Things That Fink

/ Big Brother

Bruce Schneier’s Crypto-Gram points to some impressive work done by researchers at the University of Washington showing how Apple’s Nike + iPod kit can be used to track people. The kit consists of a transmitter that you put in your shoe and a receiver you plug into your iPod. The transmitter wakes up whenever it gets shaken and sends out pedometer info every second, and the receiver then uses that info to give voice and visual feedback on your pace and how far you’ve run. The UW team discovered that each transmitter sends out a unique ID so the receivers can distinguish among several in the area, and then built several PDA-sized units to listen for IDs and log the data either to flash memory or retransmit it over Wi-fi or SMS. They also built software that would trigger a USB camera whenever a particular ID went by, and wrote a visualization tool that shows either historical or real-time overlays of sensor IDs and/or pictures taken on top of Google Maps. Details are in their paper, and they also have a video.

The threat models they lay out aren’t government surveillance so much as jealous/ex-boyfriends and stalkers, and to some extent professional thieves and muggers, unethical organizations tracking their members (or their competition’s members), and stores tracking their customers. Except for muggers (which just involves detecting whether a passing jogger is likely to have an iPod or other cool gadgets on them), all the scenarios they discuss involve the use of a network of their relatively cheap sensors, each one adding a single location to the overall surveillance network. A stalker would place trackers at strategic locations, then wait for them to phone home with the unique IDs they see. To link a a unique ID with a particular person he just has to get close to his target (or for that matter just watch her jog by) and then note the ID that’s being broadcast. Or he can leave one tracker in the bushes by his target’s front door and note what ID it picks up (he gets when she comes and goes that way too). And since consumers are encouraged to “just drop the sensor in their Nike+ shoes and forget about it” the trackers will work even when the target isn’t actually jogging or using the device.

The work is impressive, but I feel like by focusing on the Nike + iPod design it’s pointing to the smoke instead of the fire. Yes, Apple probably could have designed their system to make this sort of tracking more difficult. Ditto the RFID chips in smart cards, passports, highway toll-payment boxes, quick-payment key fobs and consumer products, not to mention Bluetooth devices and cellphones. But the main technology trend that’s making this sort of tracking possible, I would argue, is not the plethora of remotely-readable unique IDs we carry everywhere we go so much as the small, cheap hardware that even a moderately technical attacker can turn into his very own sensor network. RFID and transmitters are a ready-made “fingerprint” that such sensor networks can read easily, but as machine vision and pattern recognition technology improves there will be an increasing number of features will uniquely identify you to a sensor network, including minor differences in hardware you carry, how you walk or what you look like. This is not to say we shouldn’t encourage companies to make tracking by RFID harder to do, but I think it’s at best going to buy us 5-10 years before you’ll be able to buy your own automatic person-tracking sensor network at any online spy-shop. We’d better be thinking now about what kind of social and legal systems we’ll want once that day comes.

Things That Fink Read More »

Advertising as a form of violence

/ Mind and Brain

tray-table-advertisement.jpg

Remember the future depicted in the movie Minority Report, where every last inch of real estate is covered by advertisements that demand your attention by any means possible? I couldn’t help think about that as I flew home on US Airways after Thanksgiving. First there was the TV screens, which after the safety take-off script started extolling the virtues of their Skymall shopping opportunities. Then there was the flight attendant who, having just given me potential life-saving information about the flotation abilities of my seat cushion, came through the cabin explaining how we could have a free flight if we just signed up for their co-branded credit card. Finally, just as I thought the barrage was over, I brought my tray table down only to find it was painted with yet more advertising. Good thing I’ve developed a strong stomach to all this advertising, because even their barf bag had ads printed on it!

It seems like everywhere there’s a captive audience nowadays you’ll find it stuffed full of advertising. Movie theaters have finally branched out from advertising movies and concessions to full-on TV-style ads, Wal-Mart has their Checkout TV (designed to “entertain shoppers as well as inform them about new products”), my local Longs pharmacy even has a flat-panel TV showing continuous infomercials. These ads are always delivered with the pleasant-sounding lie that they’re for our benefit. If that’s the case, why do they always make me feel like the airline, theater or store I’m patronizing has just punched me in the stomach?

I’ve tried looking past my gut reaction and thinking about the situation rationally, but oddly enough when I do that I become even more convinced that, at least most of the time, advertising is a direct form of violence. I don’t mean violence in the most limited physical definition — I don’t get a bloody nose from the Trix Rabbit. But consider the following points:

  1. While we like to think we make all our own choices based on the information we have at hand, in fact we humans are highly susceptible to manipulation. (In fact, there’s good evidence that people who think they’re not easily manipulated are the most susceptible.)

  2. Sometimes manipulations are to our long-term benefit. Education is all about changing how someone thinks; so is love. Sometimes we’ll seek out ways to manipulate ourselves directly, be it by throwing out all our cigarettes so we won’t be tempted to smoke or by getting drunk at a party to get over our shyness and meet someone new. Other times we won’t recognize the benefit of a manipulation until much later, like the addict who denies he has a problem until his friends intervene and force him to go into detox.

    That said, commercial advertising is at best neutral about whether its message actually improves our lives. Advertisers often claim they just inform the public about products they want (if only they knew it), but their main job is to install a need for their product regardless of whether the need was there beforehand. And since creating a need where one didn’t already exist takes more repetition than simply informing someone about a solution to an existing problem, most advertising we see is designed to create new needs.

