At the number 13 stop, in the morning around twenty past seven, there is a girl who always wears the same makeup: two black stripes across her cheekbones, her hair pulled to cover half her eye, the rest of her face bare. Nobody looks at her, or they look at her the way they look at anyone at that hour. The makeup, though, was not designed for us: it is drawn so that a camera cannot recognise her face.
The first person to build these objects was the artist Adam Harvey, with a project called CV Dazzle: makeup and hairstyles that break the geometric symmetry on which facial recognition systems orient themselves. Then came Kate Rose's Adversarial Fashion, prints that throw automatic licence plate readers off track. Now those objects have a retail price. Cap_able, the brand founded by Rachele Didero, sells knitwear with patterns designed to make recognition harder: «when I started, in 2018, people thought I was designing masks for robbing banks», she told the Guardian last month. Urban Privacy, founded after its co-founder Daniel Preuß had read the Snowden revelations, uses large prints and asymmetric cuts, and has in its catalogue a coat with LEDs in the hood that emit infrared to blind night-vision cameras.
They exist because the premise is not a fantasy. In the United Kingdom facial recognition has entered public spaces, the British biometrics watchdogs have called for a law and an authority to prevent its abuses, and a recent survey says that almost six in ten people consider it a step toward a surveillance society. There is a detail that weighs more than the survey: these systems make mistakes, and they make them more often on Black and Asian faces than on white ones. The risk of being misidentified is not distributed evenly, and neither is the risk of having to explain that to someone in uniform.
In Europe the AI Act bans real-time recognition in public spaces except for serious crimes, which changes less than it sounds: the camera at the station records regardless, and between recording and identifying there is only the decision to place that frame next to a database. A database exists. Clearview AI built one by harvesting billions of faces from social media without asking anyone anything, and was fined by privacy authorities across half of Europe. The fines did not erase it.
There is a German word for what this does to a body: Spielraum, the room to play, the space in which we feel free to move. The Swiss psychiatrist Ludwig Binswanger used it to describe anxiety: the square footage stays the same and the available world contracts. When we feel watched, this is what happens, and paranoia becomes a reasonable response. The clinical form describes someone who feels watched by a system that is not watching them; when the system really is watching the affective structure remains identical, because the body has no organ for distinguishing a real threat from an imagined one. It is also why telling someone «but nobody is looking at you» has never worked, even on the occasions when it was true.
What the girl at the number 13 wears is a new form of camouflage, and it is worth measuring how new. The camouflage we know serves to go unseen: the hunter's suit, the branch in front of the face, the grey of the building. This does the opposite and remains camouflage, because it is built so that a person ten metres away notices it perfectly well and a machine cannot extract from the face the proportions it needs. The name comes from that: in 1917 the British navy began painting ships in contrasting diamond shapes, dazzle painting, not to blend them into the sea, which would have been impossible. The point was to make course and speed unreadable to anyone looking through a rangefinder. The ship was perfectly visible. You just couldn't tell where it was going.
The Dutch designer Jip van Leeuwenstein pushed this logic to its conclusion with an object called Surveillance Exclusion: a transparent mask, a curved lens worn over the face that distorts the features just enough that a recognition system cannot extract the geometry it is looking for. It is transparent because whoever is standing in front of you must still be able to see if you are smiling. Here the distinction is clearer than anywhere else: a balaclava removes you from everyone, this lens removes you only from the machine and leaves intact the face that people need. Preuß describes the principle behind his catalogue in blunter terms: recognition systems get confused when they see many faces at once, and his prints play with that disorder.
Then there is the part that makes this story different from a story about disguise, and it begins the moment it works. Every pattern that fools a classifier, as soon as it circulates, becomes an example: it gets photographed, catalogued, and ends up in the training data of the very system it was meant to fool, which learns to recognise it too. The countermeasure feeds the thing it opposes, so it works only for as long as few people wear it, and it must remain rare to remain effective.
The designers, unlike their customers, know this and say so. No garment guarantees anything, Preuß keeps repeating, and the added value of fashion lies in spreading awareness. Jennifer Bell, who studies fashion and digital culture in Nottingham, is more direct: none of these products has been properly tested, and many surveillance systems handle a little resistance just fine. They remain a visible sign, she says, and on that she is right: those who wear them are asserting that they have thought about the issue, and how far that thought moves anything inside a database is…
Nick Tidball, who manufactures technical garments, puts it in writing without alarm: if these clothes really worked the whole thing would become political fast, and they could be banned. For now you can buy them in a shop.
At the number 13 stop this morning, she wasn't there. Or she was there and I didn't recognise her, which is what happens when a person changes their makeup. When she is there I can see her perfectly, the black stripes are visible from ten metres. It's the machine that can't find her.
