Facial recognition error message on vending machine sparks concern at university

https://kitchener.ctvnews.ca/facial-recognition-error-message-on-vending-machine-sparks-concern-at-university-of-waterloo-1.6779835

by whycome • 2 years ago

304 153 2 years ago

kitchener.ctvnews.ca

ryandrake2• 2 years ago

Glob of epoxy putty over the camera. Simple fix. Everyone's bloviating about how "concerned" they are, but nobody can even think of a simple step to protect themselves? This is a university with smart students in it?

mixmastamyk6• 2 years ago

Someone didn’t read the article. Also not a complete solution.

ryandrake2• 2 years ago

The article mentioned them trying ineffective solutions and complaining. Chewing gum and post-its?

gouggoug• 2 years ago

Sure, these are simple fix.

They don't address the real issues though: (1) the use of facial recognition (2) without users consenting to it (3) and the resell of the data.

neilv2• 2 years ago

Making noise about this isn't a sign that students weren't smart enough to think to cover the camera. The article said that students had covered it.

But that's only a very immediate reactive response. A more proactive and impactful response would be to hurt the companies involved (e.g., bad PR, loss of sales, machine recall costs, legal problems), put fear into other companies doing things like that, and hopefully also prompt long-lacking better privacy legislation.

Hence, the noise.

BHSPitMonkey• 2 years ago

The next model will just have the camera behind some part of the LCD.

fifteen15062• 2 years ago

Yup.

And since screens can now output music (saw some high-tech article about it) it won't be long to also record sound.

You know, just to identify the topics which resonate with better ad viewing.

mixmastamyk6• 2 years ago

Cheaper 'fix' is to rename the error message to 0x100014h.

everdrive2• 2 years ago

There are patents to put cameras inside the screens, so I imagine that this is what we'll see in the future.

barbazoo• 2 years ago

Read the article and you’ll find out you’re wrong.

robinduckett• 2 years ago

Don’t walk into any McDonalds then…

mixmastamyk6• 2 years ago

Am a privacy advocate, yet think this might be an (understandable) overreaction.

I remember older generation tech used in digital signage applications that wanted to identify ages and genders to show them appropriate content, say apparel for example. It ran locally and was well meaning (enough).

Unfortunately in a world with Meta, ubiquitous telemetry, Ring doorbells, NSA, and data breaches and brokers, … we can’t trust anyone to do the right thing any longer.

So this type of benign-ish functionality, which would have been all local just two decades ago, unfortunately now can’t be trusted either.

Still, I’m very happy to hear a young person or two being concerned. Last trip to a college campus there was mandatory app and no cash accepted in many places.

NoPicklez2• 2 years ago

I think the key difference here is that the digital signage technology you speak of, the recognition was a necessary requirement to show the appropriate content, clothing for example.

In this case, the recognition doesn't do anything for the end user of the vending machine. It is purely data for other brokers to use. The vending machine didn't say to the user that people of their demographic were buying Diet Coke over normal Coke.

Slapping facial recognition on something that didn't have it before, without any obvious functionality or benefit for the persons face being scanned is very much cause for concern, in my opinion.

QuantumG• 2 years ago

I don't know why you think it's relevant. All that matters is the privacy law in the local jurisdiction. Some people will be fine with it, others wont. The real question is: what's the harm?

mixmastamyk6• 2 years ago

This was an M&M (candy) machine. To really know, someone would need to audit the hardware and software, so we're only speculating. Can't definitively say without more info.

Was trying to make the point that there is a potential justification for the functionality, though tenuous.

Someone1234• 2 years ago

I pulled the vendor's brochure; if you were curious what a vending machine would use this information for...

They collect demographics on WHO is purchasing what items including gender, age, etc. They use this information for targeting advertising (inc. with "partner media brokers").

They're also proud that when users install their app, it uses "gamification" to increase sales (whatever that means).

