tom Cruise requires about five hours to get ready. We had to do it in five seconds, with no retakes.” Apparently some of the disguises Tony and his wife Jonna (also a CIA technical expert) made, were “paper thin,” yet able to be donned in seconds, and totally passable. During the George H.W. Bush Administration, Jonna even visited the White House in disguise and then ripped off her false face in the Oval Office to demonstrate the CIA’s disguise capabilities to the former Director. Referring to his work with the CIA Office of Technical Services, Tony Mendez said “If I were able to tell you how highly skilled we were, you wouldn’t believe it.”[vii]

So, Hollywood and the CIA could pull off these impressive disguises decades ago (and doubtless, even more amazing stuff today…). Professional mask makers and skilled DIYers can make and sell these high quality masks on the civilian market now. Given the diffusion of production capability promised by the 4th industrial revolution, and the general creativity of the modern maker, DIY, and open source movements, it’s really only a matter of time until realistic disguises become a wider hobby among the public, and a niche criminal DIY skill. These days, most criminals who want one of these disguises would still need to buy it from a legitimate SPFX company or costume vendor. That poses a risk: the purchaser or receiving party might be traced, or the legitimate mask maker might get suspicious and tip off police. Plus, professional makers only offer a certain number of mask designs at any given time.This would at least tell investigators where to start looking if they realize a design used in a crime is made by a specific studio. It would pretty much give away the farm if the design is in the facial recognition database and the purchase is easily traceable.

There are some simple workarounds criminals can use in the meantime: they can “straw purchase” their disguises through a non-suspicious person. A tech-savvy “straw purchaser” might even re-sell theatric masks anonymously on the dark web. Criminals could acquire masks through fraud, or otherwise procure them while leaving fewer clues in the transaction. They can commission legitimate makers for custom mask work. This might make the mask more unique, and therefore harder for software or investigators to identify, but it could also make the piece more memorable for the artist. If they have some artistic skill, criminals might procure professional theatric masks and then do their own DIY customizations. That way, the mask would still be realistic, but won’t precisely match anything offered by legitimate companies, making it harder to trace.

But the best option for criminal users is to get these disguises completely off-the-radar, with no legitimate transactions to retrace, and no connection to any known designs on the market. Sophisticated custom jobs with totally unique designs would be even better. That would allow a criminal user to assume any identity they’re capable of customizing a mask for. Many criminal uses of these masks involve a significant switcheroo on physical characteristics; if you’re young, you disguise yourself as old. If you’re black, you disguise yourself as white, and vice versa. Why not? The masks are good enough that you might as well throw investigators off as much as possible. We haven’t seen many cases of gender switcheroo yet. Considering that some people get caught simply because their acting or voice are not convincing enough, switching genders is probably one of the harder exploits to pull off.

But it’s definitely possible. Pro companies make masks with upper torso curtains to match skin tone, texture, and shape far enough down the body to stay convincing in different clothing styles. Otherwise, the neck and upper body would need to be fully covered at all times to avoid telegraphing the disguise. This makes even a gender switch pretty convincing. Realflesh is one pro company that offers a few female models with anatomically correct features. Physically, you really can’t get much more disguised once you’ve convincingly switched age, gender, and race. It’s easy enough to supplement the switcheroo with moderate manipulations to height, or significant manipulations of body shape underneath clothing.

Of course, investigators do have a few more tricks up their sleeves. For the time being, mask materials that are visually convincing while also capable of reliably fooling thermal or millimeter-wave scanners would probably be too much to expect, so an unlucky few might actually get caught by TSA. Investigators can do more exotic stuff now like vein analysis (examining unique visible patterns of blood vessels) or gait analysis (examining unique strides and movements). Neither is as reliable as a good facial recognition match, which itself is not as reliable as traditional forensic and biometric ID methods like fingerprints, but these techniques have worked in some cases. Famously, investigators used a combination of vein analysis and other tools to match Khalid Sheikh Mohammed as the killer of Daniel Pearl.

