Permalink

This post was originally published on Press and Publicity – NYU Stern Center for Business and Human Rights.

by Renee Dudley

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Thomas van Ruitenbeek’s life fell apart in 2012, when a psychotic episode and a diagnosis of autism derailed his pursuit of a digital communication degree at a university in Utrecht, the Netherlands. For the better part of a year, the 25-year-old wouldn’t respond when spoken to, his father said, and his blue, wide-set eyes revealed little cognition. He rarely left his parents’ duplex and filled his time studying daily newspapers, convinced they contained secret messages. Sometimes, he worked up the energy to paint miniature figurines from the medieval fantasy-themed board game Warhammer. Mostly, he did nothing.

The psychotic episode and the autism diagnosis locked him into a state of isolation that had been deepening since his childhood, solidifying his long-held belief that he was an outsider. Van Ruitenbeek’s parents took him to appointments with doctors and therapists. When he grew strong enough, they supported his return to work. He did simple tasks — mostly cutting and packaging yarn — at a job he obtained through the local mental health department. That was a far cry from his earlier aspirations of being a video game designer and hardly the life his parents had hoped he would have. They worried about what would happen when they grew old and could no longer look after him.

Then, during a meeting with his coach at the mental health department in 2013, van Ruitenbeek and his parents got an unexpected bit of hope. A short distance away, a first-time entrepreneur named Peter van Hofweegen and his business partner were figuring out how to launch an education and job placement program geared toward autistic young adults who were interested in computers.

The number of people diagnosed with autism is hard to ascertain, but the statistics that are available suggest it’s on the rise. An estimated 100,000 autistic Americans turn 18 every year, according to Drexel University’s Autism Institute, and a growing number of programs in the U.S. and elsewhere aim to employ tech-savvy autistic people.

But van Hofweegen’s program was something different. He and his partner sought primarily to recruit socially isolated, seemingly unemployable dropouts who almost certainly would be passed over even by employers who welcome candidates with neurological differences like autism. They wanted people who couldn’t make it on their own and had been “sitting for years in their parents’ homes,” van Hofweegen said. The number of students in his program would be small, but the stakes were large. If they could be doing meaningful, sophisticated work, what kind of a model might that provide for the uncounted numbers of people with autism around the world seemingly sentenced to constricted, unproductive lives.

The untested model drew skepticism even from other autism advocates, who viewed it as well-intentioned but overly idealistic. But van Ruitenbeek’s coach, Anita de Winter, saw it as a godsend. She had worked with hundreds of autistic adults who struggled to find meaningful work and become independent. De Winter described the program to van Ruitenbeek without betraying her enthusiasm. She didn’t want him to be disappointed if it didn’t work out.

“This might be for someone like you,” she told him.

Van Hofweegen’s path to autism advocacy traces back to 1996, when his first child was born. The boy, named Thijs, sustained an injury during birth and was diagnosed with cerebral palsy. Doctors told van Hofweegen and his then-wife that Thijs might never walk or talk. But with the help of specialists, he learned to both move and speak.

Thijs went far beyond that. After proclaiming a desire to learn how to swim at age 5, and taking seven years to pass his basic swimming test, Thijs persisted through intermediate and advanced levels alongside much younger classmates. When he swam the 50-meter freestyle test to pass the advanced level, he earned a standing ovation from the other students’ parents. Van Hofweegen never forgot that moment. (He continued to ponder it even as Thijs developed into a competitive swimmer and won a silver medal in the men’s 400-meter freestyle at the Paralympic Games in 2016.) It showed what a person could accomplish with the right support and accommodations.

While helping out at an event in 2012 for people struggling with unemployment, van Hofweegen met Frans de Bie, an IT guru and fellow volunteer. A year earlier, de Bie had sold his 40-person tech company. Like van Hofweegen, de Bie drew inspiration from his personal life. He had grown up alongside foster siblings, and he understood the transformative power of a supportive environment. He also was motivated by his son and daughter, who have dyslexia.

The new friends hit upon an idea. Van Hofweegen had read a survey saying 20,000 Dutch people were not participating in the workforce because of their autism. Perhaps they could start an organization that would help autistic people interested in technology to find work. After more than 25 years in management roles at hotels and at a temporary-job placement agency, van Hofweegen quit his job. A short time later, in late 2013, he and de Bie incorporated an organization they called ITvitae.

The Dutch have a saying: “God created the earth, but the Dutch created the Netherlands.” That’s because for centuries, the country’s citizens reclaimed land from the North Sea using their iconic system of dikes, canals and windmills. About a third of the country’s fertile land is below sea level. The Netherlands, half the size of South Carolina, remains among the world’s leading economies in part because its people have maximized its geographical resources.

And so it was culturally ingrained in van Hofweegen and de Bie to maximize the country’s human resources. Partly because de Bie was familiar with the unmet demand for IT jobs in the Netherlands, a gap currently estimated at 100,000, and because the country has a robust tech sector, the co-founders wanted to focus on that area.

The two men saw ITvitae — the name is an amalgam of “information technology” and “curriculum vitae,” which they pronounce ee-tay-vee-tay — as a way to fill tech-sector jobs and strengthen the Dutch economy as much as they considered it a social enterprise to lift up autistic people who felt excluded from the job market.

Common traits found in autistic people often prevent them from being hired or even applying to jobs in the first place. They may struggle to interpret social cues, pause frequently when speaking, exhibit disruptive eccentricities or avoid eye contact. Yet employers have found that other characteristics make them excellent employees. They tend to be thorough and fastidious, have the ability to go deep on specific topics and focus for prolonged periods of time. Those traits lend themselves to careers in technology and cybersecurity, among many other fields.

Van Hofweegen and de Bie envisioned a six-month course focused on preparing students to be software testers — a natural fit for autistic people, who tend to be methodical rule-followers. As the students embarked on coursework, van Hofweegen would find employers by cold-calling IT and software companies as well as by tapping the connections of his board members.

The co-founders believed ITvitae could generate revenue primarily by charging employers a recruiting fee for each hire. De Bie believed employers would be willing to pay because the amount he proposed was less than the typical cost of specialized, third-party technical training for new or existing employees.

The first challenge was finding students. After winding their way through various government agencies, van Hofweegen and de Bie found de Winter, who worked near where they lived. “Do you know these types of people?” van Hofweegen asked her in 2013 after laying out the vision for ITvitae. She replied, “How many do you want?”

As the co-founders prepared to interview about 30 candidates for 11 slots, de Winter explained the potential pitfalls. Autistic people tend to process language literally, she told them, and might be unable to respond to classic prompts. The question “what do you hope to get from your time at ITvitae?” might elicit a blank stare. That’s because, to an autistic person, there’s no basis for what the outcomes of the new program might be. Alternatively, the list of answers could be endless and paralyzing. They needed something concrete and technical to discuss. So de Bie concocted a simple tool that would serve as a discussion topic and gauge applicants’ computer interest: He asked the candidates to draw maps of their home computer networks and be prepared to describe them.

Van Hofweegen and de Bie were full of enthusiasm. But, as they continued to talk with de Winter, they realized how much they still had to learn about the very people they wanted to help. They were, perhaps, in over their heads.

For as long as he could remember, van Ruitenbeek knew he was different but felt that he couldn’t let other people know that. It was as if he were “living undercover,” he said. He was constantly afraid that asking the wrong question would cause him to be bullied, so he never asked questions. While his twin sister played with other children, he withdrew to solitary activities, learning to design his own websites on topics ranging from outer space to dinosaurs. But his life took a darker turn after his psychotic episode in Utrecht.

Van Ruitenbeek had planned to spend the summer day catching up on coursework when suddenly he began to feel that he was outside his own body. His vision narrowed and his mind compelled him to follow what he believed were secret hand signals made by strangers, which eventually directed him to a bar to order a draft Heineken. He then lurched outside the bar in a stupor. Van Ruitenbeek rambled in halting, slurred speech when his sister and father reached him by phone. Frantic with worry, Henk van Ruitenbeek drove through Utrecht and eventually found his son standing on a sidewalk, staring vacantly. He got him in the car and took him home.

In the aftermath, with a new diagnosis of autism, van Ruitenbeek believed his life was over. He had thought it was not rational or even possible to set goals for himself. Then de Winter mentioned ITvitae, and he knew he badly wanted a slot there. The ITvitae interview, he later said, was “like a ticket out of my situation.” More nervous than he had ever been, he told himself: “I have to make it. I have to do my best.”

The interview, which took place in late 2013, was difficult for everyone. Although van Hofweegen and de Bie were pleasant and upbeat, van Ruitenbeek felt he was in “hostile territory.” Then again, everything beyond his parents’ home seemed that way at the time. He stuttered severely when describing his recovery from psychosis, and it took him an uncomfortably long time to utter a single sentence. He was visibly perspiring. “This isn’t working,” de Bie thought.

When de Bie pivoted to the network drawing and other technical questions, the interview shifted. Van Ruitenbeek stuttered less. De Bie, impressed by his remarks about website design, decided before the interview ended that van Ruitenbeek should have a space at ITvitae.

De Bie thought it was obvious that van Ruitenbeek — and most of the other candidates — had raw computer talent. Van Hofweegen welled with tears. “What are these wonderful people doing at home?” he wondered.

Advocates for people with autism in the United States often ask the same question. Parents of autistic teenagers describe the “cliff” of high school or college graduation, marked by the struggle to navigate the transition from years of special education and support to independent working life. Firm data is hard to come by, but some estimates suggest millions of autistic American adults are unemployed or underemployed. Of those who find work, most are in low-wage and part-time jobs, according to Drexel’s Autism Institute.

At the same time, demand for workers with technical skills has far outpaced supply. In the cybersecurity field alone, the U.S. faces a shortfall of more than 225,000 workers, according to CyberSeek, an organization that provides job market data. The number of available tech-related jobs in the U.S. nearly doubled from 2020 to 2021, analytics company Datapeople reported.

Over the past decade, a variety of opportunities for austistic adults in the U.S. — ranging from technical training and job placement programs in various cities, to targeted hiring and retention efforts at large employers — have aimed to bridge the tech workforce gap. But the results so far have been modest, said Michael Bernick, a San Francisco-based attorney who has written two books on employment strategies for the neurodiverse.

