In Response To Getting Sued, Clearview Is Dumping All Of Its Private Customers

from the thanks-for-the-half-assed-largesse,-asses dept

This is the first good news we've heard from Clearview since its exposure by Kashmir Hill for the New York Times back in January. In response to a lawsuit filed against it in Illinois accusing it of breaking that state's privacy laws with its scraping of images and personal info from a multitude of social media platforms, Clearview has announced it's cutting off some of its revenue stream.

Clearview AI — the controversial face-tracking company known for scraping more than 3 billion photos from social media sites including Facebook and Twitter — said it is ending its relationships with non–law enforcement entities and private companies amid regulatory scrutiny and several potential class action lawsuits.

Responding to one of those lawsuits, Clearview claimed in legal documents filed in an Illinois federal court on Wednesday that it was taking those voluntary actions and would “avoid transacting with non-governmental customers anywhere.”

Clearview's motion to dismiss [PDF] argues this lawsuit is now mooted since it will no longer be doing business with any Illinois entities and has apparently found some way to sort out personal info on Illinoians from the rest of scraped stash. Take a couple of grains of salt before reading the following:

Moreover, Clearview has taken steps to secure and implement limits regarding the retention of any Illinois photos. Clearview is terminating access rights to its app for all account holders based in Illinois and is terminating the accounts of any non-law enforcement or government entity.

This is better but it's still nothing great. Governments can still use a privacy law-violating app. That's still a big problem. While private companies may be using Clearview's app the most, it's the company's government customers that are more of a problem. Unproven tech may get you booted from the local mall for resembling a shoplifting suspect, but law enforcement agencies can ruin your life and take away several of your freedoms. And Clearview isn't exactly selective about who it sells to, so plenty of overtly abusive governments will still get to use untested facial recognition software to destroy lives without worrying about niceties like due process.

Presumably, this will end the use of Clearview's AI by Illinois government agencies. But reporters at BuzzFeed couldn't get any confirmation from the Chicago PD that its plug had been pulled.

While the Chicago Police Department did not return a request for comment, a spokesperson for the Illinois secretary of state confirmed the office had been using Clearview “for about six months” to “assist other law enforcement agencies.”

Law enforcement agencies make up most of Clearview's customers in the state. If Clearview's sworn statements are true, they should all find their accounts deleted in the very near future. But Clearview hasn't been too honest when dealing with judgments passed by the court of public opinion, so it's probably wise to hold our golf applause for this lawsuit-prompted pullout until more facts are in.

We also shouldn't read too much into its declaration that it will be restricting gathering data on Illinois residents. Clearview's one-state filtering system apparently relies on metadata -- a lot of which is stripped by sites when users upload photos. It also will avoid scraping data and images from sites with words like "Chicago" or "Illinois" in the URL, which will leave a lot of Illinois-based websites open for Clearview's scraping business, no matter what it may be asserting in court. Sure, this is Clearview "taking steps" to prevent violating state law, but these two specifics can hardly be considered ambulatory.

The better news is this:

In addition, the startup said it was implementing an “opt-out mechanism” to allow people to exclude photos from its database.

Again, no congratulations until we see this implemented, and only if there's some outside auditing done to ensure Clearview is actually doing the things it says it is. For that matter, the AI still hasn't been independently examined, so we don't even know what sort of false positive rate Clearview's four-billion-image database is capable of generating.

Clearview is still as sketchy as ever and only slightly less dangerous following this move. As long as it still sells its scraped database and unproven AI to governments, it's still a threat to millions of people.

Filed Under: facial recognition, governments, privacy, surveillance
Companies: clearview, clearview ai

Hard Pass: Clearview Offers To Help Out With COVID-19 Contact Tracing

from the [incoherent-screaming-into-the-void] dept

Clearview AI is inserting itself into a discussion no one invited it to participate in. The discussion around contact tracing to manage and (hopefully) impede the spread of the coronavirus involves multiple governments around the world. It also includes Google and Apple, who are partnering to create a platform for contact tracing apps.

At least in the case of Google and Apple's offerings, there appears to have been a serious discussion about protecting users' privacy as much as possible while still offering a valuable service to government health agencies and people concerned about contracting the virus.

Now, Clearview has blundered into the discussion -- a company that has shown utter disdain for the millions of people it has force-fed to its multi-billion image database via social media site scraping. There is no opting in or out of this collection -- one that Clearview is selling to law enforcement agencies in the US and to government agencies around the world. If it's on the web, it's likely already in Clearview's database.

