Leaked Data Shows NSO Group's Malware Was Used To Target Journalists, Activists, And World Leaders

from the not-your-usual-bad-guys dept

A massive data leak has confirmed what's been suspected (and reported by security researchers like Citizen Lab) for a long time: Israeli malware developer NSO Group's powerful cellphone snooping tools have been used to target journalists, activists, and dissidents all over the world.

The Guardian and 16 other media outlets have dug into the data leak and uncovered some pretty disturbing info about NSO's Pegasus malware, which allows those deploying the spyware to extract messages, record phone calls, and surreptitiously activate microphones.

Who's in the list of phone numbers seen by the Guardian? Lots and lots and lots of journalists.

The leak contains a list of more than 50,000 phone numbers that, it is believed, have been identified as those of people of interest by clients of NSO since 2016.

[...]

The disclosures begin on Sunday, with the revelation that the numbers of more than 180 journalists are listed in the data, including reporters, editors and executives at the Financial Times, CNN, the New York Times, France 24, the Economist, Associated Press and Reuters.

Here's who's included in this first revelation by the Guardian:

[J]ournalists who were selected as possible candidates for surveillance by NSO’s clients work for some of the world’s most prestigious media organisations. They include the Wall Street Journal, CNN, the New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El País, Associated Press, Le Monde, Bloomberg, Agence France-Presse, the Economist, Reuters and Voice of America.

Also found on the list was the number of Mexican reporter Cecilio Pineda Birto, who was murdered while waiting for his pickup to finish being cleaned at a local car wash. This followed weeks of death threats that began after his reporting accused state police and local government officials of colluding with crime lords.

It's not just journalists being targeted by NSO's powerful malware. The list also includes numbers linked to religious figures, executives of private companies, union officials, high-ranking government officials, and NGO employees.

NSO, for its part, continues to insist it's not the bad guy here. It says it only sells the software to a "select group" of "vetted" government agencies. Unfortunately, that list of approved governments includes notorious human rights violators like the Saudi government (which killed Washington Post reporter Jamal Khashoggi) and agencies in the UAE, Bahrain, and Kazakhstan.

The government of Mexico is one of NSO's most enthusiastic users. It "selected" 15,000 of the 50,000 numbers recovered in the data leak. This doesn't mean 15,000 successful deployments but it does mean the Mexican government -- which has no shortage of local criminals to target -- also apparently tried to infect phones owned by journalists.

NSO's hands are far from clean. Its list of clients isn't as selective as it likes to pretend. And while it may tell purchasers the spyware should only be used to target criminals and terrorists, it doesn't yank licenses from governments that choose to target journalists, academics, religious figures, and others.

Filed Under: activists, governments, journalists, malware, snooping tools, spyware, surveillance
Companies: nso group

US Telecoms Keep Getting Wrist Slaps For Repeatedly Ripping Off The US Government

from the we're-not-actually-fixing-the-problem dept

You may have to squint to see it, but tell me if you can detect the faint outline of a pattern here.

Last year, AT&T and Verizon paid $116 million to settle allegations they'd been ripping off state government agencies for more than a decade. Last March, an AT&T whistleblower stated that AT&T had been ripping off US schools for just as long, and that he was summarily fired when he brought that to the attention of his superiors (there's been no meaningful government inquiry into his claims). And this week, AT&T was required to strike a $1.5 million penalty to settle a lawsuit (pdf) accusing the company of, you guessed it, ripping off the local DC government for years. From the DC AG announcement:

"Today’s settlement resolves a lawsuit by the Office of the Attorney General (OAG) against AT&T for allegedly submitting false invoices that did not comply with contract requirements to provide cost optimization and the most cost-effective telecommunications plans available. Instead, AT&T knowingly invoiced the District for features, add-ons, and other services that failed to comport with this mandate, causing millions in improper charges that were paid with taxpayer funds."

You know, basically the same way AT&T treats its residential broadband and TV customers.

