The US government, and others, have plotted to bypass protections regarding search and surveillance, by finely parsing the words of the 4th amendment and weaseling around them – but, mostly, by just ignoring it. Privacy is for the rich and powerful, not for hoi polloi.
It used to make the blood of fury squirt from my ears, when some of us computer security practitioners were described as “privacy advocates.” We were never advocating privacy; we were advocating freedom from surveillance. There’s a subtle difference: privacy is an inevitable consequence of being free from surveillance – but if all you ask for is privacy, then the state can say, “oh, you’re fine – we’re not looking at the data we collect.” Just asking for privacy lets the state claim you authorized it (or it’s authorized) to build a retro-scope.
I suppose it doesn’t matter; it was all a foregone conclusion, anyway.
The surveillance state is in full deployment as it responds to what is merely mild civil unrest. None of what is going on threatens the integrity of the state (in fact, the state is currently the main threat to the state’s continued existence as a semi-democratic entity) – unfortunately, they are getting a chance to see if their gear works correctly. I’m actually not too worried about this because: 1) it doesn’t and 2) the forces of the state still lack the political resolve to be totalitarian. That sense of “a house divided” that you feel is the various parts of the state trying to decide if they’re willing to go “all in” behind Trump – which I don’t think is very likely. Luckily for us he’s got the charisma of a toad, and is brain-addled, beside. The machinery of the state is running on inertia, based on its various established missions – it doesn’t mean it’s not dangerous, but it’s all tactical; we’re probably very fortunate that Trump has packed the government with non-entities to cover his ass, rather than skilled authoritarians. So, the DHS, ICE, FBI, and the military have these fantastic weapons turned sort of vaguely toward the public, but they’re not using them quite effectively.
They are, however, using them.
The Intercept reports: [intercept]
While anonymous federal agents have thrown protesters into unmarked vans and fired tear gas at Portland’s mayor in recent days, an Air Force surveillance plane designed to carry state-of-the-art sensors typically reserved for war zones has circled the Oregon city’s outskirts from above.
The plane, a DO-328 “Cougar,” was spotted via the open source flight tracking website ADS-B Exchange, allowing the public to monitor its course. The Intercept reviewed this flight data, confirming tight, circular flights consistent with surveillance operations in and around Portland.
This is, unfortunately, nothing new. There were similar flights over Minneapolis during the troubles there, by CBP (Customs and Border Patrol) unarmed ‘reaper’ predator drones. [verge]
The drone’s callsign, CBP 104, identifies it as one of CBP’s older Predator B types, which are configured for overland surveillance. The primary sensors on these drones are electro-optical and infrared full-motion video cameras in a turret under the nose, though they can also capture still imagery using the Lynx synthetic aperture radar. They also have data links capable of sending this video and imagery back to control stations on the ground in near real-time.
What on earth would they do that for? Other than to feed the retro-scope?
If you recall Black Hawk Down it exposed some of how an early version of this system operates: it provides a god-like view of the battle-area that cowardly and incompetent field commanders can use to micro-manage their troops into another stunning clusterfuck. That probably sounds like a strong statement but consider: some strategic genius decided to strand 115 federal cops in a hostile city with a population of 600,000 increasingly angry people – and they’re watching the whole thing go down from 20,000 feet where they don’t have to worry about getting tarred and feathered. These guys are not warriors, they’re cops – and they’re rent-a-cops, at that.
But their gear is still intimidatingly competent: it’s hard for most of us to understand how good a drone-based camera can be. [pogo]
With its capacity for precise zooming at short distances, aerial surveillance can, in combination with other automated identification technologies, allow for effortless cataloging of individuals and their activities. There are two prominent automated identification technologies that could allow for easy identification from immense distances: automated license plate readers and facial recognition technology. These technologies are already in wide use by government agencies. U.S. Immigration and Customs Enforcement maintains a nationwide net of automated license plate readers to track individuals, and the FBI already maintains a facial recognition database of fifty percent of American adults and permits law enforcement from dozens of states to use it.
If you’re the kind of person who believes that the government has captive space aliens, you might also conclude that the conservative wing is being played to not want to wear face coverings because it interferes with face recognition. But: someone can collect all this stuff and then the question is whether they can do anything strategically useful with it.
[source: pogo]
It gets worse, of course: the surveillance state has access to things like facebook and twitter, but it’s also got access to commercial entities that collect desirable data, so they can – sell it to the police. There are perhaps others who want this data (probably so they can spam you with stupid ads) but there’s one main customer for this: [verge]
Customs and Border Protection (CBP) purchased access to a commercial database that allows the agency to look up the historical location of vehicles nationwide without a warrant, according to a CBP document.
The news that CBP is using such a system highlights a continuing trend in which law enforcement agencies turn to the commercial sector for access to data rather than collecting it themselves, and shows that little-regulated private surveillance networks are being used by the government.
Earlier this month, CBP published a new Privacy Impact Assessment (PIA) which said that since 2017, the agency had moved beyond using just cameras and license plate reader technology owned and operated by CBP itself and had moved to acquire access to commercial license plate databases.