See here, they're super proud of it too:

https://a.storyblok.com/f/184550/x/e7435c019e/brochure-svm_g...

disillusioned2• 2 years ago

The machines use the charitably named "demographic sensor" which is obviously the embedded camera linked to a "facial recognition" application, BUT, it doesn't appear that it actually recognizes (or records) faces. Meaning, it's not linking your face to any online identity, or recording your face at all. In fact, the company is European and claims that their entire platform is GDPR compliant, which is... probably true?

Rather, it throws out a series of guesses and confidence values of a person's age, gender, and race, and allow the planogram (and OOH advertising) to change dynamically based on that information.

Which is not necessarily great, but also an entire order of magnitude less invasive than every interaction any casual user has on the internet with any ad ever. Or, frankly, with any POS system recording a repeat purchase from your credit card, from which motivated vendors can back into the rest of the demographic data.

I'm not excusing it, but while the error reads "facial recognition", it's more "stereotyping enablement platform," which, while only marginally better, is probably still better.

It's also hilarious to think of the thing displaying the green M&M if you're a "probable" woman, and the red or yellow M&M if you're a "probable" man, and seeing how long it'd take for anyone to correlate the change.

rwmj• 2 years ago

That's what the company claims, and maybe it's right, but how do we know? Do we have access to the source code? Will it change in future? You can be absolutely sure that if the company thought they could make more money by storing the photographs or somehow associating them with real identities then they would.

tdudhhu• 2 years ago

It is invasive.

In theory they can do something like "Why do you look so sad? Maybe a Mars can cheer you up!". This can be done while being GDPR complient but people don't like that. It creates a feeling that everything is watching you.

Privacy is not about hiding things, it is about controlling what you want to show.

ImHereToVote2• 2 years ago

I can't wait for the shitstorm when it starts suggesting grape soda to POC.

oniony• 2 years ago

It's not a camera, it's an optical sensor, lol.

codethief2• 2 years ago

In fact, the company is European and claims that their entire platform is GDPR compliant, which is... probably true?

I don't see how it is. The mere processing of my personal information (age, gender, race – doesn't matter that it's only a guess/estimate) without my explicit consent or any contractual need should already represent a violation of GDPR.

mateo1• 2 years ago

Honestly the whole thing would be funny if it's wasn't part of the dystopian society we're building. Is this... innovation now? What are we trying to optimize society for? Extracting maximum rents? But were will the money come from if everyone is doing the same thing and producing nothing of value?

mrighele• 2 years ago

In fact, the company is European and claims that their entire platform is GDPR compliant, which is... probably true?

Is a picture of my face necessary to sell me a chocolate bar ? I would say not, and if they take it without asking consent before I would say that it is not GDPR compliant.

gherkinnn2• 2 years ago

Vending machines covered by a large screen stand for everything I hate about contemporary tech.

They improve absolutely nothing from a buyer's perspective. Every step of the transaction is made worse. You can't glance at the entire inventory. You never know how much of an item is left. The machine does not reliably know how much of an item is left. Every interaction lags. And in return I get ads and mini games. Just so some C-suite cretin (guess what the C in C*O stands for) can show his little cretin friends how innovative his farts are.

It is late. I am hungry. My train departs in 2 minutes. Please, I just want a bloody Snickers.

These companies are a blight.

callahad• 2 years ago

They improve absolutely nothing from a buyer's perspective.

It's the "good ads" argument -- this machine can guess your age/gender and offer up items most purchased by your demographic, all the while feeding that data back to the vendor. Who wouldn't love that? :-/

More seriously, this has been a standard capability in vending machines, fast food menu systems, and digital signage in general for over a decade. Check out this ad from 2012 for Intel's AIM Suite for an example of how this stuff is pitched: https://youtube.com/watch?v=KdMIp2vQjG8

"Is the viewer a teenage girl? Then change to content to highlight a back-to-school shoe sale a few doors down. Is it a senior male? Then why not tell him about the golf club sale at the sporting goods store?"

alwa2• 2 years ago

Did you ever have the pleasure of encountering the US drugstore that replaced the entire set of doors of its entire refrigerated section with hulking, bright, animated, human-height-and-ultra-heavy TV screens?