That’s partly because many initiatives expect job candidates to have higher education, credentials and the ability to work with minimal support, said Bernick, who was director of the California labor department from 1999 to 2004. “They are looking for people who have significant tech skills,” he said. “Of that group, not all are college graduates, but they’re also not the long-term unemployed, sitting in their parents’ basements.” Someone like van Ruitenbeek wouldn’t have stood a chance.

One widely publicized initiative is the Neurodiversity @ Work Employer Roundtable, a collection of about four dozen private employers — including Microsoft, SAP, Google and more — that foster neurodiversity hiring programs. Participating companies offer screening and interview processes to accommodate autistic candidates; about 1,200 neurodiverse candidates have gotten jobs with Roundtable employers over the past decade, said Neil Barnett of Microsoft, a leader of the group. Barnett, who has discussed the initiative with Bernick, hopes that Roundtable employers will continue to expand their hiring of neurodiverse candidates with a variety of skills, including outside of tech.

Autistic adults who are interested in computers represent just a sliver of autistic job seekers, according to the national advocacy organization Autism Speaks; Bernick puts the figure around 10% to 15%. Due in part to prominent figures such as Elon Musk, who has said he has Asperger’s syndrome, which is now considered a type of autism spectrum disorder, and pop culture caricatures of socially awkward workers in Silicon Valley, the notion that autistic people inherently possess extraordinary tech competencies has become a cliché. Bernick said he once had hopes of a tech career for his own autistic son. But his son had neither uncommon skills nor a deep interest in computers.

While the 10% to 15% estimated by Bernick may seem like a small slice relative to popular perception, efforts to employ that group are nonetheless important, especially given the dramatic need in the tech sector, advocates and researchers said. Bernick said programs in the U.S. should expand their efforts to find autistic job seekers who have computer capabilities but lack the credentials — precisely the types of people van Hofweegen and de Bie recruited for their inaugural class.

In February 2014, after a six-month stint cutting yarn, van Ruitenbeek rode his bicycle to ITvitae’s space for the first day of class. He was nervous. In social settings, he always felt as though he were “from another planet,” he said. Here, though, he was surrounded by people who felt the same way.

Shortly after their arrival, de Bie assigned the students to assemble the furniture they would be using. When he returned several hours later, he found they had put it together flawlessly. He asked how everyone was getting along and discovered that none of the students had bothered with introductions. De Bie was surprised and amused; he was still learning how autistic people function.

Van Hofweegen and de Bie, who refused to use the word “disability,” told the students they had “different operating systems” than the neurotypical people they grew up with. It helped to reassure them that they belonged in the classroom, and eventually the workplace, as they all began to “learn how to learn again” following what for some was years away from school, van Hofweegen said. De Bie eased the students into a school setting by leading a training on basic Microsoft programming, networking and security. That was followed by a 40-day course on software testing offered by an organization that issues certifications for technical specialties in the Netherlands.

After only a short time, van Ruitenbeek said he began to feel “at home for the first time in my life.” He enjoyed his coursework and excelled at it. He gradually began interacting with other students as he felt more at ease and less afraid of making social mistakes. When he grumbled about commuting by bike, a classmate offered to drive him to and from ITvitae. Van Ruitenbeek gladly accepted.

Yet, for all his progress, van Ruitenbeek continued to face obstacles. Conversation remained difficult due to his stutter, and he lacked the energy to work the 32-hour week that most employers expected of ITvitae’s graduates. Sometimes his father worried it was all too much for him. He was one of three students for whom van Hofweegen struggled to find a job.

When the coursework drew to a close, the students took a formal exam to be certified in software testing. Van Ruitenbeek breezed through the questions, except for one that confounded him: None of the multiple choice answers were technically correct. So he selected the answer that he suspected the test-maker wanted. He picked correctly and scored 100%. “It was my first achievement,” van Ruitenbeek said. “I could do something.”

A short time later, a director from the testing company visited ITvitae and van Hofweegen told him that a student had spotted a mistake in the exam. Van Hofweegen, who has an uncanny ability to sense an opportunity and pounce, suggested that van Ruitenbeek could be a test reviewer. The company invited him to join a small group of volunteers who look over exams for accuracy and clarity. Van Ruitenbeek readily agreed. To prepare, he plowed through a textbook on ethical hacking.

The work led him to his next self-discovery: Ethical hacking was fun. Once unable to set goals for the future, van Ruitenbeek now dreamed of a career in cybersecurity. He would hunt for hidden vulnerabilities in software and networks, and prevent them from falling prey to malicious hackers.

Following the success of their first class, van Hofweegen and de Bie recruited another class, then another, each with a maximum of 14 students. After the first year, with steady revenue generated mainly from fees paid by employers, the co-founders began taking salaries, and they hired additional staff. ITvitae’s mission spread to autistic job seekers and their supporters across the Netherlands.

As the organization grew, van Hofweegen and de Bie relocated ITvitae to a floor in a former monastery, which had been converted into offices. The founders thought its tree-shaded walking paths and seclusion would impart a serenity that the students needed. The organization also began offering new courses in software development, data science and cybersecurity, all specialties in high demand. Students delighted in being able to focus exclusively on topics that fascinated them, a luxury — for many of the students, a necessity — that traditional educational settings couldn’t provide.

Certain similarities emerged among ITvitae’s students. Before joining, nearly half had been sitting at home, unemployed and socially isolated, for longer than two years. Many passed the time playing video games and lost track of whether it was day or night. They told van Hofweegen and de Bie they felt worthless and never fit in; many reported having been bullied and struggling through periods of depression.

ITvitae turned away about two-thirds of applicants, most frequently because of untreated mental health issues. Other candidates simply weren’t ready. One 2022 applicant said he hadn’t left his home for 10 years and spent most of his time gaming. “It was such a big thing for him to be here” for the interview, de Bie said. “But then traveling regularly, studying in a group, doing exams — that would have been too heavy for him. I had to tell him it’s not the right time.”

Male students at ITvitae outnumber female students 10 to 1, both because autism is more prevalent in men and more likely to go undiagnosed or misdiagnosed in women. Many experience sensory challenges, such as headaches if the light is too bright or if there’s too much noise. One student was distracted by the sound of blinking eyelashes. Most struggle to varying degrees with communication.

To help both prospective employers and job candidates work through the inevitable miscommunications, ITvitae staff members accompanied students to job interviews. Saskia Meeuwessen, who was hired as the CEO of ITvitae as it expanded, recalled joining a student at an interview for a cybersecurity job with the Dutch National Police. The interviewer asked the candidate to introduce himself. The student froze: It wasn’t a question he had practiced. Nonetheless, he was later invited for a second meeting with an interviewer who was more experienced in interacting with autistic people.

That interviewer sat down and, with no social niceties, asked, “When I type www.google.nl, what happens?” Meeuwessen thought to herself, “Well, Google shows up, what a silly question.” But the candidate had a completely different reaction, launching into nuanced details about internet servers and connections. For 90 minutes, Meeuwessen “sat there, listening to stuff that I really didn’t understand,” she said. The candidate was hired on the spot.

Thanks in part to its gradually sloped coastline, the Netherlands is a popular landing spot for the underwater fiber optic cables connecting the United States and Europe. Fast, reliable and inexpensive internet connectivity has fostered a flourishing tech sector. But that connectivity has negative consequences, too. Hackers who can’t rely on the fragile internet connections in their home countries use servers in the Netherlands to commit crimes.

To counter these hackers, the Dutch National Police established an elite force called the High Tech Crime Unit, or HTCU. The unit has become renowned both for its success disrupting the operations of cyberattackers and for its innovative culture, which for years has included hiring unconventional candidates, including those with autism.

In 2017, at van Hofweegen’s urging, the HTCU brought on a graduate from ITvitae. He proved to be an open-source intelligence wizard. Another graduate followed. Then the floodgates opened, and about 30 ITvitae graduates were eventually hired to jobs in regional police squads, where they handle data analysis, digital forensics and other technical specialties.

The National Police’s embrace of a neurodiverse workforce extended beyond its partnership with ITvitae. Its most renowned hiring initiative for autistic employees began with a 2016 murder case.

A 50-year-old Turkish man had been shot more than 30 times in the Dutch city of Leiden and died two days later. The National Police collected surveillance camera footage and quickly identified the suspects. Their work also seemed to link the murder to a number of cold cases in Amsterdam. The National Police took over those investigations, inheriting 1,700 hours of camera footage. Watching the tapes was a marathon of drudgery that none of the National Police detectives wanted to take on.

One National Police detective, Jory de Groot, happened upon an idea. De Groot, who has a foster brother with Down syndrome, volunteered with a group that organized trips for young adults with disabilities. On a weekend shortly after the murder, she led a group of people with autism. De Groot, then 26, described her job to one participant on the trip and mentioned the painstaking work of watching security footage. Some autistic people excel at recognizing small details, the woman told de Groot. They might love the very task that neurotypical detectives loathe.

De Groot then contracted four people from AutiTalent, a Dutch job placement organization for autistic people. She prepared her colleagues, advising them against asking typical get-to-know-you questions, and set up a radio-free office in a quiet corner of their building.

When the autistic contractors arrived, the National Police detectives tested their abilities by having them watch the footage collected in the Leiden murder. The detectives had already watched the tapes, which included the days leading up to the shooting, and knew precisely when the suspects would be seen on the day of the shooting.

Before long, one of the contractors spotted a suspect on the tape — but not when the detectives expected. The contractor found the suspect casing the crime scene the day before the attack. The detectives had missed it. “It was really important evidence that we overlooked,” de Groot said. Eventually, the two suspects were convicted in the Leiden murder.

As word of the feat reverberated through the National Police, requests for more AutiTalent contractors flooded in. Eventually, 50 autistic people were working as “camera footage specialists,” a newly created role, across the National Police. De Groot’s original team grew to six people, who increasingly talked with one another and with their police colleagues as they became more comfortable. The contractors joined detectives from the start of investigations, rather than stepping in after they were already in progress, and took part in briefings. Additional contractors from AutiTalent became “audio specialists,” who transcribed interrogations and wiretaps.

