Cambridge, Massachusetts Passes Ban On Facial Recognition Tech Use By Government Agencies

from the party-on,-faceblockers dept

Congratulations to Cambridge, Massachusetts for joining the banwagon! Cambridge joins three other communities in the state which have decided facial recognition tech is too risky, too invasive of privacy, and all-around bad news for their residents. Brookline, Somerville, and Northampton have also banned the tech, potentially leading the way for a statewide ban.

A bill before the State House would also establish a statewide moratorium on the use of facial recognition technology and other forms of biometric surveillance, including the analysis of a person’s gait or voice, until the legislature regulates the software.

These communities join their West Coast counterparts in making the tech unavailable to government agencies. San Francisco and Oakland both banned the tech recently. This was followed by a statewide ban that made these efforts (mostly) redundant. But not completely. The state ban only applies to cameras operated by law enforcement officers. The city bans block all city government agencies from deploying the tech.

There really isn't any good reason for any city or state to, at the very minimum, not pass a moratorium on facial recognition use. The tech is unproven. Specs vary widely between vendors, but most of the major offerings aren't exactly burning up the charts in terms of false positives. That's still a huge problem. But it's only one of the problems.

A large percentage of false positives also means the programs are prone to false negatives, which runs contrary to law enforcement assertions the tech will aid and abet in crime-solving. You need to be able to accurately identify people to do that and high miss rates don't exactly point to increased law enforcement efficiency.

Beyond that, the tech tends to show bias, some of which can be attributed to the people building the programs. The quality of the training inputs also matters, but the race to grab market share means speed is prized over accuracy. At this point, facial recognition tech is mostly known for getting things wrong and giving white males yet another reason to be grateful they're white and male.

Unfortunately, these efforts will probably be temporary. There's no way law enforcement agencies will go without this tech for long. And these agencies wield a great deal of power when it comes to crafting legislation, especially if they're represented by a union.

As heartening as it is to see these efforts come to fruition, the widespread deployment of facial recognition tech feels almost inevitable. Maybe it isn't. But state efforts won't do much to halt the ever-expanding plans of the federal government, which is very much interested to subjecting as many Americans as possible to biometric collections, all in the name of national security. But a groundswell of state efforts could halt this advance or, at the very least, slow the surveillance rush back to a creep.

Filed Under: ban, cambridge, facial recognition, massachusetts

Study Claims Old People Select Stronger Passwords Than Teens

from the maybe-they-just-follow-instructions-better? dept

We've all seen tons of reports on how bad people are at choosing secure passwords, but it's not too surprising to find out that different demographic segments are better or worse than others at having secure passwords. Though, it may be a bit surprising to find out that a new study suggests that those over 55 pick passwords that are twice as secure as teenagers:

This was based on research on the hashed versions of 70 million Yahoo users, in which a Cambridge research tried to determine the strength of all of the passwords, and see how different groups did. Some of the other findings:

People with a credit card stored on their account do little to increase their security other than avoiding very weak passwords such as "123456". Unsurprisingly, people who change their password from time to time tend to select the strongest ones.

In terms of more specifics:

Password strength is measured in bits, where cracking one bit is equivalent to the chance of correctly calling a fair coin toss, and each additional bit doubles the password's strength. On average, Bonneau found that user-chosen passwords offer less than 10 bits of security against online attacks, meaning it would only take around 1000 attempts to try every possible password, and around 20 bits of security against offline attacks.

That's surprising, because even a randomly chosen six-character password composed of digits and upper and lower case letters should offer 32 bits of security. Bonneau says the discrepancy is due to people picking much easier passwords than those theoretically allowed. He suggests assigning people randomly chosen nine-digit numbers instead, which would offer 30 bits of security against every type of attack – a 1000-fold increase in security on average. "I think it's reasonable to expect people to have the capacity to remember that, because they do it for phone numbers," he says.

Of course, this reminds me (like so much does) of an xkcd comic on how we've all been trained into selecting weak passwords that are hard to remember, on the false belief that they're strong.

Filed Under: cambridge, passwords, security, teenagers, xkcd

Which Would You Rather Have: The Planet, Or A Patent?

from the decisions,-decisions dept

One of the more controversial approaches to the already controversial field of climate change is geoengineering, which Wikipedia defines as "deliberate large-scale engineering and manipulation of the planetary environment to combat or counteract anthropogenic changes in atmospheric chemistry."

