Canadian university vending machine error reveals use of facial recognition without permission or warning

[CdnFox]

https://www.theguardian.com/world/2024/feb/23/vending-machine-facial-recognition-canada-univeristy-waterloo

=University of Waterloo dispenser displays facial recognition message despite no prior indication it was monitoring students

A malfunctioning vending machine at a Canadian university has inadvertently revealed that a number of them have been using facial recognition technology in secret.

Earlier this month, a snack dispenser at the University of Waterloo showed an error message – Invenda.Vending.FacialRecognition.App.exe – on the screen.

There was no prior indication that the machine was using the technology, nor that a camera was monitoring student movement and purchases. Users were not asked for permission for their faces to be scanned or analysed.

“We wouldn’t have known if it weren’t for the application error. There’s no warning here,” River Stanley, who reported on the discovery for the university’s newspaper, told CTV News.

 

 

There's been a lot of this kind of stuff - tim hortons using it's app to track the general movement of it's customers to see their habits and what other stores they go to - use of this tech to gather democraphic information etc etc.   As the article notes Canadian tire got in trouble for it too.

We need stronger laws with stiffer penalties to protect people from this kind of invasion of their privacy.

[Perspektiv]

I mean, many companies track us via loyalty cards, in house credit cards and so on so am not surprised. 

Scanning loyalty cards after all purchases, allows for unprecedented access on buying habits and for target marketing. 

Its also the unintended consequence from getting a gift card or the like. Even obtaining an app from say McDonald's and okaying their use of your location and microphone literally provides them with lawfully obtained access of your use of your microphone during calls and your privacy unless you select for it to occur only while the app is being used. Even then, if it's running in the background, that is legal gray area.

The moment you enter a store, it's already known you will very likely be recorded. 

Not sure what laws could do to stop this.

But if you have a smart TV and found yourself getting commercials on coffee on your YouTube after you talking about that specific brand, that's the level of invasiveness that we have gotten to now.

Again you would be hard pressed to any legal action as you literally okay the use of microphones, location and the like when downloading an app.

[Moonlight Graham]

1 hour ago, Perspektiv said:

The moment you enter a store, it's already known you will very likely be recorded. 

Not sure what laws could do to stop this.

 

Make it illegal and require an opt in with option to opt out

[Moonlight Graham]

Let's not forget this doozy:

https://nationalpost.com/news/canada/canadas-public-health-agency-admits-it-tracked-33-million-mobile-devices-during-lockdown

 

[Michael Hardner]

21 minutes ago, Moonlight Graham said:

Make it illegal and require an opt in with option to opt out

Didn't he just say there's an opt in?

20 minutes ago, Moonlight Graham said:

Let's not forget this doozy:

https://nationalpost.com/news/canada/canadas-public-health-agency-admits-it-tracked-33-million-mobile-devices-during-lockdown

 

De-identified and aggregated, it says right in the article.

So what's the problem?

 

[Michael Hardner]

I for one am sick of people using "privacy" as a veto to using data for the public good.

If there's a murder in your neighborhood, are you against using a local traffic camera to identify license plates in the immediate vicinity?  How about cell data?

Where is the discussion of costs and benefits?

If you lived in the neighbourhood, is the prospect of having a police data analyst review your phone pings, and immediately eliminate you as a subject so bad that you'd rather have that practice disallowed than find a killer?

I think a nuanced discussion, clown free, should be had.

[Moonlight Graham]

12 minutes ago, Michael Hardner said:

Didn't he just say there's an opt in?

Where?

12 minutes ago, Michael Hardner said:

De-identified and aggregated, it says right in the article.

So what's the problem?

It's illegal and contrary to the Charter.  You need a warrant to track people.  They also did it in secret.

[Moonlight Graham]

8 minutes ago, Michael Hardner said:

I for one am sick of people using "privacy" as a veto to using data for the public good.

If there's a murder in your neighborhood, are you against using a local traffic camera to identify license plates in the immediate vicinity?  How about cell data?

Where is the discussion of costs and benefits?

If you lived in the neighbourhood, is the prospect of having a police data analyst review your phone pings, and immediately eliminate you as a subject so bad that you'd rather have that practice disallowed than find a killer?

I think a nuanced discussion, clown free, should be had.

The Charter guarantees against search and seizure without a warrant. It's a non-starter.

I'm sick of people, including the Liberal government, using "security" as an excuse to violate our Charter rights.

[Michael Hardner]

2 minutes ago, Moonlight Graham said:

The Charter guarantees against search and seizure without a warrant. It's a non-starter.

I'm sick of people, including the Liberal government, using "security" as an excuse to violate our Charter rights.

Okay so you've got a legal road to veto 

I'm sure you can agree that search and seizure in 2024 is not the same as 1867.

I'm sure a judge would agree on that too.

Let's push aside the legal fights, and just talk like people about the pluses and minuses of this thing.

