When someone uploads a photo to the people-search tool ClarityCheck, the website claims it is private and secure. However, recent research revealed that more than 9 million image files, including photographs of people’s faces, were publicly exposed on an unsecured Amazon S3 bucket. The database also contained people's email addresses and phone numbers.

ClarityCheck's photo-search page can help identify anyone in a photo almost instantly and find social media profiles quickly. Despite these capabilities, the company secured the image database after being contacted by WIRED, but it remained exposed for months before that. The risk of exposing sensitive data like face images is particularly significant because people may not be aware their photos are part of such databases.

Independent security researcher Jeremiah Fowler warned that an AI bot could crawl and extract faces from the database for training purposes. ‘An AI bot could crawl it, extract faces, and use them for training,’ Fowler told WIRED. The company disputed any characterization of the data being exposed but acknowledged improving its security reporting procedures.

ClarityCheck’s face-search feature allows users to upload an image and receive a report about where that image may appear online and who might be shown in the photo. A test using a WIRED reporter's own face image resulted in a detailed report with personal information, photos, and videos linked from around the web.

Misconfigurations and accidental data exposures are common online as digital platforms gather more sensitive personal data. The stakes for securing this information are higher than ever as these technologies advance.