A "private and secure" face search left 9 million images in an open bucket

A people-search site whose upload page promises "Your reverse image search is private and secure" left more than 9 million image files, including photographs of people's faces, reachable on the open internet ^[3][1]. The tools that employees use to check who they are dealing with are themselves unassessed vendors holding third-party biometric-adjacent data, and this one had no lock on the door. According to research by independent security researcher Jeremiah Fowler, the exposed ClarityCheck store held roughly 450GB of images, including what appeared to be profile pictures, screenshots and other photographs of adults, teenagers and children, all sitting in an unsecured Amazon S3 bucket with folders named "faces" and "profiles" ^[2]. The access path is the part worth dwelling on: the bucket was reachable by anyone online through a URL included in the company's own publicly available website code ^[7]. A second misconfiguration exposed email addresses and phone numbers ^[9], and Fowler found the site's APIs were misconfigured such that its URLs could be manipulated to reveal data about people simply by entering names ^[11]. ClarityCheck secured the image database after WIRED contacted it in July, but Fowler says it appeared to have been exposed for months and that his initial attempts to flag the problem to the company were unsuccessful ^[4]. A company spokesperson told WIRED that "once this was drawn to the attention of the appropriate teams, we acted immediately to restrict access" ^[14]. The company disputes the characterisation that the data was exposed, saying an "ordinary member of the public" would not have come across it and that access "required knowledge of a specific, unindexed URL that was not discoverable through ordinary use of the ClarityCheck service or a general web search" ^[16]. It also said there is no suggestion of malicious access and that the files include duplicate, cropped and resized copies of the same images along with non-image data, not 9 million unique images ^[5]. It says it has improved its security reporting procedures ^[15]. On duplicates, the arithmetic is at least consistent with the company's account: 450GB spread across 9 million files averages about 51KB each, which is thumbnail and crop territory rather than originals ^[12]. On the unindexed URL, the definition is not the vendor's to set. The security industry and the US federal government treat data as exposed if it could be accessed by people not intended to have access, particularly if it is reachable on the open internet without an authentication requirement ^[17]. Mark Beare, head of consumer products at Malwarebytes, puts it as "the state in which personal or sensitive data has been left accessible, discoverable, or otherwise put at risk of unauthorized access, whether or not anyone has yet taken or misused it" ^[18]. A path published in your own front-end code is not obscurity. The operator problem sits in what the product is for. ClarityCheck says it can run searches on phone numbers, email addresses, vehicle identification numbers and names, and its photo-search page says it can help "identify anyone in a photo" and find social media profiles "in seconds" ^[8]. That is a description of work already being done inside recruiting, fraud, trust and safety and sales teams, and nothing about pasting a photo into a website touches procurement. The site asks uploaders to attest that they have permission to upload the photo ^[10]. Fowler's point is that the attestation is structurally hollow: the service exists to identify people, and people do not usually set out to identify themselves or people they already know, so those whose faces were in the bucket may have had no idea it held their image ^[6]. If someone in your organisation ran a candidate's or a counterparty's photo through it, your organisation moved a third party's face into a vendor it never reviewed, and it has no record that it happened.