[0] https://www.cnn.com/2022/03/12/business/walgreens-freezer-sc...

euroderf• 2 years ago

Welcome to an outer ring of hell. Brought to you by... Moore Slaw.

hn_user82179• 2 years ago

The one upside I would offer is that with some of them, you can "click" the item to view nutritional facts and ingredients. That's invaluable to me personally, as frequently I want the "least sugary" option available in the machine.

alwa2• 2 years ago

That's quite the brochure. My favorite selling point is the way you can make the machine display products that it's doesn't actually have inside, sell them, and give the punter a digital IOU instead of the soda they tried to buy...

"Customizable UI design - Product selection can be extended to include products not physically in the machine. Consumers can store them in Invenda Wallet [a mobile app] and redeem them somewhere else."

Somehow managing to turn a convenience-driven impulse buy into an additional chore to redeem later.

At the end of the day, there must be some angle I'm not understanding or these features wouldn't actually drive sales. I wonder if the idea is to vend digital products? Drive traffic to nearby physical stores through some kind of targeted digital coupon? Has anyone seen this kind of thing in the wild?

rob742• 2 years ago

Wow... the whole point of a vending machine is to get a soda when you want to have a soda, if you wanted to have a soda later you could get it (usually a lot cheaper) at a supermarket? I hope there's at least a warning message where you can abort your purchase before you get the "voucher" instead of the actual product?

tjoff• 2 years ago

Maybe it's nothing but a scam?

Place it somewhere where there are enough people that haven't tried it before and trick them into buying something they don't want. No one will ever use it more than once.

gumby• 2 years ago

Can’t believe they missed the opportunity to have the non-present purchase represented by an NFT. A buzzword overlooked by Marketing!

StanislavPetrov• 2 years ago

> "Customizable UI design - Product selection can be extended to include products not physically in the machine. Consumers can store them in Invenda Wallet [a mobile app] and redeem them somewhere else."

Speaking only for myself, this would not be long-term profitable for the vending machine company, as the cost of them fixing the boot-sized hole in the machine would be far higher than the $2 they stole from me.

red_admiral• 2 years ago

Detecting "gender" by facial recognition on a 21st century uni campus in the USA ... what could _possibly_ go wrong and cause a massive media meltdown?

thebruce87m• 2 years ago

Needs a TSA full body scanner to get the real demographics of drink sales.

RockRobotRock• 2 years ago

In Japan, facial recognition vending machines have been used to make product recommendations and collect statisics since 2010:

https://www.youtube.com/watch?v=S2hwnGrn3go

ssss11• 2 years ago

Oh my god I can’t buy a mars bar without the world trying to send me targeted ads

heads• 2 years ago

I’m sure this is real but just for fun I’m entertaining the idea that someone is trolling — either with a fun dialog title or the app name.

I worked at a company in the late 2000s that moved to an office with automatic urinals. These were fairly novel at the time and had a matte black plastic unit with a flush handle that also had a shiny window made of dark, IR transparent plastic. It was clearly some kind of proximity sensor for the autoflush but some joker made an official “do not touch the cameras” sign that wound a few people up.

hn_throwaway_992• 2 years ago

I know the HN guidelines say not to comment that someone hasn't read the article, but the comments section can be a little useless when literally all of the top comments I see are from posters who appear not to have read the article.

In summary (and, in fairness, these technical details are pretty far down the article):

The machines are owned by MARS and the manufacturer is Invenda.
MARS did not respond to requests for comment from CTV.
Invenda also did not respond to CTV’s requests for comment but told Stanley in an email “the demographic detection software integrated into the smart vending machine operates entirely locally.”
“It does not engage in storage, communication, or transmission of any imagery or personally identifiable information,” it continued.
According to Invenda’s website, the Smart Vending Machines can detect the presence of a person, their estimated age and gender. The website said the “software conducts local processing of digital image maps derived from the USB optical sensor in real-time, without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.”

moi2388• 2 years ago

Yes, the actual image data doesn’t get sent, but all the information gained from said image data does.

jjav2• 2 years ago

The website said the “software conducts local processing of digital image maps derived from the USB optical sensor in real-time, without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.”

