Researchers have conducted an investigation into infrastructure involving OpenAI, the US government, and Persona.
Traces of Surveillance Database Found in OpenAI-Related Identity Verification Service
This article is a translation. Read the Japanese original
The target of the investigation is the KYC service "Persona," which utilizes facial recognition technology for identity verification.
The investigation was a passive reconstruction using public sources such as Shodan. It is reported that no direct access to the systems or use of authentication credentials was performed.
A specific hostname was discovered on a Google Cloud IP address located in Kansas City: openai-watchlistdb.withpersona.com.
Hostnames for test environments were also confirmed. The naming conventions suggest the existence of a watchlist database.
The researchers have been in written communication with CEO Rick Song and state that he has promised to answer 18 specific questions.
The findings included facial recognition algorithms, SAR (Suspicious Activity Report) documents, and intelligence agency codenames, all obtained from publicly available source code.
The researchers maintain that there is no illegality in their actions, asserting that this is reporting and research based on the First Amendment and GDPR.
Sources: OpenAI, the US government and Persona built an identity surveillance machine (HN 657pt, 195 comments) (HN Search (backfill), 2026-02-25)