 Good morning. I'm Attorney General T.J. Dunham and joined with me today is my Chief of Staff, Charity Clark, Chief of my Public Protection Division, Chris Curtis, Assistant Attorney Generals Jill Abrams, Ryan Krieger and Justin Colbert. We are here today because the state of Vermont just filed a lawsuit to protect Vermonters privacy. We filed a lawsuit against Clearview AI. Clearview AI is a company that has collected billions of photos off the internet by screen scraping, applying artificial intelligence, technology, biometric data to these photos and selling them, including photos of Vermonters and their children without Vermonters consent. We believe this is a violation of Vermonters privacy. We've sued today. We've also filed a motion for preliminary injection, asking the court to enjoin Clearview from stop collecting Vermonters photos, applying this technology, essentially mapping their faces, including Vermont's children and stop selling it without Vermonters consent. We have a proud tradition of protecting Vermonters privacy in this state. It is a value since the founding of this state. And the right to privacy, the right to be free, the right to be anonymous, the right to walk our streets, the right to walk down Church Street, the right to assemble these fundamental freedoms that we hold true as Americans are put in jeopardy by this technology without people's consent that has created a constant state of surveillance by this company, by collecting this information, by probing Vermonters, by taking their photos off the internet, by mapping their faces, including children's and selling it without Vermonters consent. We say today that's against Vermont's law. That violates the Vermont's consumer protection statute. It's a violation of our data broker registry. And we say no more. And I want to be clear, as a parent, as a parent, and I think I speak for all parents in this state of Vermont, you want to take something from our kids, you better ask us or you're going to hear from us. And today this company has heard from us through the Attorney General's office to stop violating Vermont's children's rights. We're asking the court to put an end to this practice. I want to be clear about what biometric data is. It's a unique identifier to a certain somebody's identity. Think about somebody's fingerprint. Think about DNA. That's biometric data. You have to get a court order to get somebody's fingerprint or DNA. And this company is using this technology to map people's faces, to apply that biometric data, and then to sell it to companies to make a profit without Vermonters consent. When you talk about surveillance, we think about law enforcement. And I understand that. But we have guardrails and safeguards, namely the Fourth Amendment, when we talk about surveillance. What this company has done, what this technology does without those safeguards, without those guardrails, is to create a surveillance economy. Vermonters have rights. We need protections. We need guardrails. We need to protect people's privacy. So with that, let me turn it over to my Chief of my Public Protection Division, Chris Curtis. Again, I want to thank his team, Ryan Krieger, Justin Colbert, and Jill Ravens for their great work to talk more about this lawsuit and our motion for a preliminary injunction, which has been filed earlier today. Chris. Thank you, Attorney General Donovan. Again, my name is Christopher Curtis. I'm the Chief of the Public Protection Division at the Office of the Attorney General. And I want to thank the general for assigning us this task to be stewards of Vermonters' privacy interests in the context of our Consumer Protection Act. That act protects us against unfair or deceptive acts or practices in commerce. This company has gone out violating terms of service and taken photographs unbeknownst to the general public, amassed a multi-billion photograph database without anyone's consent, and is now using that to sell it to the highest bidder. That's just wrong, as the Attorney General made clear. And I couldn't be more proud of our team, our Consumer Protection Unit Director, Jill Abrams, Assistant Attorneys General Ryan Krieger and Justin Colbert for pulling together this complaint and request to the court to stop this practice. Imagine, just imagine photographs from all walks of life, your home, your workplace, out in the community that you had no expectation. Not only that somebody would have access to and compile and be putting out there for sale unbeknownst to you, but that actually pulls them and pulls them all together to create a unique dossier of all of your activities from all walks of life. It's not just wrong, it's frankly offensive. Particularly when you think about children that may be swept into this database with unique biometric data that can follow them for the rest of their lives. It's wrong, we're calling for this practice to end, and with that I want to turn it over to Assistant Attorney General Krieger who can talk a little bit more about the specifics of the complaint and the request for preliminary injunction. I'm Ryan Krieger, Assistant Attorney General. So this case is about privacy. It is about how you cannot have privacy without a certain degree of anonymity, the ability to go about your day without people automatically being able to identify you. Now you may think when you walk down the street well you might be identified, and that's fine when you walk around your own neighborhood then people who know you might know who you are. But if you go to Montreal or New York City no one's going to know who you are. Ask any celebrity and they will tell you there is a big difference