Image security in the age of AI, deepfakes in focus after Epstein Files bring scrutiny to school picture days

One of the country’s largest school pictures photography firms has seen instances of districts canceling or delaying shoots, and others allowing parents and students to opt out of picture day, stemming from its private equity owner’s ties to Jeffrey Epstein.

The scrutiny facing Minnesota-based Lifetouch Group also connects to bigger issues over the security and safety surrounding images, how that content is stored, and who owns and controls it.

That includes deep-fake images on social media and how artificial intelligence (AI) is used (and potentially misused) when it comes to large sets of data and images.

Minnesota-based Lifetouch is one of the largest school photography companies in North America. It also provides photography services to churches and other houses of worship, as well as preschools.

The school photography firm is part of Shutterfly/Lifetouch LLC after an $825 million acquisition in 2014 by Shutterfly.

California-based Shutterfly (including Lifetouch) was bought by private equity behemoth Apollo Global Management for $2.7 billion in 2019.

That has created new scrutiny for the school photography company.

One of Apollo’s founders, Leon Black, had meetings with and links to Epstein, who was accused of operating a high-profile sex ring involving young and sometimes underage girls and prominent CEOs, politicians, academics and Hollywood notables.

Epstein died in a New York jail in 2019.

Black has acknowledged ties to Epstein, but has denied wrongdoing.

But the release of millions of emails and other files by the U.S. Justice Department has highlighted Epstein’s connections to the rich, famous and powerful, with the late financier also accused of running a sex ring for American and global elites.

'NO ACCESS TO STUDENT IMAGES'

In a statement, Lifetouch stressed none of its executives had any ties to Epstein, and that Apollo’s acquisition of Shutterfly closed in September 2019, a month after Epstein’s death inside a U.S. prison.

“As news media outlets are now widely reporting, these claims are completely false,” a company spokesman said, referencing social media concerns about potential links to Epstein.

“No Lifetouch executives have ever had any relationship or contact with Epstein, and we have never shared student images with any third party, including Apollo. Apollo and its funds also have no role in Lifetouch’s daily operations and have no access to student images. In fact, Apollo funds did not acquire Shutterfly, Lifetouch’s parent company, until September 2019 – two months after Epstein was put in jail and a month after Epstein’s death,” the Lifetouch spokesperson said.

The Associated Press also reported Feb. 13 that there have been no indications of connections between Lifetouch and Epstein in the scores of records released by the Trump administration.

Apollo, a Wall Street behemoth, has also stressed its distance from Epstein.

Apollo President James Zelter said in a Feb. 18 statement that the investment giant’s ties to Epstein were related to tax advice he gave to Black, who left the firm in 2021.

“Mr. Black, who left the firm in 2021, previously retained and compensated Mr. Epstein for personal tax advice. In select instances, Apollo CEO Marc Rowan and other Apollo employees provided information to Epstein in connection with his tax work for Mr. Black. While Mr. Epstein sought to do work with the Apollo co-founders other than Mr. Black, it was declined at every turn,” Zelter said in a letter to investors.

Apollo’s holdings and investments have also included some well-known brands, such as security firm ADT Inc., arts and crafts retailer Michaels, University of Phoenix, a 90% stake in Yahoo, past ownership of Chuck E. Cheese pizza parlors (which it sold to another investment firm in 2020) and a current 55% stake in the Atletico Madrid Spanish soccer team.

'NOT NAMED'

Black’s ties to Epstein have drawn social media attention and raised concerns among parents, as well as some school districts, about safety around school pictures shot by Lifetouch.

There have been instances of school districts, including in Texas and Pennsylvania, canceling picture days with Lifetouch. Others have put those events on pause. A number of districts have also sent out communications to parents and students to try to ease concerns about picture day and safety around those images.

Lifetouch CEO Ken Murphy reiterated in a statement posted on the company’s website that the school photography firm is not mentioned in the Epstein files and that the company safeguards students' images and does not share “with any third party” or artificial intelligence (AI) models.

“Lifetouch is not named in the Epstein files. The documents contain no allegations that Lifetouch itself was involved in, or that student photos were used in, any illicit activities,” Murphy in the public statement.

