On April 16, Clearview AI disclosed that it had experienced another data security breach. In the suit, Plaintiff David Mutnick claims that this new information provides an additional basis for the Court to grant his preliminary injunction in an earlier lawsuit against the company. In the request for preliminary injunction, Mutnick stated that “given Defendants’ lack of concern for data security and their new-found notoriety, it is extremely likely that Defendants [Clearview AI] will experience additional and more severe data breaches, further injuring those whose data they wrongfully acquired in the first place.” His prediction has come true, despite Clearview previously stating security was its top priority.
The company has faced notoriety in recent months due to allegations that it has maintained a massive database of facial recognition photos and sold access to law enforcement and other private agencies.
According to TechCrunch Clearview AI had a “misconfigured server” which “exposed the company’s internal files, apps and source code for anyone on the internet to find.” Consequently, anyone could run Clearview’s application software and access its biometric database, which contains information on more than 3 billion people. Additionally, the breach “revealed that Defendant Clearview’s server had 70,000 videos of a lobby in a residential building that showed residents entering and leaving the building.” Clearview CEO Hoan Ton-That noted that Clearview was investing in increased security measures and that the company had “experienced a constant stream of cyber intrusion attempts.” According to the article, Clearview attempted to cover up the recent data breach by attempting to pay the cybersecurity expert that discovered the misconfiguration and have him sign a non-disclosure agreement. Additionally, Apple recently blocked Clearview’s app for violating its rules. The plaintiff claims that this is further evidence that people’s biometrics are not currently safe with Clearview; he subsequently requests that his preliminary injunction is granted in light of this new information.
The preliminary injunction would prevent Clearview AI from continuing to keep the biometrics of Illinois residents without taking adequate and reasonable measures to secure this information. Mutnick sued Clearview in January for violating his privacy and the privacy of others, with both constitutional violations and violating Illinois’ Biometric Information Privacy Act.
Vermont has sued Clearview AI, Clearview had its client list stolen earlier this year, the company faced four lawsuits in a month, and Facebook and YouTube have requested that Clearview AI stop scraping their platforms.