between being able to go out to lunch and not being identified and being able to be identified anywhere that you go. I think that this lawsuit is going to confront a lot of myths that have arisen around privacy. Like the notion that privacy is dead, that our data is already out there everywhere, and so what does it matter? That's a myth. Our information isn't all out there. The folks who want to take all of our data want us to think that there's no sense in trying to protect our privacy anymore. A myth that once you put a photo out on the internet you lose all rights to anything that happens with that photo. If you post a photo on Facebook and you say it's public, you are consenting to make that photo public, you can remove consent. That's a fundamental aspect of privacy. You can remove consent and say no I want that to be private again. Just because you put a photo on Facebook does not mean that anyone can come and download it and apply facial recognition to it and share it with anybody or collect all of your photos together from across the internet. So in our complaint we allege that that is basically what Clearview has done. Clearview has used screen scraping technology which is a technology where you basically go on a website and you just collect all of the information. You download it all at once. Many websites like Facebook, Google, YouTube, LinkedIn, they have clear policies saying you're not allowed to do that and when you upload your photo to these websites you expect other people to interact with those websites in that way. Not that they'll just come in and download all of the information all at once which is what this company has done. You certainly don't expect that they are going to download all the information at once and then apply facial recognition technology to them and share that information with anybody who wants it or sell that information with anybody who wants it. The critical aspect of biometrics which is creating an identifier about you from your physical being or from your behavioral traits like the way you walk or the way you write or the way you look, the thing about biometrics is you can't change that about yourself. If you lose your password or your ID you can get a new one issued. You haven't just given up your privacy forever but once someone has mapped your face it's in a database forever. Once someone has mapped a child's face that child is in that database forever and can't be removed from it. So it's this permanent aspect. You can't change your genes, you can't change your fingerprints, you can't change your facial recognition, absent what putting on a mask every time you go out in public, something like that. So in our preliminary injunction motion what we have asked the court to do is to force or demand that that Clearview AI remove all Vermonters from its database and especially the children and to stop collecting Vermonters and Vermont children using screen scraping from the internet and that's that's all we want. We said you did not consent to have us put in this database and so we want you to remove us from this database. That is the relief that we are requesting from the court and we are expressing to the court that this is urgent because they are continuing to share our information and in addition by putting all this information in one place you are creating a threat that someone will come along and try to steal that information that there will be a data breach and there has already been a data breach with Clearview AI. There was a data breach two weeks ago in which their entire client list was stolen. So clearly this is not a company that has the best data security available and we see all the time Equifax was a major data breach in which we got more complaints in our office than in a shorter time than we had ever received before over 700 complaints. Vermonters care when companies collect their data and then lose their data and we want to make sure that that does not happen in this case which is why we are moving so quickly and with such urgency. Thank you. I just want to say one last thing that this is truly about consent. Vermonters have rights, Vermonters have a right to know that this type of information particularly about their kids is being collected and sold. Vermonters have a right to know and Vermonters have a right to privacy and to say no if they choose. That's why we're asking the court to stop this and I want to say one last thing about this type of technology and biometric data. You can't see folks or recognize them by the naked eye but this technology allows you to be identified where you seek to be anonymous, where you seek to be private. That's a fundamental freedom of this state of this country and we are in a brave new world and involved in a digital economy. I understand that but the right to privacy is timeless and it's not going away and we need to draw the line and hold the line here in Vermont to say that privacy matters in the online world. That's what we've asked the court to do today to simply say that privacy still matters and people still have a right to privacy particularly to their children, particularly to the essence of who they are. That's why we filed this lawsuit, that's why we filed a preliminary injunction today asking the court to stop and enjoy this company from collecting Vermonters information and selling it. Happy to answer questions. When did the attorney, when did you learn of this company and the first person? About a month ago I think. I know there's some articles obviously in the New York Times and I should have said this earlier. You know we passed this data broker law two years ago which are third-party