The most important thing to keep in mind about clauses like this is that at any time it's only one software update away from changing the behavior and suddenly starting to send everything. You'd never know. (And: That point in time may be in the past.)

ourmandave• 2 years ago

By purchasing this candy bar, you agree to our updated Terms of Service.

Eddy_Viscosity22• 2 years ago

“It does not engage in storage, communication, or transmission of any imagery or personally identifiable information,”

Probably bullshit.

Firstly, "personally identifiable information" is usually defined very specifically, like 'we didn't record their social security number'.

Secondly, they send a bunch of information extracted from the image and they probably store the raw images on the machines which are then manually extracted at some point. Like photocopier that store a scan of everything put on the bed in its own hard-drive.

Cheer2171• 2 years ago

An image of a face is literally personally identifiable information. A face is a unique identifier.

kibwen• 2 years ago

What on Earth has ever given you the idea that companies should ever be trusted to tell the truth when money is involved?

hn_throwaway_992• 2 years ago

What on Earth has ever given you the idea that I believe companies should be trusted in this regard?

I just quoted the most relevant technical details of what is actually presented in the article given that so much of the initial commentary when I first saw this post were from people who clearly hadn't read the article.

aendruk• 2 years ago

Thank you for the excerpt. I attempted to read the article but have a firmly negative reaction to the auto-playing video that CTV chose to pop over it.

notRobot• 2 years ago

I hate that with time there is just going to be more and more covert non-consentual facial recognition everywhere. It should be outlawed, but obviously that does not align with the interests of the powerful so it'll never happen.

stainablesteel• 2 years ago

there's a lot of roads all leading to the same place, there needs to be a constitutional amendment about the right to own your own data, and if someone collects it from you they need to pay you to collect it, and you should receive a tax on any transaction where its sold

at least that's my suggestion

if people collected my information and sent me a check in the mail every month for a decent amount, i might not be so annoyed.

Nihilartikel• 2 years ago

I'm looking forward to a growing culture of mask wearing in public spaces.

It worked in Venice, and what a fine method of self expression!

offtrail2• 2 years ago

Just smash it if you see it. Or someone suggested super glue. If we all actively destroy these devices, it'll eventually not be worth it to replace them.

hiatus• 2 years ago

Except they would have you on camera vandalizing the machine.

EMCymatics• 2 years ago

Worked at a place that put your last four of your ssn for the vending machine. I really hated that.

hexo• 2 years ago

ELI5 please

bombcar5• 2 years ago

Some places (colleges were very bad about this) would use your SSN as both an ID and a password - so to buy at the cafeteria you’d swipe your student ID and your PIN was the last four of your social.

Some workplaces did it too. It’s mostly gone now, but pieces still remain.

c223• 2 years ago

I'm pretty sure many big box places like Home Depot and Walmart are using actual facial recognition on everyone who is in or near any of their stores. This vending machine sounds pretty benign by comparison.

jjav2• 2 years ago

Just because something can be worse, does not make a bad thing benign.

c223• 2 years ago

By comparison...

That is to say, my comment was meant to inform the concerned reader about other dastardly actors, not to excuse the behavior of the vending machine. (Not sure I have the authority even to make such an excuse.)

neilv2• 2 years ago

The website said the “software conducts local processing of digital image maps derived from the USB optical sensor in real-time,

Is the "USB optical sensor" really a hidden camera, and "digital image maps" is images from the hidden camera?