The need to wear gloves can be a problem for criminal users. On one hand, it’s not unusual for a robber to wear gloves during the act, but any observations of a suspect wearing gloves under unusual conditions might be a clue for investigators. Obviously, if the hands aren’t covered, a serious race or age switch is going to be obvious. Combine that with likely improvements to vein analysis in coming decades, and there’s an incentive to develop flesh-mimicking gloves (possibly forearm length) or other makeup and prosthetic techniques to make the hands appear a natural match with the face and upper torso. A very sophisticated operator might even make gloves that will spoof fingerprints, truly enabling an identity switch. This stuff requires a lot of skill. But technology is already expanding options, making some things more accessible to the less-skilled, and giving skilled artists ever more impressive capabilities.

As the public and private infrastructures for mass facial recognition are developing, so are the technologies behind disguises. We really shouldn’t be surprised if a kind of arms race develops between the various parties trying to build and improve facial recognition systems, and the parties trying to bypass them. Facial recognition and big data are almost inseparable conceptually, and this concerns everyone, not just criminals. The more faces captured, the better most facial recognition systems will work. Social media (most especially Facebook), have a huge advantage at harnessing facial recognition data. Over a billion users around the world voluntarily provide Facebook and other social media applications with tons of high-quality photographs from different angles and in different lighting conditions. Users also provide photos of themselves over periods of years or decades, allowing for time-series analysis.

Through incessant selfie-ing and tagging the photos of every person we’ve ever met, we’ve given Facebook the “largest biometric database” in the world. And this thing is way better than anything law enforcement has. Law enforcement can search millions of mug shots and DMV records with facial recognition software, and they can compare CCTV footage to these databases. But the records in these databases are of varying quality, and usually involve only a small number of images from limited angles. Facebook has full photo albums provided by a billion users in high-resolution under a huge variety of conditions. The introduction of tagging only improved accuracy.

Facial recognition systems are still limited in their ability to identify individuals among a much larger sample. If all a system needs to do is verify a known person’s identity under controlled conditions by comparing a new image with high quality images already enrolled in the system, it can do that very accurately. But these systems still struggle to identify unknown individuals among much larger populations in uncontrolled conditions.[viii] A 99% accuracy rate sounds great until you realize that there will be 100 false positives in a population of 10,000, or 10,000 false positives in a population of a million. Finding “that one guy” in a major city based on facial recognition software alone is still very difficult. The holy grail of facial recognition would be a system capable of identifying unknown individuals by facial biometrics in real time, within large populations, under realistic passive collection conditions (i.e. people are scanned in their daily business without being required to alter their behavior, and may not even know they are being scanned). To develop systems capable of meeting this standard, the largest possible database is ideal.

With over a billion users already voluntarily in the system, Facebook has the perfect dataset for overcoming the obstacles that have prevented truly robust and reliable facial recognition. Facebook will probably end up owning the world with this somehow, but until then, one question is how aggressively law enforcement agencies will push for access to Facebook’s biometric data, and another is whether (and which) intelligence agencies are already looting Facebook’s precious precious faces. The rapidity with which surveillance has become pervasive has also led to some creative resistance. Obviously, criminals want to get around it, but not everybody who wants to fool CCTV and facial recognition is a criminal. Some people just value privacy or want to make a statement about the overall techno-social weirdness of going from a world where tracking everyone’s face would have been technically inconceivable, to a world where it became technically conceivable but remained legally and politically questionable, to world where it’s just happening.

Chicago artist Leo Selvaggio mounted a campaign to encourage public discussion on surveillance, but he used a novel method. Selvaggio’s URME Surveillance Project enables people to use his “Personal Surveillance Identity Prosthetic.” The PSIP is actually a realistic 3D printed reproduction of his own face. Selvaggio claims that “All URME devices have been tested for facial recognition and each properly identifies the wearer of [as] me on Facebook, which has some of the most sophisticated facial recognition software around.” A user wearing the mask will (theoretically) show up as Selvaggio in facial recognition systems, and even if a system doesn’t ID the wearer as Selvaggio, the mask will prevent accurate identification.

disguises6Ever feel like things are getting a little Minority Report-y? Me neither (Image Source)

To get one of these definitely not creepy masks, you just order them from, and they’ll 3D print it for you. And here’s a key factor: if you can provide a few high resolution photos to thatsmyface or similar custom additive manufacturers, you can get a reproduction of anybody’s face. (They do take bitcoin, by the way). Now, these masks are probably not going to be fooling people up close, since they are not custom fitted to the wearer. (Hence, the creepy eye situation). However, the concept is established, and this stuff will only improve over time. It’s all a little weird, but Selvaggio’s got a point: we haven’t really discussed and hashed out all the implications of bulk facial recognition in public spaces, and we really haven’t hashed out what happens once people develop methods to defeat “big face.”

