International Organisation: Risk Assessment for Image-Based Community Platform
Digital platforms provide new ways to harness community and citizen engagement to help solve challenges and meet the needs of beneficiaries. However, there are inherent trade-offs with these platforms when organisations share information publicly. Various risks can arise from the ease and availability for third parties to collect and then analyse these public images including by using web-scraping tools and facial recognition technologies. Providers of public databases of images must therefore carefully consider the cost and benefits of deploying such systems.
AWO was asked by an international organisation to carry out a risk assessment for an image based community platform.
Our findings
-
OSINT
The current digital landscape provides means for various threat actors to easily collect and identify individuals from public images. This includes OSINT services and web-scraping tools to systematically extract images from websites as well as facial recognition technology applications to identify individuals from images containing faces of such individuals.
-
Threat actors
The motivation of threat actors is dependent on the context in which the database is deployed. More adversarial contexts, such as a conflict scenario, may encourage certain actors to collect data to be used for nefarious purposes, and public image based community platforms could be an attractive target.
-
Trade offs
There is a trade-off between the implementation of risk mitigation measures and the effectiveness of the service that the public database has been deployed for. For example, manipulating images prevent identification through the use of facial recognition technology (for example cloaking or pixelation) could also make it more difficult for genuine users of the service to use the platform.
The scraping and processing of images of individuals and their subsequent identification is a processing activity that can be carried out by different actors in today’s digital age. The likelihood of this taking place, however, depends on the context in which this may take place.
Accordingly, AWO provided in its risk assessment the factors impacting the likelihood of this activity and appropriate risk mitigation measures, including those that are technical, organisation or legal in nature.