Showing posts with label privacy. Show all posts
Showing posts with label privacy. Show all posts

Child's Play: Hacking the Internet of Things

...

A company called VTech based in Hong Kong makes smart toys for kids.  One of their tablet products can connect to a parent's smartphone with a service called KidConnect, allowing children to send photos and text messages to their parents.  Sounds all nice and family-friendly, yes?  Well, in November the website Motherboard revealed that a hacker had managed to get into VTech's servers and download thousands of private photos, messages, passwords, and other identifying information that KidConnect users had sent and received.  This has understandably upset digital media commentator Dan Gillmor, who swears in a recent Slate article that not only he will never buy any Internet-enabled toys for children, he doesn't think anybody else should, either.  Reportedly, VTech has shut down the KidConnect service until they can do something about security.  But this incident brings up a wider question:  what dangers does the Internet of Things pose for children?

In case you've been living in a cave somewhere, the Internet of Things (IoT, for short) is the idea that in the very near future—by some measures, right now—internet connections, sensors, and the hardware and software needed to use them will be so cheap and ubiquitous that lots of everyday items will be connected to the Internet, sending and receiving data that will make great changes in our lives.  The promoters of IoT naturally hope that these changes will be for the better, and can point to examples that have done that.

This matter gets close to home for me personally, because for the last several years I have supervised electrical engineering senior design teams at my university, and several of the past and current teams have worked on projects that are IoT-related.  About four years ago, one team's project was a communications system designed to monitor electric-power consumption in the home, at a finer-grain level than just what the electric meter could sense about overall power consumption.  The idea was that if consumers have a detailed profile of their electricity usage, they can make more intelligent choices about what to turn on when.  Maybe doing the laundry late at night instead of right when you get home in the afternoon will put usage into a more favorable rate period, for example. 

As I was discussing the project with the team, it occurred to me that this information could be used for nefarious purposes.  You can tell a lot about a person if you have the kind of usage information the team was planning to measure: whether the user is home, for instance, and even what appliances are used and how often.  So I brought up this ethical issue with the team and made sure that they mentioned it in their final report. 

Since then, companies such as Freescale Semiconductor have jumped into IoT-related products and devices in a big way.  (Full disclosure:  Freescale has donated equipment and funds to the Ingram School of Engineering, where I work.)  From all I can tell, the Internet of Things is going to happen one way or another, and it behooves both engineers and the general public to give some thought to any possible downsides before something really bad happens.

Returning to the question of children and IoT, we are in a peculiar position these days.  Many children and young adults are vastly more tech-savvy than their parents, and this makes it hard for the parents to institute meaningful controls on what kids do online.  In the bad old days when the list of dangerous things in the home was mainly physical—guns, knives, poison, screwdrivers near electric outlets—it was a fairly simple matter for parents to keep toddlers out of harm's way.  But in the case of some toy that hooks up to your WiFi network, odds are that the parents are as clueless as the children regarding the privacy and security measures taken by the device's maker.  VTech itself didn't know how vulnerable its servers were until some enterprising hacker cracked into them and notified the media. 

Despite living with the Internet for close to thirty years now, we still have some things to learn about it, among which are new ways of using it that are potentially hazardous.  And children are an especially vulnerable population, as everyone agrees.  It's shortsighted to think of children always as the innocent parties in these matters too.  Some kids can be downright wicked, bullying others mercilessly.  Before we got so interconnected, a bully's sphere of influence was limited to the radius reachable by his fists, but hand a bully a smartphone with some sort of anonymous chatting app on it, and it's like putting wings on a wildcat.  His bullying sphere has instantly widened to include the entire globe, limited only by language ability and time.  And we have already seen instances in which Internet bullying has driven some vulnerable individuals to suicide.

Nobody is calling for a wholesale ban on Internet-enabled toys or anything like that.  But as I have often emphasized to my students in discussions of engineering ethics, many ethical lapses in the area of engineering can be traced to a lack of imagination.  When you are dealing with a physical structure like a bridge, it's relatively easy to calculate the maximum loads and find out how strong each member has to be for the bridge not to fall down.  But in any system that is intimately bound up with the behavior of people—especially millions of people at a time—your imagination has to anticipate the character and intentions of persons perhaps very different from you, who will twist your system around to serve their possibly sinister purposes. 

That is why privacy and security concerns need to be considered at the very beginning of any project that involves the Internet, and especially when a product is intended to be used by children.  VTech clearly did an inadequate job in this area, but they can serve as a bad example to warn future designers and users of IoT-enabled gizmos.  The craft of lockmaking is nearly as old as the craft of housebuilding, and for a good reason.  There are bad actors out there, and any time we open up a channel of communication involving a private citizen or residence, it needs to be guarded with the same care that we would extend to our own physical possessions.  Beyond mere technical ability, doing that well requires moral imagination, which should be in the toolkit of every good designer.

