PC World.com



Yes, You Are Being Watched


At home and in the office--and everywhere in between--you could be under legal digital surveillance.


Stephen Lawson, IDG News Service

Friday, December 27, 2002

If you're feeling fenced in some day, you may decide to take a trip to your favorite gambling mecca, where anything goes.

Before you leave, you may want to tell your friends, and while you're at it, let them know what you've been doing lately. Depending on where you are, and whether what you do sounds suspicious, the government may read that e-mail.

If you go to the town square to wave down a taxi to the airport, you may also be waving to a camera housed in what looks like a street lamp. If you look like a wanted criminal, you may draw the attention of a security guard watching a monitor, or the guard across the street.

You can bypass all that by driving to the airport. But if you keep your mobile phone on, the carrier will always know where you are by triangulation using the phone's signal.

At the airport, you may have your face scanned again. This may actually speed your rush to freedom, because if you're a frequent flyer who's volunteered to be prescreened, you'll probably face less scrutiny before you get on the plane.

Finally, you'll reach the gambling mecca. The management there likes people-watching, too. If you've been there before and they suspected you were cheating, your face may set off an alarm. Or if you're just a high-roller who volunteered to be identified automatically, they'll welcome you by name. Then you'll be free.

If it feels like Big Brother is watching you, it may really be your boss, or a big bank ... or your own big brother.

Under Surveillance

On one hand, you're onto something: Use of surveillance tools is growing, and new technology is making them more powerful all the time. On the other, there's a big difference between surveillance in George Orwell's novel 1984 and in the real world of the 21st century. In Orwell's book, the government planted listening devices and two-way televisions called "telescreens" in homes, offices, and public places. These days, the government doesn't have a monopoly on ways to watch, listen to, or find you.

Some such technologies remain in the hands of a few powerful entities and are shrouded in mystery. However, today the spy kits of private companies may contain tools that a potential target might not even know exist. By the same token, some supposed surveillance capabilities are less science than fiction.

Privacy laws vary widely around the world, but the technology trends creating new ways to invade privacy are pretty much universal. Devices are getting smaller and cheaper, networks to access the collected data are getting faster, the Internet is getting bigger, and software for data analysis is getting smarter.

Although different surveillance technologies may be used together, they fit into a few broad categories: tools for watching or listening in the physical world, monitoring activity in cyberspace, locating people or things, and interpreting the information that's collected.

Miniature Machines

Cameras and audio recording devices are getting smaller and their wireless communication capabilities are growing, warns Richard Hunter, a Gartner analyst and author of World Without Secrets: Business, Crime, and Privacy in the Age of Ubiquitous Computing. Combined with powerful back-end systems on the other end of those wireless links, they are becoming virtual eyes and ears for just about anyone.

"The miniaturized aware machines ... will not only see and hear what's going on around them, but they will be able to understand it in ways similar to the ways humans understand it," Hunter said.

Wireless digital cameras with microphones and radios, now about the size of a golf ball, within two or three technology generations could be the size of a shirt button and cost $25, Hunter said.

"When you walked down the street, anyone might have multiple such devices on their person," Hunter said. Likewise, "If you have a surveillance device the size of a button, you could have hundreds of them in a room without anyone being aware," he said.

Meanwhile, wireless network connections at speeds of 5 to 20 gigabits per second eventually will allow those devices to constantly send large amounts of data, he added.

Digital video cameras already have slashed the cost of surveillance in public spaces and private buildings in the past few years, putting unsuspecting people in the gaze of a lot more cameras. Digital cameras can be made much smaller than analog ones, said Mihir Kshirsagar, a policy analyst at the Electronic Privacy Information Center, a watchdog group in Washington, D.C. They also produce clearer images, which can be transmitted over long distances in the same ways as any data.

Your Face Looks Familiar

Increasingly, digital surveillance cameras are being used with face-recognition software that links what a camera sees with a database of pictures and facial measurements, which in turn are linked to criminal records or other information.

When a face appears that matches a suspicious person's to a set degree of sensitivity, an alarm goes off in a control center and a human operator looks at other factors--height, sex, hair color, and so on--to see if they match, according to Joseph Atick, president and chief executive officer of Indentix, in Minnetonka, Minnesota, a maker of face-recognition systems.

Set to high sensitivity, a system can identify 90 out of 100 people sought, with 2 percent to 3 percent false positives, Atick said. A lower setting cuts the number of false positives, but also the detection rate. Meanwhile, the systems are getting better: They can now identify 40 characteristics of a face in real time, up from 20 a few years ago, he said.