In a brief discussion with NBC News, CEO Hoan Ton-That pitched his idea for a Clearview-based contact tracing program. What Ton-That wants to do is tie his app and its database to thousands of CCTV cameras located in stores, parking lots, gyms, and other locations where, as he puts it, "there's no expectation of privacy." Ton-That doesn't explain how his system will be notified of a person's COVID status, but he's pretty sure his software will be able to recognize faces accurately. Clearview's facial recognition AI remains unproven, but it's supposedly capable of making guesses about faces using images as small as 110x110.

Ton-That also seems unconcerned about the privacy implications of adding people's health status to his enormous database of scraped personal information. He says any limitations on gathering/storage of this info would be up to whoever decides to take him up on his unsolicited offer.

Obviously, no one should do this. The AI is unproven and Clearview is far from trustworthy. Activist group Fight For The Future has issued its official statement on Clearview's contact tracing pitch. It's short but punchy.

“Absolutely the fuck not,” said Evan Greer (she/her), the groups Deputy Director.

As FFTF points out, adding Clearview to the mix just adds more potential privacy violations to the mix by dumping people's health info into a database that's already being accessed by a number of private companies and government agencies around the world. Ton-That appears to assume that anyone in a "public" area is fair game for his company. Adding thousands of cameras operated by hundreds of private companies would provide a steady flow of facial images (some tied to very personal information) into his database, making his product even more enticing to government agencies.

Hopefully, no one will let Clearview near any of this. Facial recognition adds nothing to contact tracing -- something that can be done almost anonymously using the platform developed by Google and Apple. Hoovering up facial images -- along with location data and health info -- is a privacy nightmare. And there's probably no company that should be trusted less with your personal info than Clearview, which has repeatedly demonstrated it cares nothing about the millions of people it has turned into fodder for its unproven tech.

Filed Under: artificial intelligence, contact tracing, facial recognition, hoan ton-that, privacy, trade-offs
Companies: clearview, clearview ai

Cybersecurity Firm Finds A Bunch Of Clearview's Secret Stuff Sitting Around In An Poorly-Secured Cloud Storage Bucket

from the just-scraping-it-from-the-unsecured-web-so-to-speak dept

As if we needed any further evidence that Clearview is a terrible company. The web-scraping, facial recognition provider has been pitching its unproven tech to an assortment of law enforcement agencies, one-percenters, and questionable governments for a little while now. It shows no sign of slowing down either, no matter how many people (including members of Congress) are now aware of its business practices and cheerful exploitation of billions of images found all over the web.

Someone grabbed a few internal Clearview documents and shared them with BuzzFeed earlier this year. Maybe they shouldn't have bothered. Clearview likes harvesting data and images as quickly as possible. But it's apparently less concerned with keeping its scraped stash secure from outsiders. As Zack Whittaker reports for TechCrunch, Clearview's internal files have been accessed by a security researcher, giving us yet another reason to distrust Hoan Ton-That's company.

Mossab Hussein, chief security officer at Dubai-based cybersecurity firm SpiderSilk, found the repository storing Clearview’s source code. Although the repository was protected with a password, a misconfigured setting allowed anyone to register as a new user to log in to the system storing the code.

The repository contained Clearview’s source code, which could be used to compile and run the apps from scratch. The repository also stored some of the company’s secret keys and credentials, which granted access to Clearview’s cloud storage buckets. Inside those buckets, Clearview stored copies of its finished Windows, Mac and Android apps, as well as its iOS app, which Apple recently blocked for violating its rules. The storage buckets also contained early, pre-release developer app versions that are typically only for testing, Hussein said.

If you've ever wanted to roll your own affront to humanity, Clearview helpfully left a starter kit out in the open. Of course, it's nothing without a few billion scraped images, so it's not exactly an all-in-one-kit. Maybe some Clearview insider could have hooked Hussein up with its stash of personal info. Couldn't have hurt to ask. And he could have. Included in the repository were the company's Slack tokens, which would have allowed anyone to access the company's internal communications. Also included in the storage buckets: 70,000 security cam videos of residents entering and leaving a residential building.

