What do the Toronto Police Service, the owners of the Eaton Centre and Canada's federal government have in common?

They've all now been caught using facial recognition technology on members of the public without consent, warning or even notice — and they didn't just scan a few faces, but millions.

An explosive report in The Globe and Mail today reveals that Government of Canada officials "quietly tested facial recognition technology on millions of unsuspecting travellers at Toronto's Pearson International Airport in 2016."

The pilot project, dubbed "Faces on the Move," ran for about six months, from July to December of 2016. About 2,951,540 people passed through border control at Pearson's Terminal 3 during that time period.

An Ottawa-based tech firm called Face4 Systems conducted the program on behalf of the Canada Border Services Agency (CBSA), and revealed in presentation slides obtained by the Globe that the technology was used on between 15,000 and 20,000 travellers per day during the test.

But why?

Well, as documents obtained by the newspaper through a freedom of information request show, the initiative was "meant to pick out people the [CBSA] suspected might try to enter the country using fake identification."

Damn I worked as a manager at a YYZ Pearson Airport CATSA screening checkpoint in 2016. Never knew anything about this!

— Nathan A Drescher (@NateDrescher) July 19, 2021

"The CBSA has identified thousands of international travellers who have been denied entry to Canada or who have been deported after being admitted into Canada," reads an 87-page-long CBSA report outlining the program.

"These travellers have been deemed inadmissible for any of a number of reasons, such as security, criminality, health grounds, misrepresentation or non-compliance with the lRPA. Many of these inadmissible travellers try repeatedly to re-enter Canada."

"The CBSA uses a list containing the names of previously deported persons and other similar lists to identify inadmissible travellers at ports of entry. Many such travellers, however, use false identity documents, or even legally change their names in their home countries and obtain new, legal travel documents under their new names," the report continues.

"Name-based lists such as those currently in use have inherent limitations which can be overcome using biometric technologies."

While the concept of using facial recognition to catch repeated illegal border crossers is interesting, it's also fraught with potential complications including human rights violations and privacy breaches.

First off, the CBSA didn't put up any signs at the airport to inform travellers that their faces were being scanned. While a summary was posted to the agency's website back in 2016, it wasn't widely publicized, and did not specify which airport was being used for the facial recognition tests.

In Canada would of course *never* become a surveillance dystopia news*...

"Ottawa tested facial recognition on millions of travellers at Toronto’s Pearson airport in 2016"https://t.co/nyG8ApaFad pic.twitter.com/NmcU0pcokT

— David Moscrop (@David_Moscrop) July 19, 2021

"As travellers walked through the international arrivals border control area at Pearson’s Terminal 3, 31 cameras captured images of their faces," explains the Globe and Mail report.

"Whenever the system returned a match against a 5,000-person list of previously deported people, a border officer would review the data and pass the traveller’s information along to an officer on the terminal floor, who would track the traveller down and pull them into a 'secondary inspection.'"

Face4 Systems Inc. confirmed in an undated presentation deck that the 2016 pilot returned 47 "real hits," meaning that it detected 47 people whose faces matched those already in the CBSA's "previously deported persons" database.

It is not clear if the project actually got anyone deported, but its very existence is setting off alarms among privacy experts, including Canada Research Chair in Internet and E-commerce Law Michael Geist, who glibly pointed out on Twitter today that:

"A year after an election campaign in which surveillance and Bill C-51 was a major issue with promises of reform, the government tested facial recognition technology on millions of people at Pearson Airport with no disclosure."

The CBSA Privacy Impact Assessment document does state that while "facial photographs, some scene camera recordings, and POD records must be retained until the end of the project," all records were to be destroyed by the end of it "except for records that were used for an 'administrative purpose'."

A CBSA spokesperson told the Globe and Mail that all facial recognition technology used for the project was removed from Pearson at the end of the test period, and that images collected of travellers have been erased.

It is, however, getting harder for people to believe such statements as reports of unauthorized facial recognition surveillance programs continue to surface all over the world.