Police in the US city of New York used a photo of actor Woody Harrelson in an attempt to identify a thief who looked like him.

That is according to a report published Thursday from Georgetown University.

The report claimed public records showed the NYPD used facial recognition on a photo of Harrelson to identify and arrest a supposed lookalike suspect.

"On multiple occasions, when blurry or flawed photos of suspects have failed to turn up good leads, analysts have instead picked a celebrity they thought looked like the suspect, then run the celebrity's photo through their automated face recognition system looking for a lead", the university said.

The report released by the Center on Privacy & Technology examined how police agencies across the US "misuse face recognition technology", with reference to actual use cases from the NYPD.

It said analysts using these systems also sometimes submit forensic sketches, and "routinely doctor" low-quality photos to make them clearer - including by copying and pasting facial features from someone else's face onto a photo of an unknown suspect.

On the left: a slide from the NYPD FIS describing its "celebrity comparison" technique. On the right, a photo of Woody Harrelson | Source: left, NYPD; right, Gabriel Cristóver Pérez/LBJ Presidential Library

The report claimed: "On April 28, 2017, a suspect was caught on camera reportedly stealing beer from a CVS in New York City.

"The store surveillance camera that recorded the incident captured the suspect’s face, but it was partially obscured and highly pixelated.

"When the investigating detectives submitted the photo to the New York Police Department's (NYPD) facial recognition system, it returned no useful matches.

"Rather than concluding that the suspect could not be identified using face recognition, however, the detectives got creative.

"One detective from the Facial Identification Section (FIS), responsible for conducting face recognition searches for the NYPD, noted that the suspect looked like the actor Woody Harrelson."

"A Google image search for the actor predictably returned high-quality images, which detectives then submitted to the face recognition algorithm in place of the suspect's photo.

"In the resulting list of possible candidates, the detectives identified someone they believed was a match - not to Harrelson, but to the suspect whose photo had produced no possible hits.

"This celebrity 'match' was sent back to the investigating officers, and someone who was not Woody Harrelson was eventually arrested for petit larceny."

The report added: "There are no rules when it comes to what images police can submit to face recognition algorithms to generate investigative leads.

"As a consequence, agencies across the country can—and do—submit all manner of 'probe photos,' photos of unknown individuals submitted for search against a police or driver license database.

"These images may be low-quality surveillance camera stills, social media photos with filters, and scanned photo album pictures.

"Records from police departments show they may also include computer-generated facial features, or composite or artist sketches."

A slide from NYPD FIS describing “Removal of Facial Expression” technique | Source: NYPD

Another technique that the NYPD and other agencies use involves 3D modeling software to complete partial faces and to 'normalize' or rotate faces that are turned away from the camera.

The report suggested: "After generating a 3D model, the software will fill in the missing facial data with an approximation of what it should look like, based on the visible part of what the subject's face looks like as well as the measurements of an 'average' face.

"According to the NYPD, the software creates 'a virtual appearance of the suspect looking straight ahead, replicating a pose of a standard mugshot'".

Without any regulation, police have been abusing face recognition tools. This includes editing photos of suspects, even adding in features from other peoples’ photos, in order to find potential matches. pic.twitter.com/a1Txz3sx1X

— Georgetown Privacy (@GeorgetownCPT) May 16, 2019