OLYMPUS RISK INTELLIGENCE PROTOCOL — INSTITUTIONAL ASSESSMENT DIVISION CASE WTW-2026-078

CLEARVIEW AI

THE INSTITUTIONS THE DRAGNET
BODY LAYER — FACE-SEARCH DRAGNET AUTHORITY
Status
ACTIVE — Commercial facial-recognition vendor, founded 2017; database of 30B+ scraped images (company claim, March 2023)
Hazard — Reach
84
RCH / FND / ENT
9 / 8 / 5
Conduct
ADJUDICATED — FINED ON FOUR FRONTS, PAID IN ITS OWN STOCK, STILL OPERATING

OLYMPUS opened an institutional file. A firm has no Big Five and no Dark Triad, and the unit does not invent them; what a firm has is an asset, a client list, and an enforcement record. Clearview AI is catalogued here as the dragnet — the private company that scraped the open web into a reverse index of the human face and sold the search box to police. The finding is not any single search. It is the asset: thirty billion faces by the company’s own count, held by a firm that four European regulators fined, one American class sued into part-ownership, and one American state could not establish jurisdiction over. The numbers in the front matter are reach, entrenchment, and durability — not malice.

Institutional Archetype

THE DRAGNET — The archetype is the net cast before anyone consented to swim. Clearview does not run cameras, does not arrest anyone, and does not write policing policy; it scraped faces already posted — social media, employer pages, news sites, anywhere a face sat next to a name — and turned the scrapings into a search engine for people. The instrument is the database. The leverage is that it cannot be un-scraped: a deletion order in Italy reaches the Italians Italy can prove are in the net, and the net keeps the rest. Every enforcement action in this file ran into the same asymmetry — the remedy is jurisdictional, the asset is not.

Mandate & Origin

Clearview AI was founded in 2017 by Hoan Ton-That (co-founder and chief executive — cross-reference hoan-ton-that.md) and Richard Schwartz, and operated in near secrecy until the New York Times exposed it on January 18, 2020 — at which point, per the Times investigation, its database held some three billion images and its tool was in use by more than 600 law-enforcement agencies, including the FBI and the Department of Homeland Security. By March 2023 the company’s own figures, announced by its chief executive, had grown to 30 billion+ scraped facial images, roughly one million police searches, and 2,400+ agencies among its clients — company self-report, unaudited. The company has stated a goal of 100 billion images.

Funding & Backers

Clearview is a commercial firm, and its capital history is thin enough to be load-bearing. Early backing included $200,000 from Peter Thiel, per the Times investigation. By the time the Illinois biometric-privacy class settlement was structured in March 2025, the company could not fund a cash settlement: the class instead received a ~23% equity stake ($51.75M against a **$225M** valuation). Read the cap table after that settlement and the finding writes itself: the people the company scraped without consent are now among its owners, and their compensation is tied to the continued commercial success of the machine that scraped them.

Institutional Voice & Intent

The voice is the odometer — the company’s public register is its database milestone, announced by its chief executive to the press: three billion, thirty billion, a hundred billion to come. Where the field’s other institutions speak in “decision intelligence” and “emerging risks,” Clearview speaks in inventory. The persuasion is in the scale itself: a number that large reads as inevitability, and inevitability is the strongest sales argument a surveillance vendor can make.

Stated intent: Provide an after-the-fact investigative tool that helps law enforcement identify suspects, victims, and witnesses from images — built on publicly available photographs.

Observed intent: Build and hold the largest privately owned index of the human face, sell search access to as many agencies as possible, and keep the asset beyond the effective reach of any single regulator.

Gap: The jurisdictional defense is not incidental to the business — on the record, it is the business’s most successful legal product. The UK First-tier Tribunal accepted in 2023 that a foreign firm serving foreign law-enforcement clients sat outside UK data-protection law; a Vermont judge held in December 2025 that the company “conducts no substantial business in Vermont” and dismissed the state’s suit on personal jurisdiction. A firm whose product is everyone’s face turns out, when sued, to be located nowhere in particular. That is the gap between the stated intent (a lawful tool for police) and the observed structure (an asset engineered to survive every remedy aimed at it).

Position in the Apparatus

Clearview is the privatized square of the convergence table. In China the state runs the face layer directly; in Britain the Metropolitan Police operate Live Facial Recognition under their own published policy; in the United States there is no federal ban and the capability is largely privatized into the identity layer — and the name in that cell is Clearview. The research corpus places it in the facial-recognition-deployers and surveillance-customer-cohort clusters alongside Palantir, Anduril, NSO, and Cellebrite (cross-reference palantir.md); the structural contrast is with the state-run enrollment systems (cross-reference aadhaar-uidai.md) — Aadhaar enrolls you with your thumbprint on a form, Clearview enrolled you the day you posted a photograph. The body-layer rhyme is with the genetic database (cross-reference 23andme.md): both files end with the asset changing hands in ways none of the people in the database chose — one in bankruptcy, one in a settlement paid in stock.

Actions & Leadership Choices

Founding purpose, judged on evidence. The scrape was the founding act, not a drift. The company assembled its database by harvesting faces from the open web without the consent of the people in it, and sold search access to police — that is the business as documented from the first public account of it in January 2020. This is not a neutral-tool prior gone wrong at the margins; non-consent is the input the product is made of. The deeds below are weighed against that, and so are the defenses.

