The future of anti-surveillance fashion

Mashable’s series explores how the challenges of today will dramatically change the near future. 

Today, face masks are an essential public health tool. In the future, they could be the ultimate anti-surveillance fashion statement. 

Strangely patterned sweatshirts, reflective eyewear, wild face paint. Over the past decade, computer science researchers, artists, fashion designers, and hobbyists have been creating clothing that makes it harder for surveillance systems to identify people.

So far, these creations have been mostly experimental, or only worn in niche . 

However, thanks to the unique circumstances of 2020, the idea of averting or subverting surveillance through fashion is having a moment.

“Obviously we’ve been handed a very interesting coincidence of history, which is that face masks are more acceptable than they’ve ever been,” Kate Bertash, a cybersecurity professional who runs a website called AdversarialFashion.com, said. “They’re necessary for public health reasons, and people are making sure you avoid facial recognition in protests.”

The coronavirus pandemic has made wearing face masks widespread and socially acceptable, while unprecedented participation in protests against police brutality has raised awareness about the surveillance state and shown how important it is for protesters to protect their identities. 

Police have met protests with drone, helicopter, and airplane surveillance, feeding into a federal system that enables law enforcement to use the footage for future investigations. They’ve already used facial recognition to . In response, guides on how to protect your digital identity circulated widely. Rep. Alexandria Ocasio-Cortez advised protesters to wear nondescript clothing and leave smartphones at home or go into airplane mode to evade tracking.

At the same time, previously disparate camps in anti-surveillance fashion have started collaborating, with more amateurs and students joining the bandwagon. Some face masks now feature images that confuse surveillance systems — and that has the potential to go mainstream.

“I’m excited to see what people put on masks,” Bertash said. “Especially with face masks, I don’t think we even know yet what can be done to undermine facial recognition by obscuring a part of the face.”

Accessory of the future

Cihang Xie, a fifth-year computer science Ph.D. student at Johns Hopkins University, is trying to make computer vision systems that recognize images smarter. He also inadvertently created anti-surveillance fashion tools for protesters.

“Just do not use it for bad things,” Xie said, when asked how he would feel about protesters using his research to protect their identities.

Along with several colleagues at both U.S. and Chinese universities, Xie recently about creating a Universal Physical Camouflage (UPC) Attack, or basically a framework for creating patterns that cause object recognition systems to misclassify what they’re looking at. The paper shows how easy it is to fool these systems, and to ultimately make AI smarter by identifying (and patching) their vulnerabilities.

The researchers put their patterns on clothing, and showed that they could trick a computer into thinking a human was a potted plant or a bird. Others have undertaken similar research: Tom Goldstein, a computer science professor at the University of Maryland, programmed an algorithm to design an “invisibility cloak” that made humans invisible (not just misclassified) to an image recognition system. But while Goldsein puts his cloak mostly on T-shirts and sweatshirts, Xie’s research team also put their computer-fooling images on face masks.

“Wearing a mask is already occlusion, and that’s already a hard question for facial recognition,” Xie said. “With more patterns, especially adversarial patterns, that definitely will make the problem much much harder. I do not know any solution yet.”

Goldstein sees this as an exciting strategy.

“Now that you have the ability to wear a mask, you can cover so much more of your body,” Goldstein said. “The more of your body that you can cover with adversarial patterns, the more susceptible these attacks are.”

Bertash has also been playing with adversarial patterns and face coverings. She puts images of fake license plates on backpacks, shirts, and other items, in order to feed Automatic License Plate Readers (ALPRs) “junk data.” This is called a poison attack, which intentionally makes surveillance systems less accurate. She now makes fake license plate-covered face masks and buffs.

“What I I have learned over this past year and a half of really trying to dig deep and understand is that this is still a very open area of research,” Bertash said. “People will come to realize, especially in the next five years, nobody has quite figured out what computers are looking at when they look at a human’s face.”

The extent to which mask wearing undermines facial recognition systems is not yet known. While some reports show that mask wearing is , others show that there are , or that the people making facial recognition tech .

However, Goldsein still sees mask wearing as the future of anti-surveillance fashion, both because of its power to become widely worn, and its effectiveness at undermining systems.

“Adversarial things like cloaks and clothing, I think they will improve in their accuracy, but I don’t think they’ll ever be as reliable as just covering your face,” Goldstein said. “To me, the potential of masks in public spaces is what I see as the biggest opportunity for counter-surveillance.”

Walk this way

Nina Zhong, a Parsons School of Design senior studying fashion, is facing a problem: how to create anti-surveillance shoes that are comfortable enough to wear.

“I haven’t totally finalized this yet, but I was looking to create heels which are asymmetrical,” Zhong said. “I think the problem with this is that it might be kind of uncomfortable to walk in a different way, but it might be worth the difference.”

Zhong says she takes inspiration from Bertash and adversarial fashion designer Adam Harvey to prevent the collection of “soft biometrics” like height, weight, and hair color. Since some systems can identify a person by their gait, Zhong is trying to create shoes that would change the way a person walks.

In the past, she has felt “alone” in this work. But now that her friends and classmates are taking to the street, and combining skill sets like protest tactics and fashion design, she feels things are changing.

“I have friends who have experience doing this in actual real life, like in protests,” Zhong said. “I myself am getting more feedback for those kinds of events. When people work together it’s a lot more effective.”

Bertash was excited to hear that a fashion student was inspired by her work. She felt it showed that the ability to fight back against surveillance was becoming more widespread and accessible.

“The big moment that I see happening right now is that artists in particular are realizing the mechanics of the way these things work,” Bertash said. “Once they find an experimental environment, I think a lot of people can have the same ability to start playing with things in their closet.”

The trend has extended beyond the fashion world. Academics are reaching more people, and building on each other’s work, too. 

“It used to be people who were interested in surveillance were in different camps,” Goldstein said. “AI, security and systems databases, people who work on human computer interaction, it used to be that these three academic communities never spoke to each other. But now, suddenly all of this is coming together.” 

Researchers and designers are also making their work more accessible. Bertash’s website has a section that teaches others how to make their own poison attacks. The designer of the camouflage face masks, Xie, has put his designs and research on GitHub for anyone to download. Although he didn’t intend for it to become a tool for protest, he’s not averse to the idea — and even sees its benefits.

“If you want to protect yourself, you don’t want your government to know your information, you should know this technique,” Xie said. “Anybody who wants to use it, our paper is there. You are free to download them.”