In many of these deals, the settlement itself barely comes close to actually covering the amount of money AT&T made ripping off governments and taxpayers. And the companies don't have to actually admit to any wrongdoing. Other times, nothing happens at all. In 2016, the Obama FCC attempted to fine AT&T $106,425 for repeatedly overcharging two school districts in Florida, only to have that inquiry gutted when Trump and Ajit Pai came to town. The FCC would have much of its consumer protection authority gutted by the Trump administration, at direct lobbyist behest, one year later.

While we like to insist the US isn't a corrupt mess, we've built a system where accountability, when it actually happens, is usually just viewed as a minor pest and the cost of doing business. To hold AT&T properly accountable you'd need government policies that encourage competition in consumer and government service broadband, better antitrust enforcement and tougher merger review, properly funded and empowered regulators, and lawmakers genuinely interested in consumer protection and fraud prevention, all things we're very much not doing consistently. In part because AT&T is politically powerful and doles out plenty of campaign contributions, but also because it's tethered to our intelligence and law enforcement systems.

That's not to say some regulators and governments haven't tried all the same. In just the last five years or so AT&T has been fined $18.6 million for helping rip off programs for the hearing impaired; fined $10.4 million for ripping off a program for low-income families; fined $105 million for helping "crammers" by intentionally making such bogus charges more difficult to see on customer bills; and fined $60 million for lying to customers about the definition of "unlimited" data. Again it's subtle, but maybe you see a pattern here?

In nearly every instance regulators will pat themselves on the backs for issuing "record" fines. But once these efforts wind their way through litigation, most of these fines are usually reduced, if not eliminated altogether. And they're collectively still a pittance compared to the money AT&T makes from being a natural monopoly across vast swaths of the country. But instead of directly targeting telecom monopolization and the rampant state and federal corruption that protects it from change, competition, and accountability, we dole out a parade of wrist slaps and then pat ourselves on the back for a job well done.

Filed Under: false invoices, fcc, ftc, governments, overcharging, rip offs, scams, subsidies
Companies: at&t, verizon

G7 And Technical Standards: Blink And You Might Have Missed The New Battleground

from the governments-encroaching dept

Amid all the news about the third wave of the COVID-19 Pandemic and the politics behind the vaccination roll out, you might have missed the Ministerial Declaration from the G7 Digital and Technology Ministers’ meeting. As per tradition, the G7 Digital Ministerial provides the opportunity for the seven richest countries of the world to declare their commitments and vision on the type of digital future they would like to see. The document is non-binding but it has the tendency to provide some useful insights on the way the G7 countries view digital issues and their future positions in multilateral fora; it is also informative of other, more formal, multilateral processes. On 28 April 2021, a statement was made addressing key technology issues and opportunities including security in ICT supply chains, Internet safety, free data flows, electronic transferable records, digital competition and technical standards.

Yes, you read that right - technical standards. In the last several years technical standards have moved from the realm of engineers into wider politics. News stories have been replete with China’s efforts to become a competitive force on 5G, AI and facial recognition standards and its wish to be developed internationally based on their national rules, culture and technology. But the public eye turned more closely to China when it was discovered that the facial recognition standards being developed by China in the UN system were from countries on the US sanctions list and used by China for monitoring Uighurs.

None of this is new. For the past few years and for anyone who has been paying attention, China has been strategically positioning itself in various standards bodies realizing that shifting from a unipolar to a multipolar world order cannot happen unless it is capable of demonstrating a more strategic and competitive approach to the domination of the west. What was the tipping point, however, that made the seven richest countries in the world offer explicit language on standards inserted into their declaration? Everything seems to be pointing to the "newIP" standard proposal, recommending a change in the current Internet technology, that was put forward by Huawei and supported by China in the International Telecommunications Union (ITU). Although this new standard did not manage to pass the ITU’s study group phase, it did raise the eyebrows of the West. And, rightly so. 

Historically, Internet standards have paved their own path and have majorly managed to stay outside of politics.  In one of the earliest Requests for Comments (RFC), the definition of a standard was specific and narrow:  a standard is “a specification that is stable and well-understood, is technical competent, has multiple, independent and interoperable implementations with operations experience, enjoys significant public support, and is recognizably useful in some or all parts of the Internet”. 