There are other issues too, and we’re just starting to seriously discuss them. Privacy is one issue, legalities are another. Methods of defeating facial recognition in public are already illegal in many jurisdictions. This didn’t start as a conspiracy to get everybody in the database, most of these anti-mask laws go back decades or further. For example, a lot of southern US states (Florida, for example) put anti-mask laws on the books when they were dealing with the Ku Klux Klan in the old days. Other jurisdictions worried about anarchists, communists, fascists, other old-timey agitators, or common criminals using masks in public spaces. These laws remain on the books in many places around the world.

Today, we’re discovering new issues around the citizen’s right not to be recognized in public, versus the citizen’s obligation to be recognized in public. A lot of the brouhaha about banning female Islamic dress in French public spaces was couched in security terms: this clothing enables anonymity in public, and critics argued that it was a security issue. It definitely has nothing to do with the fact that this anonymizing dress is associated with a specific religion, amiright? Point is, when facial biometrics become a major component of policing and security, non-compliance for any reason (whether noble, malevolent, or neutral), becomes a suspicious act. Creeped out by having your visage tracked and identified at all times in public spaces? What’s the problem? Haven’t you heard that people with nothing to hide, hide nothing? By the way, your goatee is interfering with the scanners. A voucher for some free Soylent will be mailed to your housing pod a couple weeks after the software determines you have removed all facial obstructions.

The privacy issues are significant, but still somewhat abstract. In the Free World, this technology hasn’t really been abused (yet?). Issues for security, crime control, and free expression will probably become more pressing in the shorter term as high-quality masks become more accessible. If disguises capable of tricking human witnesses and CCTV became popularized for a wider variety of crimes, it could really be a game changer for police and courts. What happens when anybody identified by witnesses or CCTV could theoretically be somebody else? What happens when people start framing each other for crimes using super-realistic disguises (possibly even using fingerprint spoofing as well)?

One of the ostensible benefits of mass surveillance is that it prevents faulty suspicion: if everyone is constantly tracked, then at least police will be able to quickly rule out suspects. But if surveillance data alone is considered strong enough to provide an airtight alibi, will it also provide an airtight case against some poor sucker who gets framed by a mask-wearing scofflaw? Will people get masks of themselves and ask others to wear them in public to provide an alibi? How do we enforce laws against wearing masks in public, or take advantage of CCTV and facial recognition for their legitimately beneficial purposes, if the masks are so good nobody can tell they’re masks anymore?

Some protest groups use masks. The legalities of this may differ, but it’s a common practice among “Black Blocs” and anarchists and so forth. Can it ever be considered protected artistic expression or legitimate political speech to appropriate the face of a celebrity or politician in public? On one hand, the masks do conceal identities. On the other hand, the newly-appropriated identity might arguably qualify as a political statement. Imagine a thousand Donald Trumps protesting in favor of comprehensive immigration reform, or a thousand Hillary Clintons occupying Wall Street. It’s a bit weird, but the faces selected by protestors might be considered a part of the political expression.

What happens when people start appropriating the faces of celebrities and public figures? How will journalists and bloggers ensure that the latest video of Nic Cage absolutely losing his shit, is actually Nic Cage and not somebody else playing a prank?[ix] Will stalkers, kidnappers, or assassins use these masks to appropriate the identity of a trusted person and gain access to their target? If you thought the concept of bulk facial recognition was already a little paranoia-inducing, just wait till the methods of defeating recognition take us all on a fast train to freaky town. I know what you’re thinking. You’re thinking, “come on, paranoid security nerd from the internet, these issues are way in the future.”


