Evan Schuman's StorefrontBacktalk

In a development that will have a huge impact on retail CRM and IT security operations, a series of Carnegie-Mellon University experiments has established startling recent improvements in facial recognition. The biometric technology improvements would be meaningless, though, were it not for a social-media-fueled avalanche of tagged images and personal information.

The combination makes absolutely practical a science-fiction-like scenario of customers being identified as they walk into a store by virtue of their face alone. Cameras at POS could match faces with names from a payment card, thereby enabling the customer to be subsequently identified and tracked without a loyalty card. The CMU experiments suggest an even more powerful privacy-smashing scenario, with consumers walking into a store identified by any site that has ever posted their pictures.

Imagine a loyalty program with 90 percent participation, requiring no effort—nor, for that matter, intent or consent—from any customers. An absence of laws will make the ethics of retail senior executives the only boundary. (Uh-oh.)

Alessandro Acquisti, a CMU associate professor of IT and public policy, made the presentation at this week’s Black Hat USA conference. Acquisti’s team wanted to see how far facial recognition had advanced, so they tried matching images of people against the tons of publicly available online images. Last year, for example, according to Facebook itself, 2.5 billion photos were uploaded to Facebook’s site alone—each month. That figure has sharply increased this year, and it’s only one site.

In CMU’s first experiment, the team wanted to see how truly anonymous people were on U.S. dating Web sites. “We downloaded primary profile photos for Facebook profiles from a North American city using a search engine’s API (i.e., without even logging on Facebook itself),” Acquisti said. “One out of 10 dating site’s pseudonymous members was identified. We constrained ourselves to using only a single Facebook (primary profile) photo and only considering the top match returned by the recognizer. Because an ‘attacker’ can use more photos, and test more matches, the ratio of identifiable individuals would dramatically increase.”

The second experiment was closer to the retail scenario. They asked students to have their picture taken and to then fill out a survey. One-third of all random students were correctly identified in “less than three seconds,” Acquisti said.

The third experiment was the CRM privacy coup de grâce. That’s where the CMU team shot pictures of subjects and then used public databases to identify the people and their birth dates, activities and Social Security numbers.