The company in question is named “Vigilant” (nice, huh?) and it appears to be getting copies of tollway license plate data, parking garage license plate data, and may have its own detector systems scattered around. It turns out that a car with a bumpy thing on its roof (or black out windows and a bunch of gear inside) can drive around a metropolitan area and scan every license plate in the downtown zone in about 20 minutes. [KWCH12]
[source: kwch12]
Footage from an FBI drone of the Freddie Gray protests [pogo]
Now, I believe I have adequately illustrated the difference between privacy and freedom from surveillance. If you’re allowed privacy, it can mean that the police collect this stuff and just don’t look at it, unless, you know, they want to. If you are free from surveillance it would mean that none of this stuff is legal at all – whether it’s being captured by government agencies or civilian companies. That ship, as they say, has sailed and the government has video of everyone boarding and leaving the ship while it was at anchor.
Video from a commercial drone camera – “prosumer” drone – not a military/intelligence drone; those are better. [originally linked in the pogo article]
These technologies are fundamentally dual-use technology. They could be used to monitor and identify where the federal rent-a-cops are spending the night, where they live, who they are. The license plates of their cars would reveal that they are members of Enterprise car rental’s advantage club, and a hacker could pull the identities of the drivers and the source of their funds, instantly (since Enterprise scans both credit card and drivers’ license) – “we” could know everything about them, in minutes, too, down to the size of their underpants. Probably the most effective thing that “we” can do about these technologies is to demonstrate how they work by using the commercial versions, or by embedding in a federal agency that has access to them, and using them with intent to disclose their operation. For example, it appears the federal rent-a-cops are staying at the downtown Marriott in Portland – a drop camera fed into a facial recognition database would give a pretty good map of who they are, then check their facebook pages, create a couple of cop sockpuppets and get some friend requests sent. I used to know an information security guy whose hobby was infiltrating jihadi facebook groups (back before they figured out it was time to leave) using fairly simple methods. Apparently the stuff that the rent-a-cops talk about in their private groups is a lot of racist and nasty crap. Unfortunately, that sort of thing seems to have lost its power to shock.
Eventually, the people are going to have to embrace this sort of technology, as well. Places where it has been done (e.g.: the Waze GPS app’s speed trap warning system) really really piss off the authoritarians who believe that this stuff is only for them.
The Washington Post [wapo] describes a business that believes it is capable of offering complete real-time monitoring of an urban area:
What McNutt is trying to sell is not merely the latest techno-wizardry for police. He envisions such steep drops in crime that they will bring substantial side effects, including rising property values, better schools, increased development and, eventually, lower incarceration rates as the reality of long-term overhead surveillance deters those tempted to commit crimes.
He’s either naive or he’s a lying asshole – right now, the problem in many american cities is criminal police. Tell me how effectively this surveillance has reduced their tendency to violently suppressing citizens?
The military’s most advanced experimental research lab is developing a system that uses hundreds of cellphone cameras to watch 36-square-mile areas. McNutt offers his system – which uses 12 commercially available Canon cameras mounted in an array – as an effective alternative that’s cheap enough for local police departments to afford. He typically charges between $1,500 and $2,000 per hour for his services, including flight time, operation of the command center and the time that analysts spend assisting investigations.
Dayton police were enticed by McNutt’s offer to fly 200 hours over the city for a home-town discount price of $120,000. The city, with about 140,000 people, saw its police force dwindle from more than 400 officers to about 350 in recent years, and there is little hope of reinforcements.
“We’re not going to get those officers back,” Biehl, the police chief, said. “We have had to use technology as force multipliers.”
Ooh! I can tell you one of the big problems Dayton appears to have with its police: they have a police chief that uses soldier-terms like “force multiplier” – he’s not in Fallujah, he’s in a city he’s sworn to protect, not suppress and surveil.
One of the depressing truths about the information security business is that, about 20 seconds after 9/11, the money shifted to surveillance and development of offensive cyberwar tools. Many of us saw this coming, and our concerns were brushed aside because the money was just too damn good. It’s going to cost a lot of money and probably some blood, if this technology is to be rolled back. Attacking the drone bases is a good idea, as the Somalis demonstrate [guard] The best way to make these technologies unworkable is to raise the force protection costs to “astronomical” – which means embedding, rooting and trojaning the systems and networks, and monkey-wrenching the drones:
A US military base used to launch drones and a European military convoy have been hit in separate attacks in Somalia
According to my 19-year-old daughter, the assumption from her generation is that you should always figure you are being filmed whenever you are outside on a street or sidewalk. They’re never going to get upset about this — life is one big Tiktok video for them.
A problem, to be sure, but THE problem? I’m fairly sure that, regardless of your race, you’re still more likely to be shot in an American city by one of your fellow citizens exercising their god-given 2nd amendment rights than by the police.
And yes, the surveillance can occasionally cause police to be convicted for shooting us. We just need to step up our legal ability to force them to release their footage.