Traditionally, governments have had a hands-off approach in the development and deployment of standards related to the Internet; their development was part of the consensus-based, community-driven process developed and nurtured by the Internet Engineering Task Force (IETF) and their deployment was left to the market.  A standard’s life has always depended on its utility and contribution to the evolution of the Internet. 

This seems to be the case less and less. Over the past years, governments have shown increasing interest in the development of standards, and have sought ways to inject themselves into Internet standardization processes. There are two distinct ways that this trend has emerged. First, there's China, which actively seeks to displace the current Internet infrastructure. That was clear in the attempt with the “newIP” proposal. China has been strategic in not directly suggesting a complete rejection of the Internet model; instead, its claims have been that the Internet cannot meet future technologies and needs and, therefore, a new infrastructure, developed  and nurtured by governments, is necessary. The second trend continues to support the open, market-driven standards development processes, but seeks ways for governments to be more actively involved. This, so far, has mainly been interpreted as identifying ways to provide incentives for the creation and deployment of certain standards, often those deemed strategically important. 

Even though these approaches reflect different political and governance dimensions - China supports a top-down approach over the West’s bottom-up model - they do share one commonality: in both cases, politics are becoming part of the standardization process. This is entirely unlike the past 30 years of Internet development. 

This could have significant implications in the development and future of the Internet. There are benefits from the current structure: efficiency, agility and collaboration. The existing process ensures quick responses to problems. But, its main advantage is really the collective understanding that standards are driven by what is “good for the Internet”; that is, what is required for the Internet’s stability, resilience and integrity. 

This doesn’t mean that this process is perfect. Of course, it comes with its own limitations and challenges. But, even then, it is a tested process that has worked well for the Internet throughout most of its existence. It has worked - despite its flaws - because it has managed to keep political and cultural dimensions separate. Participants, irrespective of background, language, and political persuasion have been collaborating successfully by having the Internet and what's good for it, as their main objective. 

On the contrary, intergovernmental standards are driven by political differences and political motives. They are designed this way. This is not to say that governments should not be paying attention to the way standards are developed. But, it is crucial to do so in ways that do not seek  to upend a model that is tested and responsive to the needs of the Internet. 

Dr. Konstantinos Komaitis is the Senior Director, Policy Strategy and Development at the Internet Society.

Dominique Lazanski is the Director of Last Press Label, and a Consultant in International Internet and Cybersecurity Standards and Policy.

Filed Under: china, g7, governments, internet standards, multistakeholder, politics, standards

eBay To Let Governments Pull Down Listings Automatically; What Could Possibly Go Wrong?

from the have-you-seen-who-we've-elected-lately? dept

One common theme we've seen for ages in the various content moderation debates are that those who think that governments should be able to determine what content stays up and what content needs to come down don't seem to recognize who various government leaders around the world are these days. Governments have an unfortunate track record of trying to pull down content that embarrasses themselves. And yet, for reasons unknown, eBay has decided that it is going to let government regulators automatically remove listings on the auction site.

This latest move, eBay said, was designed to speed up the removal of "illegal or unsafe items" without waiting for approval from the company.

Only selected, trusted authorities will have access to the new tools. But those that do will have "the ability to take down any listings from the marketplace themselves", the company said.

More than 50 authorities around the world are already involved in the early stages of the project, it added.

Now, admittedly, removing products for sale may be a bit different than removing content. And, there are plenty of stories about "unsafe" or counterfeit goods listed on these sites (though, in the past we've noted how the moral panic stories about such listings tend to be massively exaggerated). It's also not at all clear that government agencies are going to be able to properly recognize when a product is "unsafe" or "illegal."

In the US, for example, we've certainly seen Homeland Security seize products claiming they were "unsafe" when they really just seemed to be... competitive with a bigger company's offerings.

