Secretive Aussie genius selling your photos to the world
Exclusive: An Australian computer boffin and alleged spammer has scooped up three billion of your photographs - and he's selling them to police.
Former Canberra schoolboy Hoan Ton-That is the man behind the New York-based company Clearview AI, which has amassed the world's largest facial recognition database.
A 32-year-old gender-fluid former model and musician, Ton-That is now the face of a very modern debate about privacy in the digital age.
His company has built a database of more than three billion photographs, mostly scraped off social media accounts by computer programs known as spiders or web-crawlers.
Clearview AI sells access to the site to law enforcement, government agencies and commercial businesses, allowing people to upload images including screengrabs or CCTV shots and compare them, using artificial intelligence, to photos in his enormous database.
It then provides what information it has on those people, including names, and address or location details it has scraped off their social media accounts.
The hugely-controversial company is now being sued in jurisdictions across the United States and has been shut down in Australia after officers from at least four local police forces signed up to it.
Twitter, Facebook and Google are among the sites serving cease-and-desist letters on the company and Apple has blocked the app from its store.
Cyber security expert Dr Suranga Seneviratne said Clearview's activities amounted to a "big privacy scandal'' because of the way the company had collected the photos.
"I think it's one of the most serious (privacy issues) we have seen in recent years,'' Dr Seneviratne, from the University of Sydney's School of Computer Science, said.
He said other major privacy breaches had occurred because databases were hacked or compromised.
By comparison, Clearview had intentionally scraped photographs, which were likely public, but the people who had posted them never expected, or consented, for them to be used in such a way.
He said the database would allow law enforcement or private citizens to identify "pretty much most of the people'' whose photos had been scraped.
Dr Seneviratne said he did not believe many Australians knew this was happening to their photos.
He urged Clearview to provide more information about its activities, and said there needed to be Government regulation of the site, and others like it.
Ton-That keeps his own life private and has wiped his digital footprint clean. He has no active social media accounts under his own name.
The brief biography on his website states he is a "self-taught engineer'' and an Australian of Vietnamese descent who moved to San Francisco when he was 19.
"As a student he was ranked #1 solo competitor in Australia's Informatics Olympiad. He was also ranked #2 guitarist under age 16 in Australia's National Eisteddford (sic) Music Competition,'' his website says.
"I previously went by other gender identities but currently go by: he/him.''
A special News Corp investigation has confirmed that Ton-That lived in Melbourne and Canberra, and grew up in a modest home in Lyneham, in the suburbs of Canberra, where his mother and sister still live.
His parents are divorced, and his father, an established academic and translator, now lives in Melbourne.
Ton-That went to the nearby state school Lyneham High School and finished year 10 in 2003. The school's yearbook 'Between the Lynes' has a photograph of a young Hoan, without his trademark long hair, where he reveals his future ambition is "be a dwarf.''
It mentions that he competed for the school in a local chess competition.
He went on to Hawker College and completed his years 11 and 12 before enrolling at the Australian National University, where he spent two years studying a Bachelor of Information Technology, before quitting without graduating in 2007 and moving to Silicon Valley.
His computer interests were obvious early - in 2006, he registered a company, Software for Mom Pty Ltd, under his birth name Cam-Hoan Ton-That, to the home address.
He was accused in 2009 of being behind two US phishing scams, which he denies.
In a court case currently being run against Clearview AI, the Vermont Attorney-General TJ Donovan alleges in documents filed with the state's Superior Court that: "Prior to creating Clearview, Ton-That was involved in other companies including ViddyHo.com, an alleged phishing site which tricked users into sharing access to their gmail accounts so that it could generate spam to the users' contacts.
"Ton-That also founded Fastforwarded.com, an alleged phishing site which tried to fraudulent extract passwords from users.''
He worked various jobs in Silicon Valley before moving to Seattle and New York, and founding Clearview AI, then known as Smartcheckr, in 2017.