The high profile of the contractors led some members of the National Police force to speak out about their own autism, which they’d previously hidden. The outpouring prompted de Groot to work with those employees and an advocacy organization to establish an “Autism Embassy” at the National Police. Now about a dozen workplace “ambassadors” — employees with autism who volunteer for the role — offer an ear and advice to both autistic colleagues and their managers.

The National Police’s embrace of autistic contractors has been partially driven by government-proposed targets, accompanied by subsidies, for industry and government to hire 125,000 people who have difficulty finding work because of a disability. That sort of government-centric approach is unlikely to occur in the U.S. Still, law enforcement agencies in the U.S. could draw lessons from the Dutch experiment, said Michael Bernick, the attorney who has focused on employment strategies for autistic people.

Amid ITvitae’s successes, van Ruitenbeek was still floundering. He had enjoyed his time as a volunteer test reviewer in 2014, but it didn’t lead to a job. A subsequent internship with a computer security consultancy also didn’t land him permanent employment. Yet another internship, with an organization that maintained supercomputers, failed when he experienced a psychotic episode in late 2016.

It happened when van Ruitenbeek was commuting to the company’s Amsterdam office by train. He knew public transportation was a stressor for him, but he thought he could push through it. He couldn’t. That day, he believed everyone on the train was talking about him. He didn’t fully lose control, as he had in Utrecht. Still, he realized he couldn’t continue to commute and work normally with the organization any longer. He quit.

It had been more than two years since his ITvitae graduation, and van Ruitenbeek was again feeling hopeless. He mostly stayed at his parents’ home, where he tinkered with developing his own video game. He sometimes rode his bike to ITvitae’s offices — “just as a place to go,” he said — where he read books on cybersecurity and tried to ground himself.

Van Ruitenbeek happened to be at ITvitae one day in late 2017 when Pim Takkenberg, then a director at the Dutch cybersecurity firm Northwave and a former leader of the National Police’s High Tech Crime Unit, was there. Earlier that year, Takkenberg had overseen the development of a training program for ITvitae’s cybersecurity students. During the visit, van Hofweegen, ever scouting, made a request: “Pim, I have a person here, who is extremely vulnerable but extremely brilliant. I want you to talk to him.”

After a brief chat, Takkenberg agreed to give van Ruitenbeek a “hack test” to assess his aptitude for penetration testing. The prospect alone was enough to help van Ruitenbeek regain some hope. A few months later, on exam day, Takkenberg instructed him to find vulnerabilities in a piece of software, which hackers could exploit to attack the hypothetical client. Takkenberg jokingly warned him not to cheat. Van Ruitenbeek took him literally, assuming he meant not to research anything on the internet. In reality, using the internet would have been allowed, even expected.

Van Ruitenbeek found the main vulnerabilities. Takkenberg was impressed but remained skeptical. Van Ruitenbeek still had trouble with conversation, and he was able to work only three days a week. Addressing the doubts, van Hofweegen said: “You want a problem solved. He communicates better with computers than with people. In a technical world, it’s not so bad.”

Takkenberg offered him a trial six-month internship. But he needed someone who could work 40 hours a week. They found a compromise. Van Ruitenbeek would start with three days a week, then gradually increase to five days. Northwave also allowed van Ruitenbeek to work from home occasionally, a major concession before the pandemic. He went on a special diet and began exercising to improve his health and boost his energy. He was determined to have a permanent place at Northwave, where he might finally gain the independence and fulfillment he’d long chased.

Over their nearly nine years together as business partners, van Hofweegen and de Bie proved there was space in the labor market for people who had been overlooked by employers and who previously thought themselves to be shut out of the workforce. Since 2014, ITvitae has graduated and placed nearly 500 students in technical jobs spanning sectors from agriculture to chip manufacturing to law enforcement. Bernick called that total “striking” and said, “We don’t have any company in the United States that comes near that number, even over a 10-year period.”

De Bie’s early assessment that employers would be willing to pay a fee to hire ITvitae’s graduates proved to be right. It costs the equivalent of $30,000 to educate, coach and find employment for each student. About a third of that is generated from tuition while the remainder comes from the employer.

As ITvitae’s Meeuwessen points out, autism doesn’t end when students gain employment. That’s why the organization provides regular coaching to help graduates navigate changes — anything from a new manager to a schedule shift — they perceive as disruptive and unsettling. “As soon as something happens, they start to doubt. If there’s doubt, they get unstable and that’s bad,” Meeuwessen said. “Most are doing just fine after many years, but it’s a process.”

For all the success, there have been setbacks. Even with coaching, some students struggle. ITvitae occasionally hears from an employer that a former student has stopped showing up to work and hasn’t responded to messages, sometimes for weeks. “We go to their houses,” van Hofweegen said. “We knock on the door. We call the parents. And we still can’t make them understand why they need to communicate with their employers.”

A few times, the problems have been far more dire than an inability to show up at work. De Bie keeps a photo on his desk of a talented software programmer who specialized in a language called C#. After his graduation, he was hired by a prestigious global corporation. His coach regularly checked in, and, by all appearances, his first few months at the company were successful. Then came word that the student had taken his life, one of three graduates to die by suicide. Even before graduating, the programmer had obtained an illegal drug from China with the intention of overdosing. He waited to take it. He wanted to finish his education and get a job to prove that he was capable of success. “For him, that was enough,” van Hofweegen said.

When van Ruitenbeek started at Northwave in 2018, being in an office with other people scared him. Takkenberg knew that van Ruitenbeek wouldn’t be comfortable speaking to clients or even colleagues right away and tried to smooth the transition. He and his team organized roles that accommodated van Ruitenbeek and other ITvitae graduates “in doing the things they’re good at and not doing the stuff they really hate to do.” So, after van Ruitenbeek rooted out the vulnerabilities in a network, another colleague would meet with the client to explain the findings. Through a government program for people who need work accommodations, de Winter helped van Ruitenbeek borrow a car so he could avoid the stress of public transportation.

Van Ruitenbeek found an accepting culture at Northwave. He began to confide in colleagues, who looked after him. As van Ruitenbeek’s trust in them grew, he started asking questions and giving more than yes and no answers. He successfully pursued a notoriously difficult, globally recognized certification for his line of work, which Takkenberg said was a “big sign” that the intern’s abilities were exceptional. Once the internship ended, Takkenberg gave him a permanent job sniffing out gaps in software that could make it vulnerable to being penetrated by malicious hackers. “He is one of the best pen-testers we have,” Takkenberg said. “Because of his talent to focus and stay focused, he always will find the small details.”

Shortly after van Ruitenbeek started in his permanent position, he and Takkenberg discussed his goals for his first year. They decided van Ruitenbeek should find a CVE, short for common vulnerabilities and exposures, security flaws in software that are formally and publicly cataloged. Takkenberg was ecstatic when, by the midyear check-in, van Ruitenbeek had uncovered six. “OK, that goal is done,” Takkenberg said. “For the rest of the year, let’s focus on your social skills.”

A short time later, van Ruitenbeek attended a company golf outing. Takkenberg, who retains the rough-around-the-edges demeanor of an ex-cop, joked that van Ruitenbeek would probably excel despite never having played. “We know you read eight books in a month for fun, Thomas,” he teased. “So you probably read a book about how to golf to prepare for this.” Van Ruitenbeek was able to recognize that Takkenberg was joking, something he’s sure would have eluded him in the past. It was a revelation.

Then, during a weekend retreat with his team, van Ruitenbeek carted along some records and a record player. Music had long been a passion that allowed him to express himself when he lacked the words to do so. One evening, he worked up the courage to play records for about 15 of his colleagues. The airy, electronic music helped everyone relax. Word of his talent spread, and the next day, he found himself DJing a barbecue for Northwave’s entire cyber unit, more than 50 people.

Takkenberg decided to splurge on a DJ booth for Northwave. He dubbed van Ruitenbeek the company’s official DJ and assigned him to play music at its Friday afternoon happy hours. Van Ruitenbeek became the center of Northwave’s social gatherings.

Watch video ➜

When COVID-19 hit, van Ruitenbeek found himself longing for the company of colleagues. “I mostly miss the casual chats,” he said of the days that he works from home, about half his schedule these days. “That is the biggest change of my life since Northwave,” he said. “Social development. Now I am outgoing.”

Van Ruitenbeek has started mentoring a new autistic employee. He also began working with Northwave’s sales team to write proposals and even meet with clients. That’s not to say there aren’t challenges. But now, when the workload feels too heavy, or he senses he’s becoming over-stressed, van Ruitenbeek asks for help. “I used to think I had to shoulder it on my own,” he said.

Now 35, van Ruitenbeek is becoming financially independent. He received a promotion and raise. He leased his own car and, in 2021, with help from his family, van Ruitenbeek purchased a one-bedroom apartment just a short walk from them. Giving a tour of his new home, he showed off the view of a pond beyond the sliding doors of his living room. He had carefully organized scores of records on shelves below his DJ equipment. Tucked away in a corner, he displayed the artifacts of his period of isolation: shelves filled with the Warhammer figurines he painted as he recovered from his psychosis.

If you meet van Ruitenbeek today, you wouldn’t likely guess his history. Compact and ruddy, he makes eye contact when he speaks — in fluent English when he was interviewed for this article — and is often self-deprecating and quick to smile. His easy banter with his father, a reliable source of support, encouragement and protection, was unimaginable in the aftermath of his psychosis a decade ago.

When he entered the working world, van Ruitenbeek had to consciously mimic social behavior and speech that he observed in peers. Over time, though, being social gradually became second nature. He felt like a foreign language student who once had to rehearse sentences in his mind but eventually spoke the new language fluently.

In April, van Ruitenbeek attended the graduation of this year’s cybersecurity class at ITvitae’s monastery, sitting among the new graduates’ families and friends on a drizzly afternoon. An ITvitae manager named Jessica van der Ploeg told the 11 new graduates, who were going on to jobs at global bank ING, consulting giant Deloitte and the Dutch Ministry of Defense, “The job market is waiting for you, for your talent and for who you are.”

