Clearview Looking To Expand Its Market To Problematic Countries Known For Human Rights Abuses

from the a-cop's-a-cop,-right? dept

It appears no one's thrilled facial recognition upstart Clearview is scraping their photos to build a facial recognition database to sell to cops. But what can they do about it? Not much more than write angry letters.

Twitter was the first to send a C&D to the troubling developer over this troubling development. It was presumably ignored. Google also issued a C&D, only to be not-so-gently reminded by Clearview that Google does the same thing to build its search engine database. (Of course, web site owners and developers can opt out of being crawled by Google bots -- something that's not an option with Clearview.)

Added to the list of pissed scrapees are Venmo and LinkedIn, the latter known for actually suing people who have scraped its site. Facebook, however, has not done this and it's by far the largest repository of face photos and personal information on the web. Facebook claims to be asking Clearview some tough questions about its scraping and database compilation but it has not sent a formal cease-and-desist.

Maybe Zuckerberg's just disappointed he didn't think of this first. Or, as Aaron Mak speculates for Slate, maybe it has something to with Peter Thiel's early investment in Clearview and his position as a Facebook board member. Thiel likes surveillance and Clearview's scraping of Facebook to compile a facial recognition database may be just the sort of vertical integration he's looking for.

But the bad news gets worse. Clearview's aggressive pursuit of law enforcement agency customers -- combined with its questionable database construction methods -- hasn't won it very many friends. Not even from the law enforcement community, which has been forced to offer rebuttals to exaggerated (or downright false) claims made by Clearview in its marketing materials.

Clearview isn't going to limit itself to the United States. Documents obtained by BuzzFeed show Clearview is pitching its facial recognition app to abusive governments around the world.

A document obtained via a public records request reveals that Clearview has been touting a “rapid international expansion” to prospective clients using a map that highlights how it either has expanded, or plans to expand, to at least 22 more countries, some of which have committed human rights abuses.

The document, part of a presentation given to the North Miami Police Department in November 2019, includes the United Arab Emirates, a country historically hostile to political dissidents, and Qatar and Singapore, the penal codes of which criminalize homosexuality.

So far, Clearview says it only has "partnerships" in the US and Canada. But no developer flogging surveillance tech has ever been willing to limit themselves to the "good guys." Even Israeli tech companies have been willing to sell products to their country's direct enemies, presumably assuming the profits will outweigh the collateral damage when these are inevitably turned against their nation's people.

Clearview may find more opposition if it attempts to sell its products to European law enforcement agencies. Unlike here in the US, privacy protection laws are extremely restrictive. The unholy mess that is the GDPR makes it untenable for US sites to use cookies or serve ads. Trying to push a product built on non-consensual scraping of personal data from dozens of websites is a non-starter.

Potentially more problematic is Clearview’s inclusion of nine European Union countries — among them Italy, Greece, and the Netherlands — on its expansion map. These countries have strict privacy protections under the General Data Protection Regulation (GDPR), a 2016 law that requires businesses to protect the personal data and privacy of EU citizens. Joseph Jerome, a policy counsel for the Center for Democracy and Technology, said it was unclear whether Clearview AI's technology would violate the GDPR.

Then again, there may be almost no trouble at all. Like almost every privacy protection law created anywhere in the world, law enforcement and national security services enjoy some very large carve outs, which makes it possible for them to do the things the law says is illegal if anyone with a lot less power to destroy lives does it. In this case, Clearview's data collection process may be illegal, but government use of the end result won't be. Funny how that works.

Filed Under: facial recognition, governments, privacy, scraping, surveillance
Companies: clearview, clearview ai

Google Says Clearview's Site Scraping Is Wrong; Clearview Reminds Google It Scrapes Sites All The Time

from the twospidermans.jpg dept

Clearview's business model has resulted in some mutual finger pointing. The most infamous of facial recognition tech companies outsources its database development. Rather than seeking input from interested parties, it scrapes sites for pictures of faces and whatever personal info accompanies them. The scraped info forms the contents of its facial recognition database, putting law enforcement only a few app clicks away from accessing over 3 billion images.