data brokers that you got to register with the state of Vermont. Third-party data brokers, you don't have a direct relationship with a consumer. You're buying and selling people's data. It's a big business. Vermonters have a right to know about that too in my opinion. That's why we said you got to have a registry and in that you got to disclose. Are you collecting information about kids? They registered. I'll be a little bit late if I have that right and disclose that they were collecting this information about kids. So these are the protections. It was a sequence of events to answer your questions. Certainly I think the New York Times had some articles. We got some questions. The data broker registry, the disclosure about children and this first started really from a law enforcement perspective. Whether or not Vermont law enforcement was utilizing this type of technology, I can tell you that to best of my knowledge, Vermont law enforcement is not using this technology. I can tell you specifically that Vermont State Police is not using this technology and I think there's issues with that in law enforcement. But as Mr. Krieger said, this isn't just law enforcement. We know from the data breach that this is going everywhere. This product is being sold to businesses, to universities and the fact of the matter is Vermonters can't just be swept up in this without their consent. People have a right to know. That's why we sued. Scream scraping. Scream scraping. How do they do that? I mean, where do they go to get the info? Are they going to like... That's a tech question, Pat. So let me get Ryan Krieger and answer that. Yeah. I mean, I'm curious. Are they going to Facebook pages? Are they going to newspaper pages? I mean, where do they collect all this from? As far as we understand right now, the collection is fairly indiscriminate. They've collected from many... It's been reported millions of websites. We have a strong belief that YouTube, Google, Venmo, LinkedIn, Facebook were scraped partly because they've sent cease and desist letters to Clearview saying, stop violating our terms of service. And basically, screen scraping is when you create a computer program, a script, an automated process to just go out, access the website, and then just download everything on the website, which these companies have terms of service that explicitly say you may not use bots to do what you are doing. And they violated those terms of service. So is Vermont's new law the data law that went into effect, the data broker law? Is this the only law across the country that holds a chance of being able to bring these guys to court to stop them? So the data broker law had two key elements for this case. One is it created this registry, which required these third party data brokers who otherwise you would have no idea who they are or that they're collecting your data to register in Vermont so that they have to come into the sunlight. And California actually in January of this year passed its own data broker registry modeled on ours. It has another aspect of it which has a specific prohibition against fraudulent acquisition of data. It prohibits fraudulent acquisition of data and acquiring data in order to engage in stalking, harassing, discrimination, other acts like that. We have alleged in our complaint that their screen scraping constitutes fraudulent acquisition of data. As far as I know, I don't think any other states have that specific law. That's not the law we're entirely basing our complaint on. We're also saying they're engaging in unfair acts, which all 50 states have laws that prohibit unfair and deceptive acts. But we are the only state that has asserted this particular claim. And I think it's in part because we have this history with the data broker registry with this fraudulent acquisition law. And we've been kind of laying the groundwork for being able to protect consumers' privacy for quite some time in this area. Now, I think T.J. mentioned that they have registered. They are an out-of-state company though, right? Correct. Law enforcement, Vermont are using this. Do you think it's a tool that law enforcement should be using? I think there's going to be safeguards. And I think, you know, the New Jersey attorney general essentially put out a memo directing all New Jersey law enforcement to stop using this type of technology until there's protections and guard rails in place. And, you know, you talk about it in the criminal justice realm, the fourth amendment is the guard rail. In the consumer protection realm, we don't have those guard rails. We have the consumer protection law. But if you don't know about it, this has been going on. So I think right now, we have had a conversation with Colonel Birmingham and Vermont State Police. Unequivocally, they're not using it to the best of my knowledge. No other law enforcement agency in the state of Vermont is using it. If they are, I think I'd have concerns about that. Do you think that the, I mean, my understanding from what I've read about Clearview's technology is that what the state is asking for in terms of removing Vermonters from their database, even opting out is not really maybe even possible with the way their software is built. Do you believe that is, that's even a possibility that they could do that? And if not, what is the remedy then? That's not our problem that they don't have the technology. That's the harm to Vermonters, that they've collected it, they've mapped people, and now they're selling these images of Vermont kids without parents' consent. And then they're going to say, well, we don't have the technology too bad. That's why we're going to