Exposed: Vending Machine Glitch Uncovers Hidden Face Recognition Technology

Ashley Belanger, Ars Technica

Canada-based University of Waterloo is racing to remove M&M-branded smart vending machines from campus after outraged students discovered the machines were covertly collecting face recognition data without their consent.

The scandal started when a student using the alias SquidKid47 posted an image on Reddit showing a campus vending machine error message, “Invenda.Vending.FacialRecognitionApp.exe,” displayed after the machine failed to launch a face recognition application that nobody expected to be part of the process of using a vending machine.

“Hey, so why do the stupid M&M machines have facial recognition?” SquidKid47 pondered.

The Reddit post sparked an investigation from a fourth-year student named River Stanley, who was writing for a university publication called MathNEWS.

Stanley sounded the alarm after consulting Invenda sales brochures that promised “the machines are capable of sending estimated ages and genders” of every person who used the machines—without ever requesting consent.

This frustrated Stanley, who discovered that Canada’s privacy commissioner had years ago investigated a shopping mall operator called Cadillac Fairview after discovering some of the malls’ informational kiosks were secretly “using facial recognition software on unsuspecting patrons.”

This story originally appeared on Ars Technica, a trusted source for technology news, tech policy analysis, reviews, and more. Ars is owned by WIRED’s parent company, Condé Nast.

Only because of that official investigation did Canadians learn that “over 5 million nonconsenting Canadians” were scanned into Cadillac Fairview’s database, Stanley reported. Where Cadillac Fairview was ultimately forced to delete the entire database, Stanley wrote that consequences for collecting similarly sensitive face recognition data without consent for Invenda clients like Mars remain unclear.

Stanley’s report ended with a call for students to demand that the university “bar facial recognition vending machines from campus.”

A University of Waterloo spokesperson, Rebecca Elming, eventually responded, confirming to CTV News that the school had asked to disable the vending machine software until the machines could be removed.

Students told CTV News that their confidence in the university’s administration was shaken by the controversy. Some students claimed on Reddit that they attempted to cover the vending machine cameras while waiting for the school to respond, using gum or Post-it notes. One student pondered whether “there are other places this technology could be being used” on campus.

Elming could not provide a definitive schedule for the removal of the machines, stating only that it would be done “as soon as possible” in her conversation with Ars. She did not grant Ars’s plea to provide clarification on whether facial recognition data is being gathered in other campus areas. Additionally, she refused to assure students, occasionally looking for treats on campus, about the time frame for replacing the vending machines with non-surveillance camera fitted snack dispensers.

The investigative team at MathNEWS was able to solicit responses from companies in charge of intelligent vending machines on the University of Waterloo’s grounds.

Adaria Vending Services, in their reply to MathNEWS, explained that it is primarily crucial to understand that the vending machines do not record or keep any images or photographs, making it impossible to identify an individual through the technology incorporated in these machines. The technology functions somewhat like a motion detector that recognizes faces, hence informing the machine when to switch on the purchasing interface, without ever capturing or storing customer images.

Adaria and Invenda emphasized that students should not be apprehensive about data privacy as the vending machines comply fully with the stringent General Data Protection Regulation (GDPR) enacted by the European Union, arguably the world’s strictest privacy law.

“These machines are fully GDPR compliant and are in use in many facilities across North America,” Adaria’s statement said. “At the University of Waterloo, Adaria manages last mile fulfillment services—we handle restocking and logistics for the snack vending machines. Adaria does not collect any data about its users and does not have any access to identify users of these M&M vending machines.”

Lauren Goode

Dhruv Mehrotra

David Nield

David Gilbert

Under the GDPR, face image data is considered among the most sensitive data that can be collected, typically requiring explicit consent to collect, so it’s unclear how the machines may meet that high bar based on the Canadian students’ experiences.

According to a press release from Invenda, the maker of M&M candies, Mars, was a key part of Invenda’s expansion into North America. It was only after closing a $7 million funding round, including deals with Mars and other major clients like Coca-Cola, that Invenda could push for expansive global growth that seemingly vastly expands its smart vending machines’ data collection and surveillance opportunities.

“The funding round indicates confidence among Invenda’s core investors in both Invenda’s corporate culture, with its commitment to transparency, and the drive to expand global growth,” Invenda’s press release said.

But University of Waterloo students like Stanley now question Invenda’s “commitment to transparency” in North American markets, especially since the company is seemingly openly violating Canadian privacy law, Stanley told CTV News.

On Reddit, while some students joked that SquidKid47’s face “crashed” the machine, others asked if “any pre-law students wanna start up a class-action lawsuit?” One commenter summed up students’ frustration by typing in all caps, “I HATE THESE MACHINES! I HATE THESE MACHINES! I HATE THESE MACHINES!”

This story originally appeared on Ars Technica.

Total
0
Shares
Leave a Reply

Your email address will not be published. Required fields are marked *

Previous Article

How Nvidia CEO, Jensen Huang, is Fuelling the AI Revolution

Next Article

All You Need to Know About Fortnite Chapter 5 Season 2: Start Date, Battle Pass, Theme and More

Related Posts