Rekognition's only known law enforcement client does not use “confidence threshold”, undermining Amazon's defense against research showing the software's bias
Context & Ripple Effects
Amazon has spent months defending Rekognition against the ACLU's test showing misidentification rates by arguing that accuracy depends on how customers configure the tool — and that setting thresholds is properly a job for government regulators, a line AWS chief Andy Jassy repeated when he said it was Washington's duty to specify rules for facial recognition.
Gizmodo's report cuts that defense at its root: the only known law enforcement client using Rekognition does not set a confidence threshold at all, meaning the safeguard Amazon points to as the fix for biased matches is unused in the field. That matters because Forbes had already shown how cheaply anyone can assemble a working face-matching system on top of the service.
First-order effects
- Amazon's 'configure it correctly' rebuttal loses its factual footing — the one police agency actually deploying Rekognition skips the threshold tuning Amazon says prevents false matches.
- The burden shifts back onto AWS itself: with no customer-side mitigation in practice, Amazon can no longer frame accuracy problems as user error rather than product characteristics.
Second-order effects
- Jassy's push for government-set regulations becomes harder to sustain as a deflection, since regulators now have evidence that the vendor's own recommended safeguard is ignored by its sole known policing customer.
- Other agencies and public-sector buyers evaluating Rekognition face renewed scrutiny over deployment terms, pressuring AWS to consider defaults or contractual requirements rather than optional settings.
Third-order effects
- If the pattern holds — vendors shipping powerful identification tools with safety controls left optional — the likely endpoint is mandated defaults or outright restrictions on facial recognition sales to police, decided by lawmakers rather than left to customer configuration.
- Cloud AI providers broadly confront the structural question of whether they are responsible for downstream use of their models, a liability question that configuration-based defenses appear unable to answer.
The trend: Cloud vendors selling surveillance-capable AI are discovering that leaving ethical safeguards as optional customer settings invites regulators to impose them instead.