If so, then are they also being weaselly in the rest of the sentence?

without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.”

zoky• 2 years ago

It’s probably something like Apple’s Face ID sensor, which is a “camera” in the strict sense of the word but it captures a depth map rather than an image. I’m willing to believe that they aren’t transmitting images or even raw depth maps over the Internet (for one thing, it would be a lot of data and it’s hard to conceive of what the use of such data would be), but they are almost certainly attempting to correlate demographic information, or possibly even individual users, with specific purchasing patterns.

kevin_thibedeau• 2 years ago

They don't have to transmit images. It's enough to generate a unique hash that can track your activity in the presence of the panopticons. Sweeten the deal even more by capturing your IMSI for future reference.

SuperNinKenDo2• 2 years ago

You don't need to transmit anything over the wire, someone has to restock the things. Unclear what the relationship is there.

nusl3• 2 years ago

I wonder where the line in the sand exists for what people feel is “okay” tracking and “not okay” tracking. Here it seems to be that almost universally, the students dislike the facial recognition. Many folks I’ve spoken to otherwise don’t care about being tracked online. I suppose people are more sensitive to being tracked when it transitions into the real world and becomes more “real.”

giarc• 2 years ago

I don't mind being targeted online since it changes the ads I see from "Acai berry smoothies" to "beach vacations". Something I am not interested in, to something I am interested in (due to browsing history). That makes my experience better and I understand the trade off while using a free product (Google Maps, Facebook etc etc).

However, the difference in this case is that the vending company (or someone along the chain) is using it to serve demographic ads to the customer of the vending machine. I still have to pay for the product and it's not changing non targeted ads to targeted ads (there were no ads before). I'm sure they aren't passing along some of the ad revenue to me since there's no competition (I'm sure all vending machines in the area are owned by the same company). So this is just a source of extra revenue for the company and serves no purpose to the user.

nusl3• 2 years ago

All right. I try my best to keep my adverts as random as possible(if they appear at all), since somehow it feels like I'm being passively influenced by viewing the same sort of adverts suggesting I buy stuff repeatedly.

The way they're sticking ads on everything with or without tracking is pretty annoying. I hope they lose money with the tech they had to dev and install vs ad returns.

mixmastamyk6• 2 years ago

Interesting. Instead I block most ads (the most unethical ones, if I can discern that), problem solved.

KMnO4• 2 years ago

There’s an implied consent. I know that creating a Gmail account means that Google has access to all my emails. By using Gmail, I’m relatively aware that they’re building an ad profile on me, and I implicitly consent to that.

But if I found out they’re collecting the bloodwork pdfs my doctor sends and selling them to insurance companies, that would be objectively beyond any reasonable consent.

If you’re selling me M&Ms, I have a very very low tolerance for what I consider appropriate data collection.

nusl3• 2 years ago

You know, though I am not sure of how well-known it is outside of tech circles.

I agree with the second point. Facial recognition for demographic stats seems kinda reasonable if it's anonymised properly, but people don't like their photo being taken without knowledge of it.

russellbeattie• 2 years ago

As multimodal AI becomes more prevalent and commercial AI attendants become the dominant user interface, there's going to be a basic expectation of object, gesture and facial recognition.

"Welcome back to McDonald's, Mr. Beattie, would you like your usual?" Nods head and grunts while sending text "Very good. I'll charge your card on record and send a notification when your meal is ready. Thank you!"

This will all require an integrated camera and microphone, and maybe other sensors as well. All turned on 24/7. This isn't science fiction, it's just a few years away from every day reality.

So, in other words, get used to it.

Nullabillity• 2 years ago

That's assuming a lot of givens.

antfarm2• 2 years ago

That’s not a camera, it’s a Demographic Sensor™.

ale42• 2 years ago

In that case I want the Sensor™ to be physically unable to send out actual images to the computer that handles the vending machine, so no software update can actually start doing something else than they claim it to do originally.

antfarm2• 2 years ago

I wouldn’t even want them to use my biometric data or even turn on the camera at all without asking for my consent.

And in that case my answer would be a decisive NO.

kypro2• 2 years ago

Isn't facial recognition wide spread in the US yet?

