Billions of police facial recognition photos stolen in one data breach

3 hours ago - Technology

Report: Full list of Clearview AI's law enforcement clients stolen

Margaret Harding McGill

https://images.axios.com/6HYjL080I-M...2737925754.jpg
Illustration: Aïda Amer/Axios

Controversial facial recognition startup Clearview AI told its customers that its complete list of clients, which includes law enforcement agencies all over the country, was stolen in a data breach, The Daily Beast reported Wednesday.

Why it matters:
An intruder gaining access to Clearview's client list will likely trigger alarm bells for both would-be customers and privacy advocates, who have already denounced the company following a New York Times report on Clearview culling more than 3 billion images from websites like Facebook to create its database.

Details: The Daily Beast obtained a notice Clearview sent to customers reporting that an intruder gained access to its list of customers, the number of user accounts and the number of searches the customers conducted, according to the report.

• Clearview told The Daily Beast the vulnerability has been fixed, and that law enforcement search histories were not revealed, nor were the company's servers compromised.
• "This is a company whose entire business model relies on collecting incredibly sensitive and personal information, and this breach is yet another sign that the potential benefits of Clearview’s technology do not outweigh the grave privacy risks it poses," Sen. Ed Markey (D-Mass.) said in a statement in response to the news report.

Go deeper: Clearview brings privacy concerns from facial recognition into focus

https://www.axios.com/report-full-li...074cc17b9.html

5/29/2015

"This fall, customs agents will begin collecting face and iris scans of people entering and returning from Mexico on foot from a San Diego border crossing."

Border facial recognition test program

1/20/2016

U.S. will use facial recognition at airports


U.S. border checkpoints at airports of entry nationwide will begin using facial recognition technology on foreign visitors and U.S. citizens . . .

5/11/2017

U.S. Citizens to Receive Airport Facial Recognition Scans

Facial-Recognition Company That Works With Law Enforcement Says Entire Client List Was Stolen


https://img.thedailybeast.com/image/...TX6GAJ3_qa1rc9


REUTERS/Thomas Peter

A facial-recognition company that contracts with powerful law-enforcement agencies just reported that an intruder stole its entire client list, according to a notification the company sent to its customers.

In the notification, which The Daily Beast reviewed, the startup Clearview AI disclosed to its customers that an intruder “gained unauthorized access” to its list of customers, to the number of user accounts those customers had set up, and to the number of searches its customers have conducted. The notification said the company’s servers were not breached and that there was “no compromise of Clearview’s systems or network.”

The company also said it fixed the vulnerability and that the intruder did not obtain any law-enforcement agencies’ search histories.

Tor Ekeland, an attorney for the company, said Clearview prioritizes security.

“Security is Clearview’s top priority,” he said in a statement provided to The Daily Beast.

“Unfortunately, data breaches are part of life in the 21st century. Our servers were never accessed. We patched the flaw, and continue to work to strengthen our security.”

The firm drew national attention when The New York Times ran a front-page story about its work with law-enforcement agencies. The Times reported that the company scraped 3 billion images from the internet, including from Facebook, YouTube, and Venmo.

That process violated Facebook’s terms of service, according to the paper. It also created a resource that drew the attention of hundreds of law-enforcement agencies, including the FBI and the Department of Homeland Security, according to that report. In a follow-up story, the Times reported that law-enforcement officials have used the tools to identify children who are victims of sexual abuse. One anonymous Canadian law-enforcement official told the paper that Clearview was “the biggest breakthrough in the last decade” for investigations of those crimes.

• The notification did not describe the breach as a hack. David Forscey, the managing director of the no-profit Aspen Cybersecurity Group, said the breach is concerning.
• “If you’re a law-enforcement agency, it’s a big deal, because you depend on Clearview as a service provider to have good security, and it seems like they don’t,” Forscey said.
• Facial-recognition technology—which matches photos of unidentified victims or suspects against enormous databases of photos—has long drawn intense criticism from privacy advocates. They argue it could essentially mean the end of personal privacy, especially given the proliferation of security cameras in public places. Some law-enforcement officials, meanwhile, see it as a tool with enormous potential value.

https://www.thedailybeast.com/clearv...ist-was-stolen

FBI, ICE using state driver's license photos without consent for facial recognition