In March 2018, 18-year-old high schooler Ousmane Bah got a learner’s permit to drive in the city of New York. Then, he lost it.
No biggie, right? It had his name, address, date of birth, sex, height, and eye color, but it didn’t have his photo. These things are just printed receipts, issued as interim permits until an official permit arrives in the mail.
As far as identity theft goes, Bah didn’t worry about it. The license said on its face that it wasn’t meant to serve for identification purposes. He’d get an actual permit in the mail shortly, so he didn’t file a police report.
Unfortunately, there was more for Bah to worry about than he realized. He got a summons to appear in Boston municipal court. He had been accused of larceny over $1,200 for allegedly ripping off multiple Apple pencils, each of which retail for $99, from an Apple store in Boston.
Bah says he’s never been to Boston before the 27 June arraignment. What’s more, on the date of the alleged theft, he’d been at his senior prom in Manhattan. That wouldn’t be the only criminal charges he’d face, either.
According to a lawsuit Bah filed on Monday in the US District Court for the Southern District of New York, he’s been charged with similar crimes in multiple jurisdictions, including Delaware, Massachusetts, New Jersey and New York, all for allegedly ripping off Apple stores. Three of the cases have been dropped, the suit said, but the one in New Jersey is still pending.
Bah is suing Apple for $1 billion for what his suit says is Apple’s reliance on facial recognition software to identify a suspect, who, the suit says, must have gotten his hands on Bah’s photo-less interim license. That permit was never supposed to be used as identification, yet Apple allegedly failed to use anything else to verify the true suspect’s identity. From the suit:
The irony here is that Defendant [Apple] relied heavily on one method of identification – facial recognition software – and failed to use a more labor-intensive form of verifying the true suspect’s identity. The latter method is similar in many ways to multi-step authentication; it requires the use of information from various, reliable sources, such as a driver’s license photograph or a government-issued identification card that contains a photograph, to confirm a particular individual’s identity. Given the number of individuals who provide false identification when suspected of committing a crime, it is remarkable that Defendant blindly accepted the photograph-less learner’s permit as a valid form of identification.
Does Apple really use facial recognition to identify shoplifters? As the Washington Post reports, the company declined to comment on the lawsuit itself, but it did say that it does not, in fact, use the technology in its stores.
How in the world did Apple finger Bah for the crime?
According to the lawsuit, Bah, who was arrested at his home in November, was served a warrant that had somebody else’s photo on it. The suit claims that a New York detective who viewed surveillance video from the Manhattan store concluded that the alleged thief “looked nothing like” Bah.
The suspect’s height, in fact, didn’t match what was listed on Bah’s learner’s permit.
Similar to the detective’s conclusion, the Boston district attorney, after looking at surveillance footage, dismissed the case against Bah.
Bah’s suit claims that none of these charges should have been made against him. They were because Apple allegedly accepted an interim permit, without a photo, that never should have been used for identification purposes, as a valid form of identification.
Bah has been forced to travel to multiple states to fight these spurious charges, the suit claims, was subject to a “shocking and traumatic” arrest at his home at 4:00 am, has been shamed and humiliated, and was forced to miss multiple days at school, which has brought down his grades.
Besides the $1 billion, the suit seeks a declaration that Apple “wrongfully and baselessly damaged” Bah’s reputation, and a court order compelling Apple to “address the mistake in the stored data” that links Bah’s identifying information to the company’s facial recognition technology.
Ian
I want…..100 billion dollars
Mahhn
1B is to much but he should get compensation, as well as apple fixing their system and a “huge” apology, including from the courts for accepting poop as evidence to press charges. Maybe also be a case study/awareness item of flaws of facial ID systems.
Terry
Here’s a thing. I recently bought something in an Apple store here in the UK. The guy who served me asked me for my email address so that he could send me a paperless receipt. I agreed. He then – without asking my permission – took a photograph of my face and shoulders with his Apple Store iPhone. Am I able to ask Apple to delete my photo from its records? Had I been given the option on having my photograph taken by the store assistant, I would have refused. I was not given this option. All informed suggestions will be gratefully received.
Alison Meeks (@AMGraphix)
Hey Terry – You absolutely should. The GDPR should have you covered on that. At your request they must be able to remove any info on you from their system. That may have some affect on iTunes and other system conveniences so review closely.
Terry
Many thanks indeed, Alison! I will contact Apple first thing tomorrow morning and request them to remove my photograph from their system and will, as you suggest, review all their apps on my MacBook Pro and my phone to check that this has done. I’ve been in that Apple Store multiple times before and they have never ever asked for my photograph. Then they just snapped me without any warning or explanation. I was so taken aback I just accepted it and left with my purchase. Apple probably has this all figured out as an effective, self-serving tactic…
Paul Ducklin
To be clear, I don’t think GDPR gives you an absolute right to have all your data purged – there may be competing regulations that require some of it to be kept, e.g. an employer keeping hold of records of how much they paid you and what tax was witheld, or a merchant keeping transaction data including details like purchaser, price and VAT amount.
But snapping a closeup photo of you after accepting your money and processing the transaction is isn’t just sneaky, its IMO creepy… where is that pic going to end up next? What sort of weirdo territory is that? I’ll be interested to hear how you get along.
Terry
Thanks for this info. Paul. I will let you know how I get along, as you suggest.
dtorgersen86
Terry, Alison is correct that GDPR will allow you to remove any PII (Personal Identifiable Information), including photographs, name, account details, etc upon your request. Upon receiving your request they have 72 hours to respond and start removal. In addition, any agreement would have required explicit consent with which you have the ability to rescind your permission. Regardless, you have your rights under the Right to Be Forgotten caveat. You should file a complaint with your DPA (Data Protection Authority) and contact Apple.