[Moonlight Graham]

1 minute ago, Michael Hardner said:

Okay so you've got a legal road to veto 

I'm sure you can agree that search and seizure in 2024 is not the same as 1867.

I'm sure a judge would agree on that too.

Let's push aside the legal fights, and just talk like people about the pluses and minuses of this thing.

The Charter was written in 1982, not 1867.

I don't want the government or anyone else knowing or tracking when I visit a porn site or what porn I watch.  What I do or where I go isn't anyone's business and people have a right not to be followed because governments, like police, abuse this power, which is why the rights exist in the first place.  That's why police can't tap your phone or put a tracker on your car or barge into your house and rifle through your drawers either on a whim.

If they suspect a crime then get a warrant to access that info.

[Moonlight Graham]

45 minutes ago, Michael Hardner said:

De-identified and aggregated, it says right in the article.

So what's the problem?

 

How do you de-identify a single person sitting in their house for 12 hours and then them leaving their house and driving around the city? You have said in the past you want all this info public. I don't want my neighbours knowing where I am.  It's rife for abuse. 

[Michael Hardner]

12 minutes ago, Moonlight Graham said:

1. The Charter was written in 1982, not 1867.

2. I don't want the government or anyone else knowing or tracking when I visit a porn site or what porn I watch. 

3.If they suspect a crime then get a warrant to access that info.

1. Okay, the principal still applies. They couldn't anticipate IP address scanning from a device in 1982.

2. Ok.  Poilievre won't be proposing that I'm sure.

3. So if judges start allowing pings of cell tower dumps, seems you would be ok with that.

[Michael Hardner]

2 minutes ago, Moonlight Graham said:

How do you de-identify a single person sitting in their house for 12 hours and then them leaving their house and driving around the city? You have said in the past you want all this info public. I don't want my neighbours knowing where I am.  It's rife for abuse. 

Sorry you're pivoting. I was talking about your categorization as something being a doozy. You're on to something else now..

[CdnFox]

5 hours ago, Perspektiv said:

I mean, many companies track us via loyalty cards, in house credit cards and so on so am not surprised. 

Scanning loyalty cards after all purchases, allows for unprecedented access on buying habits and for target marketing. 

Its also the unintended consequence from getting a gift card or the like. Even obtaining an app from say McDonald's and okaying their use of your location and microphone literally provides them with lawfully obtained access of your use of your microphone during calls and your privacy unless you select for it to occur only while the app is being used. Even then, if it's running in the background, that is legal gray area.

The moment you enter a store, it's already known you will very likely be recorded. 

Not sure what laws could do to stop this.

But if you have a smart TV and found yourself getting commercials on coffee on your YouTube after you talking about that specific brand, that's the level of invasiveness that we have gotten to now.

Again you would be hard pressed to any legal action as you literally okay the use of microphones, location and the like when downloading an app.

Well there are laws about that.  The loyalty card advises you that they track your purcahse info if you read the fine print.

But there's a big difference between an app that tracks your purchases and activity with the store - and one that tracks your movement to other stores.  And there's a big difference between you agreeing when you sign a loyalty card agreement to certain things and someone collecting personal information and images of you without any knowledge or consent.

Canadian tire and tim hortans have been smaked under the canadian laws, and if the laws were stronger and the penalties higher i suspect companies would be reluctant to run afoul of them.

[Aristides]

Phone apps give you the ability to opt out, give location info all the time or just when the app is being used. I always opt out unless I can see the app needs that info to work properly,  then I select, only when using app. The only exception is my thermostat which I allow to use phone location to determine whether I am home or out. I even turn that off if I am going to be away for an extended period.

Using face recognition without approval is something else. You can and likely will be tracked on the internet unless you use a good VPN and erase cookies regularly.

Edited February 24 by Aristides

[Perspektiv]

1 hour ago, CdnFox said:

The loyalty card advises you that they track your purcahse info if you read the fine print.

Let's be real here. Very few read the entire fine print. I read every detail of a contract prior to signature, personally but this isn't the norm.

I have experienced countless clients return items, clearly having omitted to read the fine print. 

I used to work for a store that sold refurbished products. I think you know where this is going. 

So many people would return me electronics, citing there were imperfections, as they expected them to be new. Not only was this a shock to them, but my pointing out the no return policy, made my job fun until I quit. 

But you're correct, in that they protect themselves and aren't doing it blindly. They require your authorization. Your signature, or your clicking to consent.

I just don't know of any laws that prevent this being abused.

Am sure many of us have seen the documentaries seeing how obtuse the levels of intrusion are, on apps like Tik Tok, Facebook and others, who knowingly invade on your privacy. 

1 hour ago, CdnFox said:

if the laws were stronger and the penalties higher

One issue with that. Tim Hortons is a multi billion dollar corporation. Canadian Tire. Facebook. Tik Tok.

They possess heavy handed financial power. Very hard to go against such companies.

3 minutes ago, Aristides said:

You can and likely will be tracked on the internet unless you use a good VPN and erase cookies regularly.