Van der Ploeg acknowledged that many incoming ITvitae students feel shut out of society because of their autism, just as van Ruitenbeek once did. Alluding to an analogy ITvitae often uses to describe the communication gap between people with autism and their neurotypical peers, she said, “It’s us Windows users who sometimes don’t know how Linux works.”

Van Ruitenbeek listened intently. At various points in his life, he had been unable to express emotion. Now he had tears streaming down his face.

Do You Have a Tip for ProPublica? Help Us Do Journalism.

This post was originally published on Articles and Investigations – ProPublica.

by Craig Silverman and Bianca Fortis

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

To his more than 150,000 followers on Instagram, Dr. Martin Jugenburg is Real Dr. 6ix, a well-coiffed Toronto plastic surgeon posting images and video of his work sculpting the decolletage, tucking the tummies and lifting the faces of his primarily female clientele.

Jugenburg’s physician-influencer tendencies led to a six-month suspension of his Ontario medical license in 2021 after he admitted to filming patient interactions and sharing images of procedures without consent. He apologized for the lapse and is currently facing a class-action lawsuit from female patients who say their privacy was violated.

But on Spotify, Apple Music and Deezer, and in roughly a dozen sponsored posts scattered across the web, Jugenburg’s career and controversial history was eclipsed by a new identity. On those platforms, he was DJ Dr. 6ix, a house music producer who’s celebrated for his “inherent instinctual ability for music composition” and who “assures his followers that his music is absolutely unique.”

It’s an unconvincing persona — perhaps even less so once his “music” is played. But it was enough to secure what he wanted: a verification badge for his Instagram account.

The coveted blue tick can be difficult to obtain and is supposed to assure that anyone who bears one is who they claim to be. A ProPublica investigation determined that Jugenburg’s dubious alter ego was created as part of what appears to be the largest Instagram account verification scheme ever uncovered. With a generous greasing of cash, the operation transformed hundreds of clients into musical artists in an attempt to trick Meta, the owner of Instagram and Facebook, into verifying their accounts and hopefully paving the way to lucrative endorsements and a coveted social status.

Since at least 2021, at least hundreds of people — including jewelers, crypto entrepreneurs, OnlyFans models and reality show TV stars — were clients of a scheme to get improperly verified as musicians on Instagram, according to the investigation’s findings and information from Meta.

Verified Spotify profiles for MTV “Siesta Key” stars Mike Vazquez and Lexie Salameh were removed after ProPublica reached out.

(Screenshots by ProPublica)

In response to information provided by ProPublica and the findings of its own investigation, Meta has so far removed fraudulently applied verification badges from more than 300 Instagram profiles, and continues to review accounts. That includes the accounts of Mike Vazquez and Lexie Salameh, two stars of the MTV reality show “Siesta Key.” Rather than get verified for their TV work, they were falsely branded online as musicians in order to receive verification. They lost their badges approximately two weeks ago and did not respond to requests for comment.

Jugenburg did not respond to a phone message left at his Toronto practice or to emails detailing evidence that he had paid for his Instagram verification. He has told media outlets he intends to vigorously defend himself against the class-action suit.

The scheme, which likely generated millions in revenue for its operators, illustrates how easily major social, search and music platforms can be exploited to create fake personas with real-world consequences, such as monetizing a verified account. It also underscores how Instagram’s growth and cachet combines with poor customer support and lax oversight to create a thriving black market in verification services and account takedowns for hire.

Influencers, socialites, models, businesspeople and all manner of clout chasers rely on Instagram to flaunt their lifestyle, generate income and establish a personal brand. Some influencers and models told ProPublica they face a barrage of impostor accounts trying to run scams to trick their fans. They also run the constant risk of malicious actors fabricating evidence and filing user reports to convince Instagram to ban their accounts. They see a badge as one of few options available that can help them protect their accounts and business. Others covet the blue tick as a status symbol. The result is a steady supply of well-heeled customers willing to pay five figures to get verified. (Meta is reportedly working on enhancing its customer support.)

The verification scheme identified by ProPublica exploited music platforms like Spotify and Apple Music, as well as Google search, to create fake musician profiles. The songs uploaded to client profiles were often nothing more than basic looping beats or, in at least one case, extended periods of dead air. They credited composers with nonsense names such as “rhusgls stadlhvs” and “kukyush fhehjer.” The Meta employees tasked with reviewing the musician verification applications apparently failed to listen to the tracks or look too closely.

The people running the scheme also purchased articles promoting fake artists and their music on websites, including hip-hop publications like The Source and ThisIs50.com, a music and culture site affiliated with rapper 50 Cent. They often bought fake comments and likes for clients’ Instagram posts to make the accounts look popular and purchased fake streams for songs on Spotify, according to two sources with direct knowledge of the operation. One source said some clients were told to rent a recording studio and post photos on Instagram that made it look like they were working on music. (The Source and ThisIs50.com did not respond to emailed requests for comment.)

“You can make a Spotify account or Apple Music account and boost the streams and get fake music press very cheap. It’s quick and easy,” said the source, who asked not to be named due to fear of retaliation.

A Spotify spokesperson said the company identified artificial streams, which are often generated using bots, on many of the 173 profiles provided by ProPublica. The company has removed more than 100 of the artists from its platform.

“Fraud is an industry-wide issue that we take very seriously,” Spotify spokesperson Zachary Kozlak said. “Spotify invests heavily in automated processes and manual reviews to prevent, detect, and mitigate the impact of artificial activity on the platform. We’ve removed the content in question we found to be manipulated.”

Apple Music did not respond to multiple requests for comment, but it has removed music from the profiles of many of the dubious artists identified by ProPublica.

Using domain registration records, corporate and banking documents, information from online platforms, and interviews with clients and people with knowledge of the scheme, ProPublica was able to identify the person at the center of the plot. He is a Miami-based aspiring DJ and would-be crypto entrepreneur named Dillon Shamoun. With little or no interference from Meta, Shamoun built a verification-for-pay juggernaut while also burnishing his own image by using the same digital manipulation techniques he offered to clients.

Shamoun appears to have hawked his Instagram verification services to a cadre of Miami nightlife impresarios, restaurateurs, jewelers, models and others. He also transformed his model-influencer girlfriend and his older brother, a mortgage broker, into musical artists in attempts to secure account verification.

In phone interviews with and text messages to ProPublica, Shamoun, an athletic, bearded 26-year-old, denied any involvement in the scheme and said he does not sell account verification services. He said he works on FanVerse, a crypto startup that enables creators and influencers to sell NFTs of themselves, among other projects.

“People know who I am and my character and what I do for business, and it has nothing to do with Facebook or Instagram,” he said.

After being provided information by ProPublica, Meta confirmed Shamoun’s key involvement in the fake musician verification scheme. It banned him from its platforms and removed his Instagram and Facebook accounts. The company said that Shamoun’s scheme was a sophisticated operation and that Meta works to thwart the sale of fraudulent services to users of its platforms.

“Scammers selling fraudulent services continue to target online platforms across the internet, including ours, and constantly adapt their tactics in response to industry detection methods,” said a Meta spokesperson, who asked not to be identified due to security concerns related to this story’s subject matter. “We urge people to keep vigilant and never pay for verification status because it violates our Terms. Whenever we identify a scheme like this, we take action – and that means not only will someone who’s paid for verification lose their money, they’ll lose their verification status, as well.”

When asked if any Meta employees or contractors were involved in the scheme, the spokesperson said they can’t comment on internal personnel matters or investigations.

A falling out between Shamoun and a business partner, combined with scrutiny from Meta and ProPublica’s investigation, has unleashed a vicious round of finger-pointing that exposed the underworld of social media manipulation and verification services.

In response to questions from ProPublica, Shamoun said the scheme is all the work of Adam Quinn, a prominent Instagram creator who previously worked with mega-influencer and boxer Jake Paul, and who has collaborated with musicians and celebrities for online promotions. Quinn’s Instagram account had more than 2 million followers when it was removed by Meta in June. The company sent him a cease-and-desist letter that month accusing him of selling account verification services, running celebrity giveaways that inauthentically boosted followers for Instagram accounts and offering to reactivate disabled Instagram accounts for a fee.

The Meta spokesperson said the company had collected evidence of Quinn’s involvement in selling verification services before its recent move against Shamoun for the fake musician scheme.

In comments to ProPublica and in a legal letter sent to Meta, Quinn acknowledged he sold account verification in partnership with Shamoun. He denied being personally involved in account reactivation, and he said his giveaways were in line with Meta’s rules and did not result in fake followers. An archived version of his company’s website lists a menu of “Instagram Growth Packages” ranging up to $7,500 and promising to deliver 100,000 followers using the giveaway model.

Quinn said he had used his connections and Instagram account to refer clients to Shamoun and had received a portion of the resulting fees. Clients typically paid $25,000 to verify an account, though Shamoun has at times charged more than $100,000, according to Quinn. He provided ProPublica with a bank document showing wire transfer information for Shamoun’s company, as well as two agreements from this year that said Quinn and Shamoun were partners in a “Social Media Verification” business. One agreement, signed in June, stipulated that Shamoun’s company was responsible for the client work to “ensure successful Verifications.” A source close to Shamoun, who asked not to be named to avoid jeopardizing their current job, verified the authenticity of the agreements but claimed Quinn was the one submitting fake musician verification requests. The language of the agreements appears to dispute this claim, as do Meta’s findings.

ProPublica also obtained a copy of a business proposal from Shamoun’s company, Rumor LLC, that pitched a range of online marketing services, including social media verification.

In his lawyer’s letter to Meta, Quinn denied submitting fake musician accounts to the company for verification. He said Shamoun created and controlled the process and handled the submissions. He also accused Shamoun of supplying information to Meta in an effort to get Quinn’s and Quinn’s girlfriend’s Instagram accounts removed in June.

“I believe that I am a victim of circumstance here, being unjustly attacked by someone not only violating Meta’s terms and conditions, but abusing the system put in place to prevent people like him from doing what they do,” Quinn’s letter said.

