This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The facial recognition service FindFace was utilized by users of the imageboard 'Dvach' to deanonymize and harass women working in the sex industry. Participants in the campaign matched photos of these women to their Vkontakte social media profiles and subsequently spammed the victims' friends and families with the information. The service's founder stated that they could not prevent such misuse but offered to cooperate with authorities to identify the harassers.
The facial recognition software FindFace allowing its users to match photos to people’s social media pages on Vkontakte was reportedly abused to de-anonymize and harass Russian women who appeared in pornography and alleged sex workers.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The AI tool was leveraged by malicious actors for the targeted humiliation, doxing, and harassment of specific victims.
The FindFace AI system was used to correctly infer the real-world identities of anonymous individuals (pornographic actresses and subway passengers) without their consent, compromising their privacy.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The primary cause of the harm was the intentional decision and action of Dvach users to weaponize the deployed FindFace tool to dox and harass women.
Added categories peak at 2: Minor (Psychological Harm, Indirect)
The incident involved the weaponization of the FindFace facial recognition tool by online actors to deanonymize and harass Russian citizens. While causing severe privacy violations and psychological distress to targeted individuals, the incident's national security implications remain minor, representing a localized law enforcement and regulatory challenge rather than a systemic threat to state stability.
FindFace operates as a tool. It takes an input photograph and matches it against a database of Vkontakte profile photos, returning matching profiles. It does not exhibit autonomous planning or maintain an internal state beyond the database lookup.
High Risk: The system is a facial recognition application used for biometric identification of individuals, which has significant implications for fundamental rights and privacy, similar to high-risk AI categories like biometric identification.
The primary function of FindFace is to perform facial recognition by matching input photographs to Vkontakte social media profiles to identify individuals.
The report provides clear, consistent details about how the FindFace application was used, the specific doxing campaign on Dvach, and the reactions of the platform (Vkontakte) and the developer. There are no major conflicting accounts, and the role of the AI system is explicitly described.
None.
Technology
Facial Recognition Matching
Highly accurate matching of random photos to social media profiles.
Lack of Abuse Prevention Tech
No built-in technical blocks to prevent automated or mass reverse-searches.
Data Inputs
Public Social Media Photos
Unprotected Vkontakte profile pictures used as the matching database.
Target Images from Pornography
Images scraped from adult sites used as query inputs for matching.
Human Factors
Malicious Intent of Online Users
Dvach users motivated by moral outrage and resentment targeted women.
Inspirational Misuse Demonstrations
Public demonstrations of the tool's invasiveness inspired harassers.
Process and Methods
Absence of Consent Verification
No process to verify if the subject consented to being searched.
Inadequate User Activity Monitoring
No mechanism to flag or block users performing malicious searches.
Management
Passive Abuse Mitigation Approach
Management accepted harassment as unpreventable, relying on post-hoc policing.
Inadequate Risk Assessment
Failure to foresee and mitigate obvious harassment risks before release.
Regulatory Environment
Weak Privacy Regulations
Lack of legal frameworks preventing biometric scraping of social media.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