Hussein did disclose this issue to Clearview, but declined to take the offered bug bounty since it would have forbidden him from publicly discussing his findings. For refusing to shut up, Hussein was thanked by being called a criminal by Clearview's founder.

Ton-That accused the research firm of extortion, but emails between Clearview and SpiderSilk paint a different picture.

Lovely. Well, I'm sure this won't be the last public gaffe by the Company Most Likely To Trigger New Privacy Legislation (State or Federal). People have seen things Clearview never wanted them to see. And they've shared this stuff with the public, which now knows quite a bit about this app-based embodiment of oversharing and the damage done. It's in the midst of a very Ring-esque news cycle where every bit of new reporting makes it look even worse. But unlike Ring, it doesn't have the billions of Amazon to back it when its fortunes start to fade.

Filed Under: facial recognition, leaks, mossab hussein, security, source code
Companies: clearview, clearview ai, spidersilk

How Much Data Does Clearview Gather On People? The Answer (Sadly) Will Not Surprise You.

from the hoovering-up-your-entire-online-presence-using-this-1-simple-trick! dept

Clearview's facial recognition app links to a database of 4 billion pictures. And those photos are linked to all the data that got scraped up with them, culled (without permission) from sites like Facebook, Instagram, LinkedIn… pretty much anywhere people post photos and personal information.

There's no opting-out of this collection either, even as Clearview packages and sells access to this scraped data to law enforcement agencies in the US, as well as government agencies in countries known for their human rights abuses. Fun, fun, fun and all just a click away from exploitation by anyone with an account. That includes demo accounts operated by the super-rich and law enforcement officers told to test drive the software by running searches on friends and family members.

How much does Clearview gather on the average person? It's tough to tell. Asking Clearview directly -- at least in most of the US -- will get you nothing. However, California's privacy law (the California Consumer Privacy Act) mandates the disclosure of gathered personal data to requesters. That's what Thomas Smith of OneZero did. And here's what he got back.

The depth and variety of data that Clearview has gathered on me is staggering. My profile contains, for example, a story published about me in my alma mater’s alumni magazine from 2012, and a follow-up article published a year later.

It also includes a profile page from a Python coders’ meetup group that I had forgotten I belonged to, as well as a wide variety of posts from a personal blog my wife and I started just after getting married.

The profile contains the URL of my Facebook page, as well as the names of several people with connections to me, including my faculty advisor and a family member (I have redacted their information and images in red prior to publishing my profile here).

Based on the request process -- which involved some emailing back and forth before Clearview asked Smith to upload a photo of himself to run against its database -- Smith estimates it only took about a minute or so for Clearview to run the search and retrieve his profile.

No one knows how often Clearview crawls the web to gather new info, but what's already been gathered is impressive enough. Unfortunately, there's no one vetting this data, so it's up to end users to figure out what's right and what's wrong. The end users are (most often) law enforcement agencies, who don't really place a premium on ensuring innocent people don't get swept up in their secondhand surveillance nets.

Perhaps most worrying is the fact that some of Clearview’s data is wrong. The last hit on my profile is a link to a Facebook page for an entirely different person. If an investigator searched my face and followed that lead (perhaps suspecting that the person was actually my alias), it’s possible I could be accused of a crime that the unknown, unrelated person whose profile turned up in my report actually did commit.

Or vice versa. The negative possibilities are endless. And all of this starts with a photo of someone's face. No other input is needed. Clearview's algorithm -- which hasn't been independently tested or examined -- does the rest.

And there's more bad news. As Smith points out, Clearview's proprietary system is just it standing on looking over the shoulders of tech giants. If Clearview can do this, anyone similarly motivated can do it. One homegrown surveillance company crashing and burning from negative press just clears the way for more competitors. The bag is open and the cat is long gone. It was gone long before Clearview drifted into the public eye. A large number of companies offer social media monitoring services and plenty of other surveillance tech companies routinely scrape publicly-available data for their government agency users.

The difference is Clearview packaged its offering in an app and handed it out to whoever wanted to take a look at it. If Clearview goes down, something else will take its place. For now, it's the most visible villain. But it's not the only one. And as long as it operates, residents of California (as well as European residents under the GDPR) can demand Clearview show them how much of their data it's gathered. So, those who can should take advantage of that to let others know this is a very real threat to their privacy, not just some theoretical threat that should only cause concern for criminals.

