Warming to Big Brother; Biometrics and the new security age

Nov. 14 — Khalid al-Midhar was on an INS “watch list” — and being hunted by the FBI — when he boarded American Airlines Flight 77 on Sept. 11. A simple computer link between federal agencies could have stopped al-Midhar’s suicide mission cold. Frustrated investigators and a nervous American public are wondering why such an intelligent network of police data isn’t already in place. But a project to create that kind of gigantic database is now being built — it’s called Golden Shield, and it’s been designed by the Chinese Communist Party’s police agency to control Chinese citizens.

THE PROJECT DESIGN for Golden Shield, as described by Canadian watchdog group Rights & Democracy, could easily be confused with some of the proposals for digital police work that have surfaced in the United States since Sept. 11.

“The aim is to integrate a gigantic online database with an all-encompassing surveillance network, incorporating speech and face recognition, closed circuit television, smart cards, credit records, and Internet surveillance,” says Rights & Democracy researcher Greg Walton in a recent report. Golden Shield will “promote the adoption of advanced information and communication technology to strengthen central police control responsiveness and crime combating capacity.”

Two months ago, even the thought of such a project in the U.S. would likely have elicited immediate outrage. Even today, as just described, Golden Shield might not sound very palatable.

But piece by piece, a skittish American public seems willing to go along with many of Golden Shield’s tactics. A Harris Interactive poll taken in late September showed 86 percent favor use of face-recognition technology in public places; 68 percent favor implementation of a national ID card; and 54 percent approve of expanded government monitoring of cell phones and e-mail.

At the same time, Congress and the federal government have acted to broaden police powers over only scant objections. The euphemistically named “USA Patriot Act” was signed into law Oct. 26, giving law enforcement a wide swath of new data collection powers. More quietly, the Justice Department recently took a bite out of traditional attorney-client privilege rules. A new federal rule lets government agents monitor chats between people in federal custody and their lawyers if the attorney general deems it “reasonably necessary in order to deter future acts of violence or terrorism.”

“People are concerned about safety now and will put up with more invasions of privacy,” concedes Richard Smith, former CTO of the Privacy Foundation and now an independent security consultant operating ComputerBytesMan.com.

There is little debate that known terrorists should be kept off of commercial airplanes, and that technology which might help should be used. But how far America should tilt toward Golden Shield, and how effective computers can really be in fighting crime, are topics of hot debate.

Here are some increased powers of investigation that law enforcement agencies might use when dealing with people suspected of terrorist activity, which would also affect our civil liberties. The Harris Poll asked 1,012 adults to approve or disapprove of each proposal.

Surveillance video companies like Colorado-based Loronix Information Systems Inc. stand to gain the most financially from a newly digitized police force. The biometrics industry alone is expected to grow from $200 million this year to about $2 billion in 2004, according to research firm Morgan Keegan & Co.

Allison Gapter, Loronix spokesperson, says technology doesn’t really change police work or add a layer of intrusive tactics — it simply only optimizes work that’s already being done.

“It’s really no different from having a super security officer who can remember all the faces walking by as you walk into the airport. Imagine a security expert flipping through a mugshot book. All you are doing is automating that,” Gapter said.

Meanwhile, lawmakers are trying to ensure that investigators and law enforcement officers can legally take advantage of high-tech crime fighting techniques, a major goal of the controversial Patriot Act. Howard Schmidt, director of security at Microsoft and president of an industry coalition devoted to cybersecurity, said he felt the the Patriot Act merely helps level the electronic playing field between criminals and law enforcement.

“Regarding the USA Patriot Act, I don’t know if I would use the term ‘expanded authorities.’ There’s nothing in there that changes thresholds. If you need a wiretap, there are still the same requirements,” said Schmidt, who is also a special agent for the U.S. Army reserves and an FBI consultant. Instead, said the law takes away some advantages that had been gained by criminals exploiting legal confusion created by new technologies, he said.

For example, in the past, a wiretap order for a cell phone user only applied locally — if a suspect flew to another jurisdiction agents were required to get new wiretap order from the local federal court. “That really inhibited the ability to track people down.”

Such orders and search warrants are essentially portable now, making chasing criminals through cyberspace much easier. “That’s the concept behind what’s being done. But it’s same threshold of evidence required to get the court order.”

Whizzy technology can also provide unexpected advantages in the fight against criminals, she said. Loronix cameras are wired throughout a Washington Mutual bank in Los Alamedos, Calif. in an experiment with local police. A wireless network broadcasts images of what’s going on inside the bank to police officers outside — cops can watch a bank robbery unfold from laptop computers across the street. And if they have to approach the bank, video can even be displayed on Compaq handheld iPaq computers.