The companies being scraped have claimed this is a violation of their terms of service, if not actually illegal. It's not clear that it's actually illegal, even if it does violate the restrictions placed on users of these services. Twitter has already sent a cease-and-desist to Clearview, but it will probably take a court to make this stick. Unfortunately, Clearview's actions could lead to some damaging precedent if Twitter forces the issue. Given the number of sites affected by Clearview's scraping efforts, it's probably only a matter of time before this gets litigious.

But the finger pointed by Google at Clearview hasn't obtained the reaction Google may have hoped for. As CBS News reports, Clearview has returned fire by comparing its business model to Google's business model.

Google and YouTube have sent a cease-and-desist letter to Clearview AI, a facial recognition app that scrapes images from websites and social media platforms, CBS News has learned.

[...]

[Clearview CEOP Hoan] Ton-That also argued that Clearview AI is essentially a search engine for faces. "Google can pull in information from all different websites," he said. "So if it's public and it's out there and could be inside Google search engine, it can be inside ours as well."

He's not wrong. Google's bots crawl the internet non-stop, building a database for its search engine. But there is one key difference: website owners can opt out of Google's indexing.

"Most websites want to be included in Google Search, and we give webmasters control over what information from their site is included in our search results, including the option to opt-out entirely. Clearview secretly collected image data of individuals without their consent, and in violation of rules explicitly forbidding them from doing so," [YouTube spokesperson Alex Thomas] said in the statement to CBS News.

There's no way to opt out of Clearview's "service," other than just not existing on the internet. Ton-That is correct in assuming there's very little legal exposure in scraping publicly-available images from the net, but these statements don't make him or his company any more sympathetic. Ton-That is serving up untested AI to as many law enforcement agencies as possible, encouraging them to test drive the app using faces of friends and family even as the company states the software should only be used for approved law enforcement purposes.

It also claims an accuracy rate of 99.6% for searches, but that number hasn't been rigorously tested. What appears to be happening is a mass rollout of untested AI to law enforcement agencies via demo/trial accounts. Clearview claims to be working with over 600 law enforcement agencies but very few agencies have stated publicly they've used Clearview to perform investigations.

Clearview's packaging of public information into a law enforcement app is unpleasant, but likely legal. The same thing goes on behind the scenes of multiple data aggregators that sell info and analytics directly to government agencies. The main difference here is Clearview hasn't been shy about its desire to pitch a cheap app/database to law enforcement even as its product remains unproven and untested. And it puts cops a lot closer to their dystopian dream of being able to demand identification from anyone they run into on the streets.

Filed Under: ai, cease and desist, facial recognition, scraping, terms of service
Companies: clearview, clearview ai, google, twitter

Facial Recognition Developer Told Cops To Test Out The Software By Running Searches On Friends And Family

from the inappropriate-access-is-the-baseline dept

More information about super-sketchy facial recognition software developer, Clearview, is being made public… none of it good.

Clearview -- an app created by a developer (Hoan Ton-That) whose previous software put Trump's hair on people's photos -- is now perhaps the most infamous name in the loaded field of facial recognition tech developers. Ton-That's app links to a proprietary database of face photos that's several times larger than any the US federal government has managed to create.

But the only thing proprietary about it is the access. The photos that make up the supposed 3 billion images stored on Clearview servers all come from other companies' websites. Any site that encourages users to upload photos of themselves has been scraped by Clearview, allowing it to amass a few billion photos with very little effort or expenditure on its part.

Those being scraped aren't happy. While it's not definitely illegal to violate sites' terms of service to scrape photos for resale, it's kind of discouraged. As long as this remains unsettled, Clearview is free to scrape sites for photos and sell access to its database to cops.

Clearview may or may not be selling a lot of access to a lot of cops. I don't normally use that mostly-meaningless (and wholly-useless) phrase, but Clearview hasn't exactly been honest about its law enforcement partnerships. The company has claimed in marketing materials it has been instrumental in identifying wanted criminals and providing lists of suspects for cold cases. Conversations with the agencies named in Clearview's sales pitches have pointed out the company's claims are exaggerated, if not completely false.

Fudging facts is just part of the business model, apparently. Ever since Kashmir Hill's investigation of the company for the New York Times went public, multiple journalists have dug up even more details about the company. Every new story makes the company look even shadier.