court saying stop this. That's their burden. That's a question for the court to answer. But I've heard the same thing, and that's a question that's going to be answered here in the state of Vermont in this courthouse. Do you think there's a possibility other states might join your lawsuit because you said it's not entirely involving the Vermont Stat of Broker law? Look, I can't speculate what other states are going to do. I think Vermont is unique in our history and tradition of privacy. That is a value that I think we hold dear in this state. It is in our constitution. We are a state that is, I think, we believe in letting people live their lives and respecting people's privacy and letting people make their own decisions. And in this new online world that we are fully engaged in, we have to set a marker saying privacy still matters. And there's got to be some guardrails put in place. There's got to be protections. And the fundamental question that we're going to be confronted with, not just on this case, but in many cases going forward is this. Has technology outpaced the law? That is a legitimate question. And are our laws written in some cases hundreds of years ago, in some cases two years ago, going to be flexible enough to confront this challenge because the future of consumer protection is online because we are engaged in the digital global economy. And this is a commodity that they're using, people's data. Well, it's exactly that. It is people's data. People own it, in my opinion. Particularly our kids. People have a right to say, no, you can't do this. People have a right to be informed and people have a right to say, you can't do this. You can't take this information from my kids and sell it to a third party without my consent. My understanding is a clear view was not registered in Vermont State of America Registry when the New York Times brought them public attention. Is that correct? And if so, do you know when they registered? So I believe that they registered on January 14th. The article came out the 18th. So I think just ahead of the article, they did register. And we said late because we believe they were doing business last year as well. And they did not apply last year. They did not register last year. So it's not a result of any outreach? That is correct. Yeah. So your complaints against a clear view? Clear view. It's public decor. They've already gotten a lot of this data. How is there any way of stopping where that go the proliferation of that data and what companies already have bought data from them and to sort of pull that pull that back? That's a great question. And I mean, that's those are the questions that need to be answered here. And we'll be addressed in the core is what is the technology available to stop this practice to stop the collection to stop the selling. And it has been sold what what recourse exists to protect from others. Those are all good questions. Those are all questions that need to be answered in the court. And here's the bottom line. The court is the appropriate place for this. Because if you're going to engage in the marketplace absent these protections, you're going to hear from folks like me saying, wait a minute, as a parent, I didn't know about this. I didn't give you permission and I don't agree with it. And now you have to answer my questions, not only as a consumer, but in this case, as the attorney general for the state of Vermont. Are there other companies that use the collect biometric data like this that are registered? I'm sure there are other companies that collect biometric data. We know that. I mean, think about your thumbprint to get into your phone. Sure. The issue is consent and selling it without consent. But is the law is the data broker law doing kind of its job? I mean, if there are other companies operating that you don't know about, or there are ones operating that are registered that are doing this and you're not able to enforce them, it sort of sounds like clear UAI came more to your attention after the New York Times wrote about it less because they registered with the state. Well, if you don't register, we don't know about it. Right. So is the law adequate enough? It's a great question. I mean, it's a hard question to answer. I mean, you know, if it comes to our attention in whatever form it's going to come to our attention. I'll say this. I am sure there are companies that should be registering with their data broker registry have not registered. And if it comes to our attention, we'll deal with it. Along those lines, though, is this case going to motivate your office to investigate, to see if other companies registered or not, are screen scraping in Vermont? Well, we're focused on this. And as Mr. Krieger said, the violation of the data broker registry is one count. The two other counts are the consumer protection, unfair and deceptive acts. And so that is, again, collecting the mapping and the selling. And so this isn't just about our data broker registry, but this is we have always stood up for privacy in this state. This data broker law was championed by my office. Brian Krieger was a champion of it over in the legislature. We're great from the legislature past it. But look, you don't, you guys know this better than I do. You don't read a story in the paper. You don't read something that's going on this world without talking about privacy, without talking about data, without talking about the selling of data and how we define privacy rights in this context is going to be an emerging practice. And I think we're on the front lines here in the state of Vermont because it's a value of Vermont, the right to privacy, the