I know people who have gone to places like Russia, where you expect this sort of thing. IE knowing your phone has been taken over, as your screen blanks out, and apps open and close.

[Aristides]

Facebook and Tik Tok recording what you are looking at on their sites is one thing and acceptable, monitoring your use when you are not on their sites is something else.

Edited February 24 by Aristides

[Moonlight Graham]

5 hours ago, Michael Hardner said:

1. Okay, the principal still applies. They couldn't anticipate IP address scanning from a device in 1982.

2. Ok.  Poilievre won't be proposing that I'm sure.

3. So if judges start allowing pings of cell tower dumps, seems you would be ok with that.

3.  If there's reasonable suspicion someone has committed a crime, yes.   Same rules apply for cops entering your home and searching through it, warrant is needed.

As for vending machines or anything private, consent should be needed for facial recognition tracking.

[Michael Hardner]

40 minutes ago, Moonlight Graham said:

1.  If there's reasonable suspicion someone has committed a crime, yes.   Same rules apply for cops entering your home and searching through it, warrant is needed.

2. As for vending machines or anything private, consent should be needed for facial recognition tracking.

1. Do you know what a cell tower dump implies?

2. Do you have a doorbell camera?

[herbie]

Let's use Occam's Razor:

Yeah the Ivenda Group sells and leases machines that do that. Why you'd pay for that feature is beyond me. Because it was a college, the Brainiacs in management did their usual "it costs more so it must be batter" reasoning and didn't even know it could do that.

Therefore they didn't know that if there was a power bump or they changed their College's wifi name or password, it couldn't reconnect and crashed.

So how much will the Vending company gouge them to get out of their contract, to change out the machine?

[CdnFox]

31 minutes ago, herbie said:

Let's use Occam's Razor:Yeah the Ivenda Group sells and leases machines that do that. Why you'd pay for that feature is beyond me.

First - that's not occam's razor.  

Second - the data can be very valuable.  In simple terms if you knew that based on facial recognition 60 percent of the people who come up to the machine are women you could choose your products to favor women and the placment of those objects in the machine as well to encourage maximum buying. You could tell how many people looked and decided to buy or not and adjust.

Get a little more 'creepy' and you can start to tell what Jeramy buys most, or which machines on campus he's at most or the like and start getting into patterning to improve sales with top customers etc  You might even share that info between devices on and off campus.

Bottom line is don't collect info on people unless you're telling them.

And don't use words if you don't know what they mean. Occam's razor simply says that generally speaking the most simple answer that solves the question is most likely to be the correct one.

[Michael Hardner]

I'm starting to see that the principal is.... If a few people think it's creepy, then it gets in the news, then it becomes controversial, then they have to back off. That's it.

[Moonlight Graham]

3 hours ago, Michael Hardner said:

1. Do you know what a cell tower dump implies?

2. Do you have a doorbell camera?

1.  No

2   no and I never will

[Michael Hardner]

17 minutes ago, Moonlight Graham said:

1.  No

2   no and I never will

1. So the cops go a judge and say "there was a random murder at location X at 4 AM.  Can we please get the telco to send us all mobile devices pinging in the area and distance from the three towers located closest by" ?   It was early morning so there weren't many people out.  The judge approves and the cops analyze the data and find the man's phone stopped moving at a certain time in the morning, just as 3 devices were pinged moving on the road past him.  The telco is able to determine the names of the owners of the phone from digital records.  An arrest is made. 

Sounds like what might have happened in Schomberg Ontario when a 65 year old dog walker was gunned down in early morning by 3 members of a Salvadoran-American gang M13.  https://toronto.citynews.ca/2023/06/02/men-charged-in-drive-by-shooting-of-ontario-dog-walker-schomberg/

I am very glad that we have the technology to find who did that.  How about you ?

2. Why not ?

[Moonlight Graham]

51 minutes ago, Michael Hardner said:

1. So the cops go a judge and say "there was a random murder at location X at 4 AM.  Can we please get the telco to send us all mobile devices pinging in the area and distance from the three towers located closest by" ?   It was early morning so there weren't many people out.  The judge approves and the cops analyze the data and find the man's phone stopped moving at a certain time in the morning, just as 3 devices were pinged moving on the road past him.  The telco is able to determine the names of the owners of the phone from digital records.  An arrest is made. 

Sounds like what might have happened in Schomberg Ontario when a 65 year old dog walker was gunned down in early morning by 3 members of a Salvadoran-American gang M13.  https://toronto.citynews.ca/2023/06/02/men-charged-in-drive-by-shooting-of-ontario-dog-walker-schomberg/

I am very glad that we have the technology to find who did that.  How about you ?

2. Why not ?

1.  Yes that's good.  It was obtained by a warrant I assume, via the judge, just like any evidence and search/seizure.

2.  Privacy concerns.  I don't use things like cloud storage and Alexa etc either for the same reason.  The only reason i'd need anything like Ring is for security, and in that case i'd just install a closed circuit camera system not connected to the internet.