Thread by @sh_riga

The shady Pimeyes 👀

A (somehow) complete thread 🧵

Pimeyes is a service that search photos thru a phenomenal database scrapped from the Internet, thanks to powerful facial recognition :

It was originally used to find yourself, but his popularity grew rapidly to be used for other purposes, as finding people during the Capitol insurrection :

vice.com/en/article/4ad…

Surprisingly, Pimeyes website highlight bad press while trying to discredit them (a bit awkwardly) :

1 - They have an affiliate program, a common way to encourage subscriptions
2 - While stating that you can submit DMCA requests to remove your face, you still need a paid subscription for monitoring :

Before going into controversies, let's track back the origins of Pimeyes ⬇️

From the @washingtonpost, two Polish individuals made the service since at least 2017 :

1 - WHOIS history shows that Lukasz Kowalczyk is the owner of the domain pimeyes.com, also revealing the contact email
2 - The late mobile app is signed by Denis Tatina

[e-mail] has made two Google Maps reviews in Poland a few years ago, but no other traces are available (breach, accounts...)

As @_IntelligenceX showed, the company was originally registered as 'Pimeyes sp. z o.o.' in Poland, with another entity 'Face Api EU sp. z o.o.'

https://twitter.com/_IntelligenceX/status/1471852614467956737?s=20

But in 2020-2021, Pimeyes moved to Seychelles (a known tax heaven) as "Face Recognition Solutions Ltd.", while also changing the WHOIS record for more privacy :

To finally land in Belize, another tax heaven, as 'Carribex LTD', coinciding with the arrival of a new owner...

...Giorgi Gobronidze bought Pimeyes for an undisclosed amount as he said to @netzpolitik_org
netzpolitik.org/2022/pimeyes-c…

G. Gobronidze is an academic, lecturer and researcher from Georgia, who also worked for the Ministry of Defense :

He also answered @alicehines questions from @VICENews latest video :

But what about the tech side of Pimeyes ?
Even if they mostly use Cloudflare, their infra seems to be hosted on AWS & Hetzner in Germany :

Protonmail is used for emails, and [e-mail] has been created the 2021-02-05 :

And here's the shady tech side :
❌no whitepaper
❌unclear TOS
❌ no communications with privacy watchdogs

A lot of misuse :
edition.cnn.com/2022/05/24/tec…

Pimeyes creates more questions than answers :

- How an individual could (and would) buy such a sensitive tech ?
- Who are the clients ?
- Why can't it be traced and audited clearly ?
- How's the data stored and shared ? Under which regulations ?

Pimeyes seems to play on a fine line, and the investigations of some states may shed light on its operation.

✍️