Filed Under: data, data collection, facial recognition, privacy
Companies: clearview, clearview ai

Clearview Was A Toy For Billionaires Before It Became A Toy For Cops

from the searching-billions-of-images-for-fun-and-profit dept

Clearview's claims that its controversial facial recognition program is only for use by law enforcement agencies continues to be exposed as a lie. Documents obtained by BuzzFeed showed the company has sold its tech to a variety of private companies, including major retailers like Kohl's and Walmart.

It's also expanding its reach across the globe, pitching its products to dozens of countries, including those known mostly for their human rights violations. Even when it limits itself to law enforcement agencies, it still can't help lying -- exaggerating its success and assistance in criminal investigations.

Before Clearview became a plaything for government agencies and private corporations, it was a toy for the rich and powerful. Kashmir Hill -- who broke the first story about Clearview's problematic image-scraping operation -- has a followup in the New York Times detailing the company's unpleasant origin story.

One Tuesday night in October 2018, John Catsimatidis, the billionaire owner of the Gristedes grocery store chain, was having dinner at Cipriani, an upscale Italian restaurant in Manhattan’s SoHo neighborhood, when his daughter, Andrea, walked in. She was on a date with a man Mr. Catsimatidis didn’t recognize. After the couple sat down at another table, Mr. Catsimatidis asked a waiter to go over and take a photo.

Mr. Catsimatidis then uploaded the picture to a facial recognition app, Clearview AI, on his phone. The start-up behind the app has a database of billions of photos, scraped from sites such as Facebook, Twitter and LinkedIn. Within seconds, Mr. Catsimatidis was viewing a collection of photos of the mystery man, along with the web addresses where they appeared: His daughter’s date was a venture capitalist from San Francisco.

“I wanted to make sure he wasn’t a charlatan,” said Mr. Catsimatidis, who then texted the man’s bio to his daughter.

That's just one anecdote. There are others. Investors approached by Clearview, like venture capitalist Hal Lambert, explored the power of Clearview's app in pretty irresponsible ways. Lambert allowed his school-aged daughters access to the app. And it appears actor/investor Ashton Kutcher was given access to the app. He described an app that sounds exactly like Clearview when he appeared on the YouTube series "Hot Ones" last September.

“I have an app in my phone in my pocket right now. It’s like a beta app,” Mr. Kutcher said. “It’s a facial recognition app. I can hold it up to anybody’s face here and, like, find exactly who you are, what internet accounts you’re on, what they look like. It’s terrifying.”

It is terrifying. And far more people have had access to it than Clearview has admitted. Plenty of potential investors were given access to the app. It's not clear how many still have access, but it appears their use of the app went unmonitored/uncontrolled by Clearview. Understandably, investors want to know if the thing they're looking to invest in works, but Clearview did nothing to ensure this access was limited or used responsibly. That same attitude has carried over to its pitches to law enforcement, which encourages cops to use friends and family members as guinea pigs for tech it claims should only be used for legitimate law enforcement efforts.

Power and responsibility are supposed to go hand-in-hand. There's none of that happening here. Clearview compiled a database by scraping images from hundreds of websites and is now selling this access to pretty much anyone willing to buy it.

Filed Under: billionaires, facial recognition, john catsimatidis
Companies: clearview, clearview ai

Clearview Sued By Vermont Attorney General For Violating The State's Privacy Laws

from the engineering-its-own-downfall dept

For the second time in a little over 30 days, odious facial recognition tech supplier Clearview is being sued. Unlike the first lawsuit, which is a proposed class action over violations of Illinois' biometric privacy law, this one [PDF] is being filed by a government agency. The Attorney General of Vermont is seeking to permanently ban Clearview from collecting info about state residents or sell access to the info it's already collected.

The complaint alleges that Clearview AI has been collecting photos of Vermonters available on the internet – called “screen scraping” – and using artificial intelligence to “map” individual’s faces. Private businesses, individuals, and law enforcement use this data via an app that allows a user to identify a person within seconds using only a photograph. No Vermont state or local law enforcement agencies have used the app. Clearview AI collects the facial recognition data of Vermont children, as well as adults, without their notice or consent.

The complaint also alleges that Clearview AI violated Vermont’s new Data Broker Law by fraudulently acquiring data through its use of screen scraping.