Sources:  The online magazine Slate carried the article "Parents: This Holiday Season, Do Not Buy Internet-Connected Toys for Your Kids" by Dan Gillmor at http://www.slate.com/blogs/future_tense/2015/12/03/internet_connected_toys_make_terrible_holiday_presents.html.  That article referenced a report at Motherboard describing the VTech hack and what the hacker found, which is at http://motherboard.vice.com/read/hacker-obtained-childrens-headshots-and-chatlogs-from-toymaker-vtech.

Privacy and Backscatter X-Ray Technology

...

The New York City Police Department owns an unknown number of high-tech vans that allow their operators to play Superman—at least with regard to his X-ray vision abilities.  An online article in The Atlanticlast month describes how NYPD Commissioner Bill Bratton indirectly admitted his organization was using X-ray vans when he refused to discuss the matter at a press conference, citing security concerns.  Superman was a fictional character whose strictly limited flaws were in service of a plot that always ended in the triumph of the unquestionably good over the irrevocably bad.  But real life isn't so simple.  And there are real concerns about the way the NYPD may be using this technology.

First, how does it work?  Offhand, it sounds highly irresponsible for somebody to just shoot X-rays at random passersby.  X-rays are a form of what is called ionizing radiation, meaning that they have enough energy to knock electrons out of atoms to make ions.  Such ions can wreak havoc in the DNA of a biological target, for instance, and lead to cancer and other problems.  That is why medical X-ray systems are highly regulated and only properly trained operators are allowed to use them.

But there is apparently a sort of escape clause for non-medical equipment that uses X-rays.  If it meets a certain technical standard that limits the amount of exposure someone would get from a typical spying operation that lasts a few seconds, then the FDA is not involved and the rules change.  According to numerous sources, the type of X-ray machinery used by the NYPD uses so-called "backscatter" X-ray technology that falls into the low-dose category. 

It's really rather clever.  Conventional X-ray machines use a transmission approach, sending X-rays through the item to be examined and recording what comes out on the other side.  Your dentist uses this type of machine, and the image of your teeth shows up because bone is denser than air or soft tissue and absorbs and scatters more X-rays.  But obviously, for transmission X-rays to work, the rays have to be strong enough to get all the way through the item being examined.

Backscatter X-rays work differently.  Instead of producing a strong beam that illuminates the whole target at once and goes through it, a scanning type of backscatter unit sends a "flying spot" of X-rays sweeping across the target, which could be a person inside his or her clothes, or even a car.  These X-rays don't have to penetrate the target.  Instead, all they have to do is cause a thing called Compton scattering, which is basically what happens when an X-ray encounters an electron and is generous enough to share some of its energy.  The electron takes off with some of the energy and a new X-ray photon appears carrying the energy that's left. 

It is these new lower-energy X-rays that are detected by the backscatter machine, which consequently does not need to use X-rays that are as energetic as those used by conventional transmission machines.  That and the fact that any one point on the target is exposed to X-rays for only a small fraction of the total time of exposure, means that the X-ray dose of a backscatter unit is much smaller than, say, what you'd get from a medical chest X-ray.  Numerous sources confirm that the dose is so small from a surveillance backscatter X-ray device, that you would get something similar by just standing on a street corner for an hour or so and exposing yourself to background radiation.  This comes from sources like cosmic rays and the potassium in construction materials, and everybody gets that every day, twenty-four hours a day.  So despite some concerns on the part of investigative journalists that there are health hazards from backscatter X-ray technology, as long as the systems are working properly and used properly there are much more important things to worry about.  

To my mind, the greater concern about these systems is privacy.  You don't think that research directors of government agencies would go in for public cheesecake photos of themselves, but the Wikipedia article on backscatter X-rays shows such an image of Susan Hallowell, director of the U. S. Transportation Security Administration's research lab.  It is, er, very clear that the image is that of a woman.  We can all be glad that she wasn't a man. 

At this point, we should take a look at the U. S. Constitution's Fourth Amendment, which is short enough to quote in full here:  "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."  Updating its 1792-era language to modern terms, it means that no government official can snoop on you unless they swear or affirm that they have a good reason to do so, and the officials can say exactly where they're going to look and what they're going to look for.

I'm not a lawyer, and since the Fourth Amendment was passed it has accumulated various qualifications and exceptions, like a ship picks up barnacles.  But the principle that the writers of that amendment had in mind is still clear.  A person's body, house, papers (which was the only way to record data back then), and "effects" (as in personal effects—what a ten-year-old would call "my stuff") are inviolable against government attempts to mess with them—taking them, looking at them, or anything along those lines.  The only cause strong enough to justify such violation is when the government has a good case to show that something is amiss and can describe what they want to look for and where.  This clearly rules out fishing expeditions, in which an official simply snoops at will and starts investigating a crime when the snooping itself provides evidence.

Right now, the NYPD is in effect saying "Trust us, we're using this X-ray van the right way."  But if citizens can't even know how many vans there are, let alone how they're being used, that is asking for a heck of a lot of trust.