Clearview insists it's a powerful tool that should only be used responsibly by government agencies. But it actually says something else to the law enforcement agencies it pitches its product to, according to documents obtained by Buzzfeed.

[I]n a November email to a police lieutenant in Green Bay, Wisconsin, a company representative encouraged a police officer to use the software on himself and his acquaintances.

“Have you tried taking a selfie with Clearview yet?” the email read. “It’s the best way to quickly see the power of Clearview in real time. Try your friends or family. Or a celebrity like Joe Montana or George Clooney.

“Your Clearview account has unlimited searches. So feel free to run wild with your searches,” the email continued.

The email chain also encouraged the department to freely use its "Invite User" function to give access to as many people as possible, with Clearview stating it would "immediately" open demo accounts for each invited user. "Running wild" must have worked for the Green Bay PD. It ended up signing a $3,000 contract with Clearview.

Clearview's insistence that this irresponsibility is being handled responsibly by the company doesn't make things much better. It asks the police to police themselves, something they often seem incapable of doing.

“As as [sic] safeguard we have an administrative tool for Law Enforcement supervisors and administrators to monitor the searches of a particular department,” Ton-That said. “An administrator can revoke access to an account at any time for any inappropriate use.”

Run wild… in moderation. It's unclear how many law enforcement agencies have been offered the same pitch: an invitation to run inappropriate searches to test drive the product. But it could be in the hundreds. Or it could only be dozens. Clearview's claims continue to shift, moving upwards with each new iteration of its website, which is now being scrubbed a bit cleaner as the company faces more scrutiny. At one point, Clearview said it was being used by 600 law enforcement agencies, putting it up there with Amazon's Ring. Now, it says it's working with "over a thousand independent law enforcement agencies."

"Working with" may mean nothing more than "sent marketing materials to." Or it could be Clearview is abusing its own code of conduct by running unsolicited searches on criminal suspects and forwarding this information to agencies. It has made bogus claims in the past about its contributions to investigations and it will likely continue to do so until it feels the endless rebuttals are hurting its ability to close sales.

The sales pitches are already light on facts. Going forward they might also include very questionable assertions about citizens' rights and freedoms, like the one Clearview investor David Scalzo made on Dilbert creator Scott Adams' podcast. Apparently, the thing that makes America great is the ability to scrape social media websites for photos and sell access to this database to law enforcement officers.

"The reason why America is the greatest and most prosperous is because of our Bill of Rights, and the First Amendment ... says that we do not have to be hidden to be free,” he said. “We do not have to be hidden to say what we want, to share ideas, to share information, and to be with people.”

Ah. The 28th Amendment: "If you've got nothing to hide, you have nothing to fear." I'm sure plenty of states would be willing to ratify this endorsement of unchecked domestic surveillance. While there is little expectation of privacy in public social media posts, the expectation that these won't be harvested in bulk by third parties and sold to the government remains unchanged. Given the many flaws of facial recognition tech (built-in bias, high false positive rates), having nothing to hide should still give most people plenty to fear -- especially when a private company is encouraging cops to "run wild" with unproven software.

Filed Under: facial recognition, hoan ton-that, police, scraping
Companies: clearview, clearview ai

Facebook Pays $550 Million Settlement In Illinois Facial Recognition Lawsuit, Which Could Pose Problems For Clearview

from the upstart-may-be-able-to-burn-the-industry-to-the-ground dept

Late last week, legally and ethically-dubious facial recognition tech developer Clearview was sued for violating an Illinois law making certain collection and storage of biometric information illegal. I was very dismissive of the lawsuit, stating that scraping of publicly-posted photos couldn't possibly create an actionable violation of privacy.

My assessment may be wrong. A recent settlement by Facebook in a lawsuit alleging violations of this law suggests the proposed class action against Clearview might actually go somewhere, even if Clearview is an outside party scraping (possibly illegal) photo collections from other sites.

In what lawyers are calling the largest settlement ever reached in a privacy related lawsuit, Facebook will pay $550 million to settle claims it harvested users’ facial data without consent and in violation of a 2008 Illinois privacy law.

