ClarityCheck’s exposed biometric databases present major identity theft, fraud risk

Consider where your face might be found. Social media, probably. Maybe internet search. It doesn’t naturally occur to anyone that their face may be stored in a publicly exposed database with no security safeguards to speak of. Unencrypted and freely available, your face could be nicked from that database, paired with fake data and used for identity fraud.

Cybersecurity researcher Jeremiah Fowler recently happened upon just such a database.  According to what he shared with ExpressVPN, it contained 9,042,977 image files totaling 450.2 GB of data, housing the facial biometrics of adults, teens, and children in folders labeled “faces” and “profiles.”

“These included what appeared to be profile images, screenshots, and physical photographs that appeared to have been uploaded for reverse image searches or other identity verification purposes,” Fowler says.

“Upon further research, I was able to determine that the files belonged to a U.S.-registered company called ClarityCheck.”

Treat biometrics with care they warrant: Fowler

ClarityCheck offers reverse phone, email, image and vehicle lookup services. Its website describes “an online digital investigation service that uses reverse image search technology and claims to help users identify individuals, detect catfishing, investigate suspicious online profiles, and perform OSINT-based identity verification.”

In the case of a service like ClarityCheck, Fowler says, “the marketed purpose of the platform is the re-identification of individuals by allowing users (anonymous and registered) to upload an image of a person and attempting to connect that image to publicly available information, online profiles, or other identifying records.”

For ClarityCheck, a side effect was the mass retention of biometric data that, it turned out, anyone could steal.

“I imply no wrongdoing by ClarityCheck, Clarity Check Ltd., or any related entities,” Fowler says. “I do not claim that user data was actively exploited or that any internal systems were compromised. The hypothetical risk scenarios presented in this report are provided strictly for educational and awareness purposes and should not be interpreted as evidence of malicious activity.”

Nonetheless, he says, “I would strongly advise companies that collect and store facial biometric data to treat those images as sensitive information and protect them with the same level of care as other forms of PII.”

Policies provide flimsiest governance

The story is not surprising; in a world choked with data, breaches are the new reality. But it is illustrative of how flimsy tech company policies are in practice. ClarityCheck’s terms and conditions say that, in using the reverse image search tool, they affirm the legal right to upload any image associated with the search.

“You further consent to the temporary storage and processing of the image as outlined in our data retention policy, which states that uploaded images will be stored for fourteen (14) days before being automatically deleted,” the policy says.

The accountability behind these agreements is functionally nonexistent. No tangible legal threat actually prevents users from uploading images they have no right to, or have not obtained consent to use. As deterrents go, it is roughly as effective as the FBI warning that used to appear before movies on video cassette.

Which is to say, there is no real way to confirm if more than nine million people said it was fine for their face to be uploaded to ClarityCheck. As Fowler notes, “it is hypothetically possible that, in some cases, the individuals depicted were unaware that their facial images were being collected, indexed, or stored without them ever interacting with the ClarityCheck platform or service directly.”

As long as recorded media has existed, there has been the possibility that someone might capture your face. Home movies and video cameras have existed for decades. What’s changed is now easily we can move and store media – and what can be done with it once it has been stolen. “Publicly accessible images are a growing privacy risk now that powerful AI tools are widely accessible,” Fowler writes.

“Once biometric facial data is exposed, individuals cannot simply reset or replace their faces in the same way they would change a password or credit card number. Exposed facial datasets could become valuable targets in ways that we may not fully understand today and could pose a range of identity threats in the future as technology becomes more advanced.”

Article Topics

biometric database  |  biometrics  |  ClarityCheck  |  cybersecurity  |  data protection  |  face biometrics