Some people are concerned that such large-scale interventions might produce large-scale disasters. That makes small-scale experiments exploring the underlying technologies an important first step before taking this route. Unfortunately, it seems that one geoengineering experiment has been called off because of patents:

A field trial for a novel UK geoengineering experiment has been cancelled amid questions about a pre-existing patent application for some of the technology involved.

The Stratospheric Particle Injection for Climate Engineering (SPICE) project is a collaboration among several UK universities and Cambridge-based Marshall Aerospace to investigate the possibility of spraying particles into the stratosphere to mitigate global warming. Such particles could mimic the cooling produced by large volcanic eruptions, by reflecting sunlight before it reaches Earth’s surface.

As the article quoted above goes on to explain, the main issue here is a potential conflict of interests:

a patent application that was submitted by Peter Davidson, who runs the UK consulting firm Davidson Technology on the Isle of Man and was an adviser at the workshop that gave rise to the SPICE project, and Hugh Hunt, an engineer at the University of Cambridge, UK, who is one of the SPICE project investigators. The patent is for an "apparatus for transporting and dispersing solid particles into the Earth’s stratosphere" by "balloon, dirigible or airship" technology related to the SPICE field trial.

UK funding bodies require possible conflicts of interest to be declared when applying for grants, whereas here the patent application apparently only came to light a year into the experiment. Part of the project is continuing -- things like climate modelling and analysis -- but the most innovative element, the field trial, has been cancelled.

This episode shows one of the problems with trying to marry "pure" science with commerce, and the tensions that can arise between sharing knowledge freely and trying to make money by restricting access through licensing. It would be regrettable, to say the least, if the exploration of ideas that might play a role in addressing climate change were blocked because of patents.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: cambridge, climate change, geoengineering, hugh hunt, peter davidson, spice, uk
Companies: davidson technology, marshall aerospace

Financial Industry Favors Security Through Obscurity; Demands Cambridge Censor Paper Detailing Weaknesses

from the that'll-work dept

The chip and PIN system that is used for financial transactions throughout large parts of Europe and Canada (still surprised that it hasn't really come to the US...) has numerous vulnerabilities that have been detailed over the years. In the past year alone, there have been a number of problems and weaknesses highlighted with the system. Apparently, the financial industry isn't happy about this, but rather than fixing the problems it's reacting in the usual way: going after the messenger. Slashdot points us to the news that the UK Cards Association -- a trade group representing banks and credit card companies -- has asked Cambridge researchers to remove a thesis which highlights some of the vulnerabilities.

You can see the demand letter embedded below, but it's fairly amusing. The letter claims that the publication (which you can read about on the author's (Omar Choudary) website, where he describes a device for intercepting, monitoring and modifying such data) "oversteps the boundaries of what constitutes responsible disclosure." In other words, they're not happy about it, so Cambridge should force the student to shut up. Of course, what's amusing is that after chiding Cambridge University for such irresponsible publishing, the Association then tries to downplay the significance of the whole thing anyway:

Fortunately, the type of attack described in the research is difficult to undertake and is unlikely to carry a sufficient risk-reward ratio to interest genuine fraudsters. And, in the unlikely event that such an attack were to take place in the UK marketplace, the banking industry's fraud prevention systems would be able to detect when such an attack had happened.

So why take it down?

Nevertheless, publication of such details could encourage nuisance attacks on the payment card systems, undermine public confidence in them and/or give organised crime access to material they might be able to develop further.

This, of course, is the very definition of an organization that thinks security through obscurity works. The thing is, if these students figured out these problems, it's pretty damn likely that organized crime already had figured out the same thing and probably have already developed the idea much further. Pretending otherwise is simply naive.

The UK Cards Association then goes on to lecture Cambridge University on its standards of what should be considered publishable, and worries about "future research." The response from Ross Anderson at Cambridge (linked above) is pretty straightforward, basically saying, yes, you absolutely should be worried about it:

The bankers also fret that "future research, which may potentially be more damaging, may also be published in this level of detail". Indeed. Omar is one of my coauthors on a new Chip-and-PIN paper that's been accepted for Financial Cryptography 2011. So here is our Christmas present to the bankers: it means you all have to come to this conference to hear what we have to say!

A note to the financial industry: perhaps instead of worrying about student papers, you should worry about a system that is vulnerable to so many problems.

Filed Under: banks, cambridge, chip and pin, credit cards, obscurity, security, uk