The method used to compile Clearview's database of three billion images is going to make it very difficult for the company to dodge lawsuits like these. Scraping sites may be mostly legal, but Clearview doesn't provide any way to opt out of this collection. Scraping images from sites where users have granted the platform permission to publish their information doesn't mean the TOS agreement the user made with the platform magically migrates with the scraped data.

From the lawsuit:

[T]he term "publicly available" does not have any meaning in the manner used by Clearview, as even though a photograph is being displayed on a certain social media website, it is being displayed subject to all of the rights and agreements associated with the website, the law, and reasonable expectations. One of those expectations was not that someone would amass an enormous facial-recognition-fueled surveillance database, as the idea that this would be, permitted in the United States was, until recently, unthinkable.

Thus, when an individual uploads a photograph to Facebook for "public" viewing, they consent to a human being looking at the photograph on Facebook. They are not consenting to the mass collection of those photographs by an automated process that will then put those photographs into a facial recognition database. Such a use violates the terms under which the consumer uploaded the photograph, which the consumer reasonably expects will be enforced.

Clearview's database compilation relies on its violating website terms of service en masse. Sites have begun pushing back but at this point their legal options are limited to being angry about it. But some state-by-state litigation may actually have an effect, since it seems almost impossible for Clearview to comply with privacy laws governing the collection of biometric data. Selling access to the data makes it even more difficult, since there's no way for those packaged up in Clearview's database to request removal or limit access to the scraped data.

It's too late for Clearview to salvage its reputation by claiming it controls access carefully and sells only to law enforcement agencies to assist in solving crimes. That cat walked right out of the bag and over to BuzzFeed, which reported Clearview is selling its tech to private companies and governments engaged in ongoing human rights abuses. Claiming to serve a higher purpose while behaving like a bottom feeder doesn't do anything for anyone, least of all a company that hoped it would fly under the radar long enough to capitalize fully on a bunch of free photos it found scattered around the internet.

Filed Under: data broker law, facial recognition, privacy, privacy law, vermont
Companies: clearview, clearview ai

Clearview Is Handing Out Access To Dozens Of UK Entities, Setting Up Accounts For Congressional Reps

from the mass-marketing-privacy-violations dept

Clearview continues to make itself unpopular with the general public even as it increases its user base. Supposedly, it has worked with over 900 law enforcement agencies at this point, although it's unclear how many are actually using the software and how many have just been given trial logins.

Internal documents given to BuzzFeed show a number of federal agencies (FBI, ATF, Secret Service, CBP) have performed tens of thousands of searches of Clearview's scraped-together database. But it's not just law enforcement agencies that are using Clearview's facial recognition app. The documents showed a number of private companies have also at least test-driven the software, including Macy's, Walmart, Kohl's, and Albertsons.

The company continues to expand into other countries. The documents show Clearview has customers in 26 countries, including notorious human rights violators like Saudi Arabia and UAE.

Over in the UK, Clearview is being used by more public and private entities -- another strange assortment of users that makes up a small part of the 2,900 institutions the company has handed its software to.

The National Crime Agency and Metropolitan Police are among a number of leading organisations across the UK that have registered users with controversial facial recognition technology firm Clearview AI, according to documents reviewed by BuzzFeed News.

The technology also had users at a number of other police forces, private investment firms, the Ministry of Defence, and a charity founded by Harry Potter author J.K. Rowling, the data shows.

The Met Police already has its own facial recognition tech -- one that has consistently underperformed for years. According to a spokesperson, Clearview's proprietary database of 3 billion photos scraped from the web isn't being used in conjunction with the live tech already deployed by the agency. Other UK law enforcement agencies listed in the documents as having performed searches all stated they had used the software "on a trial basis" and are not currently using the tech to search for criminal suspects.

The same comments were made by some private financial firms, which claimed it was demoed for them by Clearview, but they weren't currently using the software. A few refused to provide any comment at all, leaving that question open.

The searches run by J.K. Rowling's charity also appear to have been part of a demo.

The charity told BuzzFeed News that a staff member had tried out the software once at an event and Clearview was not being used by Lumos in its work.

A spokesperson for Lumos said: “A member of Lumos staff attended an anti-trafficking event last year to which a number of NGOs were invited as well as a representative from Clearview AI.

“During the event the representative from Clearview AI demonstrated the software which we understand was being used in the US by law enforcement to tackle child exploitation.

Back in the United States, Clearview continues its aggressive expansion, preemptively creating accounts for Congressional reps and administration officials.

