Comment

Networked devices extend reach toward smarter surveillance

A picture of a person of interest can be gained by linking data from loyalty cards, mobile phones, credit cards, travel cards, social network sites and medical records.

ASIO's recent advertisement for blue-collar workers to apply to become surveillance officers attracted considerable media attention. To a large extent, we are still locked into human surveillance, both fixed and mobile, in places like the western suburbs of Sydney to monitor the activities of persons of interest. But in the future, these people's activities will be monitored increasingly by a range of networked devices.

A covertly placed data-linked surveillance camera is much less obvious than a human and is more reliably attentive. In some dangerous operating environments, like Northern Ireland or Syria, covert monitoring devices can significantly reduce surveillance risks. For mobile work, a real-time data-linked quadcopter could be a useful surveillance platform in some circumstances where human surveillance would be too obvious or risky.

A covertly placed data-linked surveillance camera is much less obvious than a human and is more reliably attentive.
A covertly placed data-linked surveillance camera is much less obvious than a human and is more reliably attentive. 

While civil libertarians worry about over-zealous data collection by intelligence and security organisations, the reality is that commercial organisations often have more information about us than the government does. As soon as you sign up for a commercial loyalty program to get whatever benefits are offered, your purchasing history will be tracked and recorded, and can be linked to your image using facial recognition software. I was told by an "intelligent analytics" analyst in the US that one shopping chain can tell when a woman is pregnant before she knows it herself, just by where she stops in the store. This information is used for personalised push-marketing of baby-related products.

A more comprehensive picture of a person of interest can be gained by linking data from loyalty cards, mobile phones, credit cards, travel cards, social network sites, medical records, etc.

One of the challenges of remote surveillance in a city environment is linking CCTV coverage to provide comprehensive cover. This has largely been achieved in London with overlapping coverage. Melbourne also has good CCTV coverage. In London, the Met has a record of all private security CCTV coverage that can be accessed if necessary. This could be used, for example, to backtrack from a terrorist attack to determine where the terrorists came from and who they are – including by using CCTV on public transport, motorway cameras on highways into London, etc.

CCTV coverage has even been linked in some British cities to traffic light operation to prevent criminals or violent offenders from escaping by vehicle. Automatic number plate readers are also a useful surveillance or interception tool.

We are familiar with the internet as the fastest way of accessing and exchanging data. In a pre-internet Italian kidnap case involving an American general, security authorities were able to determine which city apartment he was being held in by matching telecommunications activity data with unusually high electrical power use and late-night vehicle traffic patterns. At the time it took several days; now it could be done in several minutes.

Earlier this month during testimony to the US Senate, Director of National Intelligence James Clapper acknowledged that the "Internet of Things" (IoT) could offer new means to track and monitor citizens. The IoT is the network of physical objects – devices, vehicles, buildings and other items that are embedded with electronics, software, sensors, and have internet connectivity, which enables them to collect and exchange data.

DNI Clapper noted "In the future, intelligence services might use the IoT for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials."

Integration and programming of the IoT to identify the characteristic movements and activities of a person are already achievable. This might be useful for example for monitoring a property to ensure that the person of interest is still there from his or her distinctive use of the IoT.

The Berkman Center for Internet and Society at Harvard in a report published earlier this month suggested that products ranging from "toasters to bedsheets, light bulbs, cameras, toothbrushes, door locks, cars, watches and other wearables", will give the government increasing opportunities to track suspects and in many cases reconstruct communications and meetings.

When my wife and I had a rental car on Route 66, she accidentally touched a red button on the rear view mirror. A voice immediately came over the radio saying "What is the nature of your emergency?" When my wife apologised for pressing the button, the voice said "Enjoy Kansas - have a nice day". Clearly the rental company could listen in to our conversations and track our location if it chose to do so.

Some concerns have been raised that the IoT is being developed without appropriate consideration of the potential threat to consumers from hostile non-government sources. According to a Business Insider survey in 2014, 39 per cent of respondents said that the security threat posed by the IoT was their biggest concern.

When David Petraeus was CIA Director he noted that internet linked household devices "change our notions of secrecy" and prompt a rethink of "our notions of identity and secrecy".

In a January 2014 article in Forbes, cybersecurity columnist Joseph Steinberg listed many internet-connected appliances that can already "spy on people in their own homes" including televisions, kitchen appliances, cameras, and thermostats. He added "Computer-controlled devices in automobiles such as brakes, engine, locks, hood and truck releases, horn, heat and dashboard have been shown to be vulnerable to attackers who have access to the onboard network." Such vehicle access could be used both for travel reconstruction purposes and for assassination.

It is also possible to not only monitor but also assassinate someone in a smart house by overriding safety systems and turning on the gas and then igniting it when the optimum air to gas mix is reached.

The US National Intelligence Council concedes that it would be hard to deny "access to networks of sensors and remotely-controlled objects by enemies of the US, criminals and mischief makers ... An open market for aggregated sensor data could serve the interests of commerce and security no less than it helps criminals and spies identify vulnerable targets."

IT security practitioners recognise that the seemingly attractive combination of lower operating costs and convenience for consumers inevitably results in degraded personal security, which fortuitously for those in security intelligence makes surveillance and monitoring easier.

Clive Williams is an adjunct professor at the Australian Defence Force Academy and an honorary professor at the Australian National University's Centre for Military and Security Law.