Why do a university's M&M vending machines have facial recognition software installed?

[thewayne]

This is a question being asked at the University of Waterloo (Canada) right now as the machines are being planned for removal.

If you're into IT like I am, or like reading computer security newsletters that show error screens of crashes or failure to loads, a student noticed a screen at one such vending machine on campus that showed a classic Windows error dialog that said "Invenda.Vending.FacialRecognitionApp.exe", and he asked the question 'WTF is facial recognition software doing on a vending machine?' Subsequent casual browsing of Invenda's web site found a sales brochure that "... promised "the machines are capable of sending estimated ages and genders" of every person who used the machines without ever requesting consent." While Canada may not have Europe's GDPR, their privacy laws come pretty darn close, especially on facial recognition. And the fecal matter impacted the rotary impellers.

Now, I'm going to play Devil's Advocate here as a programmer. They could be using this app to simply detect 'Hey! Someone is standing in front of the machine! Let's turn on the lights and do our little dog and pony show and try to entice them into buying something!' without storing or transmitting any biometric information whatsoever. It could be 100% innocent and they're using the tech just to detect someone staring at the machine.

Do I believe this?

Nope. I'm sure the app could do this, but if this is what they were using this for, you'd think someone would have +1 point of IQ to say 'Hey, maybe we should rename the app to FaceDetectApp.exe, just in case the name of the app leaks out'. But they didn't. And most vending machines have cell phone systems built-in to tell the managers what supply levels are, validate credit cards, and sometimes send diagnostic info if the machine needs repairs. It would be trivial to send biometric data. Modern vending machines are very sophisticated computers these days.

The article mentions a previous Canadian facial recognition scandal where a mall operator was covertly scanning people walking around a mall (or perhaps several) and collected biometric face data of over FIVE MILLION people! He was forced to erase those databases.

https://arstechnica.com/tech-policy/2024/02/vending-machine-error-reveals-secret-face-image-database-of-college-students/

https://yro.slashdot.org/story/24/02/24/0012232/vending-machine-error-reveals-secret-face-image-database-of-college-students

Comments

[disneydream06]

Suddenly I have no desire to ever use a vending machine again. :o :o :o
I don't remember how long ago it was that I did use one.
I walk up to them and look at the prices and instantly think, I could get a big bag of whatever at the grocery store for that price. :o :o :o
Hugs, Jon

[thewayne]

Very true.  We have a Pepsi machine in my library, used to have a snack machine but they emptied it at the end of every Spring and Fall semester and then they removed the machine entirely a couple of years ago.  I would buy something from it every now and again, typically a Lance's toasted peanut butter cracker thingie.  The Pepsi machine: they're like $3 now!  We have a fridge in the back, I bring my own: I get these small cans with real sugar, 90 calories a pop and I don't drink them every day.

[disneydream06]

DANG, I miss drinking pop soooooooo much. :o

Vending machines

[moxie_man]

The last time I dealt with a vending machine was two office locations ago (20 yrs ago). Old school, loose-change-only model. Someone would pick an item, the little screw auger wheels would do their thing and their purchase would hang-up.

Me to the rescue to tilt the machine back on its rear legs just enough, that when I let go, it would thump with just enough force to jar the item loose...and sometimes the item behind it.

Re: Vending machines

[thewayne]

Yep!  That was the kind of snack machine that we had in our library, though it's been gone for a couple of years now.

[silveradept]

If proximity detection is what they wanted, they can achieve this is many other ways without having to ever get close to the idea of facial recognition. This seems much more like someone trying to capture demographic data to primarily sell, and then, perhaps as a fig leaf, to try and customize the content and prices of the machine to reflect the people who are using them.

Everybody wants to get into the data brokering world, apparently.

[thewayne]

Agreed.  Simple thermal detection would see if someone were standing in front of the machine.