Mike Sullivan, a Naperville, Ill.-based police detective and nationally-known police technology consultant, says cops must be able to use high-tech gear to protect themselves.

“There can be a great officer safety benefit ... Police can know if they are walking into an ambush situation at the bank, for example, or can see if they are dealing with a hostage situation,” he said.

Cameras in airports or banks are one thing; cameras in public places seems to be another. When Florida authorities wired the Super Bowl this January with cameras and used face recognition software, public sentiment raged against the idea. At the same time, Tampa’s installation of cameras at public places revealed that local governments in the U.S. are already willing to do what might once have sounded Orwellian — watch their citizens remotely.

Loronix practices what it preaches — presence of video cameras is a way of life at the company. Visitors to the Loronix Web site can poke around the cubicles and hallways of the company’s Durango, Colo., offices, noting when employees get up for coffee or just wander around.

“We are just used to it,” she said, explaining that workers there don’t seem to mind. “If I had something to hide it would bother me ... but if you have nothing to hide it certainly becomes a non issue.”

But the issue is about more than hiding, argues Smith, the privacy consultant. When people know they are being watched, there is a so-called “chilling” effect, Smith says. People can’t act like themselves, and basic freedoms are eroded. Public exposure also offends our natural need for privacy, Smith says.

“People say they don’t have anything to hide and aren’t worried until their teen-aged daughter gets photographed ... and then they scream about it,” he said.

But beyond the privacy concerns, Smith and others skeptical of a newly digital police force point a more practical issue — does this stuff really work? When America is wired for safety, will we really be any safer? Or will we have created a network that is only effective in catching petty criminals and tracking the movements of law-abiding citizens, while emboldened terrorists outsmart the systems and exploit a false sense of security?

“What scares me is how superior we assume we are to terrorists, and that our technology will save us,” said Joel de la Garza, a security consultant with Securify.com. “You are not going to catch these people that way. They are just too savvy.”

For example, Hollywood movie plots make obvious that cameras on street corners can easily be foiled. Facial recognition programs have notorious failure rates, de la Garza says. And even worse — video networks designed to help police could actually help the bad guys. Bank systems broadcasting video could be hacked, making the scene available to the criminals, too.

Carole Samdup, spokesperson for the Democracy & Rights watchdog groups, thinks extensive police monitoring technology has already demonstrated its ineffectiveness.

“All this technology has existed for years and we still haven’t arrested anyone (using it),” she said. “Even Timothy McVeigh was under surveillance. We are trying to kill too many birds with one stone here.”

Boaz Guttman, former terrorism investigator in the Israeli police force, has used video camera evidence to investigate crime and hunt down suspects, but says they are only effective after a crime and are of little use in preventing terrorism.

“Video cameras in football stadiums prevent hooligans. Really? It helps get evidence after the big fight, no more,” Guttman said. He feels the same way about about wiretapping and other electronic monitoring.

“There is no miracle at all with wiretapping. It did not prevent crime even in Red Russia. ” he said. “What if terrorists use coded messages. He calls the bomb ‘cake’ and the target ‘my mother in law.’ You can intercept ‘til tomorrow, ‘til next week (and not stop terrorism),” he said. “If somebody thinks that with all this tracing alone, he will defeat terror .. as I said to an important person in your country ‘Sorry you are sleeping in the middle of the day.’ ”

“We see this more times then not,” Schmidt said. “Things people perceive as being done for feel-good reasons, thinking that technology is the panacea. Technology is not the panacea ... technology is generally just an aid .”

But the march of technology is often irreversible, and increased police monitoring and cross checking among federal agencies seems inevitable — and sometimes just plain common sense. Few would contest the kind of law enforcement database linking which might have stopped al-Midhar on Sept. 11. And the less controversial provisions of the USA Patriot Act were designed simply to clarify evidence-gathering rules in the complex new world of Internet communications. For example, Sullivan said, Internet service providers were allowed to divulge information on customers’ Internet travels to interested marketing companies or any almost other entity except law enforcement — which needed a court order to obtain such records.

“To say that every citizen in the country can have that information except for a police officer, is that making your data any more private?” he said.

Some newfangled security measures even have support among the staunchest privacy advocates.

Smith, for example, is generally in favor of more intense security measures at airports, such as the use of face scanning at airports.