Similarly, giving anyone outside of the company direct control to pull down other people's content has been fraught with problems. Over and over again we've seen such "trusted flagger" programs fail spectacularly, even with supposedly larger organizations that should know better.

And, of course, even when it comes to things like auctions, governments may have extremely different ideas of what counts as "unsafe" or "illegal" than the platforms do. It's ancient history in internet time, but some of us still remember that France charged Yahoo's then CEO as a war criminal because Yahoo's own auction site in the early 2000s had some Nazi merchandise for sale. Yes, obviously in some countries Nazi paraphernalia is illegal to sell. But do we really think governments should be able to just reach into a platform, without review, without due process, and pull down those listings?

As Stanford's Daphne Keller notes, this seems like we're careening at high speed down the slippery slope towards governments directly deciding what remains up and what gets taken down, with little (or no!) consideration of the users' own interests.

Filed Under: auctions, counterfeits, governments, safety, takedowns, trusted flaggers, unsafe items
Companies: ebay

New York Court Reminds Native American Tribe That Suing For Libel Isn't An Option For Government Agencies

from the what-you're-allowed-to-do-vs.-what-you'd-like-to-do dept

We give government agencies a whole lot of power. That's the way the government works: we, the people, allow agencies to perform their duties with minimal interference and, in exchange, we theoretically benefit from these services we pay for indirectly.

To perform their duties, agencies need a bit of runway. Discretion is theirs alone. We can hope to force external change, but internally, agencies operate without direct oversight from the people funding them. And when it comes to litigation, government agencies can usually dodge lawsuits, thanks to multiple levels of immunity. Qualified immunity shields public servants from accountability. Absolute immunity shields pretty much everything else.

But there's a flipside, one we don't see all that often. The government can dodge a lot of accountability, thanks to its immunity stacks. On the other hand, it can't easily engage in litigation against the citizens signing its paychecks, thanks to Constitutional, judicial, and legislative protections.

The government can only do so much when it feels besmirched. And it definitely can't do this sort of thing. Government officials can sue in their personal capacity. But they can't sue as a cohesive whole. That's the uptake from a short decision entered against a Native American tribe that decided to sue TV producers over some fictional stuff that happened in a fictional TV show. (via the Volokh Conspiracy)

The Cayuga Nation -- a federally recognized Native American tribe that possesses land in New York, Oklahoma, and Ontario, Canada -- sued over its depiction in the Showtime series, Billions. In one episode, the Cayuga tribe was depicted as engaging in an illegal land deal -- one that involved bribery and blackmail.

The tribe sued, claiming it had been defamed. But the court [PDF] handling the case points out the tribe is a governmental agency and, therefore, cannot engage in libel lawsuits. The First Amendment forbids this sort of government action, even if the government agency pursuing the claim operates outside of the federal government's purview.

Contrary to Cayuga Nation's contention, First Amendment principles are applicable to cases involving libel claims arising from fictional works of entertainment (see e.g. Gravano v Take-Two Interactive Software, Inc., 142 AD3d 776 [1st Dept 2016], affd 31 NY3d 988 [2018]; Batra v Wolf, 2008 NY Slip Op 30821[U] [Sup Ct, NY County, Mar. 14, 2008]). Supreme Court reasonably rejected plaintiffs' conclusory contention that the episode referred to plaintiff Halftown individually, and the episode can reasonably be said to concern how the Cayuga Nation "governs," as it depicts the Nation's involvement in a land deal and its decision to support a particular character in connection with a mobile voting program that he seeks to implement. While plaintiffs argue that Native American tribes are a unique kind of government entity, they do not explain how that uniqueness bears on the libel analysis at issue.

Unique or not, the tribe is a government agency. And, as such, they cannot engage in civil libel litigation without undercutting long-held tenets of free speech. Any close relation between real persons and fictional depictions on TV shows is a non-issue. Billions is understood to be a fictional show. That it uses characters and entities existent in the real world is not a legitimate basis for a lawsuit by a government agency. After all, Billions -- like every other TV show and motion picture -- expressly notes that any relation to real world entities is strictly coincidental. That that tribe would feel offended by this depiction makes human sense, but it doesn't make legal sense.

