Black Hat 2011: Faces of Facebook, the Largest Real ID Database

Every month Facebook users upload 2.5 Billion photos.  With each upload users may identify and tag not only themselves, but everyone in the photo.  What if we could use this massive attendance sheet of the world in a larger way.  Say with facial recognition and location information?  Today Alessandro Acquisti presented his research and attempts at doing just that.

The recent exploration into the cloud makes handling and comparing a massive database (1 per person who owns a Facebook) possible and feasible. Acquistis’ small scale testing (~33k) of photo/name data mined from Facebook yields some surprising results: Nearly perfect recognition and re-identification of people in the database with a photo taken from a smartphone in under 3 seconds.

Afraid yet? This is where my imagination went wild… What could a government do with a photo-based collective of the country? Or the World? What if they logged IP addresses to also know where you are. Who are they to say where my privacy ends and begins? There are obviously a lot of privacy questions that need to be answered. Thankfully, Acquistis’ research is by no means scale-able to a worldwide population, and there is a high level of photo restrictions (in terms of quality) for basic reference.  But it is a proof of concept. Facial recognition from basic recognition software (ie Face) and free data mining from a name and photo database can be done quite easily.

In a followup study Acquisti attempted to determine the SSN of someone using a photo and database reference. Using DOB and location of birth, Acquisti had ~25% success rate for the first 5 digits with 3 attempts and~33% correct conversion rate with 5 attempts.

Is the hardware there to support such an endeavor on a worldwide scale?  Almost. Some improvements are needed to make handling  and comparing the amount of data a reality.  Is there software to support facial identification and recognition? Yes.  It is only a matter of time before disappearing off the grid means changing your physical features.