He also sought to quell concerns about image security.

“When Lifetouch photographers take your student’s picture, that image is safeguarded for families and schools only, with no exceptions. Lifetouch does not – and has never provided – images to any third party,” Murphy said.

Murphy said the company is “amidst of sea of misinformation” in the open letter addressing concerns about Epstein’s ties to Black and Apollo.

“Lifetouch images are shared only for the purposes of school records and to allow parents or guardians to purchase them,” he said.

Murphy also said that “Lifetouch never shares, sells, or licenses student images to train AI models, including large language models, or facial recognition technology.”

He also said Apollo investment funds are at arm’s length from the Minnesota company’s operations.

“Funds managed by subsidiaries of Apollo Global Management are investors in Shutterfly, the parent company of Lifetouch. Neither Apollo nor its funds are involved in the day-to-day operations of Lifetouch, and therefore no one employed by Apollo has ever had access to any student images.”

The Kentucky Educational Development Corp. (a nonprofit cooperative that works with 81 school districts in the Bluegrass State) said on Feb. 24 that it reinstated Lifetouch as "preferred vendor" after a review of the photography business' practices found “no evidence of current affiliations or business practices that would compromise student safety, data protection or district trust.”

‘POINT OF NO RETURN’

Beyond the troves of emails involving Epstein and associate Ghislaine Maxwell (who was convicted of sex trafficking charges in 2022) and their ties to the rich, famous and powerful, there are concerns and plenty of uncharted territory related to artificial intelligence, deepfakes and other enhanced photographs and videos (including for nefarious purposes) and facial recognition technology.

Benjamin Hori, chief strategy officer at Spotlite (a technology platform that books models and other talent with advertisers), worries about some of the rushes to adopt AI.

“As a society, we have been rapid to adopt anything 'AI' related, the core issue here is we never gave security and protection a thought until we started to cross the point of no return,” Hori said.

“School photos are incredibly dangerous because they are systematic. Same child, every year, brightly illuminated and facing the camera. This is not a simple memory photo but a dataset, a typically public dataset, which makes it more troubling. What is scarier is that most large tech companies have been collecting this data from users unknowingly. Check the TOS (terms of service) of any SNS (social networking service), and they are likely to have been using your images. This means if a parent shared a school photo, it's likely been ingested into an AI model for regeneration.”

Hori notes how much easier it is becoming to download and screenshot photos and other images, but also the access to users’ personal data enjoyed by technology giants.

“Should we openly allow large tech companies to have unrestricted access to all of the data we thought was protected?” he asks, adding that the data chain can now include larger parent companies, including private equity firms.

WHO OWNS WHAT?

Hannah Choi, who founded Spotlite with Hori in 2023 and serves as the company’s CEO, also sees bigger questions arising related to chain of custody and ownership of content.

“The core issue isn't just Lifetouch. It's that we've built an entire economy around collecting images – school photos, social media posts, medical records, professional headshots – without ever seriously asking who owns them, who can access them, and what happens when the company holding them changes hands,” she said.

Choi said the problem also is the person whose picture has been taken can be out of the 21st century loop.

“Right now, your image can be collected, transferred, sublicensed, and monetized across dozens of entities, and you will never know. You are, in the most literal sense, out of the loop on your own likeness,” she said.

Zbyněk Sopuch, chief technology officer for Safetica (a Silicon Valley-based data security firm), said companies need to look at how long they store images amid a fast changing landscape ripe with data breaches.

He suggested shorter image storage timeframes.

Sopuch said customers and users “should look at any company that has their personal images, from sports teams to school photos, to holiday card printing companies” and determine how their images are stored and for how long, as well as if older images are archived or deleted.

“The latter is the preference,” Sopuch said. “The company should also provide the highest level of security for any short-term stored images.”

Choi said private equity (PE) acquisitions and investments in various businesses also complicate how images and data might be used or monetized.

“When PE firms acquire companies with large data assets, those assets get valued on the balance sheet, but the consent relationships attached to them don't transfer meaningfully,” she said.

“Data becomes collateral. The original agreement between the company and its users gets buried somewhere in the acquisition paperwork, while the data itself gets repackaged and monetized for the next fund cycle.”