First and foremost, government agencies cannot be libeled. Or, even if they've been libeled, they can't sue. That dates back to the Supreme Court's Sullivan decision:

For good reason, "no court of last resort in this country has ever held, or even suggested, that prosecutions for libel on government have any place in the American system of jurisprudence."

If the federal government can't sue, neither can federally recognized government entities like this one. The Cayuga Nation may be offended by this episode of Billions. But that's all it can be. It can't be litigious. It has no legal basis to sue, even considering its status as a semi-autonomous nation under federal law. If this government is unhappy about its portrayal in mass media, it has plenty of PR options at its disposal. What it doesn't have is the right to engage in litigation.

Filed Under: 1st amendment, billions, cayuga nation, defamation, fiction, governments, native american, new york

In Response To Getting Sued, Clearview Is Dumping All Of Its Private Customers

from the thanks-for-the-half-assed-largesse,-asses dept

This is the first good news we've heard from Clearview since its exposure by Kashmir Hill for the New York Times back in January. In response to a lawsuit filed against it in Illinois accusing it of breaking that state's privacy laws with its scraping of images and personal info from a multitude of social media platforms, Clearview has announced it's cutting off some of its revenue stream.

Clearview AI — the controversial face-tracking company known for scraping more than 3 billion photos from social media sites including Facebook and Twitter — said it is ending its relationships with non–law enforcement entities and private companies amid regulatory scrutiny and several potential class action lawsuits.

Responding to one of those lawsuits, Clearview claimed in legal documents filed in an Illinois federal court on Wednesday that it was taking those voluntary actions and would “avoid transacting with non-governmental customers anywhere.”

Clearview's motion to dismiss [PDF] argues this lawsuit is now mooted since it will no longer be doing business with any Illinois entities and has apparently found some way to sort out personal info on Illinoians from the rest of scraped stash. Take a couple of grains of salt before reading the following:

Moreover, Clearview has taken steps to secure and implement limits regarding the retention of any Illinois photos. Clearview is terminating access rights to its app for all account holders based in Illinois and is terminating the accounts of any non-law enforcement or government entity.

This is better but it's still nothing great. Governments can still use a privacy law-violating app. That's still a big problem. While private companies may be using Clearview's app the most, it's the company's government customers that are more of a problem. Unproven tech may get you booted from the local mall for resembling a shoplifting suspect, but law enforcement agencies can ruin your life and take away several of your freedoms. And Clearview isn't exactly selective about who it sells to, so plenty of overtly abusive governments will still get to use untested facial recognition software to destroy lives without worrying about niceties like due process.

Presumably, this will end the use of Clearview's AI by Illinois government agencies. But reporters at BuzzFeed couldn't get any confirmation from the Chicago PD that its plug had been pulled.

While the Chicago Police Department did not return a request for comment, a spokesperson for the Illinois secretary of state confirmed the office had been using Clearview “for about six months” to “assist other law enforcement agencies.”

Law enforcement agencies make up most of Clearview's customers in the state. If Clearview's sworn statements are true, they should all find their accounts deleted in the very near future. But Clearview hasn't been too honest when dealing with judgments passed by the court of public opinion, so it's probably wise to hold our golf applause for this lawsuit-prompted pullout until more facts are in.

We also shouldn't read too much into its declaration that it will be restricting gathering data on Illinois residents. Clearview's one-state filtering system apparently relies on metadata -- a lot of which is stripped by sites when users upload photos. It also will avoid scraping data and images from sites with words like "Chicago" or "Illinois" in the URL, which will leave a lot of Illinois-based websites open for Clearview's scraping business, no matter what it may be asserting in court. Sure, this is Clearview "taking steps" to prevent violating state law, but these two specifics can hardly be considered ambulatory.

The better news is this:

In addition, the startup said it was implementing an “opt-out mechanism” to allow people to exclude photos from its database.

