1y ago

'Facial recognition' error message on vending machine sparks concern at University of Waterloo

kitchener.ctvnews.ca

A set of smart vending machines at the University of Waterloo is expected to be removed from campus after students raised privacy concerns about their software.

The machines have M&M artwork on them and sell chocolate and other candy. They are located throughout campus, including in the Modern Languages building and Hagey Hall.

Earlier this month, a student noticed an error message on one of the machines in the Modern Languages building. It appeared to indicate there was a problem with a facial recognition application.

"We wouldn't have known if it weren't for the application error. There's no warning here," said River Stanley, a fourth-year student, who investigated the machines for an article in the university publication, mathNEWS.

150 comments

It gets worse :/
I looked up the brand (Invenda). Their PDF includes "using AI", "measuring foot traffic", and gathering "gender/age/etc" e.g. facial recognition to estimate a persons age and gender
And in terms of "stored locally" this is straight from their website
The machine comes with a “brain” – Invenda OS – and is connected to the Invenda Cloud, which allows you to manage it remotely and gather valuable environmental, consumer and transactional data. The device can be branded according to your requirements to further enhance your brand presence.
The marketing also so fricken backwards that it reads like satire:
For a consumer, there’s no greater comfort than shopping pressure-free. Invenda Wallet allows consumers to browse, select and pay for products leisurely and privately 🤦‍♂️
- I'm dreading for the day they introduce dynamic pricing based on who's buying and refuses to sell without a full face scan.
  
  What really bothers me is the "measuring foot traffic". I already refuse to use vending-machines because of the pricing and unhealthyness, but you're telling me I need to make GDPR takedown requests just for walking to class?
  
  Fast food franchises always charge more in poor areas, I wonder if dynamic pricing would charge poor people more as well.
  
  Why does privacy matter?
  Price discrimination!
  Login to LinkedIn to purchase [groceries / diapers / your new mechanical keyboard] 🤢
  
  Shut the fuck up, they can hear you!
  
  Dynamic pricing already exists based on what device brand you use
  
  Try that with me, and I'll unplug the fucker and cut the plug off.
  
  People panic about face scan while the ongoing massive privacy breaches exist around online services and electronic devices. The amount of personal data that people pour into smartphones is enormous compared to using that vending machine. We need more GDPR.
- They have to make it sound like it's private and secure, but it really isn't. It's sad how dystopian our future is becoming.
  
  I keep telling my zoomer son he needs to read 1984. Not to live his life in fear of it, but to help his awareness of it, and provide an example of what that sort of societal control can look like. It's probably the one thing I nag him about. 5 years later he still hasn't read it. lol
  I haven't read it in decades, but I still feel it's hard to miss certain parallels with modern reality when you have.
- When did it become ok for people to be violated so profusely without any consequence?
  
  When society started paying for convenience?
  
  In the 18th century. That's when capitalism really got rolling and when Adam Smith wrote his crap.
  Alternatively: 1493
  
  There was a quaint old time, shortly after Google was founded, where people mused about privacy over the internet. It was forgotten about as the profits started rolling in and pretty much all other companies started following along. That was the time when we started transitioning into a period of massive data surveillance. Glad to see that the conversation is starting to pick up again in some areas, though it's definitely being actively suppressed in many others.
  
  Laws and lawyers. You can't go there and beat them up. That pretty much paved the way. Money is just a toy to them. So there is zero risk involved.
- "Welcome back, consumer unit number 74665!"
  
  That's specifically what they don't do. They collect statistics, not individuals.
- GDPR desperately needed on the other side of the pond...
  
  Article says they claim to be GDPR compliant.
- Invenda Wallet allows consumers to browse, select and pay for products leisurely and privately
  I never would've questioned that using a vending machine with cash would be anything but private until reading that line.
  (Well, the article was first...but if it wasn't for the article, that line is sketchy as all hell)
- Say Invenda (your brand here) five times to get a discount!
- Vending machines used to get vandalized at my school. How much tech are they putting in these things now?
- beuh, they obviously mean that the biometric data is stored and processed locally, not the data that results from that processing.
  i mean that's still kinda creepy but you're making it seem like they didn't obviously admit to it in the original sentence.
Why in the ever living hell would a vending machine need local-only facial recognition...
- My guess is to associate which product is best selling to which demographic to better target them.
  So ingenious 🤮
  
  I feel like it'd be tough to find a chip powerful enough to capture demographic attributes while also cheap enough to ship in vending machines? But admittedly I've little context on embedded systems and their capabilities
- Why the living hell would anyone agree to develop this? What douchbags are doing that job?
  