“But the things we do have to make sense. For example, at first we banned curbside check-in, but then it came back because that didn’t make sense,” he said.

Holding the line at privacy invasions that “makes sense” is the most subtle of standards, a fine line that police, governments, and citizens will now try to walk in the post Sept. 11 world. Libertarian cries of absolute privacy sound empty these days, with the knowledge that Khalid al-Midhar and other plane hijackers exploited America’s lax security measures. At the same time, what’s to keep overzealous investigators from using the Anti-terrorism Act to create America’s version of Golden Shield? Sullivan, the techno-savvy police investigator, says the Supreme Court will play the crucial role in picking through those issues.

“The crux of the difference (between the U.S. and China) is the Supreme Court,” said Sullivan. “Ultimately they will decide what’s Constitutional and what’s not. We have the ability as U.S. citizens to cry foul. In China, citizens do not.”

--------- A nascent technology is rushed to the front line Facial recognition biometrics, like Viisage's FaceFinder technology, chart the human face, breaking it down into a digital "map" -- or Eigenface.

MSNBC NEW YORK, Nov. 20 — The next time you fly through Boston, your eyes, nose and mouth may be scrutinized — digitally cross-checked with the eyes, noses and mouths of suspected terrorists. Starting this month, Logan International Airport will try out two facial recognition systems designed to boost security after two hijacked planes originating at the airport changed the course of history.

EVEN BEFORE September’s terrorist attacks put the nation on edge, a controversial new security and surveillance technology known as biometrics was emerging.

Combine Star Trek’s futuristic fantasies, James Bond’s sex appeal and a pinch of Orwellian paranoia, and you’ve got the perfect recipe for biometrics, a technology that uses the human body as a password, key or ID.

London’s Heathrow airport has started directing selected international passengers to bypass immigration agents and instead look into a machine that captures the unique pattern of the iris, translates it into 512 bytes of binary data called an iris code and matches it to the passengers’ frequent flier numbers.

At Disney World in Florida, annual pass holders breeze through the gates of the Magic Kingdom by placing their hand on a scanner.

In Connecticut, the Department of Social Services stores the digital fingerprints of welfare recipients to combat “double dipping” fraud.

Casinos across the country routinely use facial recognition technology to snoop out known cheaters. A growing number of banks, including Texas-based Bank United, the Bank of America and Wells Fargo, are using biometric technology to improve the security of online banking and replace PINs and bank cards at ATMs.

In the pre-9/11 world, a mere reference to biometrics raised the hackles of privacy advocates, who said the word was synonymous with “Big Brother.”

Biometric security systems grant—or deny—access to buildings, information and benefits by automatically verifying the identity of people through their distinctive physical or behavioral traits.

Once “captured,” a biometric is translated algorithmically into a complex string of numbers and stored in a database as a template. Later, this template can be compared to any "live" biometric presented as proof of identity.

Finger imaging: Similar to an old-fashioned ink fingerprint, a scan of the finger is taken, revealing distinctive ridge patterns such as loops and whorls.

Hand geometry: The hand is lined up with five guide pegs on a platen. Ninety characteristics are examined, including the length and width of the fingers, and shape of the knuckles.

Facial recognition: The face is captured on video so the system can encode measurements between distinctive facial features.

Iris recognition: A video image of the eye is captured, and unique features such as iris pattern and color are then encoded.

Voice authentication: The voice is recorded to create a 'voiceprint' based on inflection and the distinctive highs and lows in a person's speech.

Retinal scanning: The retina at the back of the eye is scanned, revealing a unique pattern of capillaries that can be mapped and encoded.

Body odor: The chemical pattern of human body smell. Ear shape: The bone structure and shape of the outer ear and ear lobe.

Gait recognition: The pattern of movements made when the body is walking or running.

Facial thermography: The pattern of facial heat caused by the distinctive flow of blood under the skin.

Signature verification: The speed and pressure exerted by the hand when signing a name, as well as the static shape of the completed signature. Vein check: The vein structure, or “tree,” on the back of the hand.

Recently, however, such criticism has been muted considerably as many Americans appear willing to trade some privacy for more security.

Despite the enormous costs of widespread implementation and lingering disputes about the technology’s accuracy, Americans seem ready to give certain biometrics a try.

In a Harris Interactive poll conducted between Sept. 19 and 24, for example, 86 percent of the respondents supported the use of facial recognition technology to scan for suspected terrorists at key locations and public events.