Again, no congratulations until we see this implemented, and only if there's some outside auditing done to ensure Clearview is actually doing the things it says it is. For that matter, the AI still hasn't been independently examined, so we don't even know what sort of false positive rate Clearview's four-billion-image database is capable of generating.

Clearview is still as sketchy as ever and only slightly less dangerous following this move. As long as it still sells its scraped database and unproven AI to governments, it's still a threat to millions of people.

Filed Under: facial recognition, governments, privacy, surveillance
Companies: clearview, clearview ai

NSO Fires Back At Facebook, Says It's Not Responsible For Malware Deployments By Foreign Governments

from the fair-point-but-doesn't-really-make-NSO-Group-look-any-better dept

NSO Group has finally decided to engage in the lawsuit Facebook filed against it late last year. The Israeli surveillance tech company has shown itself to be pretty cavalier about its market expansion plans. Despite being located in a country surrounded by unfriendly governments, NSO is more than willing to give Israel's enemies something to use against it. Its client list includes Saudi Arabia, United Arab Emirates, Bahrain, and Kazakhstan.

Facebook's lawsuit is questionable and if it wins, it would cause a lot of damage. Facebook is unhappy NSO software uses WhatsApp to deliver malware payloads to targets. But seeking precedent that would criminalize terms of service violations isn't going to help anyone, much less stop NSO from using encrypted messaging apps as attack vectors.

NSO is now firing back. And it makes a point that's true, if not all that sympathetic. It is not its customers. Much like the gun dealer who sells the gun eventually used in a mass shooting, NSO's sales of malware to governments that use them in questionable ways isn't really NSO's fault. It may have provided the surveillance tech, but it is not telling governments who to target or participating in the surveillance directly.

In its first substantive legal filing in the case, filed last week, NSO hit back at WhatsApp and its parent company, Facebook, which it said were seen by governments as “safe spaces for terrorists and other criminals” who – without NSO’s services – could operate “without fear of detection by law enforcement”.

NSO Group also argued that WhatsApp had “conflated” NSO Group’s actions with the actions of NSO’s “sovereign customers”. While NSO Group licenses its signature spying technology, Pegasus, to government law enforcement and intelligence agencies and assists with “training, setup, and installation”, it said it did not operate the technology.

This is NSO arguing it cannot be held responsible for the actions of others. If Facebook doesn't like what these governments are doing with NSO's tech, it's welcome to sue those governments directly. Not that those lawsuits would succeed. We're not the only nation that extends sovereign immunity to government agencies. That's standard operating procedure around the world. This is what NSO is hoping will convince the court to toss the suit.

“For that reason,” the company said in the filing, “permitting this litigation to proceed would infringe critical national security and foreign policy concerns of sovereign governments”.

NSO is also fighting back with a little dirt of its own. Long before it was sued by Facebook, it spent a little time discussing its spyware with the company.

In October 2017, NSO was approached by two Facebook representatives who asked to purchase the right to use certain capabilities of Pegasus, the same NSO software discussed in Plaintiffs' Complaint.

The Facebook representatives stated that Facebook was concerned that its method for gathering user data through Onavo Protect was less effective on Apple devices than on Android devices. The Facebook representatives also stated that Facebook wanted to use purported capabilities of Pegasus to monitor users on Apple devices and were willing to pay for the ability to monitor Onavo Protect users. Facebook proposed to pay NSO a monthly fee for each Onavo Protect user.

Onavo was Facebook's VPN -- one that had little to do with offering privacy to its users. It may have shielded them from others attempting to take a look at their web traffic, but it didn't do anything to prevent Facebook from collecting tons of data on users, which included a whole lot of minors. It was booted from Apple's App Store in 2018 for hoovering up too much sensitive data. Roughly six months later, Facebook killed the faux VPN for good.

Facebook claims this is an "inaccurate" portrayal of its meeting with NSO, but it's not like Facebook has much credibility on the privacy front. Its thirst for data has been unquenchable and its mitigation attempts have been provoked by Congressional inquiries and years of work by privacy activists. It hasn't suddenly become altruistic.