His co-founder in Smartcheckr was Richard Schwartz, a former policy adviser to Donald Trump's lawyer, Rudy Giuliani, who worked for Giuliani when he was Mayor of New York. Mr Schwartz was one of several Right-aligned or alt-Right figures that Ton-That would befriend, setting him apart in the Left-leaning world of tech entrepreneurism.
He met and married American singer and actor Chantelle Tibbs while in the US. The pair divorced in 2014, according to documents lodged in the San Francisco District Court.
It is clear that Ton-That is a remarkably clever young man, equally talented playing classical guitar as writing code.
What's less clear is whether he's a computer wunderkind helping law enforcement track down criminals and freeing children from online abuse, or a man who has eroded our privacy.
Ton-That declined to be interviewed and his spokeswoman would not answer questions from News Corp, instead providing a statement from Clearview's lawyer, Tor Ekeland, who said the company was "primarily focused on providing its groundbreaking and effective technology to assist law enforcement in the US in identifying perpetrators of horrific crimes, such as trafficking and child abuse.''
"It has a remarkable record of achievement saving the most vulnerable members of our society and helping to keep communities safe. Clearview AI is committed to abiding by all laws applicable to it,'' Mr Ekeland said.
"Regarding Hoan Ton-That, he is a talented individual who developed the world's most powerful facial recognition technology. He never created 'phishing' scams. His personal and professional relationships include people of varying races, ethnicities, gender identifications, and political persuasions."
As well as the lawsuit from Vermont, Clearview is facing a class action for breaching privacy provisions in the state of Illinois, a separate action in Virginia, and the State of New Jersey directed its police to stop using his service.
In Australia, police officers from Victoria, Queensland, South Australia and the Australian Federal Police held a number of registered accounts with Clearview AI.
This became public earlier this year when US media site Buzzfeed obtained a leaked copy of its client list, which showed the officers had signed up to the site. Rather than paying the thousands of dollars a year the site charges, it seems likely most officers signed up to the free pilot trial, and it's not clear any of the officers from the state police uploaded photos to check the site.
However, the Australian Federal Police admitted to a parliamentary committee that officers from the AFP-led Australian Centre to Counter Child Exploitation had registered for a free trial of the Clearview AI facial recognition tool and "conducted a limited pilot of the system in order to ascertain its suitability in combating child exploitation and abuse.
The Australian Information Commissioner is now investigating and the Clearview site has now been disabled in Australia.
Meanwhile, the Morrison Government's bid to establish a national facial recognition database remains before the Parliament after being knocked back by the Parliamentary Joint Committee on Intelligence and Security.
In the Illinois class action, being run out of a court in New York, plaintiffs Mario Calderon and Jennifer Rocio allege Clearview AI and their middleman marketers, CDW Government LLC: "actively collected, stored and used Plaintiffs' biometrics - and the biometrics of most of the residents of Illinois - without providing notice, obtaining informed written consent or publishing data retention policies.''
Professor Eric Goldman, the co-director of the High-Tech Law Institute at Santa Clara University in Silicon Valley, said it was not known exactly which databases Clearview AI had scraped when it compiled its database.
"It seems highly likely the service scraped or licensed police mugshots and other government-operated databases,'' he told News Corp.
Prof. Goldman said private commercial facial recognition databases were not subject to the same legal protections as those operated by governments.
"They provide law enforcement with a loophole to gather more data, with fewer safeguards, than the law anticipated,'' he said.
He also expressed concern that Clearview AI could itself be hacked - as its client list apparently was - and its enormous bank of faces stolen by state-backed hackers and cybercriminals.
"Clearview AI provides one-stop-shopping of highly valuable information for the "bad guys." The database and all of Clearview AI's data will almost certainly end up in the hands of repressive and despotic governments, who will use it to advance their own agendas that are likely not in our interests,'' he said.
Originally published as Secretive Aussie genius selling your photos to the world