Sept. 11 prompted commissioners from 20 U.S. airports that together handle 166.5 million passengers annually to meet and ask Congress for up to $4 billion in annual reimbursement funding to offset the costs of bolstering security — including installing biometric scanners in some airports.

“We now perceive aviation security as national security, ” said Stephen Van Beek of Airports Council International.

Currently, only a handful of airports around the globe rely on biometric ID systems, including Iceland’s Keflavik Airport and Toronto’s Pearson Airport.

But the race is on to install more. In addition to Logan’s tryout this month, officials at San Francisco International, Oakland International and Fresno airports have committed to installing some form of biometric security devices.

Congress, too, is casting aside suspicions and embracing the technology. During the past two months, representatives and senators alike have introduced a flood of bills that recommend or mandate the use of biometric technology in the war against terrorism.

September 10 — Facial recognition technology developed by Viisage technologies translates a person’s facial features into a long string of numbers that can be used to identify individuals electronically. MSNBC.com’s Ursula Owre Masterson reports.

Even before the September attacks, the federal government was buying into biometrics. Last year, the U.S. Department of Defense received a congressional mandate to set up an entire office devoted to researching current biometric technologies. Now, at a special lab in West Virginia, the Biometrics Management Office oversees the testing of hundreds of new products, recommending ones it deems best at improving security throughout the DoD, whether at the Pentagon or on the battlefield.

“Corporations and government agencies are turning increasingly to biometrics for security,” says Rick Norton, a spokesman for the International Biometrics Industry Association, “because PINs and passwords are notoriously corrupt, very easily compromised and expensive to administer.”

And “unlike car keys, you always have your biometric with you,” says John Woodward, a senior analyst at Rand who studies biometric policy issues. He says this “built-in” quality makes biometrics more convenient and secure than any other method of identification.

But while biometrics may offer the potential for greater security, civil libertarians warn that the emerging technology can also be used “passively” against us, and in places where terrorists are unlikely to tread.

“It’s inevitable that once you install biometric technology in airports, it will be used in more and more places” says Jay Stanley of the American Civil Liberties Union. “Then we might just slip further down the slippery slope to a surveillance society.”

Dr. Frank Askin, a law professor and civil liberties expert at Rutgers University, also is wary of the surge in biometrics’ popularity.

“When you have a lobby that has an economic incentive in this, and when it’s being fueled by concerns about terrorism, there’s always the potential for going overboard,” says Askin.

Even before terrorism concerns were paramount, video cameras equipped with facial recognition technology were being used in several U.S. and European pilot projects to scan streets for criminals. Such projects still touch a nerve among those who maintain that, even in the name of security, we shouldn’t have our every move tracked or our most personal information digitized and stored in databases.

Then there’s the issue of the databases themselves. In the wake of the attacks, there has been renewed talk of issuing every U.S. citizen a national ID card, encrypted with biometric information such as a digital fingerprint.

But any resulting government database could be misused, according to biometrics detractors. In a recent op-ed article for SF Gate’s Tech Beat, Silicon Valley columnist Hal Plotkin reminds readers that “our government officials have an already notorious track record of harassing or targeting out-of-favor groups.” Plotkin cites the internment of Japanese-American citizens during World War II and Vietnam War-era protesters audited by the Internal Revenue Service.

In answer to such complaints, some in the industry, like Visionics, a New Jersey-based leader in facial recognition, have suggested specific measures designed to uphold privacy rights and ensure that databases don’t get overloaded with images of average, law-abiding citizens. These include a “no match-no memory” system that would insure no images are kept by a system unless matched to a criminal.

Back in January, after facial recognition was used at Super Bowl 35 to scan crowds for criminals, civil libertarians were outraged. Some called the game the “Snooper Bowl” and said the scans amounted to a “digital line-up.”

Then U.S. Rep. Dick Armey, R-Texas, got involved. When police in Tampa, Fla., used biometric technology on the streets of a popular city neighborhood, Armey blasted the city’s hi-tech surveillance and asked for a General Accounting Office study on the source of funding for such technologies.

Today, however, such pre-September memories are fading, and Americans have more to worry about than petty criminals showing up at ball games. The prospect of foreign terrorists in our midst, committed to killing themselves while murdering thousands of civilians, has prompted an increased willingness to give up some personal information in exchange for peace of mind.