  There's a lot of people in the world who do, in fact, like to eat.
  
  There are people who actually believe that kind of dystopic bullshit, even in the tech sector. I remember a colleague a few years ago, told me he liked targeted ads because "it knew what I wanted"
  
  Probably exploited labor, similar to those who have no choice but to work in scam call centers to survive.
  Pretty unfortunate that things are like this IMO
  
  Bro theres plenty of people who run scams in big offices all day every day
  
  What kind of amoral, selfish monster, would know full well that car emissions are exterminating life as we know it on earth, and still decide to drive a car?
  The same kind of monster who develops this technology.
  
  I'd do that. Privacy should not exist. Everything must be public and available to everyone. Every person should have a tracking implant and anyone should be able to access it.
- "local only"
  Even if it's technically local-only, pretty easy for a tech to drive by and pull data it's stored.
  Or when it gets filled.
  
  Its not really local only either, the cameras exist for the point of data harvesting, just look at their marketing. They only mean they're not streaming video to a server for recognition. The after-recognition data is still sent to a server https://www.invendagroup.com/vending-machines
- You know, when technology really got started, I had dreams about tech knowing me, doing things for me, acting in my best interest. Smile at the cashier, and my bill is paid, entering any public building, and I'm added to the queue, my documents already there... A vending machine would know me, holding back that last Snickers bar, because it knew that I would come by today...
  It could have been good. It could have been right. On another planet, with another species. :')
- Probably because its real purpose is not to sell things.
- Best case scenario the machine has some sort of standard software with facial recognition code, but no hardware in the machine. Would he interesting to know.
  
  Unfortunately its got the hardware for it https://www.invendagroup.com/vending-machines
A massive and punitive fine for anyone gathering biometric data without express permssion would be a great way to discourage other companies from bringing that shit around. A billion or two ought to do it.
- Or do it like they do in China: if your company breaks the law you have two choices: donate it to the government or we take your CEO behind the shed for questioning.
- Your face is not private, nor are your fingerprints. In public and in many private properties that are open to the public(e.g. stores) you have no expectation of privacy so you can be filmed within the law. You consent to facial recognition by passive agreement when you enter the public without your face covered.
  Facial recognition technology is everywhere and there is nothing that will be done to curb it's use.
  Edit: To be clear, I do not support anyone or any entity using biometric data for any purpose except verification of identity for security purposes with intentional consent. Businesses or government using biometric data, or any data obtained without clear and willful consent, is unacceptable.
  
  Apathy is a bullshit response
  
  There is a massive fundamental difference between having a person see your face in public, or even having a basic security camera record your face, and having a system recognize your biometric data and stalk you through every public environment with extreme precision.
  The general public should absolutely not accept the imposition of being expected to be followed through every public place by private corporate entities for undisclosed purposes. We can and should aggressively push government representatives to take strong regulatory action to outlaw this behavior and aggressively punish violations.
  Will making these efforts actually change matters? Maybe, maybe not. Will throwing your hands up and just assuming it's impossible to change anything and that we should all just lay down and accept it as fact lead to the worst possible outcome? Absolutely.
  
  Fuck off narc
  
  Your face, retinas, and fingerprints are keys to unlock digital assets.
  
  That's where the laws come in. I don't agree that recording and biometric information on people should be legally protected, unless you ask for permission first.
  
  So instead of changing the laws you would rather...just let it happen? Alternatively, you don't have to obey the law. Enamel paint is very cheap and easy to apply to lenses. I think breaking the machines would curb their use, no?
Yet another demonstration that the primary meaning of "smart" has come to be "unbelievably stupid."
- The definition of pretty much every word these days has been hijacked to mean the exact opposite - like Google lets you "search" for things you "want", and Reddit would "connect" you to "~~humans~~ people", FaceBook will ~~steal all of your data~~ share "news", again from "people", and so on.
  I pretty much think of "smart" as now meaning "tactically weaponized to maximize corpo profits" - you know, "for your convenience"!:-P 🤮
  
  "War is peace.
  Freedom is slavery.
  Ignorance is strength."
Regardless of the privacy issues, if this is actually a default feature of this machine, why does the camera hole look like it was put there with a hammer?
- Dunno, but it needs more of the hammer treatment.
- I bet it's from people picking at it and the paint chipping off the sharp edge, but it does also look like the hole was drilled on a Friday afternoon by a guy who probably should have retired 10 years ago.
  