The implosion of the scheme has left Quinn and Shamoun banned from Instagram and other Meta platforms and has put an end to their lucrative business partnership. It has also left more than 300 recently de-verified clients angry that they paid tens of thousands of dollars for nothing.

For his part, Shamoun insisted that any information linking him to the scheme was fabricated by Quinn in order to frame him.

“As stated, I’m a very influential individual in Miami, that’s why I’m being framed by someone who’s now a ghost online,” he wrote.

Shamoun said he had over 70 pages of evidence showing Quinn is responsible for the entire scheme, as well as other types of platform and account manipulation. When asked to share that evidence with ProPublica, he said he could not because he is bound by unspecified nondisclosure agreements. Shamoun also said he is working with Netflix on producing a film or series based on the documents.

“I’m going to make something even bigger than ‘The Tinder Swindler,’” he said, citing a recent hit Netflix documentary about a scammer who dated women and made off with their money.

Netflix did not respond to a request for comment.

Battle for the Badge

The criteria determining who is eligible for verification are not always clear-cut, but Instagram says accounts must be authentic, unique, complete and notable.

Besides offering clout, a blue check mark provides social proof that the account holder is who they say they are. Verified account holders may also get access to new features before they’re available to the general public.

Meta’s policies forbid users from selling account verification as a service and from misrepresenting their identity in order to receive a badge. But people have been selling Instagram verifications for years. A 2017 Mashable article reported that people were paying thousands for a blue tick.

As demand for verification rose over the years, Meta developed verification criteria for various categories of people or brands, including music, fashion and entertainment. This scheme shows how those criteria can be used as a road map by people like Shamoun.

Shamoun “had the most volume out of anybody,” said a source who has bought verification for clients and frequents the dark web chats and Telegram channels where people offering the service congregate. The source, who asked not to be named in order to protect their Instagram accounts, said Quinn’s high profile also helped bring a steady flow of clients to the operation.

Among those clients were multiple performers on OnlyFans, a popular platform among adult entertainers who can charge users for access to members-only photos, video and communications. One model, who said she declined an offer from Shamoun to get verified, told ProPublica that OnlyFans performers in particular see value in verification. She said they are often targeted by extortion schemes whereby hackers file false reports and get a model’s Instagram accounts removed, and then offer to reactivate the account for a fee. The OnlyFans model spoke on condition that her name not be used, as she feared reprisals for speaking out.

“A lot of people will impersonate you if you’re an OnlyFans girl and put a link up and pretend to be you” in order to scam fans, she said, adding that she feels Instagram is more strict about content posted by OnlyFans performers, and that losing an account could result in a drop in revenue.

Making a Fake Musician

DJ Dr. 6ix’s Spotify profile was removed after ProPublica reached out to the company.

(Screenshot by ProPublica)

Jugenburg’s online profile as DJ Dr. 6ix is typical of the work done by the operation: a raft of paid press articles extolling the DJ’s musical genius, false claims about his popularity and background, profiles on major music platforms like Spotify, Apple Music and Deezer, and songs that often consist of a simple looped beat.

“Umbrella”

On Spotify and other music platforms, Jugenburg had five songs with titles such as “Umbrella,” “Mysteries” and “Next Party.” One of the songs showed it had been streamed close to 60,000 times, but included 90 seconds of dead air and credits an apparently made-up writer: “gbfred gtfrde.” The source with direct knowledge of the operation said fake Spotify streams were bought for songs to make clients look convincing if a Meta employee ever checked. Spotify removed DJ Dr. 6ix’s profile after being contacted by ProPublica.

DJ Dr. 6ix’s Spotify bio claimed he was featured in publications such as “EDM.com, The Source, & Billboard.” Jugenburg does not appear on EDM.com or in Billboard, but he was featured in an apparently paid article on The Source. It falsely describes him as a Los Angeles-based artist and says his song “Umbrella” has “firmly established himself as one of the most well-known musicians of his generation.”

Articles about Dr. Martin Jugenburg’s alter ego, DJ Dr. 6ix, were placed on music websites to help get his account verified.

(Screenshots by ProPublica)

That same line appears in at least nine other apparently paid articles about other likely Shamoun clients. On those and other occasions documented by ProPublica, his operation apparently reused the same article text and simply swapped in different artist and song names.

The lack of effort put into the paid articles wasn’t an accident. The operation also reused songs for clients. It was an assembly line for Instagram verification. The source with knowledge of the process said the goal was to secure a badge for a client in 30 to 45 days.

.bb-aside p {
margin-top: 5px;

}
.bb-aside h2 {
margin-bottom: var(–spacing0);
}

Anatomy of a False Verification Scheme
Step 1

A client creates content showing them in designer clothing, at luxury locations or in a recording studio to make them look like a musician.

Step 2

Spotify and Apple Music profiles are created for the client, basic songs are uploaded with album art, and fake streams are purchased to make their songs appear popular.

Step 3

Paid articles about the client’s songs are published to add further legitimacy.

Step 4

The client posts their lifestyle and music content, spacing it out over time. Engagement in the form of likes, comments and followers are purchased for the posts, providing evidence of popularity.

Step 5

Google’s search engine indexes the client’s music and articles, then automatically generates a “knowledge panel” that brands the person as a musical artist when someone searches for their name.

Step 6

In final preparation for verification, a client edits their Instagram bio, feed and highlights to emphasize their musical career.

Step 7

The client’s Instagram account is submitted to Meta for verification. If everything goes as planned, they’ll receive a blue check and the account protection and status it affords.

Here’s how it worked: The first step is to have a client produce photos in lifestyle poses and situations that made them appear to be an artist or someone with a high cultural status. Client profiles reviewed by ProPublica often showed people posing in front of expensive cars, in designer clothes or near private planes. In some cases they appeared behind or near a DJ booth or in a recording studio.

As clients produced their content, Shamoun and his small team commissioned articles and music for them. Many paid articles featuring fake artists are credited to Lost Boy Entertainment, a PR firm. Cofounder Christian Anderson confirmed that the articles placed for the fake musicians, and for Shamoun, were paid placements, or what he called “advertised press.” He said he wasn’t sure who paid for them because they were likely purchased via his company’s account on Fiverr, an online marketplace.

“After this has been brought to our attention we are working on taking many of these articles down already. We weren’t aware of the end goal,” he said in an email.

As for the songs, the source with knowledge of the operation said basic beats can also be purchased on Fiverr. With music in hand, the music and artist profile information was uploaded to Spotify, Apple Music and other platforms.

Clients were then told to start posting their content on Instagram. The operation also purchased fake likes and comments on Instagram posts that featured music content. The source said they were unaware of any instances where Instagram flagged likes or comments as potentially inauthentic.

“If you’re an Instagram employee with a heavy workload, are you really gonna check the comments on every submission?” they said.

The source said they also worked to ensure a client’s Google search results would present them as a musician. Google itself proved helpful in this regard. Once articles and music profiles were indexed by Google’s search engine, the site generated a “knowledge panel” in search results for the person’s name. The box appears next to search main results and identifies the person as a musical artist, offering links to their online profiles and music. In the eyes of Google, the client was now a real musician.

A Google spokesperson said that close to 80% of the 173 people identified by ProPublica as likely Shamoun clients were labeled musicians in these auto-generated knowledge panels. The company said because these individuals had profiles on Spotify and Apple and were the subjects of articles, they met the criteria to be labeled as musical artists. It’s not Google’s responsibility to determine whether the artists are legitimate, according to company spokesperson Lara Levin. As of now, these people remain marked as musical artists when you search for their names on Google.

Google automatically generated musician “knowledge panels” for Vazquez and Salameh.

(Screenshots by ProPublica)

The source said Shamoun claimed his actual costs for each verification submission amounted to roughly $1,500. He typically charged clients $25,000 for each verified account, making the operation hugely profitable, they said. Meta kept approving fake musicians, and the clients kept coming.

“Jungle”

One client is Alfredo Troia, who sells custom jewelry out of a Pembroke Pines, Florida, shopping mall and goes by the moniker Goody the Jeweler. His verified Spotify profile had a total of seven songs and 180 monthly listeners prior to being removed by the company. While all of his music is electronic, his profile image shows him sitting next to an upright piano, reading what appears to be sheet music. Writing credits for his music list names such as “wehkuudhs wehdgjg,” “trudbkds prosbhkdfs” and “caddfhjksf probfbksd.” His song “Jungle” also sounds the same as DJ Dr. 6ix’s “Umbrella.” He did not respond to requests for comment. He lost his Instagram badge, and his music was also removed from Apple Music and Deezer.

“Despair”

Akop Torosian, a bakery and gym owner, had four songs on his Spotify page under the name No Limit Boss. One track, “Despair,” which sounds like an audio sample played on loop for more than four minutes, was described as an “opus” in a likely paid March article published by Muzique Magazine. (Muzique did not respond to emailed requests for comment.)

In June, Torosian was arrested at Los Angeles International Airport on a complaint of attempted murder after he allegedly threatened one of his employees with a weapon. He pleaded not guilty in that case. The arrest came days after Torosian was accused of making racist comments about a Mexican juice vendor. In 2015, he was sentenced to three years of probation for a weapons charge related to a triple shooting. His Spotify profile was recently removed, and his Instagram badge was recently revoked by Meta. He did not respond to requests for comment.

Several OnlyFans models were also verified as musicians. Desiree Schlotz, Hannah Palmer and Lauren Blake boast a total of 4.7 million followers on Instagram, and each had songs, music profiles and paid articles presenting them as musicians. All three lost their Instagram badges, and Spotify removed their songs. They did not respond to requests for comment.

Nicky Gathrite and Tara Electra (whose name in corporate records is Tara Niknejad) are the co-founders of Unruly, an LA-based agency representing models and OnlyFans performers. They were also falsely verified as musicians. Both recently lost their badges.

In a phone call, Gathrite denied any knowledge of the paid verification scheme. When asked if he’s really a musician, he said, “If you Google me you can see that I am.” Google searches on his name brought up an automatically generated knowledge panel describing him as a musical artist. Electra did not respond to a request for comment.

Gathrite is also involved in FanVerse, the Shamoun startup that sells NFTs of models and influencers. Another partner in the company is Mike Vazquez, the “Siesta Key” star who lost his badge after being falsely verified as a musician.