Clearview AI, the secretive facial recognition company whose software has been used by more than 2,200 organizations around the world, created accounts for the offices of four members of Congress, including one whom President Donald Trump is nominating for director of national intelligence.

Clearview data reviewed by BuzzFeed News includes an unused account for Texas Rep. John Ratcliffe, a Republican whose eventual nomination to DNI was announced by Trump on Friday via tweet. Trump has yet to formally send the nomination to the Senate.

In Clearview documents viewed by BuzzFeed News, the entry for “Congressman John Ratcliffe Staff” indicates that that user had performed zero log-ins and zero searches, meaning that Clearview had created an account that was never used. A spokesperson for Ratcliffe told BuzzFeed News that Clearview staff had met with Ratcliffe’s staff.

All of these appear to have been set up when staffers met with Clearview reps. Only one rep's office -- Mark Walker's -- appears to have run any searches.

In other news on the homefront, Apple has disabled Clearview's iOS app for violating the company's rules on distribution.

In distributing its app for Apple devices, Clearview, which BuzzFeed News reported earlier this week has been used by more than 2,200 public and private entities including Immigration and Customs Enforcement (ICE), the FBI, Macy’s, Walmart, and the NBA, has been sidestepping the Apple App Store, encouraging those who want to use the software to download its app through a program reserved exclusively for developers. In response to an inquiry from BuzzFeed News, Apple investigated and suspended the developer account associated with Clearview, effectively preventing the iOS app from operating.

The company's CEO says it's working with Apple to get the app reinstated, claiming Clearview did not actually violate the rules since the app cannot be used without "proper authorization." But that doesn't explain why Clearview is demoing its "internal use application" to hundreds of potential customers and facilitating that access by setting up accounts for anyone who wants to try the app out. Apple's Enterprise Developer program forbids the distribution of internal apps to users outside of the developer's company.

If Clearview stays ousted, it's going to hurt its plans for expansion. One of the selling points of Clearview's tech is that it's available in app form -- portable and usable by anyone who owns a smartphone. Linking the app to 3 billion face photos and other personal information scraped from the web makes it almost irresistible. Taking a sizable chunk of phone users out of the equation will slow the company's roll. But I imagine it will find a way to get some version of its app back into the store -- and into the hands of uncurated user base.  

Filed Under: facial recognition, uk
Companies: clearview, clearview ai

Documents Show Clearview Is Selling Facial Recognition Tech To Retailers, Fitness Centers, And Human Rights Violators

from the should-just-be-honest-since-it's-all-going-to-come-out-anyway dept

Clearview -- the latest (and most troubling) entrant into the facial recognition tech sweepstakes -- says it's product is just for law enforcement. And law enforcement has seemingly welcomed the web-scraped facial recognition database with open arms. Clearview's marketing documents claim the company works with over 900 law enforcement agencies in the United States and elsewhere in the world.

Clearview's app puts the agencies a few clicks away from over three billion images scraped from sites such as Facebook, Twitter, and LinkedIn. Those being scraped aren't happy about it but there's little they can do but engage in some cease-and-desist shouting.

But Clearview's claim that it's only making this available to law enforcement agencies is false. New documents, obtained by BuzzFeed, show the company is selling its product to a number of other entities, both public and private.

The internal documents, which were uncovered by a source who declined to be named for fear of retribution from the company or the government agencies named in them, detail just how far Clearview has been able to distribute its technology, providing it to people everywhere, from college security departments to attorneys general offices, and in countries from Australia to Saudi Arabia.

That's the public sector buy-in. Here's the private sector's investment.

More than 200 companies have Clearview accounts, according to the documents, including major stores like Kohl’s and Walmart and banks like Wells Fargo and Bank of America. While some of these entities have formal contracts with Clearview, the majority — as with public sector entities — appear to have only used the facial recognition software on free trials.

This list also includes a number of entertainment venues, casinos, fitness centers, and, oddly enough, the NBA.

So, it's not just for cops. That might explain the company's hands-off attitude towards the entities it has publicly acknowledged it works with. Cops are encouraged to test-drive the software by searching friends and family members. Nothing like encouraging misuse right off the bat to dissuade law enforcement officers from using this tool for personal evil.

As BuzzFeed notes, most of these appear to be limited trials of Clearview's software. But a few private entities are apparently paying for the privilege of running security camera footage against Clearview's scraped-together database.

