A reverse image search service left nine million faces open

Jeremiah Fowler found 9,042,977 image files, 450.2 GB, in a cloud storage database belonging to ClarityCheck, a US-registered reverse image search and people-finder service. The store was “neither password-protected nor encrypted.” The folders were labelled “faces” and “profiles.” He found the storage URL in ClarityCheck’s own page source.

The sample held “facial images of adults, teens, and children” — profile pictures, screenshots and photographs of physical photographs.

ClarityCheck’s own terms, at section 14, say uploaded images “will be stored for fourteen (14) days before being automatically deleted.” Fowler: “I observed images in the publicly accessible database with timestamps that exceeded this 14-day retention period.”

The company disclaims offering facial recognition. Its service page says reverse image search “can be used to identify anyone in a photo, find names, social profiles, and online presence in seconds.”

Fowler, quoted in WIRED’s report: “An AI bot could crawl it, extract faces, and use them for training. And there are lots of pictures of kids in there.” A ClarityCheck spokesperson told WIRED the company does “not accept that data in the temporary storage location was ‘publicly exposed,’ which implies large-scale public access,” because “access required knowledge of a specific, unindexed URL.”

The two accounts of how it closed do not line up. Fowler’s report says the database “was restricted from public access and was no longer accessible at the time of publication” and quotes a cooperative reply thanking him for “diligent and responsible disclosure.” WIRED reports the company ignored his initial alerts and secured the store only after WIRED made contact in July. Fowler’s writeup gives no dates for discovery or disclosure.

A password on a bucket is a control you can add after the fact. A face is not reissuable, and nine million of them were indexed by a service whose business is matching faces to names.