Gathrite did not respond to follow-up questions sent by email, and Vazquez also declined to comment. Shamoun did not respond to questions about his connections to Vazquez, Gathrite and Unruly.

“From a Sales Guy to a Music Sensation”

Shamoun seemed a natural fit to oversee the manufacturing of dubious musical artists.

He grew up in the Detroit area and has performed as a DJ under the name “Not Dillon.” As early as 2020, he began placing paid articles to promote himself and his ambitions in the music industry. Like those discussing his clients, the articles made exaggerated or false claims about Shamoun’s accomplishments.

“From a sales guy to a music sensation, Dillon is breaking records with his music and has established himself as an emerging name in the industry today,” reads a January 2020 article placed on an Indian news website.

Dillon Shamoun’s verified Spotify profile was removed after ProPublica contacted the company.

(Screenshot by ProPublica)

Another apparently paid article from the same month on a different Indian website claimed Shamoun had “over 10 million streams on the music which he has created.” His two songs as Not Dillon on Spotify have less than 200,000 streams, and an old SoundCloud account in his name has six songs with less than 1,000 total plays. ProPublica could not find evidence of significant audience interaction on other platforms.

Over the next two years, his questionable claims of fame and success grew.

Back in 2020, online articles said he had played at a handful of music festivals. Shamoun’s website claimed he was involved in “branding and playing 12 of the world’s most reputable music festivals.” When he spoke to a ProPublica reporter this month, he claimed to have sold a major music festival to Live Nation. He declined to name the festival or provide additional information to back that up. It appears any supposed windfall from that sale may have been minor: Records show that a Dillon Shamoun with an address that matches public records for the aspiring DJ received a Payroll Protection Program loan of $18,540 in April 2021. Loan data lists Shamoun as working in “Marketing Consulting Services.”

Shamoun’s personal site also claimed he has two certified gold records, and that he planned to release music with top artists Tyga and Tory Lanez in 2021. There’s no evidence of any of that. Shamoun did not reply to questions about the PPP loan or his claims about gold records and working with major artists. His website was taken offline after ProPublica reached out. Management for Tyga and Tory Lanez could not be reached for comment.

Shamoun’s musical career exists in a haze of dubious claims, but there’s overwhelming evidence connecting him to the Instagram verification scheme, which he denies all involvement with. Multiple former clients confirmed that he sold verification services, and Shamoun is also listed in Whois records as the owner of close to 200 web domains featuring the names of people who have dubious musician profiles created by the scheme. There’s djdrsixmusic.com for the plastic surgeon, as well as melodymoralesmusic.com, the website of Shamoun’s girlfriend. She recently lost her verification badge as part of Meta’s move against fake musical artists, and her account, @mell, is no longer active. Morales’ three songs were removed by Apple and her account was taken down by Spotify after ProPublica reached out. Her website was also taken down after a reporter contacted Shamoun. In a text message, she declined to comment.

Shamuon also owns the domain name djtylerrumor.com. His older brother Tyler Shamoun, a Detroit mortgage broker, was branded in paid articles and on Spotify and other platforms as DJ Rumor in a failed attempt to receive verification. Tyler Shamoun did not respond to emails or messages containing a detailed list of questions.

In text messages and phone calls, Shamoun kept citing one piece of evidence against his former partner: the fact that lawyers working for Meta sent Quinn a cease-and-desist letter in June. Shamoun said the lack of action by Meta against him showed he was not involved. “If it were true, I’d be in the same predicament Meta put the actual person in,” he said, referring to Quinn.

On Aug. 16, four days after Meta was contacted by ProPublica, the company sent Shamoun a cease-and-desist letter and banned him from its platforms for selling account verification services.

“As a result of our investigation, we’ve sent a cease-and-desist letter and removed related fraudulent verifications on our platform,” said the Meta spokesperson.

Days later, Shamoun messaged a prospective client with an offer: He could get their Instagram account verified for the low price of $15,000.

Do You Have a Tip for ProPublica? Help Us Do Journalism.

United Kingdom-based startup Clean Food Group has completed a £1.65 million (US$2 million) seed funding round that will bring the company one step closer to producing a viable yeast-based alternative to palm oil. The cultured (or lab-grown) alternative has the potential to reduce the detrimental environmental impact of palm-based ingredients that includes massive global deforestation and the resulting destruction of wildlife habitats for endangered species such as the orangutan, pygmy elephant, and Sumatran rhino.

The investment in Clean Food Group was led by Agronomics—which has also backed companies such as VitroLabs, a cultured leather startup that aims to take animals out of the leather-making process—holding a 35 percent interest in the company along with SEED Innovations Limited, a global food and beverage company, as well as venture capital investors. In addition, billionaire Jim Mellon has joined the board of Clean Food Group following the investment by Agronomics.

“With this funding round now successfully completed, we are not only well capitalized to complete the next stage of our corporate development, but are also well placed to take the next step on the path to bringing our palm oil alternative—an ingredient with the potential to solve substantial environmental, food security, health, and working environment challenges within the incumbent palm oil supply chain—to market,” Alex Neves, co-founder and CEO of Clean Food Group, said in a statement.

Why is palm oil so harmful? 

Palm oil—an industry that is estimated to be worth $65 billion—is used in a number of everyday products such as food, clothes, shampoo, cosmetics, and fuel and is associated with deforestation of rainforests from Costa Rica to Indonesia to make way for palm tree plantations, releasing carbon dioxide into the atmosphere and destroying habitats for people and endangered wild animals along the way. 

Peter Prokosch

This deforestation leaves the orangutan and thousands of other species without a home. Consequently, their ability to survive is greatly affected: The orangutans are isolated within small enclaves of the rainforests, unable to forage for food, and too close to humans. Additionally, the forest is often burnt after having been cleared which can start uncontrollable forest fires and destroy even more of the forest. For orangutans alone, it is estimated that between 1,000 to 5,000 are killed every year in palm oil concessions.

A sustainable palm oil alternative

Clean Food Group was founded in 2021 by Neves and Ed McDermott with the mission to solve the environmental crisis caused by the production of palm oil. The startup makes its yeast-based alternative using fermentation, a process that is similar to that of beer making. It ferments a proprietary natural yeast that contains oils, proteins, and other ingredients using food stocks that would otherwise go to waste in a sustainable and circular process. The startup then separates the ingredients and sells them for use in food and cosmetic products. 

Taking on the palm oil industry is no small feat. Currently, palm-based ingredients are used in nearly 50 percent of packaged products globally. To provide an alternative for such a massive market, Clean Food Group is relying on a combination of cutting-edge tech, strategic partnerships, and impact investment. Earlier this year, the startup acquired relevant intellectual property from the University of Bath, where the technology has been developed over the last eight years by Professor Chris Chuck and his team. Prior to the acquisition, more than $5 million was spent to develop the technology to the stage where it is ready for scale-up and commercialization.

Now with the intellectual property rights to the technology, the startup has initiated a two-year collaboration agreement with the University of Bath. Additionally, Chuck, the lead developer of the product, has joined the team as a technical advisor and leads a team of scientists at a dedicated Clean Food Group laboratory and pilot plant at the University of Bath.

Laurie Lapworth / University of Bath

“Our dependence on palm oil comes at a great environmental cost,” Chuck said in a statement. “We’ve worked over many years to create robust palm oil alternatives that give us a real chance to cut the impact of a range of products that until now have only been possible to produce with palm oil and the deforestation, pollution, and emissions that come with it.”

Clean Food Group is not the first company to attempt to provide a sustainable solution to palm oil. In 2019, startup C16 Biosciences developed a lab-grown alternative to palm oil also using yeast, which grows in tap water and feeds off a feedstock or carbon source to multiply. Given the wide use of palm oil in products, the company is concentrating its efforts to replace the use of palm oil in a small portion of the market, starting with the skincare and cosmetics industries. 

“Fermentation is a well-proven commercial process that has been used for centuries to convert raw materials into consumable commercial products consumed by billions of people every day,” C16’s website says. “We believe that brewing palm oil like beer is the best and most likely path to developing a truly sustainable palm oil alternative.”

For the latest vegan news, read:
Nestle Launches New Vegan Beef Made For NoMoo
Kourtney Kardashian and Travis Barker Reveal Their Favorite Vegan Dishes
Plant-Based Meat Is Healthier and More Sustainable Than Animal Meat

The carbon removal industry is reaching a critical mass. Not in terms of how much carbon is being removed from the atmosphere — that number is still trivially small compared to how much has been emitted over decades of intensive fossil fuel use. But there are now so many fledgling companies working on ways to make money managing carbon dioxide — by sucking it up, utilizing it, or storing it — that the industry is now undergoing a rite of passage: It is forming a trade association.

On Tuesday, 42 startups announced the launch of the Carbon Business Council, a nonprofit that aims to “create a seat at the policy table for early-stage companies focused on restoring the climate,” according to the group’s press release. 

The council’s first set of actions include releasing an “ethical oath” that companies can sign to signal their commitment to scaling up the industry responsibly, and urging policymakers to support the full diversity of methods of removing carbon from the atmosphere, most of which are still in relatively early stages of development.

“We feel like it’s too soon for the government to pick winners and losers about what pathway to removal is going to be most promising,” said Ben Rubin, the executive director and co-founder of the group. 

Scientists now conclude that we’ve dumped so much carbon into the atmosphere that cutting emissions — while urgent — will not on its own be enough to achieve international climate goals or avoid more extreme climate impacts than the ones we’re already experiencing. Actively drawing down carbon that’s already been released can serve to balance out ongoing greenhouse gas emissions that will be hard to cut, like those from agriculture and flying. Eventually, carbon removal could even hypothetically reverse warming.

Last year’s bipartisan infrastructure law contained $3.5 billion for demonstration projects of one particular pathway known as direct air capture, which usually refers to machines that suck carbon dioxide from the air. Some members of the Carbon Business Council are working on that approach, while others are working on methods that involve enhancing the natural uptake of carbon by plants, soils, minerals, or the ocean. The group also includes startups that are creating marketplaces where carbon removal companies can sell their services to polluters in the form of carbon offsets, and others that are developing products made out of the captured CO2 itself.

