Clearview, this time information leak due to server error

Clearview AI has built and sold facial recognition AI using 3 billion facial photos and personal information posted on SNS, etc. without permission, but it is said that information such as source code was leaked due to a server setting error.

The server containing the data cloud storage account information, such as the problem face recognition software source code, secret key, and certificate information, could be used by anyone with incorrect settings. In addition, cloud storage kept copies of applications created for testing and unreleased applications, and Slack access information that could be used for communication within the enterprise was also disclosed.

Clearview AI face recognition software, which uses 3 billion image data collected by ignoring the privacy policy of SNS platform companies, has been sold only to law enforcement agencies and has been partially used. However, there have been reports that it has been sold to private companies such as Wal-Mart and Best Buy that have entered this year, as well as organizations such as the NBA.

ClearView AI reported that it has launched a bug bounty program that provides rewards to people who discover defects in its system, and the defects reported by SpiderSilk, who are not registered in the compensation program, include personal identification information, search history, and biometric information. He emphasized that nothing was exposed. Of course, SpiderSilk claims it has refused to receive compensation because it cannot openly address security concerns.

Prior to the spread of Corona 19 infection, a judge ordered the destruction of residents’ data with a ruling that the technology would conflict with the Illinois Biometric Information Protection Act BIPA, surrounding ClearView AI. In February, major web services such as Facebook and Google requested to stop unauthorized collection of images in response to image acquisition ignoring the terms of use and policies. In California, they also filed a class action lawsuit claiming that Clearview’s collection of information violated the California Consumer Protection Act CCPA. Related information can be found here.