For $29.99 a month, a website called PimEyes offers a potentially dangerous superpower from the world of science fiction: the ability to search for a face, find obscure photos that would otherwise have been as sure as the needle proverbial in the vast digital haystack of the Internet.
A search only takes a few seconds. You upload a photo of a face, check a box agreeing to the terms of service, and then get a grid of photos of faces deemed similar, with links to where they appear on the internet. The New York Times used PimEyes on the faces of a dozen Times reporters, with their consent, to test its powers.
PimEyes found photos of each person, some that reporters had never seen before, even when they were wearing sunglasses or a mask, or their faces were turned away from the camera, in the image used. to perform the search.
PimEyes found a journalist dancing at an event at an art museum ten years ago, and crying after being proposed in marriage, a photo she didn’t particularly like but the photographer decided to take use to advertise their business on Yelp. A tech reporter’s younger self was spotted in an awkward fan crush at the Coachella music festival in 2011. A foreign correspondent has appeared in countless wedding photos, obviously the life of every party, and in the blurred background of a photo taken of someone else at a Greek airport in 2019. A journalist’s past life in a rock band has been uncovered, as has his favorite summer camp getaway of another.
Unlike Clearview AI, a similar facial recognition tool available only to law enforcement, PimEyes does not include results from social media sites. Instead, the sometimes startling images that PimEyes surfaced came from news articles, wedding photography pages, review sites, blogs, and porn sites. Most of the matches for the reporters’ dozen faces were correct.
For women, the incorrect photos were often from porn sites, which was troubling in the suggestion that it might be them. (To be clear, it wasn’t them.)
A tech manager who asked not to be identified said he used PimEyes quite regularly, mostly to identify people who harass him on Twitter and use their real photos on their accounts but not their real names. Another PimEyes user who asked to remain anonymous said he used the tool to find the real identities of porn actresses and to find explicit photos of his Facebook friends.
The new owner of PimEyes is Giorgi Gobronidze, a 34-year-old academic who says his interest in cutting-edge technology was sparked by Russian cyberattacks on his home country of Georgia.
Gobronidze said he believes PimEyes could be a tool for good, helping people keep tabs on their online reputation.
“It’s stalkerware by design, no matter what they say,” said Ella Jakubowska, policy adviser at European Digital Rights, a privacy group.
“Basically extortion”
A few months ago, Cher Scarlett, a computer engineer, tried PimEyes for the first time and was confronted with a chapter in her life that she had tried so hard to forget.
In 2005, when Scarlett was 19 and broke, she considered working in pornography. She flew to New York for an audition so abusive she gave up on the idea.
PimEyes unearthed the trauma, with links to where exactly the explicit photos could be found on the web. “Until now, I had no idea these images were on the internet,” she said.
When she clicked on one of the explicit photos on PimEyes, a menu appeared offering a link to the image, a link to the website where it appeared, and an option to “exclude from public results” on PimEyes.
But the exclusion, Ms. Scarlett quickly discovered, was only available to subscribers who paid for “PROtect plans,” which cost $89.99 to $299.99 per month. “It’s basically extortion,” said Scarlett, who ultimately signed up for the more expensive plan.
But when the Times ran a PimEyes search on Scarlett’s face with her permission a month later, there were over 100 results, including the most explicit.
Gobronidze said it was a “sad story”. Instead, it blocks from PimEyes’ search results all photos of faces “with a high level of similarity” upon opting out, which means people have to opt out regularly, along with multiple photos of themselves- same. Gobronidze said he wants “ethical use” of PimEyes. But PimEyes doesn’t do much to enforce this, beyond a box that a searcher must click to affirm that the uploaded face is theirs.
There are users that Gobronidze does not want. He recently blocked people in Russia on the site, in solidarity with Ukraine. He mentioned that PimEyes was willing to offer its service to organizations for free, if it would help in the search for missing persons.
A German data protection agency has announced an investigation into PimEyes.
Gobronidze said he had heard nothing from German authorities. “I look forward to answering any questions they may have,” he said. He doesn’t care about privacy regulators, he said, because PimEyes works differently.
He described it as almost like a catalog of digital cards, saying the company doesn’t store individual facial photos or models, but rather URLs for individual images associated with the facial features they contain.