The council’s first policy move is endorsing a bill that was introduced in the Senate last month called the CREST Act, which would create new federal research programs to examine all of the different scientific pathways for carbon removal. It also would provide funding to startups to measure how much carbon they are actually removing — an expensive and complicated endeavor, in many cases — and require the federal government to begin paying companies to remove carbon.

Deploying carbon removal at a meaningful scale will come with untold trade-offs. It can be energy intensive or land intensive, pose ecological risks, or exploit communities. Many in the climate movement are skeptical that it should be given any resources at all. In response, the Carbon Business Council has created what it is calling a “first of its kind standard for the responsible growth” of the industry. Rubin likened it to the Hippocratic oath, a sort of do-no-harm pledge that companies can sign — though members are not required to do so. So far, 25 have. 

The statement is brief, just 15 sentences, and commits signatories to abstract ideals like acting with humility and honesty, being guided by science, and recognizing the value of “including voices from all backgrounds in conversations” about carbon removal.

Rishabh Varshney, the CEO of a member company called Sequestr, said that to him, responsible growth means making sure people on the ground benefit the most from carbon removal projects. Sequestr helps communities and tribes create carbon offset projects involving forests and agriculture, and then sells the offsets on its own marketplace. “We’ve heard a lot of stories in the carbon market, especially where a landowner is getting ten cents on their dollar for something that gets sold at full price,” he said. “We want to make sure that this is a bottom-up industry first and foremost.”

The oath also fends off a common attack launched at the nascent but fast-growing industry. Critics contend that pouring too much money and attention into removing carbon from the atmosphere will detract from efforts to get off fossil fuels and stop emitting in the first place. The oath promises to “support efforts to reduce climate pollution.” 

But the statement avoids what some experts see as a more salient question for the industry — how much reduction, and how much removal? If the world over-relies on the promise of some massive future deployment of carbon removal, we could be dooming the whole mission of halting climate change. In a recent op-ed in MIT Technology Review, two carbon removal experts wrote that if governments and businesses move ahead thinking they can reduce emissions by only 50 percent and offset the rest with carbon removal, “that would necessitate sucking up and storing away carbon dioxide at levels that are almost certainly technically, environmentally, or economically infeasible, or possibly all of the above.”

Emily Cox, a research associate at the University of Oxford studying responsible innovation in the carbon removal field, wondered whether the diverse group of companies in the Carbon Business Council would interpret the statements in the oath the same way. “Even the term ‘carbon management,’” she said — “what that actually means in practice could be something that’s really amazing for the climate. It could also be the opposite.”

To Cox, there is an inherent tension between some of the underlying interests of these companies. For example, an active debate in the field right now is how long carbon should remain out of the atmosphere for it to be considered “removed.” The carbon sequestered by trees and soils could be re-emitted in a matter of decades due to disturbances like fire or disease. Some experts argue that short-term carbon removal just kicks the can down the road, and that carbon must be removed more permanently to truly offset ongoing emissions. The Carbon Business Council includes companies working on shorter-term solutions as well as more durable forms of carbon storage. 

It’s notable that a few prominent carbon removal companies are absent from the group’s member list, including the direct air capture companies Climeworks and Heirloom and the bio-oil company Charm Industrial. All of them are focused on approaches that would sequester the removed carbon for thousands of years. The companies did not respond to a request for comment, and Rubin declined to comment on their absence. 

Danny Cullenward, the policy director for Carbon Plan, a prominent watchdog for the carbon removal industry, said it’s hard to disagree with anything in the oath — “values, data, rigor, that kind of stuff.” But it’s hard to actually apply it to the conflicts that are emerging about how to scale carbon removal, like the questions of how much removal will be needed, how permanent removal should be, or which potential impacts on communities and the environment are acceptable. “When it comes to the debates people are having, this is at a higher level, and it doesn’t really commit people one way or the other to a particular course of action,” he said.

Rubin acknowledged this. “The oath is one part of a larger process,” he said. “Responsible growth will ultimately be talked about and developed by government policies and by regulations.

“As the industry grows, the oath will hopefully continue to be a benchmark or guidepost that we can come back to,” Rubin added.

Editor’s note: Climeworks is an advertiser with Grist. Advertisers have no role in Grist’s editorial decisions.

This story was originally published by Grist with the headline Carbon removal trade group launches with ‘Hippocratic oath’ for the industry on Jul 19, 2022.

This post was originally published on Grist.

Abusive parents searching for kids who have fled to shelters. Governments targeting the sons and daughters of political dissidents. Pedophiles stalking the victims they encounter in illicit child sexual abuse material.

The online facial recognition search engine PimEyes allows anyone to search for images of children scraped from across the internet, raising a host of alarming possible uses, an Intercept investigation has found.

Often called the Google of facial recognition, PimEyes search results include images that the site labels as “potentially explicit,” which could lead to further exploitation of children at a time when the dark web has sparked an explosion of images of abuse.

“There are privacy issues raised by the use of facial recognition technology writ large,” said Jeramie Scott, director of the Surveillance Oversight Project at the Electronic Privacy Information Center. “But it’s particularly dangerous when we’re talking about children, when someone may use that to identify a child and to track them down.”

Over the past few years, several child victim advocacy groups have pushed for police use of surveillance technologies to fight trafficking, arguing that facial recognition can help authorities locate victims. One child abuse prevention nonprofit, Ashton Kutcher and Demi Moore’s Thorn, has even developed its own facial recognition tool. But searches on PimEyes for 30 AI-generated children’s faces yielded dozens of pages of results, showing how easily those same tools can be turned against the people they’re designed to help.

While The Intercept searched for fake faces due to privacy concerns, the results contained many images of actual children pulled from a wide range of sources, including charity groups and educational sites. PimEyes previously came under fire for including photos scraped from major social media platforms. It no longer includes those images in search results. Instead, searches churn up a welter of images that feel plucked from the depths of the internet. Some come from personal websites that parents created anonymously or semi-anonymously to feature photos of their children, likely not anticipating that they could one day be pulled up by strangers taking snapshots of kids on the street.

One search for an AI-generated child turned up images of a real boy in Delaware, where a photographer had taken portraits of his family on a sunny spring day. When she posted the portraits in her online portfolio, the photographer omitted the boy’s name and other identifying details. But a determined person might theoretically be able to find such information. (The photographer did not respond to requests to comment for this article.)

Another search turned up a girl displaying a craft project at an after-school program in Kyiv, Ukraine, in a photo taken just before the war. A second page on the same website showed the girl at home this spring; by then, Kyiv was under siege, the program had gone remote, and teachers were assigning kids craft projects to complete from their kitchen tables.

A third search turned up a photo of a 14-year-old British boy that had been featured in a video about the U.K. educational system. The commentator gave the boy’s first name and details about the school he attended.

Still another search turned up a photo of a toddler from an American home-schooling blog, where the girl’s mother had revealed her first name and, when the family was traveling, rough whereabouts.

PimEyes is the brainchild of two Polish developers who created the site in 2017 on a whim. It reportedly passed through the hands of an anonymous owner who moved the headquarters to the Seychelles and then in December 2021 was purchased by Georgian international relations scholar Giorgi Gobronidze, who had met the site’s creators while lecturing in Poland.

In a wide-ranging video interview that stretched to nearly two hours, Gobronidze offered a vague and sometimes contradictory account of the site’s privacy protections.

He said that PimEyes was working to develop better safeguards for children, though he offered varying responses when asked what those might entail. “It’s a task that was given already to our technical group, and they have to bring me a solution,” he said. “I gave them several options.”

At the same time, he dismissed the argument that parents who post anonymous photos of their children have any expectation of privacy. “Parents should be more responsible,” he said. “I have never posted a photo of my child on social media or on a public website.”

“Designed for Stalkers”

On its website, PimEyes maintains that people should only use the tool to search for their own faces, claiming that the service is “not intended for the surveillance of others and is not designed for that purpose.” But the company offers subscriptions that allow people to perform dozens of unique searches a day; the least expensive package, at $29.99 a month, offers 25 daily searches. People who shell out for the premium service can set alerts for up to 500 different images or combinations of images, so that they are notified when a particular face shows up on a new site.

Gobronidze claimed that many of PimEyes’s subscribers are women and girls searching for revenge porn images of themselves, and that the site allows multiple searches so that such users can get more robust results. “With one photo, you can get one set of results, and with another photo you can get a totally different set of results, because the index combination is different on every photo,” he said. Sometimes, he added, people find new illicit images of themselves and need to set additional alerts to search for those images. He acknowledged that 500 unique alerts is a lot, though he said that, as of Thursday, 97.7 percent of PimEyes subscribers had a lighter account.

Following criticism, the company pivoted to claiming that the search engine was a privacy tool.

PimEyes’s previous owners marketed it as a way to pry into celebrities’ lives, the German digital rights site Netzpolitik reported in 2020. Following criticism, the company pivoted to claiming that the search engine was a privacy tool. Gobronidze said that fraught features were being overhauled under his ownership. “Previously, I can say that PimEyes was tailor-designed for stalkers, [in that] it used to crawl social media,” he said. “Once you dropped a photo, you could find the social media profiles for everyone. Now it is limited only to public searches.”

But many people clearly do not see PimEyes as an aid to privacy. The site has already been used to identify adults in a wide variety of cases, from so-called sedition hunters working to find perpetrators after the January 6 insurrection, to users of the notorious site 4chan seeking to harass women.

Nor do PimEyes’s marketing materials suggest much concern for privacy or ethics. In a version of the “people kill people” argument favored by the U.S. gun lobby, a blog post on the site blithely alludes to its many uses: “PimEyes just provides a tool, and the user is obliged to use the tool with responsibility. Everyone can buy a hammer, and everyone can either craft with this tool, or kill.”

“These things should only be instrumentalized with the clear and knowledgeable consent of users,” said Daly Barnett, a staff technologist at the Electronic Frontier Foundation. “This is just another example of the large overarching problem within technology, surveillance-built or not. There isn’t privacy built from the get-go with it, and users have to opt out of having their privacy compromised.”

