As Moscow’s facial recognition system activates, journalists find access to it for sale on the black market

Andrey Kaganskikh, a journalist for MBK Media, has found that access to Moscow’s surveillance cameras — and their new facial recognition technology — is being sold on the black market.

As of the beginning of 2019, there were more than 170,000 surveillance cameras installed in Moscow. They are posted in courtyards, lobbies, parks, schools, clinics, malls, construction sites, and, of course, government buildings. About 3,000 of those cameras are connected to a facial recognition system that is integrated with Russia’s police databases. The Moscow government plans to enable facial recognition in the rest of its video surveillance system in the foreseeable future.

Internet users have sold access to the surveillance cameras illegally on chats and forms. According to Kaganskikh, those individuals are law enforcement officials and government bureaucrats who have access to the Integrated Center for Data Processing and Storage (YTKD), the system that stores data from Moscow’s cameras. For several thousand rubles, the officials typically send buyers a link to the live feed from a given camera and the footage that camera has captured for the previous five days. Those links are generated automatically by the YTKD; Kaganskikh reported that the vulnerability that allows them to be copied has existed since 2016 at least. Buyers willing to pay at least 30,000 rubles ($471) can also receive a login and password that gives them unlimited access to the YTKD system, including all of Moscow’s cameras.

Black market buyers can also receive information from the city’s facial recognition system. Most dealers offer a month’s worth of data at a time. Kaganskikh sent one such dealer a photograph of himself and got a file in return containing the system’s full search results (the journalist did not specify how much he paid for that service). In all, the YTKD issued 238 possible matches drawn from 140 different cameras around Moscow; the automatically generated accuracy rating for the search was 67 percent. Nonetheless, not one of the matches was actually Kaganskikh: All of the photographs were of other people, including many who appeared to be women.

“We can’t show you these photographs [due to privacy laws], but you can see in them that the system chose people who really do look like me. You can find people with the same wrinkles or the same nose shape,” the journalist noted. He added that the file for each photograph comes with a label that says “self” or “other” to mark whether or not the person lives at the location where the camera is stationed. “Self” means the individual crosses the camera’s line of sight often, and “other” means the camera had never spotted that person before.

To ensure that the data he received was not fake, Kaganskikh verified the codes of the cameras listed in his search results against Moscow’s public registry of surveillance cameras. The codes all lined up. “You could say that the results are a little substandard, but there’s a plausible explanation for that. […] These are results from a limited number of cameras. It’s possible that if there were more of them, then the system would have caught me, for example, in front of my apartment building,” Kaganskikh said.

The MBK Media report noted that the Russian government’s official registry of judicial decisions contains no convictions for the illegal sale of Moscow surveillance camera data.