College students used Meta’s smart glasses to dox people in real time

Two Harvard students have created an eerie demo of how smart glasses can use facial recognition tech to instantly dox people’s identities, phone numbers, and addresses. The most unsettling part is the demo uses current, widely available technology like the Ray-Ban Meta smart glasses and public databases.

AnhPhu Nguyen, one of the two students, posted a video showcasing the tech in action that was then picked up by 404 Media. Dubbed I-XRAY, the tech works by using the Meta smart glasses’ ability to livestream video to Instagram. A computer program then monitors that stream and uses AI to identify faces. Those photos are then fed into public databases to find names, addresses, phone numbers, and even relatives. That information is then fed back through a phone app.

In the demo, you can see Nguyen and Caine Ardayfio, the other student behind the project, use the glasses to identify several classmates, their addresses, and names of relatives in real time. Perhaps more chilling, Nguyen and Ardayfio are also shown chatting up complete strangers on public transit, pretending as if they know them based on information gleaned from the tech.

Facial recognition tech has been frighteningly accurate for a while now, and I-XRAY is largely just chaining together a bunch of existing technologies. It relies in part on PimEyes, which The New York Times described in 2022 as an “alarmingly accurate” face search engine that “anyone can use.” Concerns around this tech have been heightened since it came out that Clearview AI was using facial recognition to help law enforcement. What’s new about Nguyen and Ardayfio’s demo is how the tech is being paired with a consumer gadget that is discreet and easy to access.

“The purpose of building this tool is not for misuse, and we are not releasing it,” Nguyen and Ardafiyo write in a document explaining the project. Instead, the students say their goal is to raise awareness that all this isn’t some dystopian future — it’s all possible now with existing technology. In particular, they point out that I-XRAY is unique because large language models (LLMs) enable it to work automatically, drawing relationships between names and photos from vast data sources.

Privacy has always been a major concern with smart glasses. Google Glass originally failed due in part to public backlash at being recorded without consent in public spaces. However, it’s also true that in the decade since, people have become more accustomed to being filmed due to the rise of smartphones, vloggers, and TikTok. What’s unsettling about modern smart glasses, however, is that they don’t stand out quite as much as Google Glass did.

The Ray-Ban Meta glasses used in this demo look just like any other pair of Ray-Bans. While that’s critical for smart glasses adoption, it also makes it harder for people to clock when someone might be wearing a camera on their face. The Meta glasses do include a privacy light that automatically turns on whenever you’re recording video. However, in our testing, we found that the light is hard to notice when you’re outside in bright lighting and that people often don’t notice when you’re filming — especially in crowded, public spaces.

For its part, Meta cautions users against being glassholes in its privacy policy for the Ray-Bans. It urges users to “respect people’s preferences” and to clearly gesture or use voice controls when capturing video, livestreaming, or taking photos. However, the reality is people may also choose not to follow wearable etiquette, regardless of what Meta says. The Verge reached out for comment. Meta spokesperson Dave Arnold responded to our email by block quoting its terms of service, which reiterate the same guidance.

This is a sobering reminder of how smart glasses can be abused, but there are some steps people can take to protect themselves. In their document, Nguyen and Ardafiyo list reverse face search and people search databases that allow you to opt out. Even so, keep in mind it’s nigh impossible to fully delete your online presence — you can only make your information less available.

Update, October 2nd: Added response from Meta.