Company logs reviewed by BuzzFeed News include Walmart (nearly 300 searches), Best Buy (more than 200 searches), grocer Albertsons (more than 40 searches), and Rite Aid (about 35 searches). Kohl’s, which has run more than 2,000 searches across 11 different accounts, and Macy’s, a paying customer that has completed more than 6,000, are among the private companies with the most searches.

Meanwhile, US agencies are enthusiastically participating in the exploitation of this crowdsourced (so to speak…) database. BuzzFeed notes the CBP has already registered 280 accounts and run almost 7,500 searches. The Secret Service isn't far behind, having run 5,600 searches. Other federal customers include the DEA, ATF, and FBI.

Clearview has also stated its plan for international expansion begins and ends with Canada. This has already been exposed as untrue, but information in these documents shows how aggressively Clearview is pursuing customers around the world.

It shows that Clearview AI has expanded to at least 26 countries outside the US, engaging national law enforcement agencies, government bodies, and police forces in Australia, Belgium, Brazil, Canada, Denmark, Finland, France, Ireland, India, Italy, Latvia, Lithuania, Malta, the Netherlands, Norway, Portugal, Serbia, Slovenia, Spain, Sweden, Switzerland, and the United Kingdom.

And while Clearview's CEO has promised not to sell to "adverse" countries like North Korea, China, and Iran, this is the only line it appears to have drawn. The documents show Clearview has offered its software to agencies in Saudi Arabia and the United Arab Emirates -- both notorious violators of human rights.

Clearview clearly can't be trusted. It has spent its limited time in the public eye lying about what it does and who it does it with. Hopefully, the endless negative press will deter its growth. Unfortunately, there's an undeniable market for unregulated facial recognition tech and Clearview's promise of billions of photos to match faces against beats everything else offered by anyone else. As long as the market exists, Clearview will fill it.

Filed Under: customers, facial recognition, law enforcement
Companies: clearview, clearview ai

Clearview Looking To Expand Its Market To Problematic Countries Known For Human Rights Abuses

from the a-cop's-a-cop,-right? dept

It appears no one's thrilled facial recognition upstart Clearview is scraping their photos to build a facial recognition database to sell to cops. But what can they do about it? Not much more than write angry letters.

Twitter was the first to send a C&D to the troubling developer over this troubling development. It was presumably ignored. Google also issued a C&D, only to be not-so-gently reminded by Clearview that Google does the same thing to build its search engine database. (Of course, web site owners and developers can opt out of being crawled by Google bots -- something that's not an option with Clearview.)

Added to the list of pissed scrapees are Venmo and LinkedIn, the latter known for actually suing people who have scraped its site. Facebook, however, has not done this and it's by far the largest repository of face photos and personal information on the web. Facebook claims to be asking Clearview some tough questions about its scraping and database compilation but it has not sent a formal cease-and-desist.

Maybe Zuckerberg's just disappointed he didn't think of this first. Or, as Aaron Mak speculates for Slate, maybe it has something to with Peter Thiel's early investment in Clearview and his position as a Facebook board member. Thiel likes surveillance and Clearview's scraping of Facebook to compile a facial recognition database may be just the sort of vertical integration he's looking for.

But the bad news gets worse. Clearview's aggressive pursuit of law enforcement agency customers -- combined with its questionable database construction methods -- hasn't won it very many friends. Not even from the law enforcement community, which has been forced to offer rebuttals to exaggerated (or downright false) claims made by Clearview in its marketing materials.

Clearview isn't going to limit itself to the United States. Documents obtained by BuzzFeed show Clearview is pitching its facial recognition app to abusive governments around the world.

A document obtained via a public records request reveals that Clearview has been touting a “rapid international expansion” to prospective clients using a map that highlights how it either has expanded, or plans to expand, to at least 22 more countries, some of which have committed human rights abuses.

The document, part of a presentation given to the North Miami Police Department in November 2019, includes the United Arab Emirates, a country historically hostile to political dissidents, and Qatar and Singapore, the penal codes of which criminalize homosexuality.

So far, Clearview says it only has "partnerships" in the US and Canada. But no developer flogging surveillance tech has ever been willing to limit themselves to the "good guys." Even Israeli tech companies have been willing to sell products to their country's direct enemies, presumably assuming the profits will outweigh the collateral damage when these are inevitably turned against their nation's people.