In the UK we're already using it everywhere. Most stores and checkout systems have it. It's used in CCTV across the country. It's used by police to identify protestors. Schools in my area even install spyware on kids phones to monitor them and their families.

I can't imagine anyone would mind having being identified by a vending machine here lol... What's the risk?

fifteen15062• 2 years ago

This isn't a noisy adult snitching to whoever walks by what you bought.

This is a info collector which potentially disseminates information across the world, to sell better ads.

Meanwhile, categories of you are being made. Do you buy a soda every friday at 05:00? "Party Animal".

Or not. Who knows. Maybe they just spend the extra dollars on the software and camera because they really do want to lose money on it.

scohesc• 2 years ago

I knew the UK was going sharply downhill with the surveillance state nonsense, but that far already?

Wow - I have even more respect for the people who risk their lives to damage and tear down government surveillance cameras for the common good.

kypro2• 2 years ago

People here don't care.

When I read the story that schools in my area had been installing spyware on students phones I assumed it was some kind of isolated thing. But my GF works in schools so I asked her if she knew of this app and she was like, "oh yeah, all the kids have it".

I found this utterly insane but she seemed to think it was a good thing if it could be used to protect kids. And I guess I get the argument, but you could say the same thing about the government installing CCTV in everyone's homes... You need to draw lines, especially when there's an expectation of privacy.

This is my concern with facial recognition in shops too. If I go into a shop I expect people to see my face, so a simple CCTV system seems fine. I even expect people who know me might recognise who I am, so again, if a human being I've interacted with before identifies me on the CCTV system I'm okay with this. What I don't think people expect is to be identified by some automated national biometric system which checks to see if you've ever stolen anything before so it can alert security, while also trying to understand your emotions and individual purchasing habits.

I used to work for a large highstreet retail org and was literally pitched on a system which could identify our customers and tell us how they feel about their shopping experience and their shopping habits.

But like I say, no one cares. I've spoken about this with people so often and they act like I'm some kind of privacy lunatic. That said, people here get very animated if someone can access data they've personally shared to Facebook and made publicly available.

soared• 2 years ago

Is don’t understand how the EU got GDPR passed years ago but the UK has this

offtrail2• 2 years ago

The risk is the countless little bits of info being gathered by all this tech falling into the hands of the next genocidal despot. I wonder which metric they'll base their cleansing around?

bborud• 2 years ago

Nothing a bit of superglue can't fix.

rpaddock• 2 years ago

In 2018 Renesas had a "Facial Expression Kit Giveaway" contest and I was one of the winners. It was the "RZ Omron Facial Expression Kit giveaway". RZ being one of their newer, at the time, Micro lines. I had to sign an affidavit to get my prize, which I did. Never did use it and it eventually went to a local Hamfest. Their example code was a vending machine.

This is the only related item I could find today:

"OMRON Develops Real-Time Facial Expression Estimation Technology"

https://www.omron.com/media/press/2012/10/e1023.html

SuperNinKenDo2• 2 years ago

This stuff drives me mental, but the article ends up not being quite the black pill it could be. Nice to see students fighting back at the grassroots, the University (hopefully) acting, and people feeling enpowered to do something under the law.

We have to keep pushing for this stuff to become less and less normalised, and also for penalties to become more and more serious. When that happens, people will continue to feel more enpowered to fight this stuff. We should also make sure laws are clear that people have the right to "vandalise" such devices. In my opinion taking a bat to one of these things should at least be defensible in court.

more_corn• 2 years ago

I’m going to call bullshit on the claim that they don’t store data “It does not engage in storage, communication, or transmission of any imagery or personally identifiable information” They obviously store data. You have to write the image to disk after the camera takes it. I guarantee that if a 3rd party audit were conducted they’d find data stored on there. Heck, I’ll do the audit for zero upfront, payment contingent on finding images stored on there.

itsTyrion• 2 years ago

Where are the vandals when you need them?

Facial recognition error message on vending machine sparks concern at university

Related Stories