“We Do Not Want to Be a Monster Machine”

Alarmingly, search results for AI-generated kids also include images that PimEyes labels as “potentially explicit.” The backgrounds in the labeled images are blurred, and since clicking through to the source URLs could contribute to the exploitation of children, The Intercept could not confirm whether they are, in fact, explicit. Gobronidze said that the labels are assigned in part based on images’ source URLs, and that often the photos are harmless. When PimEyes representatives do run across child sexual abuse images, he said, representatives report it to law enforcement.

But one example he gave shows how easily the site can be used to unearth abusive or illegal content. A 16-year-old girl had used her parents’ credit card to open an account, Gobronidze said. She soon found revenge porn videos that had been uploaded by an ex-boyfriend — images that likely fit the legal definition of child pornography. (He said PimEyes issued takedown notices for the websites and advised the girl to talk with authorities, her parents, and psychologists.)

Gobronidze was vague on how he might limit abuse of children on the site. Subscribing requires a credit card, PayPal, or Amazon Pay account, and users upload their IDs only when asking PimEyes to perform takedown notices on their behalf. By design, he said, the search engine only seeks matches in photos and does not guess at age, gender, race, or ethnicity. “We do not want to be a monster machine,” he said, dubbing a more heavy-handed approach “Big Brother.” But at another point in the interview, he said he was planning to exclude images of children from search results. Still later, he said that his technical team was figuring out how to balance these two conflicting goals.

PimEyes flags people who “systematically” use the engine to search for children’s faces, he said. Users who plug in one or two faces of children are typically assumed to be family members. If a PimEyes representative gets suspicious, he said, they might ask a subscriber for a document like a birth certificate that would prove that a user is a parent.

When asked how a birth certificate would rule out abuse or stalking by noncustodial parents, Gobronidze said that PimEyes might instead request a signed form, similar to what parents and legal guardians provide in some countries when crossing borders with a child, to show they have any other parent’s consent. In a later email, he said that PimEyes had twice asked for “documents + verbal explanation” for people who uploaded images of children, and that the site had subsequently banned one of the accounts.

“The fact that PimEyes doesn’t have safeguards in place for children and apparently is not sure how to provide safeguards for children only underlines the risks of this kind of facial recognition service,” said Scott, of EPIC. “Participating in public, whether online or offline, should not mean subjecting yourself to privacy-invasive services like PimEyes.”

The inclusion of children’s faces in PimEyes search results underscores just how fraught the facial recognition landscape has become.

The inclusion of children’s faces in PimEyes search results underscores just how fraught the facial recognition landscape has become. For years, victim advocacy groups have pushed for expanded use of the technology by law enforcement. The Kutcher-Moore nonprofit, Thorn, has developed a facial recognition tool called Spotlight that it provides to investigators working on sex trafficking cases, as well as to the National Center for Missing and Exploited Children. In a recent report, the center said that in 2021, Spotlight helped it identify over 400 missing children in online sex trafficking advertisements.

Commercial providers of facial recognition have also gotten into trafficking prevention. The controversial facial recognition company Clearview AI sells its tools to police for identifying child victims.

But those same tools can also be used to target the vulnerable. Clearview AI promoted the use of its database for child trafficking after being sued by the American Civil Liberties Union for endangering survivors of domestic violence and undocumented immigrants, among others. Prostasia Foundation, a child protection group that supports sex workers rights and internet freedom, contends that an earlier Thorn tool sometimes flagged images of adults, leading to the arrest of sex workers.

This tension is even more extreme with PimEyes, which has virtually no guardrails and smashes long-standing expectations of privacy for both adults and children.

Gobronidze said that PimEyes had talked to Thorn about using its tool Safer to detect child sexual abuse material using image hashing technology — a potentially odd relationship given that PimEyes makes images of children searchable to the general public, while Thorn aims to protect children from stalkers and abusers.

“There has been one exploratory call between our Safer team and PimEyes to show how Safer helps platforms detect, report and remove CSAM,” a Thorn spokesperson said, using the acronym for child sexual abuse material. “No partnership materialized after that single call and they are not users of Safer or any tools built by Thorn.”

When asked about concerns about its facial recognition tool, Thorn sent a statement through a spokesperson. “Spotlight is a highly targeted tool that was built specifically to identify child victims of sex trafficking and is only available to law enforcement officers who investigate child sex trafficking.”

In the United States, PimEyes could run up against a 1998 law requiring the Federal Trade Commission to protect children’s online privacy. But so far, U.S. regulators have homed in on sites that store images or information, said Emma Llansó, director of the Free Expression Project at the Center for Democracy and Technology. PimEyes crawls images hosted on other sites. “PimEyes is just scraping whatever they can get their hands on on the web and isn’t making promises to users about what it will and won’t do with that data,” Llansó said. “So it’s something of a gray area.”

Gobronidze is keenly aware of the distinction. “We don’t store any photos,” he claimed. “We don’t have any.”

That is not entirely true. PimEyes’s privacy policy holds that for unregistered users — anyone who uses the site without a paid account — it retains facial images, along with the “fingerprint” of a face, for 48 hours and that data from the photos indexed in results is stored for two years. A sample PimEyes search showed thumbnail images of faces — photos returned in search queries that the site has edited to blur their backgrounds. A network traffic analysis showed that those photos are hosted on a PimEyes subdomain called “collectors.”

In an email, Gobronidze said he had not previously heard or read about that subdomain and was “intrigued” to learn of it. He noted that he had forwarded the results of The Intercept’s analysis to PimEyes’s tech and data security units, adding that he could not “disclose [the] full technological cycle” because it is proprietary.

Scott, of EPIC, would rather not wait around for courts and regulators to consider the storage question. “Congress needs to act to not only protect our children, but all of us from the dangers of facial recognition technology,” he said. “Services like this should be banned. That’s how you should regulate it.”

The post Facial Recognition Search Engine Pulls Up “Potentially Explicit” Photos of Kids appeared first on The Intercept.

This post was originally published on The Intercept.

by Charles Ornstein

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Following the Supreme Court’s decision overturning Roe v. Wade, advocates for privacy and reproductive health have expressed fears that data from period-tracking apps could be used to find people who’ve had abortions.

They have a point. The Health Insurance Portability and Accountability Act, the federal patient privacy law known as HIPAA, does not apply to most apps that track menstrual cycles, just as it doesn’t apply to many health care apps and at-home test kits.

In 2015, ProPublica reported how HIPAA, passed in 1996, has not kept up with changes in technology and does not cover at-home paternity tests, fitness trackers or health apps.

The story featured a woman who purchased an at-home paternity test at a local pharmacy and went online to get the results. A part of the lab’s website address caught her attention as a cybersecurity consultant. When she tweaked the URL slightly, a long list of test results of some 6,000 other people appeared.

She complained on Twitter and the site was taken down. But when she alerted the Office for Civil Rights within the U.S. Department of Health and Human Services, which oversees HIPAA compliance, officials told her they couldn’t do anything about it. That’s because HIPAA only covers patient information kept by health providers, insurers and data clearinghouses, as well as their business partners.

Deven McGraw is the former deputy director for health information privacy at the HHS Office for Civil Rights. She said the decision overturning Roe, called Dobbs v. Jackson Women’s Health Organization, should spark a broader conversation about the limits of HIPAA.

“All of a sudden, people are waking up to the idea that there’s a lot of sensitive data being collected outside of HIPAA and asking, ‘What are we going to do?’” said McGraw, who is now the lead for data stewardship and data sharing at Invitae, a medical genetics company. “It’s been that way for a while, but now it’s in sharper relief.”

McGraw noted how that’s not just the case for period-tracking apps but also some apps that store COVID-19 vaccine records. Because Congress wrote HIPAA, lawmakers would have to update it to cover those cases. “Our health data protections are badly out of date,” she said. “But the agencies can’t fix this. This is on Congress.”

Consumer Reports’ digital lab evaluated eight period-tracking apps this spring and found that four allowed third-party tracking by companies other than the maker of the app. Four apps stored data remotely, not just on the user’s device. That makes the information potentially subject to a data breach or a subpoena from law enforcement agencies, though one of the companies surveyed by Consumer Reports has said it would shut down rather than turn over users’ data.

In a press release last week, HHS sought to allay worries with some advice that sounds reassuring.

“According to recent reports, many patients are concerned that period trackers and other health information apps on smartphones may threaten their right to privacy by disclosing geolocation data which may be misused by those seeking to deny care,” HHS said in the release.

The document quoted HHS Secretary Xavier Becerra about the protections provided by HIPAA: “HHS stands with patients and providers in protecting HIPAA privacy rights and reproductive health care information,” Becerra said. He urged anyone who thinks their privacy rights have been violated to file a complaint with the Office for Civil Rights.

The release later acknowledged that, in most cases, HIPAA rules do not protect the privacy or security of individuals’ health information when they access or store it on personal cellphones or tablets. It offered guidance on steps people can take to protect their information.

Since the court’s decision overturning Roe, some period-tracking apps have taken steps to minimize the risk of personal information being shared. One such company called Flo said it is developing an “anonymous mode” that would not require users to provide their name or email address.

“Flo does not share or sell any health data with any other company, but wanted to take this additional step to reassure users who are living in states affected by an abortion ban,” the company said in a press release. “It is important to note that once this mode is activated, users will no longer be able to recover data when the device is lost, changed, or stolen and there may be limitations to using the app’s full personalization benefits. This is why Flo is offering Anonymous Mode as an option for concerned users instead of activating it by default.”

In a statement after the Supreme Court decision, the digital civil liberties group Electronic Frontier Foundation said consumers should pay attention to “privacy settings on the services they use, turn off location services on apps that don’t need them, and use encrypted messaging services.

“Companies should protect users by allowing anonymous access, stopping behavioral tracking, strengthening data deletion policies, encrypting data in transit, enabling end-to-end message encryption by default, preventing location tracking, and ensuring that users get notice when their data is being sought,” the EFF statement said. “And state and federal policymakers must pass meaningful privacy legislation. All of these steps are needed to protect privacy, and all are long overdue.”

This post was originally published on Articles and Investigations – ProPublica.