Clearview may find more opposition if it attempts to sell its products to European law enforcement agencies. Unlike here in the US, privacy protection laws are extremely restrictive. The unholy mess that is the GDPR makes it untenable for US sites to use cookies or serve ads. Trying to push a product built on non-consensual scraping of personal data from dozens of websites is a non-starter.

Potentially more problematic is Clearview’s inclusion of nine European Union countries — among them Italy, Greece, and the Netherlands — on its expansion map. These countries have strict privacy protections under the General Data Protection Regulation (GDPR), a 2016 law that requires businesses to protect the personal data and privacy of EU citizens. Joseph Jerome, a policy counsel for the Center for Democracy and Technology, said it was unclear whether Clearview AI's technology would violate the GDPR.

Then again, there may be almost no trouble at all. Like almost every privacy protection law created anywhere in the world, law enforcement and national security services enjoy some very large carve outs, which makes it possible for them to do the things the law says is illegal if anyone with a lot less power to destroy lives does it. In this case, Clearview's data collection process may be illegal, but government use of the end result won't be. Funny how that works.

Filed Under: facial recognition, governments, privacy, scraping, surveillance
Companies: clearview, clearview ai

Google Says Clearview's Site Scraping Is Wrong; Clearview Reminds Google It Scrapes Sites All The Time

from the twospidermans.jpg dept

Clearview's business model has resulted in some mutual finger pointing. The most infamous of facial recognition tech companies outsources its database development. Rather than seeking input from interested parties, it scrapes sites for pictures of faces and whatever personal info accompanies them. The scraped info forms the contents of its facial recognition database, putting law enforcement only a few app clicks away from accessing over 3 billion images.

The companies being scraped have claimed this is a violation of their terms of service, if not actually illegal. It's not clear that it's actually illegal, even if it does violate the restrictions placed on users of these services. Twitter has already sent a cease-and-desist to Clearview, but it will probably take a court to make this stick. Unfortunately, Clearview's actions could lead to some damaging precedent if Twitter forces the issue. Given the number of sites affected by Clearview's scraping efforts, it's probably only a matter of time before this gets litigious.

But the finger pointed by Google at Clearview hasn't obtained the reaction Google may have hoped for. As CBS News reports, Clearview has returned fire by comparing its business model to Google's business model.

Google and YouTube have sent a cease-and-desist letter to Clearview AI, a facial recognition app that scrapes images from websites and social media platforms, CBS News has learned.

[...]

[Clearview CEOP Hoan] Ton-That also argued that Clearview AI is essentially a search engine for faces. "Google can pull in information from all different websites," he said. "So if it's public and it's out there and could be inside Google search engine, it can be inside ours as well."

He's not wrong. Google's bots crawl the internet non-stop, building a database for its search engine. But there is one key difference: website owners can opt out of Google's indexing.

"Most websites want to be included in Google Search, and we give webmasters control over what information from their site is included in our search results, including the option to opt-out entirely. Clearview secretly collected image data of individuals without their consent, and in violation of rules explicitly forbidding them from doing so," [YouTube spokesperson Alex Thomas] said in the statement to CBS News.

There's no way to opt out of Clearview's "service," other than just not existing on the internet. Ton-That is correct in assuming there's very little legal exposure in scraping publicly-available images from the net, but these statements don't make him or his company any more sympathetic. Ton-That is serving up untested AI to as many law enforcement agencies as possible, encouraging them to test drive the app using faces of friends and family even as the company states the software should only be used for approved law enforcement purposes.

It also claims an accuracy rate of 99.6% for searches, but that number hasn't been rigorously tested. What appears to be happening is a mass rollout of untested AI to law enforcement agencies via demo/trial accounts. Clearview claims to be working with over 600 law enforcement agencies but very few agencies have stated publicly they've used Clearview to perform investigations.

Clearview's packaging of public information into a law enforcement app is unpleasant, but likely legal. The same thing goes on behind the scenes of multiple data aggregators that sell info and analytics directly to government agencies. The main difference here is Clearview hasn't been shy about its desire to pitch a cheap app/database to law enforcement even as its product remains unproven and untested. And it puts cops a lot closer to their dystopian dream of being able to demand identification from anyone they run into on the streets.

Filed Under: ai, cease and desist, facial recognition, scraping, terms of service
Companies: clearview, clearview ai, google, twitter