I’ll give you a minute to recover from this (Image Source: Carly Cooper)

You’d be right. These complications are in the future. But they’re approaching quicker than you might think. The 4th Industrial Revolution is making it easier to make stuff, and the stuff people can make keeps getting better. Technology is already giving us a hint. There are some pretty amazing applications of artisanal techniques to mask making, and these are increasingly combining with high-tech digital fabrication processes. 3D printed masks are already a thing, and they’re getting better of course. Theoretically, digital CNC could be used to “finish” the artisanal mask sculpting process with very high precision. One big tipping point will be affordable 3D printers capable of working in latex, silicone, or other viscous materials well-suited to special effects and mask making. Oh wait, so they’re working on that already?

3D printers still can’t rapidly fabricate a custom mask like in that one movie. That’s a limit, but the most important component isn’t speed of fabrication, it’s the quality and precision of the product, and the pricing and accessibility of the production capabilities. Using image capture, specialized software, and consumer-grade additive tools, it may be possible for a reasonably skilled hobbyist of the future to make any face she desires using affordable (and quite possibly, open source) tools. The sky is the limit for legitimate industrial and commercial applications. These technologies could eventually be a big deal for the mainstream medical, film, theater, and special effects industries, and something tells me the CIA already has a sub-basement stocked with 3D printed masks of the entire Russian Duma.

The digital fabrication, SPFX, and open source DIY communities are already developing these capabilities, and there are lots of legitimate reasons for it. Some 3D printing companies and equipment enable artists to design and manufacture amazingly elaborate masks, headgear, and clothing:


Ever feel like things are getting a littler Hunger Game-y? Me Neither (Image Source– 3D Printshow)

Another positive application is in facial reconstruction. If you can make convincing custom masks, you can really help out people with disfigurements. It’s not quite a face transplant, but it won’t be rejected either. Some other principles that go into custom theatrical masks have medical applications. This company uses image capture, 3D modeling, and 3D printing to make perfectly customized oxygen masks for CPAP sufferers. If you read the full article, you’ll see how much design and engineering know-how they’re throwing at this. Artists, performers, educators, and students can make and use custom masks for fun activities. Students at this college 3D printed some cool custom theatrical masks for their Greek play, and the masks were based on the students’ own faces. Naturally, Bjork is involved. She’s performing in 3D printed masks “based on her musculoskeletal system.”       


So….we’re gonna be ok? Is that what this means? (Image Source)

Hyper-realistic disguises will eventually become more than an occasional “true crime” curiosity. As technology enables public and private institutions to build infrastructures that recognize our bodies ever more effectively, they also enable entrepreneurs, artists, hackers, criminals, and activists to create physical objects that can spoof or exploit these systems. The Digital Revolution may have made bulk facial recognition technically inevitable, but the 4th Industrial Revolution may now complicate this vision of all-encompassing CCTV and facial recognition systems. We may all be destined to have our faces entered as data points in some quasi-omniscient database of the future. Yet, in post-industrial society, these systems may never be completely effective at tracking those who are motivated and skilled enough to become someone else.


[i] Still a thing?

[ii] S.J. Platz & H.M. Hosch, (1988). “Cross-Racial/Ethnic Eyewitness Identification: A Field Study,” Journal of Applied Social Psychology 18, 11(1988): 972–984

[iii] K. Hugenberg, J. Miller, & H.M. Claypool, “Categorization and individuation in the cross-race recognition deficit: Toward a solution to an insidious problem,”Journal of Experimental Social Psychology 43 (2007): 334–340

[iv] G.M. Combs & J. Griffith, “An Examination of Interracial Contact: The Influence of Cross-Race Interpersonal Efficacy and Affect Regulation”. Human Resource Development Review. 6, 3(September 1, 2007): 222–244.

[v] Though they’re working on it…

[vi] Another Ben Affleck connection?

[vii] Simon Carswell, “The Agent behind the “Argo” Mask,” Irish Times, February 23, 2013,

[viii] (aka, identifying individuals “in the wild.”)

[ix] Perhaps John Travolta in some kind of 21st century Face/Off re-boot?

One thought on “Crime Unmasked: Security, Surveillance, and the Post-Industrial Face/Off

  1. Pingback: The Urkel Hack: Facial Recognition and the Perturbed 10% | Making Crimes

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s