Facebook is right to be concerned about the use of WhatsApp to spread malware. But this lawsuit that attempts to use the already badly-abused CFAA to cover things Facebook doesn't like other people doing is going to cause collateral damage to researchers and journalists, rather than prevent NSO from selling WhatsApp-exploiting malware to government agencies.

Filed Under: cfaa, governments, hacking, liability, malware, privacy
Companies: facebook, nso, whatsapp

Clearview Looking To Expand Its Market To Problematic Countries Known For Human Rights Abuses

from the a-cop's-a-cop,-right? dept

It appears no one's thrilled facial recognition upstart Clearview is scraping their photos to build a facial recognition database to sell to cops. But what can they do about it? Not much more than write angry letters.

Twitter was the first to send a C&D to the troubling developer over this troubling development. It was presumably ignored. Google also issued a C&D, only to be not-so-gently reminded by Clearview that Google does the same thing to build its search engine database. (Of course, web site owners and developers can opt out of being crawled by Google bots -- something that's not an option with Clearview.)

Added to the list of pissed scrapees are Venmo and LinkedIn, the latter known for actually suing people who have scraped its site. Facebook, however, has not done this and it's by far the largest repository of face photos and personal information on the web. Facebook claims to be asking Clearview some tough questions about its scraping and database compilation but it has not sent a formal cease-and-desist.

Maybe Zuckerberg's just disappointed he didn't think of this first. Or, as Aaron Mak speculates for Slate, maybe it has something to with Peter Thiel's early investment in Clearview and his position as a Facebook board member. Thiel likes surveillance and Clearview's scraping of Facebook to compile a facial recognition database may be just the sort of vertical integration he's looking for.

But the bad news gets worse. Clearview's aggressive pursuit of law enforcement agency customers -- combined with its questionable database construction methods -- hasn't won it very many friends. Not even from the law enforcement community, which has been forced to offer rebuttals to exaggerated (or downright false) claims made by Clearview in its marketing materials.

Clearview isn't going to limit itself to the United States. Documents obtained by BuzzFeed show Clearview is pitching its facial recognition app to abusive governments around the world.

A document obtained via a public records request reveals that Clearview has been touting a “rapid international expansion” to prospective clients using a map that highlights how it either has expanded, or plans to expand, to at least 22 more countries, some of which have committed human rights abuses.

The document, part of a presentation given to the North Miami Police Department in November 2019, includes the United Arab Emirates, a country historically hostile to political dissidents, and Qatar and Singapore, the penal codes of which criminalize homosexuality.

So far, Clearview says it only has "partnerships" in the US and Canada. But no developer flogging surveillance tech has ever been willing to limit themselves to the "good guys." Even Israeli tech companies have been willing to sell products to their country's direct enemies, presumably assuming the profits will outweigh the collateral damage when these are inevitably turned against their nation's people.

Clearview may find more opposition if it attempts to sell its products to European law enforcement agencies. Unlike here in the US, privacy protection laws are extremely restrictive. The unholy mess that is the GDPR makes it untenable for US sites to use cookies or serve ads. Trying to push a product built on non-consensual scraping of personal data from dozens of websites is a non-starter.

Potentially more problematic is Clearview’s inclusion of nine European Union countries — among them Italy, Greece, and the Netherlands — on its expansion map. These countries have strict privacy protections under the General Data Protection Regulation (GDPR), a 2016 law that requires businesses to protect the personal data and privacy of EU citizens. Joseph Jerome, a policy counsel for the Center for Democracy and Technology, said it was unclear whether Clearview AI's technology would violate the GDPR.

Then again, there may be almost no trouble at all. Like almost every privacy protection law created anywhere in the world, law enforcement and national security services enjoy some very large carve outs, which makes it possible for them to do the things the law says is illegal if anyone with a lot less power to destroy lives does it. In this case, Clearview's data collection process may be illegal, but government use of the end result won't be. Funny how that works.

Filed Under: facial recognition, governments, privacy, scraping, surveillance
Companies: clearview, clearview ai