  I think it’s remnants of chewing gum the students were putting in there.
- I thought you were exaggerating...lmao
- The facial recognition error might be ”no suitable camera found“?
Students believe there is a camera inside this hole on the vending machine
Students and their silly beliefs. Don't worry about that lens shining in the hole. It's just a useless hole!
- Strategic use of a cordless drill can ensure it's a useless hole.
  
  that's vandalism and can get you in trouble.
  A simple sticker though, which can be easily removed, doesn't count as vandalism, and can be done over and over again for almost no cost.
who's hype for the state-industrial complex to track our every movement! surely this combined with a right wing political movement that is increasingly focused on punishing so-called enemies will never lead to a complete humanitarian disaster.
- Yea, we need to fight to make sure that the state-industrial complex tracking our every movement is focused on punishing OUR so-called enemies, as defined by a small handful of Internet based social clubs (controlled and operated by people we know next to nothing about).
- Throw in S-210, which could likely support face tracking tech for age verification, also handled by a third party. I thought Nineteen Eighty-Four was supposed to be a cautionary tale, not a playbook...
Hmm.... facial recognition vending machine huh....
Finally it's time for my jammer & some script from c/netsec to shine
- Or tape over the camera hole.
  
  I was going to suggest epoxy resin.
- To the batmobile!
new tech sux
- Technology does way more than what some consumers want without adding enough value. Ring doorbell just grossly increased their ring protect plan cost and I'm starting to wonder:
  "Why are we paying monthly subscriptions for them to just store two months of snapshots with a few videos?"
  
  We need open standards for data storage so we can have more freedom in how our data is stored.
- Corporations suck
RIP Brendan, best SCSM.
- Yeah, that was a great story, but an odd missed opportunity for a cyberpunk game on hidden mass surveillance. I'm thinking of NG Resonance from Deus Ex: Invisible War. I.e., it's odd that Bredan's a.i. was used to just sell more drinks, rather than as a mass surveillance tool. People were forming relationships with him, providing him with all sorts of personal information.
- You should tell Theo that he will miss her :'(
The pharmacist at my local Tesco once told me I was buying paramol too often. It had been at least a year since I last bought it.
This told me that:
A. They're using facial recognition to track purchases
B. There's either not enough info provided by it or enough training on it's use
[off topic?]
New York City is moving away from people paying for subway/bus rides with a pre-paid card or cash and going to a system where you pay with your credit card or smart wallet. Nice way to quietly monitor everyone's location and habits.
- Sadly. Many people do not see things like you --correctly-- do. In my city, they are pushing people onto cards, which track everything, including transfers, and how? The fare on the card is like 5 cents cheaper. Many people have no foresight.
This just in, slavery co. branded machines have been found partaking in illegal espionage, much to everyone's shock.
FatBastard.gif
~~This story seems fishy. Why would the hole for the facial recognition camera be so poorly made? It looks like someone made it with a screwdriver, not something that was made in a factory.~~
Edit: got it
- Go to the vendors website, and not only see hole for yourself, but look at them claiming to use AI to detect demographics.
  PDF Link: https://a.storyblok.com/f/184550/x/e7435c019e/brochure-svm_generic-dark-netflix-ui.pdf
  Their website: https://www.invendagroup.com/vending-machines
  Here's my own screenshots in case the vendor takes their pdf down from bad press.
  Hole: https://photos.app.goo.gl/rTk8fUWynmXgw7Zc6
  AI Features: https://photos.app.goo.gl/RiF1Phrroj65tMdd7
  
  Demographic Sensor
  People count
  GDPR-compliant demographic profiling (age and gender)
- many have tried to cover a small hole on the machine that they believe houses a camera
  Looks like a student might have used a pocket knife or similar implement to dig at the hole and enlarge it, to try to see if there was a camera.
- In a choice between thinking that a vending machine company put facial recognition technology into a vending machine or prankster students hacked the device to display a suspicious error message I would suspect the latter is the case.
  However, watching the video and looking at the brochures on the manufacturer’s website, it looks like the manufacturer did indeed put rudimentary facial recognition in so they could gather demographic information on their customers like gender and approximate age for marketing purposes. Maybe the hole was damaged by curious students?
- (After seeing your edit) to be fair, there are a ton of overblown hype articles that are actually built on nothing. The opposite side of skepticism (jumping onto the outrage bandwagon) is worse and more common than being skeptical. Its a shame things are not easier to verify.

150 comments