During the Clinton era, IIRC, I read an article about some mighty “militia” man who had gotten himself on the FBI’s wanted-but-not-immediately list. They’d tracked him to some big ranch in the Dakotas which then received regular visits from a surveillance drone at sufficient altitude that no one on the ground spotted it.
According to the article, one fine day the drone spotted the person of interest way out on the prairie, alone, close enough to a road that quickly dispatched agents could and did scoop him up without resistance; presumably they all lived happily ever after. The detail that puzzled me then and now: the drone, still high enough to remain unseen, determined with high confidence that the target had no weapons on his person. Presumably he did not belong to a secretive and stealthy brigade of nudist patriots – so what instrument(s) enabled our heroic feds to so bravely bring him in alive?
Pierce R. Butler@#2:
The detail that puzzled me then and now: the drone, still high enough to remain unseen, determined with high confidence that the target had no weapons on his person. Presumably he did not belong to a secretive and stealthy brigade of nudist patriots – so what instrument(s) enabled our heroic feds to so bravely bring him in alive?
Probably an agent in place in his ranch. Since there would be no need for evidence they wouldn’t even have to set up parallel construction.
I’ve been thinking more about this post. The discussion reminds me of a book by Arthur C. Clarke and Stephen Baxter called The Light of Other Days. (I may be getting parts of it mixed up with Asimov’s short story “The Dead Past” which has a similar idea.) The premise is that scientists invent, and make the plans public for, a machine that allows what to peer into the past, anywhere in the world. Of course historians are overjoyed. So are atheists, because most religions except for things like shinto quickly dry up and blow away. But what they realize a bit too late is that the past includes, say, five minutes ago — so it’s the complete end of any concept of privacy.
As I recall, the second half of the book then essentially becomes a prolonged thought experiment on what a world without privacy would look like. Nobody writes mysteries any more, because there is no longer such a thing as a mystery — all crimes are solved instantly. There are still crimes, of course, but only crimes of passion, and the judicial system is revamped to accommodate this. Politics becomes a whole lot less corrupt. As I recall, the overall point was that, in the long run, the elimination of secrets might be a good thing for us as a species, even though children who grew up in such a world would almost seem like another species to us (a favorite theme of Clark’s, of course).
I’ve wondered if this was what you were kind of getting at with these posts, Marcus — that it’s too late to put the genie back in the bottle when it comes to the government surveying us, so maybe the best we can hope for is that we get to survey the government as well. Or is that reading too much into what you are saying?
I’m surprised civilian use of surveilance technology hasn’t picked up the way it was described in Vernor Vinge’s Rainbows End (at least I think that was the novel).
Basically, just put surveilance cameras on your house looking into all the public areas nearby (and probably on your car, too), record all the video, and hook your system into an on-line marketplace that can provide any of your footage to any buyer, for a small price (hopefully enough to cover your hardware and storage costs). Now if you want to retroactively follow someone, just pick a starting place and time where you know they were and observe where they go from there, buying footage from the marketplace as necessary. Everybody can surveil everyone!
The only way around this that I can see is to have some fairly stringent data-protection laws that require you to get permission from an individual to maintain this sort of data on them.
I wonder how much misinformation you need to feed into such systems before they become useless. E.g. when they’re cruising down the street, picking up license plate numbers, what if you just used a sharpie to change a number here and there? How many would you need to do, before the system became too unreliable to use?
LykeX@#6:
I wonder how much misinformation you need to feed into such systems before they become useless. E.g. when they’re cruising down the street, picking up license plate numbers, what if you just used a sharpie to change a number here and there? How many would you need to do, before the system became too unreliable to use?
Not that many – about 10%-20% false positives will take some systems’ effectiveness to zero. The question is not whether it can be fooled but whether there is a significant cost to repairing the data. [See: DCA Disambiguation Cost Attacks] – if it’s something expensive to disambiguate, it can collapse the whole system pretty quickly.
brucegee1962@#4:
As I recall, the second half of the book then essentially becomes a prolonged thought experiment on what a world without privacy would look like. Nobody writes mysteries any more, because there is no longer such a thing as a mystery — all crimes are solved instantly.
Have you read Alfred Bester’s The Demolished Man? It’s one of his great masterpieces, and it’s about exactly that.
Nah, the real question is whether anybody gives a shit about false positives. In some recent(ish) trials in the UK, the false positive rate was somewhere in the region of 90% (from memory), but that was considered acceptable because the cops in question could still “apply discretion” – i.e. only hassle people they figured were shifty anyway.
I guess it depends on what you’re trying to do… If you want to build an effective panopticon, then sure, false positives matter. If you’re just trying to come up with some cover for your officers’ racial and class prejudices, they’re a bonus.
Ah, yes: https://www.theregister.com/2020/03/05/facial_recognition_cameras_london_police/
Marcus Ranum @ # 3: Probably an agent in place …
We (those of us stuck here in the 21st century) need some sort of Occam’s Razor principle to the effect that the most cynical explanation is the most likely.