Perhaps not surprisingly, the biometrics industry is one of the few beneficiaries of September’s tragic events. A week after the attacks, while other stocks were plummeting, Visionics didn’t waste a moment, sending an e-mail to reporters on the afternoon of the 11th saying that its founder and CEO, Joseph Atick, “has been speaking worldwide about the need for biometric systems to catch known terrorists and wanted criminals.” A week later, Atick testified at a meeting held by Transportation Secretary Norman Mineta about the importance of facial recognition as part of a new national security plan. NO PANACEA

Still, it’s unlikely — in the near future at least — that we’re all going to have our faces, fingers and eyes scanned every time we travel.

First, the costs of installing biometric tools and then integrating them with centralized databases is enormous, not to mention time consuming.

Second, as biometrics’ detractors are always eager to point out, the technology’s accuracy is still debatable. The National Institute of Standards and Technology cites Defense Department studies that showing that, in some cases, lighting conditions and even the presence of eyeglasses can throw off certain facial recognition programs.

Third, even industry insiders caution that biometric technology is not a panacea for all of today’s security woes.

“Biometrics is a very important additional tool,” says Tom Colatosti, president and CEO of Massachusetts-based Viisage Technologies, Visionics’ leading competitor in the field of facial recognition. “But we should still have the titanium doors in cockpits, sniffing dogs and X-ray machines.”

Then Colatosti adds a final thought: “It’s just that this technology could make the most impact. After all, two of the hijackers on September 11th were on an FBI watch list. If their faces had come up as a match, things might have turned out differently.”

September 10, 2001 — The Connecticut Department of Social Services utilizes ’finger imaging’ biometric technology to keep track of their welfare recipients. MSNBC.com’s Ursula Owre Masterson reports.

Bush federalizes force at airports nationwide

By Bill Sammon

November 20, 2001

THE WASHINGTON TIMES

President Bush yesterday federalized virtually the entire security work force at the nation's airports, abandoning his fight to use private contractors who would be easier to discipline or fire for security lapses. "Today, we take permanent and aggressive steps to improve the security of our airways," Mr. Bush said during a bill-signing ceremony at Ronald Reagan Washington National Airport.

"The events of September the 11th were a call to action, and the Congress has now responded," he added. "The law I will sign should give all Americans greater confidence when they fly."

But the president initially opposed the legislation's centerpiece, which will make unionized federal workers of all 28,000 passenger and baggage screeners within a year. Mr. Bush wanted the federal role limited to the supervision of the screeners, but Democrats insisted on a total federal takeover.

"We have our political differences, but we're united to defend our country, and we're united to protect our people," Mr. Bush said. "For our airways, there is one supreme priority: security."

Facing mounting public pressure to increase aviation security, Republicans agreed to a bill they called a compromise because it exempts a handful of airports and allows the rest to switch back to private contractors after three years. But with few airports expected to reverse the federalization of the work force, this stipulation was widely viewed as a fig leaf for retreating Republicans.

The legislation also created a new agency under the Transportation Department to oversee all airport security matters.

"We are preparing for a swift transition," said Transportation Secretary Norman Y. Mineta.

The first phase of that transition will involve staffing airport security points with federal managers, the precursors to a full federal work force. There will also be criminal background checks conducted on 750,000 airport employees.

Mr. Bush insisted there will be a way to get rid of any goldbrickers.

"The new security force will be well trained, made up of U.S. citizens," he said. "And if any of its members do not perform, the new undersecretary will have full authority to discipline or remove them."

By mid-January, airlines will start charging passengers an extra $2.50 per flight to help pay for massive increases in security costs. In some cases the charge will be $5.

During that same period, airports must begin screening checked baggage with whatever means available, including hand inspections and X-ray machines. By 2002, the airports will use machines that can detect explosives.

The federal government will also deploy more undercover air marshals. The National Guard will send more troops to guard airports, especially during the holiday travel season. The FBI will beef up its cross-checks of passengers.

While more passengers will be subjected to searches, others will eventually be able to earn "trusted passenger" status that will expedite the screening process.

With many Americans already growing weary of being repeatedly searched before routine flights for business or pleasure, it remains unclear whether the stricter security standards will help or hurt ticket sales. But Mr. Bush made clear that safety is of paramount importance.

"Security comes first," he said. "The federal government will set high standards, and we will enforce them. These have been difficult days for Americans who fly and for American aviation."

Mr. Bush emphasized that even before yesterday's enactment of an aviation security bill, the airlines and federal government were taking steps to thwart future terrorist hijackings.

"Since September the 11th, the federal government has taken action to raise safety standards," he said. "We've made funds available to the aviation industry to fortify cockpits.

"More federal air marshals now ride on our air planes," he added. "The Department of Transportation instituted a zero-tolerance crackdown on security breaches."

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.