Hacker swipes customer list from controversial face-recog-for-Feds Clearview. Its reaction? 'A part of life'

A hacker stole the customer list of Clearview, the controversial startup that scraped three billion photos from the public internet to train a population-scale facial-recognition system sold to police and government agents. Clearview notified its clients in an email on Wednesday that a miscreant “gained unauthorized access” to …

[Pascal Monett]

“Security is Clearview’s top priority"

Sound the bugle, we have another hypocrite !

As soon as I hear that sentence, I know you didn't give a flying one about security. It's a badge, you see. It's like a criminal saying "But I didn't do nuthin' !" while getting caught with the goods.

Getting hacked is a way of life ? Well sure, when you can't be arsed to set up the proper fences.

[Outer mongolian custard monster from outer space (honest)]

Re: “Security is Clearview’s top priority"

"Security is Clearview's top priority",they just forgot to mention of their ip and algo's.

I interviewed for a c suite level security bod at a cloud startup, and the entire interview was geared to how I would protect the above for them, when I asked around the PII they held on the cloud of thousands of people's medical reports, nobody gave a flying fig about any aspect of it.

I declined the job, I never was cut out for taking more filthy lucre at the expense of taking pills to keep my conscience dormant.

[Michael Wojcik]

Re: “Security is Clearview’s top priority"

Of course it's their top priority. It's their business. They're working every day to help eliminate it.

[JohnFen]

Just desserts

I don't rejoice when anybody gets their data stolen -- after all, that's the heart of my objection to how internet marketing operates. And I don't rejoice in this, either. That said, it's hard to find a more deserving victim this time.

[Mongrel]

Re: Just desserts

The problem is that they're not the victims, it's the people who's data they left lying around to be stolen.

[JohnFen]

Re: Just desserts

Everybody involved (both Clearview and their customers) are both bad actors and victims. But no really critical information seems to have been pilfered.

[IGotOut]

Server not accessed!

You dumb idiots, like they could access our servers. No, it was all on a laptop we used in Starbucks to update our Facebook account.

[Mephistro]

So, basically...

... they wiped they arse with those cease and desist letters. I'd wager there are a few lawyers maniacally rubbing their hands in this same moment.

;^)

[W.S.Gosset]

“Security is Clearview’s top priority."

That's a worry. Because they're shit at it.

[Citizen of Nowhere]

Re: “Security is Clearview’s top priority."

Imagine how bad they might be at facial recognition.

[imanidiot]

Uhmmmm what??

"Since all the images were freely available on the web, Clearview has a “First Amendment right to public information," he said in a telly interview earlier this month."

That is not how the internet, copyright law or privacy laws work...

These people deserve to go to jail imho. Absolutely immoral what they're pulling.

[Prst. V.Jeltz]

The system works thus: you give it a picture of a suspect, and it tries to match the snap to one of three billion faces scraped from Facebook, LinkedIn, YouTube, and so on. If it finds a hit, it returns details about the profile or webpage it found the photo on, allowing investigators to discover the identity of the wanted person.

That sounds like an amazingly useful tool to me.

But "privacy advocates" or whatever they're called seem to think that this system will automatically launch a drone strike on the target which it will have incorrectly identified 90% of the time.

[Kane]

"That sounds like an amazingly useful tool to me."

That's exactly the kind of comment I would expect from a Vogon.

[Prst. V.Jeltz]

yes , well we like to keep the prisoners public records well organised , but sometimes it can take the department of photos too long to check all the filing cabinets on a planet.

[flayman]

It certainly is a useful tool for all sorts of bad actors. The "good" actors who fail to take reasonable steps to secure the data and then shrug off a hack as "that's life" are negligent. Maybe the sensitive data has not been compromised, but maybe it also shouldn't be compiled and stored by someone without explicit consent. I remember the controversy around Google Glass when it was first released. You could have something that looks like ordinary eyeglasses surreptitiously recording people going about their business without their knowledge or consent and then uploading that to a public server as video clips. There ought to be a reasonable expectation of privacy in this situation. I do not consent to surreptitious videoing of myself and publishing to YouTube when I'm standing in a queue at Starbucks. I don't give consent that my movements can be discovered so easily by members of the public. I'm an adult. What about children? I don't give consent that photos of myself and my kids which are uploaded to Facebook and tagged by someone else can be used for warrant-less surveillance by the police.

[Anonymous Coward]

well , bad news buddy: If you're in a public place people can basically do wtf they want recording wise.

[flayman]

http://www.dmlp.org/legal-guide/massachusetts-recording-law

Demonstrates that First Amendment protections do not apply.

[imanidiot]

If you're in the EU, No, people cannot just do what they want. There's rules on what you can do regarding taking videos of people in public and rules on what you can do with any video you made in public.

[flayman]

First Amendment wrong

"Clearview has a “First Amendment right to public information, ..."

The First Amendment does not guarantee a right to use copyrighted materials for commercial purposes, nor to construct an elaborate framework around harvested data and media that puts people at risk (for example publishing information gleaned about a person's movements). That would be applying a context to the data that is not publicly available. Although the European legal framework does not come into play in the United States, the EU Data Protection Directive has been interpreted in such a way that publicly available information that is processed by some party into a new context causes that party to be treated as a data controller (or processor) unless it is done so for only personal use. It seems to me that this is not inconsistent with First Amendment principles, though of course I could be wrong. This has never been decided in a federal court. I suspect it would come down to whether there is a reasonable expectation that photos submitted to social media will not be used for warrant-less surveillance purposes. I think the tendency to upload photos and tag other people causes this to fall on the side of privacy.