For $ 29.99 a month, a website called PimEyes offers a potentially dangerous superpower in the sci-fi world: the ability to search for a face, find obscure photos that would otherwise have been as safe as proverbial needle in the great digital haystack of the internet.
A search takes a few seconds. Upload a photo of one side, check a box to accept the terms of service, and then get a grid of photos of faces that are considered similar, with links to where they appear on the Internet. The New York Times used PimEyes in the face of a dozen Times journalists, with their consent, to test their powers.
PimEyes found photos of all the people, some that journalists had never seen before, even when they were wearing sunglasses or a mask, or with their faces apart from the camera, in the image used for the search.
PimEyes found a journalist dancing at an art museum event a decade ago, and crying after being proposed, a photo she didn’t particularly like, but which the photographer had decided to use to advertise her business on Yelp. The youngest self of a tech journalist was seen in an awkward fan crush at the Coachella Music Festival in 2011. A foreign correspondent appeared in countless wedding photos, obviously the life of each party, and in the blurred background from a photo taken of someone else at a Greek airport in 2019. The past life of a journalist in a rock band was discovered, as well as a favorite getaway from another summer camp.
Unlike Clearview AI, a similar facial recognition tool available only to law enforcement, PimEyes does not include results from social networking sites. The sometimes amazing images that appeared on PimEyes came from news articles, wedding photography pages, review sites, blogs, and porn sites. Most of the matches on the faces of the dozen journalists were correct.
For women, the wrong photos often came from porn sites, which was disturbing to suggest that they might be them. (To be clear, it wasn’t them).
A tech executive who asked not to be identified said he used PimEyes quite regularly, mostly to identify people who were harassing him on Twitter and use his real photos on his accounts, but not his real names. Another PimEyes user who asked to remain anonymous said she used the tool to find the real identities of pornographic actresses and to search for explicit photos of her Facebook friends.
The new owner of PimEyes is Giorgi Gobronidze, a 34-year-old academic who says his interest in advanced technology was aroused by Russian cyberattacks in his home country, Georgia.
Gobronidze said he believed PimEyes could be a tool for good, helping people control their online reputation.
“It’s stalkerware by design, no matter what they say,” said Ella Jakubowska, a policy advisor for European Digital Rights, a privacy advocacy group.
“Essentially extortion”
A few months ago, Cher Scarlett, a computer engineer, tried PimEyes for the first time and was faced with a chapter in her life that she had tried to forget.
In 2005, when Scarlett was 19 and broke up, she considered working in pornography. He traveled to New York City for an audition that was so abusive that he abandoned the idea.
PimEyes discovered the trauma, with links to where the exact photos could be found on the web. “Until then, I had no idea these images were on the Internet,” he said.
When I clicked on one of PimEyes’ explicit photos, a menu appeared that provided a link to the image, a link to the website where it appeared, and an option to “exclude from public results” in PimEyes.
But the exclusion, Ms. Scarlett quickly discovered, was only available to subscribers who paid for “PROtect plans,” which cost between $ 89.99 and $ 299.99 a month. “It’s essentially extortion,” said Scarlett, who eventually signed up for the most expensive plan.
But when The Times did a PimEyes search of Scarlett’s face with her permission a month later, there were more than 100 results, including explicit ones.
Gobronidze said this was a “sad story.” Instead, it blocks any PimEyes search results from any photo of faces “with a high level of similarity” at the time of deactivation, which means that people should be regularly disabled, with multiple photos of themselves . Gobronidze said he wanted an “ethical use” of PimEyes. But PimEyes does little to enforce this, beyond a box that a search engine should click on stating that the face being loaded is theirs.
There are users that Gobronidze does not want. He recently blocked people in Russia from the site, in solidarity with Ukraine. He mentioned that PimEyes was willing to offer its service free of charge to organizations, if it could help in the search for missing persons.
A German data protection agency announced an investigation into PimEyes.
Gobronidze said he had not heard from any German authorities. “I’m looking forward to answering any questions you may have,” he said. He doesn’t care about privacy regulators, he said, because PimEyes works differently.
He described it almost as a catalog of digital cards, saying that the company does not store individual photos or face templates, but URLs for individual images associated with the facial features they contain.