Hope this helps!
Paul Ducklin
Might be worth asking Apple to remove the data first before complaining – my suspicion is that the Information Commissioner’s Office would ask, if you were to complain, if you had actually tried to get the situation sorted out first…
Terry
Good point, Paul. I’ve identified the name of the Apple rep. who took my photograph and have constructed a detailed email for Apple. Will send this on Monday.
Paul Ducklin
The shorter you make the email the easier it will be for Apple to decide if and what to do. If you hit them up with a lot of whens, whys and wherefores, and quote the law at them, and use lots of formalisms up front, then any response they produce will involve more complication (and lawyerliness) on their side.
Presumably, the result you really want it simple: get the photo removed. So I’d simply say words to this effect: “On YYYY-MM-DD I bought an X in your store in Y. After paying for it, the sales person deliberately snapped a photo of me with their work phone, without asking me first. I didn’t want my photo taken and I would have refused if asked, so I am writing to tell you that now. Will you kindly locate that photo, wherever it has ended up, remove it from your systems, and let me know that you have done so? Thanks. I look forward to your prompt response.”
IMO you don’t need to remind them of their obligations, quote GDPR at them, or sound like a lawyer in high dudgeon. (Not yet, anyway.) If they routinely dig their heels in they will do so anyway… if not, they will probably just pass it on to their data deletion department and deal with it like every other request…
My 2p. Make it really easy for them to know what you want.
Terry
This does indeed help, dtorgersen86. Many thanks for your detailed response.
Dave Marcus
Doesn’t the right to be forgotten apply?
Terry
I’ll be testing this directly. Thanks for your reply.
Dimitrios Stergiou
You can use GDPR (right to be forgotten) to ask them to delete your personal data (e.g. your pic). You can also, if you feel strongly about it, contact the regulator (ICO) and file a complain for the the way your personal data were collected and used (without your consent)
David Bradbury
He’ll be lucky to get more than his costs and an ex-gracia payment as hush money.
Riggarob
When I first looked at the headline, I figured it was clickbait. So I clicked on it anyway LOL. But it appears that at least some states attorneys have a half a brain and looked at the footage and just said this isn’t our guy. The fact that he had to travel to these destinations, Miss time from school, (and it may be questionable whether it affected his grades), but he must be a senior because at 18 years old that’s what I was. Senior year is a tough year for getting everything squared away for your college applications and so forth. I agree with the other comment of the 1 billion dollars is just to wake people up in the system, and also he should be highly compensated for all of this. Government / corporations have total disregard for the Common Man. And it’s odd, because without us, the common men / women, there would be no corporations because we are who they sell to. And the government entities completely forget that they work for us! I’ll repeat that, they work for us! We are all too often treated as criminals on unsubstantiated evidence, trumped-up charges, you get the idea. I hope this kid gets at least $250,000 for his troubles.
Seve
No it is not too much.
Glen Hughes
I agree with you. It is far too little if you ask me! The thing of it is the crime could have been more serious and ended up imprisoned for life. I’d have asked for more just to make sure apple fix this problem before it cause serious problem for any individual.
Anonymous
Way way too much..people that are killed unjustly, their pay out isnt even one hundredth of that amount..pipe dreams youngin, pipe dreams..
Mike Schwab (@maschwab63)
40-50 years of employment, $20-50K reduction per year in income, thats $800,000-2,500,000 lost income, plus reduced retirement say another $.3-1M. $10M I would award.
Riggarob
Having thought more about it, I think you’re correct. My 250k was obviously the low end I would except if I were he.
Ian
Missing a week of school costs $20-50k reduction per year in income??? Not sure I agree with that but if its true then I am going to be really mad at my parents for taking me out of school to go on a Disney vacation in 7th grade.
Paul Ducklin
$50,000 a year for 50 years certainly made me laugh. Heck, how much those afternoons off to travel to away sporting fixtures must have cost us now I look back! How much we hated getting on buses to go off and play cricket in the sunshine when we could have been sitting through a double Geography class in a stuffy classroom, followed by the riveting prospect of English Language for two periods (plus three commas, two exclamation points and a semicolon).
Bryan
Bad puns.
It’s how eye roll.
Riggarob
😜🤙👍
Grey
I would never use apple reason is they don’t want you to know that they are using facial recognition they blantly lie to cover it up. If they just ask most people don’t like having pic taken from those store execpt dmv office. Apple secertly took a pic without your knowing just look at the ceiling and if you see camera up there then they are using facial recognition Verizon is also doin the same thing. This ain’t no joke
Anonymous
I’m confused, what did the driving permit without his photo have to do with it? And why did they say it was him?
Paul Ducklin
I think there are a lot of confused and missing parts in this story – I suppose that we shouldn’t be surprised that an 18-year-old student with such an absurdly and selfishly inflated sense of self-worth might not bother with the sort of details that would help us make sense of the situation.
It certainly seems all cock-eyed to me – there’s a driving licence that didn’t have a photo that he’s nevertheless insisting is “identification” (well, it is now it’s convenient to him to say it is – back when he lost it and didn’t bother to report it missing he seems to have considered it to be a document of no consequence); there’s blame of facial recognition that Apple says doesn’t actually exist in the form he claims; and there’s Apple being sued when surely his beef would more correctly be with the police and court officials who did the investigation and brought the criminal charges – none of which actually went forward anyway. I don’t get it at all.
But the silver lining is that, thanks to the plaintiff’s penchant for misusing the civil court system for dramatic marketing purposes by making preposterous claims to be owed $1,000,000,000, his name is now known to possible future employers everywhere.
As Shakespeare might have said, “The gentleman doth protest too much, methinks.”