The announcement comes eight days after the Supreme Court denied Facebook’s petition to review the case and halt an impending trial that was put on hold in 2018 when Facebook appealed a lower court decision advancing the case.

This lawsuit dealt with yet another Facebook feature no one asked for: the nearly-automatic tagging of friends and acquaintances in uploaded photos. Facebook's AI scanned uploaded photos for matches and suggested names of people who resembled those in the photograph. Given the sheer amount of uploaded photos hosted by the site, it was speculated Facebook could have faced a $35 billion fine. If true, the $550 million settlement is a bargain.

But let's take another look at the Clearview lawsuit. Once you get past some of the more ridiculous assertions, you're looking at a few fairly plausible allegations that could survive a motion to dismiss and open Clearview up for what is certain to be some damaging discovery. The company is already cruising around on the outer edges of the law by scraping sites for photos in violation of their terms of service.

The law requires companies doing business in Illinois to obtain permission from users before harvesting biometric info. Since Clearview scrapes sites to build its biometric database, it is obviously not securing anyone's explicit permission.

And Clearview does business in Illinois. It claims it has "partnered" with 600-1,000 law enforcement agencies -- claims that should be taken with several doses of salt considering the number of law enforcement rebuttals that have greeted its marketing assertions.

But this is verifiable.

Interim Chicago Police Superintendent Charlie Beck on Thursday offered a vigorous defense of CPD’s use of a facial recognition tool that matches images of unknown suspects to three billion photos scraped from social media.

Clearview AI, the Manhattan-based firm that developed the software, has come under fire after a lawsuit was filed in federal court in Chicago earlier this month seeking to halt the company’s data collection and after a New York Times report detailed the privacy concerns its technology has brought to the fore.

But, Beck said Thursday the department needs the tool and doesn’t abuse it. Without it, Chicago Police would “solve fewer crimes than places” that do use it, he said.

Ok. Seems unlikely an unproven tool would be better at solving crimes than stuff the CPD already does, but who wouldn't prefer to use an app rather than shoe leather to track down perps?

That satisfies the "doing business in" prong. But if we're looking at unauthorized collection of biometric info, it gets a little cloudier. If Facebook's application of facial recognition AI is the key factor for its violation of the state law, Clearview's AI creates the same legal risk for the company. If the sites it's scraping from aren't applying facial recognition AI to the photos, Clearview's application of its AI creates a violation that didn't previously exist when it was simply collecting the photos for its database.

Photos scraped from Facebook don't immediately become contraband, despite Facebook's application of AI to uploaded photos. The photos are inert, so to speak, when they're scraped by Clearview. It's the application of additional software to convert them into biometric information that causes the violation and triggers the rapidly-escalating fines.

Even if its scraping ultimately proves to be legal, its application of AI makes deploying this in Illinois very risky. The bizarre twist is that it might be Clearview's decision to sell only to law enforcement agencies that might save it from being successfully sued. There's a carveout in the law for government agencies and contractors, which might mean the state law does not apply to Clearview.

Nothing in this Act shall be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.

Whew. So, ask the government for some grievance redress and get told another part of the government already let the third branch of the government do whatever it wants with otherwise-illegal biometric collections.

I'm still shorting this lawsuit, but not nearly as aggressively as I did earlier. There's too much unknown about Clearview's data-gathering at the moment. But it appears Clearview can violate the law with impunity as long as it only sells its services to Illinois government agencies.

Filed Under: biometrics, illinois, privacy, privacy laws
Companies: clearview, clearview ai, facebook

Lawsuit Says Clearview's Facial Recognition App Violates Illinois Privacy Laws

from the OR-DOES-IT-[dramatic-side-eye] dept

Clearview has gathered a whole lot of (negative) attention ever since its exposure by Kashmir Hill for the New York Times. The facial recognition app developed by Hoan Ton-That (whose previous app was a novelty that allowed users to transpose President Trump's distinctive hairdo on their own heads) relies on scraped photos to perform its questionable magic. Rather than limiting themselves to law enforcement databases, cops can upload a photo and search a face against pictures taken from dozens of websites.

The company's marketing materials claim cops have access to 3 billion face photos via Clearview -- all pulled from public accounts linked to names, addresses, and any other personal info millions of unwitting social media users have uploaded to the internet.