Sources:  The Atlantic's article "The NYPD Is Using Mobile X-Ray Vans to Spy on Unknown Targets" appeared on Oct. 19, 2015 at http://www.theatlantic.com/politics/archive/2015/10/the-nypd-is-using-mobile-x-rays-to-spy-on-unknown-targets/411181/.  I also consulted the websites of firms that make such devices, including American Science and Engineering at www.as-e.comand the Tek84 Engineering Group at www.tek84.com.  I thank my nephew Matt, a graduate student in criminal justice, for bringing this matter up at the Thanksgiving dinner table. 

Rolling Back Mass Surveillance

...

Bruce Schneier is a man worth listening to.  In 1993, just as the Internet was gaining speed, he wrote one of the earliest books on applying cryptography to network communications, and has since become a well-known security specialist and author of about a dozen books on Internet security and related matters.  So when someone like Schneier says we're in big trouble and we need to do something fast to keep it from getting worse, we should at least pay attention.

The trouble is mass surveillance.  In his latest book, Data and Goliath, he explains that mass surveillance is the practice of indiscriminately collecting giant data banks of information on people first, and then deciding what you can do with it.  One of the best-known and most controversial examples of this is the practice of the U. S. National Security Agency (NSA) of grabbing telecommunications metadata (basically, who called whom when) covering the entire U. S., which was revealed when Edward Snowden made his stolen NSA files public in 2013.  Advocates of the NSA defend the call database by saying the content of the calls is not monitored, only the fact that they were made.  But Schneier makes short work of that argument in a few well-chosen examples showing that such metadata can easily reveal extremely private facts about a person:  medical conditions or sexual orientation, for example. 

It's not only government overreaching that Schneier is concerned about. Businesses come in for criticism too.  With data storage getting cheaper all the time, many Internet firms and network giants such as Google and Yahoo find that it's easier simply to collect all the data they can on their customers, and then pick through it to see what useful information they can extract—or sell to others.  This happens all the time.  Maybe the most visible evidence of it happens when you go online and look for, say, a barbecue grill at a hardware-store website.  Then, maybe several days later, you will be on a completely different site.  Say a vegetarian friend is coming over and you're looking up how to make vegan stew.  Lo and behold, right next to the vegan recipe, there's an ad for that barbecue grill you were looking at a few days ago.  How did they know?  With "cookies" (bits of data retained by your browser) and behind-the-scenes trading of information about you and your browsing habits.

But Schneier reserves his greatest concern for something that is perhaps hardest to define:  the loss of privacy.  The right to privacy is a vital if poorly defined right whose absence makes normal life almost impossible.  Schneier says, "Privacy is an inherent human right. . . . It is about choice, and having the power to control how you present yourself to the world."  Mass surveillance tramples over the right to privacy and trains millions subtly to alter their ways of living to avoid the pain of secrets revealed.  This way of living was familiar to those whose lives were monitored by totalitarian regimes such as the old East Germany or the Soviet Union.  True, Google isn't going to send a jackbooted corporal to your door if you say something nasty about Sergey Brin, Google's co-founder.  Brin himself was born behind the Iron Curtain, though his family emigrated when he was six, and he probably remembers little or nothing about the USSR.  Nevertheless, Google and other firms that collect massive amounts of private data from their customers have set up a situation in which the privacy rights of millions, even billions, depend solely on the good intentions of a few powerful decision-makers in private companies. 

So what do we do about this?  Schneier has lots of suggestions, and points to Europe as a place where privacy is more respected in law and custom.  Changing laws is a necessary first step.  Whenever anyone moves to restrict the mass-surveillance habits of government entities such as the NSA or the Federal Bureau of Investigation, their defenders threaten us with a terrorist apocalypse, saying if we don't give up this or that privacy right, we'll tie the government's hands and be helpless before terrorist assaults.  Schneier spends a lot of time taking apart this argument, to my mind pretty convincingly.  For one thing, mass-surveillance data has not proved that useful in uncovering terrorist plots, compared to old-fashioned detective work focused intensely on a few known troublemakers. In general, government should abandon most mass-surveillance practices in favor of concentrating on specific investigations, with permission granted by courts whose workings are made public to the extent possible.

As for massive snooping by private enterprises, Schneier thinks regulations are the best option.  These regulations would impose a kind of "opt-in" system.  Currently, if you have a privacy-related choice at all in dealing with Internet firms, you have to go to a lot of trouble to make them respect your privacy, if they will allow such a thing at all.  Under Schneier's proposed policy, companies could not take away your rights to your data without your explicit permission, and the choice would be explained clearly enough so that you wouldn't need to have your techno-lawyer read the fine print to understand what's going on. 

Neither Schneier nor I are political scientists, so it's hard to say how we would get from the current parlous situation to one in which online privacy is respected, and nobody can snoop on you unless they go to a lot of trouble and get special permission to do it.  But he's told us what the problem is, and now it's up to us to do something about it.

Sources:  Bruce Schneier's book Data and Goliath:  The Hidden Battles to Collect Your Data and Control Your World was published by W. W. Norton in 2015.  The quotation from it above is from p. 126.  I also referred to Wikipedia articles on Edward Snowden, MAINWAY (the NSA call databse), and Sergey Brin.