right to be left alone. And when you're walking down the street and you're being surveilled by an individual by a company that knows where you are, can sell to you, knows where your kids are, can be used by a predator. This thing, you know, I don't want to put on a tinfoil hat, but, you know, the consequences of this is pretty disturbing in my opinion. And you got it. We have to define people's privacy rights in an online world. Do you have any information about whether this data is being used in Wilson and ISIS? I don't. I don't have that information. What do you have concerns if it works? I would be concerned if federal law enforcement is using this for, I think, Fourth Amendment issues. Obviously, that would be the federal government. I don't have information that they're using it, but I think there are real concerns about Fourth Amendment protections on this. And I think, you know, when you look in the Fourth Amendment jurisprudence, you're really looking at two different cases that have said, wait a minute, privacy matters here in the Carpenter case, which said you didn't need a warrant to get cell phone records. And cell phone records can tell you where you were. In the Supreme Court, the United States Supreme Court, John Roberts said, the fact that we can figure out what technology, cell phone records in particular, and tell where you were for the last five years, is a violation of people's right to privacy. Law enforcement, you need a warrant. And you look at that case, you look at this Jones case, which was GPS tracking for, I think, 24-7 for 30 days. You're walking, that car goes up a street and you want law enforcement to follow the street. You don't need a warrant for that. You don't need a warrant for that. But if it turns into a process that's so invasive following somebody for 24 hours a day, for seven days a week, for 30 days, the court has said that's too invasive. People have privacy rights. So you're starting to see the court say, wait a minute, privacy matters in this online world, particularly the Carpenter case, this Jones case, the Riley case would say it said, you need a warrant, not just to grab somebody's cell phone, but you need a warrant to get the data from people's cell phones. Those are all cases in the last, I think, five to six to seven years. This is going to be another one. And so we look forward to being on the front lines of this fight. This is something that is in the tradition of the state of Vermont, of Vermonters right to privacy, the right to be left alone. I know Vermonters stand for that. It's something that I grew up with. It's something that I hope my kids get to grow up with in the online world. And we need to draw the line. Not if you don't know about it. That was the problem. And so that's why we're going to court saying, you got to stop this. Vermonters have a right to know. The company does have an opt-out function on its website. Yeah, I'm going to freak your answer. So the company has stated that you have the right to opt out in jurisdictions where we will honor the right to opt out in jurisdictions which require that right. And there are a very small number of jurisdictions in the United States that have an express right to opt out, California being one of them. There is not an explicit law in Vermont that says you have the right to demand deletion in a situation like this. We are going to argue that the Consumer Protection Act under its unfairness does convey those rights. Whether or not Clearview would respect that and honor the opt-out, we don't know at this point. If I can, let me just make a quick analogy on this because my understanding is that the opt-out policy that Clearview offers, they would require somebody to submit their own photograph or perhaps a government-issued ID to confirm the person's identity and then use that to match in their database and then scrub their database of that individual. To draw a parallel, when consumers found out after the Equifax breach that in order to confirm or verify whether or not their information might have been exposed, that one of the first things that the company did was say, give us your Social Security number. And a lot of people were outrage saying, I didn't even know you had my information to begin with. And now you're asking me for more information that you just lost. I'm very skeptical of giving you additional information about myself. So to ask consumers to say, in order to exercise their rights to get out of something they never wanted to be a part of in the first place, to provide this company with more information about themselves, I think you would say there would be a very skeptical public. The last thing I want to say when we talk about what's going on in the Supreme Court, whether it was the Crawford case, that Jones case, or the Riley case, they talked about the history of the Fourth Amendment. And they talked about going into somebody's house and maybe you'd search a room and you'd look for their checkbook or their financial ledger, maybe a diary, and maybe you'd find a photo album. And again, that word of particularity drawn throughout the Fourth Amendment that it's got to be specific and searching rooms and for all that information, all that information is now here. You can learn everything about anybody by what is on people's phone. And now with this technology, when you're walking around, people can find everything about you walking down the street unbeknownst to you. So that right to privacy, which has been defined as eloquently as anywhere in the history of the law, the right to be left alone is at risk in this case. That's why we filed this lawsuit. Thanks for coming.