Its marketing materials also claims it has been instrumental in solving current crimes and generating suspect lists for cold cases. So far, very few of these claims seem to be based on fact. That's only one of the company's issues. Another is the heat it's drawing from companies like Twitter and Facebook who claim photo scraping violates their terms of service. That's one for the courts and it's only a matter of time before someone sues.

Someone has sued, but it's not an affected service provider. It's some guy from Illinois trying to fire up a class action lawsuit against the company for violating his home state's privacy laws. Here's Catalin Cimpanu of ZDNet with the details:

According to a copy of the complaint obtained by ZDNet, plaintiffs claim Clearview AI broke Illinois privacy laws.

Namely, the New York startup broke the Illinois Biometric Information Privacy Act (BIPA), a law that safeguards state residents from having their biometrics data used without consent.

According to BIPA, companies must obtain explicit consent from Illinois residents before collecting or using any of their biometric information -- such as the facial scans Clearview collected from people's social media photos.

"Plaintiff and the Illinois Class retain a significant interest in ensuring that their biometric identifiers and information, which remain in Defendant Clearview's possession, are protected from hacks and further unlawful sales and use," the lawsuit reads.

Hmm. This doesn't seem to have much going for it. And, believe it or not, it's not a pro se lawsuit. Whether it's possible to violate a privacy law by scraping public photos remains to be litigated, but it would seem the word "public" is pretty integral here. Unless Clearview found some way to scrape photos not published publicly, the lawsuit is dead in the water.

It shouldn't take too long for a judge to declare public and private legally contradictory. This lawsuit was composed by a member of the bar, but it reads more like a Facebook note the lawyer published accidentally. From the lawsuit [PDF]:

Without obtaining any consent and without notice, Defendant Clearview used the internet to covertly gather information on millions of American citizens, collecting approximately three billion pictures of them, without any reason to suspect any of them of having done anything wrong, ever.

Wat? Just because Clearview is aggressively pitching LEOs doesn't mean Clearview can only scrape photos of people it suspects of wrongdoing. Yes, it's disturbing Clearview has decided to make its stalker-enabling AI available to people who can hurt, maim, jail, and kill you, but there's nothing on any law book that says collecting pictures of faces can only be done if the people are probably criminals -- even if the targeted end users of this software are people who go after criminals.

Putting it in a sworn document doesn't make it any less ridiculous. But it does get more ridiculous.

[A]lmost none of the citizens in the database has ever been arrested, much less been convicted. Yet these criminal investigatory records are being maintained on them, and provide government almost instantaneous access to almost every aspect of their digital lives.

Facebook is collecting photos of people, almost none of which have been criminally charged. They reside in Facebook's database. Facebook is publicly searchable, and public profiles can be searched for photos, even by law enforcement officers. Is Facebook breaking state law by "collecting" photos of innocent people? No rational person would argue that it is. And yet, this is the same argument and it's no less stupid just because an actual lawyer is involved.

Look, I also don't want Clearview pushing this "product," much less to people with the power to do incredible amounts of damage to anyone the AI mistakes for a criminal. But this isn't going to fix anything. The lawsuit makes better points about Clearview's end of the deal, which makes it easier for it to look over law enforcement's shoulder. Since Clearview hosts all the pictures on its own servers, it can see what cops are looking for and do its own digging into the personal lives of anyone cops might be thinking about targeting. That's an ugly byproduct of this service and Clearview hasn't said anything about siloing itself off from government queries.

The claims in this suit are almost certain to fail. Clearview streamlines processes cops can perform on their own, like reverse image searches and browsing of social media accounts. Actions you can perform one person at a time without violating the Constitution (or state law), you can most likely do in bulk. For now. A more realistic approach would be to take edge cases to the Supreme Court, which has been more receptive to expanding the boundaries of citizens' expectations of privacy in the digital era. This lawsuit may raise limited awareness about Clearview (and discovery could be very interesting) but it's not going to end Clearview's scraping or deter law enforcement from using it. And it's certainly not going to earn a payout for the plaintiff.