The technology poses little danger to most people who walk through a public place, Atick said. False positives can be cleared up easily by a human operator monitoring the video stream or visiting the site in person, he said.

Public Safety

Face recognition has been deployed with surveillance cameras in public areas of several cities in the U.S. and the U.K., as well as in casinos, where files are sometimes kept on suspected cheaters, according to Gartner's Hunter. It's also beginning to be used at checkpoints, such as for airport security.

Atick and some other experts say face recognition can be used only to detect certain people and not to identify everyone. That may be all it can ever be used for, because lighting conditions change and pedestrians don't always face the camera.

"Over the next ten years or so, you're not going to be able to build a system that would be able to identify every person who walks by a camera in a natural outdoor environment," said Larry Davis, a professor of computer science at the University of Maryland in College Park.

At the Office

Researchers at the University of California at San Diego are developing "intelligent rooms" where hidden cameras and microphones are linked to software for analyzing someone's face, voice, and walk. The system is intended to compare the combination of those characteristics against a database of personal characteristics to identify people, said Mohan Trivedi, professor of electrical and computer engineering. It could even identify a person's mood from facial expressions.

Trivedi sees the technology as making it easier to hold a videoconference. Cameras could focus in on the person talking at any given time, and the session could be recorded and later searched by subject, speaker, and other factors. His group is now experimenting with a new, smaller generation of gear. The team has outfitted a laboratory with 50 cameras built into the walls and furniture.

"We would like to make all the sensors invisible and absolutely unobtrusive," he said.

Watching Over You

A critical hurdle for such systems is the capability to analyze images and spoken conversations, Hunter said. Winston Smith, Orwell's protagonist in 1984, never knew whether government agents were watching him through the telescreen. He thought there weren't enough of them to watch all the time.

But this kind of data analysis could let software, not humans, filter the incoming data. That could mean a lot more monitoring, according to Gartner's Hunter. By 2010, large-scale analysis of images and spoken words will be possible, but probably only in specialized domains with their own key words, such as health care or finance, Hunter predicted.

Trivedi's team has seen progress in this area.

"We are further along than what I used to think," he said. In UCSD's intelligent room, a computer now can identify two people shaking hands in real time.

Tracking Device

The growing power of microprocessors and software also is making it easier for others to know where you are. For that matter, the lowly cell phone has been a fairly effective tracking device for years.

"It's basically a vast surveillance network that half of us are now tied into, that follows us around," said Richard M. Smith, an independent security consultant in Cambridge, Massachusetts.

The network needs to keep track of where the handset is so it can be handed off to the next cell. That means it's possible to pinpoint a person's location to within less than a mile, according to Jim Southworth, chief technical officer of East By North, a broadband consulting company in Reston, Virginia. Government agencies can tap into that information in real time if necessary, or check carrier records, he said.

Location detection takes a big step forward with Global Positioning System, in which devices on the ground or in the air determine their own locations using signals received from a network of satellites. This system can pinpoint the location of any GPS device to within feet, Southworth said. The devices are quickly growing smaller and are being pitched as add-ons for mobile phones and cars.


Doing a Little Digital Eavesdropping

There is a wide range of technologies for eavesdropping on what people send over data networks and even what they do on their own computers. They break down roughly into consumer tools, ones made for companies with IT specialists, government capabilities, and the murky area of methods used by hackers and other rogue agents, according to Erik Laykin, president of consulting company Online Security, in Los Angeles.

Surveillance software is available off the shelf and on the Internet for consumers, such as parents keeping an eye on children's computer activity. Vero Beach, Florida-based SpectorSoft's EBlaster can copy all Web sites visited, keystrokes typed, and e-mail messages sent and received from the computer on which it is running. That information can then be forwarded to someone else's e-mail address, such as that of a parent at work. Programs like this could also be installed surreptitiously, for example on a PC at a competing company, through a virus or other means, according to Gartner's Hunter.

In addition to software for keystroke recording, there is at least one stealthy hardware device that does the same thing. KeyGhost, in Christchurch, New Zealand, sells a small cylindrical device that can be plugged into a keyboard cable and looks like an electrical adapter. It can capture about eight months' worth of keystrokes in flash memory.

Invisible Surveillance

Corporations can do something similar on a larger scale using Raytheon's Silent Runner, a "watered-down" version of a tool originally developed by the U.S. National Security Agency, Online Security's Laykin said. His company is a reseller of the software.

"Once the tool has been placed on a network, the tool is actually invisible to everyone on the network, including the network administrators, and it will capture and view all the data and traffic flowing on that network," Laykin said. Using keywords and rules, Silent Runner can detect improper activity, such as sending e-mail messages with information about a secret new product.