Consequential actions — the enforcement ledger. Europe fined it on four fronts: Italy’s Garante, EUR 20M (February 2022, with a deletion order); France’s CNIL, EUR 20M (October 2022) plus a EUR 5.2M overdue penalty (April 2023); Greece’s HDPA, EUR 20M (July 2022); and the Dutch DPA, EUR 30.5M (September 2024) — which, in Reuters’ dry summary, did not stop the US business. Britain’s ICO fined it GBP 7.5M with a deletion order in May 2022; the First-tier Tribunal overturned the action on jurisdiction in October 2023; the Upper Tribunal restored three of the four grounds in October 2025; and in December 2025 Clearview was granted permission to appeal again — the fine is currently remitted, not finally upheld, and this file does not state otherwise. In Illinois, the one American statute with real teeth — the Biometric Information Privacy Act — produced the March 2025 settlement paid in equity described above. And Vermont’s attorney general, Charity Clark, refiled suit in April 2025 under the state’s Consumer Protection Act, alleging the company stored the biometric identifiers of Vermonters, “including children,” without consent; in December 2025 the case was dismissed for lack of personal jurisdiction — the merits were never adjudicated, and the State’s allegation remains exactly that, an allegation.

The steel-man travels with the file. Two defenses are documented and both are real. First, the company’s product is, by US government testing standards, among the most accurate facial-recognition systems available — accuracy is not the problem this file documents. Second, its jurisdictional arguments have repeatedly won: the UK Tribunal accepted them once and the fight is still live; Vermont’s suit died on them. The wrongful-arrest record that shadows this technology class — the NIST finding that false-positive rates run ten to one hundred times higher for Asian and African American faces, the Detroit arrests of Robert Williams and Porcha Woodruff — belongs to facial recognition generally and is not attributed to Clearview’s product; the Nijeer Parks case, sometimes attached to the company, is specifically un-attached here — his attorney retracted the attribution and the company denies it. The discipline matters because the file does not need the embellishment: the finding against Clearview is the database, not the error rate.

Leadership choices. The company’s public face is its co-founder and chief executive, Hoan Ton-That (cross-reference hoan-ton-that.md), whose signature act as leader is the announcement of the database’s growth — three billion at exposure, thirty billion by his own March 2023 statement, one hundred billion as the stated goal — through five years of multinational enforcement that never stopped the scrape. The choice on the record is continuity: fined in Italy, France, Greece, and the Netherlands; litigated to a standstill in Britain; sued into part-ownership in Illinois — and still operating, still growing, still selling.

CONDUCT verdict: ADJUDICATED — FINED ON FOUR FRONTS, PAID IN ITS OWN STOCK, STILL OPERATING — a firm whose founding act was non-consensual collection at web scale, adjudicated against by four European regulators with fines and deletion orders, settled in Illinois with equity because it lacked the cash, and preserved throughout by the one defense that keeps winning: that no court asked to stop it has jurisdiction over enough of it to matter.

Reach Assessment

Institutional: By the company’s own count, 2,400+ agencies against a country of roughly nineteen thousand police departments — a minority of departments and a majority of the argument, because the asset any one agency searches is the same thirty billion faces. Memetic: The number itself is the reach. “Thirty billion” became the reference point for the end-of-anonymity argument across four books of this series and most of the litigation record cited above; a database that size reads as a fact of nature rather than one company’s decision, which is precisely the trick. Civilizational: This is the body layer, and the body layer does not rotate. A password can be changed and a card reissued; a face is broadcast with every step, and the scrape of it is permanent in a way no fine addressed — Europe fined, Britain litigated, Illinois was paid in stock, Vermont was told the defendant wasn’t there. A fine is a price. A wall is a stop. The record shows fines. The face was the last anonymous thing a person carried in public, and it is now an index term.


Sources: The Secretive Company That Might End Privacy as We Know It — New York Times, Jan 18 2020; Clearview CEO claims company’s database of scraped images is now 30 billion strong — Engadget, Mar 2023; Facial recognition: Italian SA fines Clearview AI EUR 20 million — EDPB, 2022; Clearview AI fined $33.6 million by Dutch watchdog — Reuters, Sep 3 2024; UK Upper Tribunal hands down judgment on Clearview AI Inc — ICO, Oct 2025; ICO wins appeal over Clearview AI jurisdiction ruling — Pinsent Masons Out-Law; First BIPA Litigation: Class Members Receive Equity in Clearview AI — National Law Review, 2025; $51.75M Settlement in Clearview AI Biometric Privacy Litigation — Regulatory Oversight, Apr 2025; Attorney General Clark Refiles Lawsuit Against Clearview AI — Vermont AG, Apr 25 2025; Judge throws out Vermont’s lawsuit against facial recognition software firm Clearview AI — VTDigger, Dec 18 2025; NIST Study Evaluates Effects of Race, Age, Sex on Face Recognition Software — NIST, Dec 2019; Illinois Biometric Information Privacy Act, 740 ILCS 14 — Illinois General Assembly.

RCH 9 REACH
FND 8 FUNDING
ENT 5 ENTRENCHMENT
OLYMPUS RISK INTELLIGENCE PROTOCOL does not exist. It was assembled in a GitHub issue thread in October 2023 by engineers who had read the extinction risk letter and wanted to understand who specifically had signed a document saying AI might kill everyone and then continued working on AI. These dossiers are satire. The biographical facts cited are sourced from published reporting, public statements, academic papers, and court records. The psychometric scores are not clinical assessments. No part of this constitutes professional psychological evaluation or diagnosis. Do not use these dossiers to make decisions about anything.