Filed Under: facial recognition, illinois, privacy, privacy law
Companies: clearview, clearview ai

Facial Recognition Company Clearview Lied About Its Crime-Solving Power In Pitches To Law Enforcement Agencies

from the just-the-alternative-facts,-ma'am dept

A very questionable facial recognition tool being offered to law enforcement was recently exposed by Kashmir Hill for the New York Times. Clearview -- created by a developer previously best known for an app that let people put Trump's "hair" on their own photos -- is being pitched to law enforcement agencies as a better AI solution for all their "who TF is this guy" problems.

Clearview doesn't limit itself to law enforcement databases -- ones (partially) filled with known criminals and arrestees. Instead of using known quantities, Clearview scrapes the internet for people's photos. With the click of an app button, officers are connected to Clearview's stash of 3 billion photos pulled from public feeds on Twitter, LinkedIn, and Facebook.

Most of the scrapees have already objected to being scraped. While this may violate terms of service, it's not completely settled that scraping content from public feeds is actually illegal. However, peeved companies can attempt to shut off their firehoses, which is what Twitter is in the process of doing.

Clearview has made some bold statements about its effectiveness -- statements that haven't been independently confirmed. Clearview did not submit its software to NIST's recent roundup of facial recognition AI, but it most likely would not have fared well. Even more established software performed poorly, misidentifying minorities almost 100 times more often than it did white males.

The company claims it finds matches 75% of the time. That doesn't actually mean it finds the right person 75% of the time. It only means the software finds someone that matches submitted photos three-quarters of the time. Clearview has provided no stats on its false positive rate. That hasn't stopped it from lying about its software and its use by law enforcement agencies.

A BuzzFeed report based on public records requests and conversations with the law enforcement agencies says the company's sales pitches are about 75% bullshit.

Clearview AI, a facial recognition company that says it’s amassed a database of billions of photos, has a fantastic selling point it offers up to police departments nationwide: It cracked a case of alleged terrorism in a New York City subway station last August in a matter of seconds. “How a Terrorism Suspect Was Instantly Identified With Clearview,” read the subject line of a November email sent to law enforcement agencies across all 50 states through a crime alert service, suggesting its technology was integral to the arrest.

Here's what the NYPD had to say about Clearview's claims in its marketing materials:

“The NYPD did not use Clearview technology to identify the suspect in the August 16th rice cooker incident,” a department spokesperson told BuzzFeed News. “The NYPD identified the suspect using the Department’s facial recognition practice where a still image from a surveillance video was compared to a pool of lawfully possessed arrest photos.”

The NYPD also said it had no "institutional relationship" with Clearview, contradicting the company's sales pitch insinuations. The NYPD was not alone in its rejection of Clearview's claims.

Clearview also claimed to be instrumental in apprehending a suspect wanted for assault. In reality, the suspect turned himself in to the NYPD. The PD again pointed out Clearview played no role in this investigation. It also had nothing to do with solving a subway groping case (the tip that resulted in an arrest was provided to the NYPD by the Guardian Angels) or an alleged "40 cold cases solved" by the NYPD.

The company says it is "working with" over 600 police departments. But BuzzFeed's investigation has uncovered at least two cases where "working with" simply meant submitting a lead to a PD tip line. Most likely, this is only the tip of the iceberg. As more requested documents roll in, there's a very good chance this "working with" BS won't just be a two-off.

Clearview's background appears to be as shady as its public claims. In addition to its founder's links to far right groups (first uncovered by Kashmir Hill), its founder pumped up the company's reputation by deploying a bunch of sock puppets.

Ton-That set up fake LinkedIn profiles to run ads about Clearview, boasting that police officers could search over 1 billion faces in less than a second.

These are definitely not the ethics you want to see from a company pitching dubious facial recognition software to law enforcement agencies. Some agencies may perform enough due diligence to move forward with a more trustworthy company, but others will be impressed with the lower cost and the massive amount of photos in Clearview's database and move forward with unproven software created by a company that appears to be willing to exaggerate its ability to help cops catch crooks.

If it can't tell the truth about its contribution to law enforcement agencies, it's probably not telling the truth about the software's effectiveness. If cops buy into Clearview's PR pitches, the collateral damage will be innocent people's freedom.

Filed Under: ai, facial recognition, law enforcement, lies, scraping
Companies: clearview, clearview ai