Because it could be dangerous in the wrong hands, Silent Runner is tightly controlled. If Silent Runner is watching you, you probably know it, he said.

"Generally speaking, employers have an obligation to tell employees there's a surveillance program," Laykin said.

Government Tools

However, regulations on private surveillance vary around the world. Meanwhile, little is known about some systems used by governments.

One of the most controversial tools is the U.S. Federal Bureau of Investigation's Carnivore system. Carnivore is a "packet sniffer" that the FBI installs at ISPs to capture traffic associated with a customer under suspicion, according to Smith. Despite fears of agents reading every Internet user's e-mail, the system officially can be used on specific suspects only, Smith said. But some privacy advocates worry that there is too little oversight of agents carrying out a Carnivore probe.

More wide-reaching is Echelon, a system many experts believe has been deployed by governments in the U.S. and Europe to monitor international voice and data traffic over both land lines and satellites. Echelon is used like a net, capturing a large portion of the world's communications so authorities can later sift through it and find what they are looking for, Gartner's Hunter said.

Chinese sources say police in that country have been known to monitor e-mail as well as message board activity at major Chinese portals. If the police find messages with political or other content the government finds objectionable, they may work with the portal operator to try to find those who created the messages.

Dangerous Deliveries

Perhaps the most frightening prospect for surveillance comes from outside the realm of legal tools. A custom "Trojan horse" designed to go into a specific targeted system couldn't even be detected, Laykin said.

"The virus scanners, like McAfee and Norton, will not have a signature for a custom-written virus," he said.

Some advances in technology also have made computer users more vulnerable to unscrupulous electronic surveillance. DSL Internet connections are always on, unlike dial-up accounts, so there may be more opportunity for intrusion. Wireless LANs also open up the possibility of snooping. The encryption system built into the popular IEEE 802.11b wireless LAN standard can be cracked just by examining a brief sample of packets, according to Peter Shipley, a security consultant in Berkeley, California. Shipley said he has intercepted wireless LAN traffic from 20 miles away, with an inexpensive antenna at the top of a hill.

Putting It All Together

As much as you may worry about being watched or having information gathered from you, what may be most scary is what can happen when all that information is pulled together.

Already, data mining systems can analyze 15 terabytes of data in one day, roughly as much information as is gathered by the U.S. national discount chain Wal-Mart Stores in one day, according to Gartner's Hunter. The power of this kind of software is growing, and systems that can analyze 125 terabytes per day are now under development and are likely to be deployed within five years, he said.

Storage and database technology now allows the companies with which you do business to keep more information about you. Civil rights protections may be able to keep government away from that data, but companies face an inherent risk if they keep it, said Lee Tien, senior staff attorney at the Electronic Frontier Foundation, in San Francisco.

"You can't disclose what you don't have, but if you have it, you may be compelled to give it up," Tien said. "Data retention seems to be getting a foothold around the world. We're already seeing undeliberate retention being used for surveillance purposes."

Within Reach

Meanwhile, the Internet does for data transmission and sharing what microprocessors do for data gathering: put it within reach of anyone. It can take a snooper's photo, such as digital pictures that have been taken of women entering family-planning clinics in the U.S., and put that in the hands of any Web surfer, Hunter pointed out.

"We're talking about a world where most human activity is recorded ... and most of what is recorded will be available to anyone who wants it badly enough," Hunter said.

Only in Their Dreams

Some surveillance nightmares will probably just be bad dreams for a long time, according to vendors and analysts in the industry. Among their expectations for the near future:

         Heat-sensitive infrared cameras can't watch you through the walls of your house. They can see you walking down the street day or night, but in your house they can detect the indoor temperature only.

         Don't lose any sleep over robotic spiders like the ones in the movie Minority Report that detect body heat and breath. Robotics technology is probably a long way from creating tiny creatures that can find their own way around, said Richard Hunter, an analyst at Gartner, in Stamford, Connecticut.

         Just about anyone can buy a picture taken from space, but they probably couldn't use it to identify you. In pictures from the Ikonos satellite operated by Space Imaging, in Thornton, Colorado, nothing even shows up unless it's about a meter across, according to the company, which typically sells images for uses such as urban and environmental planning. However, military satellites do have a higher resolution.

         It's unlikely that a clothing store will ever call out an unwelcome greeting to you whenever you walk by. The Tom Cruise character in Minority Report had his face scanned and recognized just when he wanted to be anonymous, running from the police. In reality, turned heads, changing light conditions, and other factors mean that kind of system would have to be reserved for just a handful of avid customers who look right at the camera every time they visit, according to face-recognition experts.