Graylark, a Boston company that sells an AI investigation platform to "qualified law enforcement agencies, enterprise users, and government entities," says that one photo taken inside a rental or a hotel room is now enough for its system to identify the place where the person is staying.
CEO Daniel Heinen announced the development on X, saying "AI can now find where a criminal is staying from a single photo taken inside an Airbnb," and "AI can now tell which hotel you slept in from a single photo."
The company's Raven tool has produced two new investigative leads products, Short-Term Rental ID, launched on September 30, and HotelID, launched on October 8.
Graylark says that Raven searches "millions of short-term rental listings worldwide with an interior photo or video frame," and that it "connects visual details to matching properties, listing photographs, and location information."
The company explains the process by saying that "room layout, structural details, and fixtures connect different views of the same space."
The results are "investigative leads" that require verification before any action is taken, and no GPS metadata is needed to use the tool, Graylark said.
The company's website features a dramatic example of how the tool can be used, saying that "a threatening livestream went live. Raven identified the location from a single frame in seconds. Eight minutes after upload, officers were on scene and the individual was under arrest." The page calls this "Based on a real case · Dramatized recreation."
Heinen has told International Cyber Digest that the tool is meant to help locate victims and investigate serious crimes, but he declined to reveal the architecture, datasets, sourcing or commercial partnerships behind Raven.
Graylark raised a $10.7 million seed round, announced on August 29, led by General Catalyst, with Alexandr Wang and Recorded Future among investors.
The company's privacy policy states that "for quick searches, images are retained for 7 days before deletion." Images that are tied to a case file are kept until the case is deleted, and for a further 30-day period.
Graylark's Raven has its roots in the company's earlier photo-geolocation tool, GeoSpy. Graylark says that GeoSpy "reached one million cumulative users in its first three months."
However, in January of last year, 404 Media reported that members of the public were using GeoSpy, "some asking for help with stalking specific women." Heinen at the time pushed back on such requests, and after the media outlet asked for comment, GeoSpy shut down public access to the tool.
404 Media also reported that the Miami-Dade Sheriff's Office and the LAPD had bought access to the tool, with the Miami-Dade's contract worth $85,500.
One of the last places where taking a photo wouldn't give away your location was a hotel room. Now even that is being taken away. And given that any photo can now be used to reveal the address of the place where it was taken, every picture that is posted online becomes a location that can be pinpointed.
While there's no doubt that the police will be able to use this tool to catch some bad guys, the fact that it is based on some unknown data that is searched by an unknown algorithm, and that the tool will be available beyond law enforcement, is very bad news for everyone else and many people aren’t aware of how easy it is to give up their location from a simple photo.
