Document face recognition in the real world

There are five points of expertise we want to hear from:

You were stopped, flagged or misidentified.

A system read your face and something followed: a question, a refusal, an escort to the door. You do not need to know how it worked. What happened to you is the evidence.

Open via HTTPS Open via Tor

You build, integrate or test the technology.

You know how a system is assembled, where one falls short of its spec sheet, or you have run a Ghostyle or a workshop look against a real system and can tell us how it performed. The form shows only the questions for what you can speak to.

Open via HTTPS Open via Tor

You operate it, day to day.

Describe its daily use, instructions and management requirements.

Open via HTTPS Open via Tor

You bought it, sold it or signed it off.

Contracts, tenders, budgets, vendor pitches, impact assessments: you know the purchase terms and agreements.

Open via HTTPS Open via Tor

You noticed something, or none of the above fits.

A camera, a kiosk, a sign, a pair of glasses you did not expect. Or something about face recognition the other four questionnaires do not ask for. No inside access needed.

Open via HTTPS Open via Tor

Before you write anything.

If you want to report, remember that browsers might save and record digital activities; it happens automatically and without explicit knowledge. Consider these hints before preparing a report.

• Do not tell people who might disclose your reporting plans.
• Do not use your employer's device, account or network to read this page or to prepare anything.
• Report what you already know and can access within your normal permissions. Do not seek additional material for us.
• Photos and documents carry hidden information: timestamps, device IDs, GPS coordinates, printer tracking dots. We do not publish material we receive; we use it as a lead. When in doubt, describe what you saw in your own words instead of uploading the original file.
• When you are ready, use Tor Browser to open the submission page, from a device and a network that are not tied to your workplace.

Further guidance

The whistleblowing platform is based on GlobaLeaks, the open-source system used by newsrooms and NGOs worldwide, and it is reachable over Tor.

Each questionnaire asks only what a person in that position can answer, and almost every field is optional, answer only what you know! You can always add to a report later with your receipt code.

These resources offer further help with digital security and ongoing risks.

What happens to what you send.

The submission screen names the editorial and research team members who will read your report. These rules apply to every channel:

• Nothing you send is published as received. Reports are leads, not articles. A document or a screenshot is used to verify and to direct the next test, and it stays inside the reporting system.
• Everything is corroborated before it is used. Each questionnaire ends by asking how you know and what would confirm it. A single-source claim is treated as a question to investigate, not as a finding to repeat.
• We follow your restrictions. At the end of each form you can tell us to use a report only as a lead, not to quote you, not to name a place or an organisation, or not to contact anyone before asking you. We honour that.
• What returns to the public is minimised. A finding becomes public only after editorial and security review, stripped of anything that points to a source: aggregated where several reports agree, redacted where one does not. Verified findings can change the reference archive, the tests run in the lab and what is published in the Fediverse. Confidential reports never go there directly.

We may suggest a newsroom or advocacy organisation through your receipt code. We will not forward anything without your agreement.

Reports that receive no further activity are deleted from the reporting system after 180 days. A case that is still open can be kept longer by the people handling it, and you can ask, through the receipt, for a report to be deleted at any time.

What we cannot promise.

• Legal protection. Whistleblower laws, including the EU directive and its national versions, mostly protect reports made to your employer, to a designated authority or, under conditions, to the public. Reporting to a research project is usually not one of the protected routes. If your position depends on legal protection, talk to a whistleblower-support organisation or a lawyer first; the resources above can point you to one.
• Intervention in your case. We investigate systems. We are not able to appeal a decision, represent you or act on your behalf, though we can suggest who might.
• A reply on a deadline. A person reads new reports at least weekly and answers through the receipt conversation. Nothing is forgotten, but this is volunteer work.
• Payment. We do not pay for information, and we would treat an offer to sell it as a reason for caution.

How the submission works.

The reporting node is a separate GlobaLeaks installation with two addresses. The first is a normal HTTPS site. The second is an Onion Service, opened with Tor Browser, which hides from your network and from us where you are connecting from, and resists selective blocking. Prefer the Onion address whenever you can.

• You do not create an account, and nothing in the forms asks for your name or contact details.
• Most fields are optional. Answer what you can and skip the rest.
• Write in the language you think in. We read Italian and English directly and translate the rest.
• Files are optional everywhere. A description in your own words is often safer and just as useful.
• If Whistleblowing is a new concept for you, check out this Wikipedia article.

Submitting is the beginning, not the end.

At the end of the form you are given a private receipt code.

Come back and use it. We may have follow-up questions, we may want to check one detail before a finding moves forward, and you may want to add something you left out or withdraw something you regret. A source who keeps that thread open helps an investigation go much further than a single anonymous drop. Secure reporting works when there is a network of technical, legal and editorial support around it rather than a box that swallows a report and returns nothing, which is the same thinking behind GlobaLeaks' own House of Whistleblowers initiative.