  3. People are naturally resistant to having new needs installed in them. Sure it feels good when we scratch that itch by buying their product, but at some level we also know that it’s the ads that made us itch in the first place. Because of this, the techniques used by advertisers are subtle and deliberately designed to manipulate our desires without our knowledge or consent.

In other words, most advertising is a deliberately deceptive manipulation of our person and our mental state, without our consent or regard for our interests. I can’t see any way how that’s not a form of violence. And they’ve been doing it all our lives, from the first toy we couldn’t live without to the makeup, gadgets and junk food we crave today.

I suspect if you were punched in the stomach every day since you were a toddler, you’d think it was normal. You wouldn’t like it, and no doubt you’d complain about the ones who punched especially hard or always punched you right as you were sitting down to dinner. But but somehow it’d still be seen as a price of living, nothing that could be done about it.

Only there is something we can do about it. The next time your flight attendant runs down the aisles with credit card applications shouting Who wants a roundtrip flight, absolutely free?!?, stop him and very politely explain how horrible you think it is that his company treats paying customers that way. Do the same with your local stores, and write letters to the company heads. Then take your business to those that don’t have such distain for their customers.

There’s no way a corporate policy of “Service with a smile and a punch in the belly” would fly. Why should advertising be given a free pass?

Advertising as a form of violence Read More »

Double or nothing?

/ Politics

Ouch. A reader of the Talking Points Memo blog comments about the Pentagon’s “Double Down” strategy of one last big push in Iraq:

Since the Pentagon has decided to discuss its new strategy in gambling parlance, it should at least use the proper terminology. Today’s LA Times article says that a Pentagon official has referred to the option of sending more troops in to Iraq as a “double down” strategy. The reference is to a bet in blackjack when, based on the cards that have been dealt, the player seeks to maximize a payoff that is more likely to occur in that hand, given the probabilities. The double down is a calculated bet, made from a position of strength when the odds are favorable to the bettor.

In Iraq, we are certainly not in a situation where the odds are favorable to winning. Our bet is not a double down. Let’s call it what it is: double or nothing. This is is more like the gambler who has been on a bad losing streak deciding to empty the savings account and put all of his chips on red, hoping that the roulette wheel will spin his way and bring him back close to even. Double or nothing is a desperation play. It is an ill-advised way to gamble, with chips or human lives, and such a strategy inevitably leads to another appropriate gambling term. Gambler’s ruin: winding up completely broke.

It’s scary how many of our political errors can be described in terms of psychological disorders…

Double or nothing? Read More »

Psiphon: censorship circumvention personal web-proxy

/ Uncategorized

Psiphon is a new anti-censorship web proxy just released by U. Toronto. People outside of a censoring country run a Psiphon server, and people inside a censoring country (China&lt/cough>) just go to the server’s URL and enter whatever URL they want to visit in the page’s own virtual toolbar. The server handles encryption and proxying of the web pages automatically, and gets around URL-based and content-based filters.

One interesting aspect is that they’re not doing anything to help people find a particular proxy. Instead they’re relying on social networks, which is to say word-of-mouth:

A social network is a structure of nodes – usually individuals or organizations – that have ties between them, such as families or groups of friends or colleagues. psiphon leverages social networks as the discovery mechanism. The psiphonode administrator and the psiphonite(s) have a trust relationship and the web address is known only to these trusted people. Each network of psiphonode/psiphonites chooses how to grow the network. It can be small and extremely private or large and relatively semi-private. It depends on the specific context and needs of the psiphonites.

The nice thing about this set up is that it doesn’t need any new routing or discovery infrastructure (since it relies on people to set them up themselves) and it makes it harder for governments to find Psiphon servers and block their ports.

(Props to Infothought for the link.)

Psiphon: censorship circumvention personal web-proxy Read More »

Swivel

/ Media Technology

Swivel looks like it might be interesting. They’re billing their service as “YouTube for Data,” where you can upload your data sets and then graph or compare them to other sets. In its best form I can imagine something like this supporting open source style research, especially if they support ways to explain and present your data (that or a good API for bloggers to link in data). In its worst form I could see any sensible analysis of the data sets getting burried under a pile of meaningless correlation statistics.

Description via TechCrunch (via Datamining Blog):

Swivel Co-founders Dmitry Dimov and Brian Mulloy start off by describing their company as “YouTube for Data.” That’s a good start for someone trying to understand it, because the site allows users to upload data – any data – and display it to other users visually. The number of page views your website generates. Or a stock price over time. Weather data. Commodity prices. The number of Bald Eagles in Washington state. Whatever. Uploaded data can be rated, commented and bookmared by other users, helping to sort the interesting (and accurate) wheat from the chaff. And graphs of data can be embedded into websites. So it is in fact a bit like a YouTube for Data.

But then the real fun begins. You and other users can then compare that data to other data sets to find possible correlation (or lack thereof). Compare gas prices to presidential approval ratings or UFO sightings to iPod sales. Track your page views against weather reports in Silicon Valley. See if something interesting occurs.

Swivel Read More »

Earliest sunset of the year

/ Science

A bit of trivia: even though the Winter Solstice isn’t for another couple weeks, tomorrow will be the earliest sunset of the year (about 4:55 PM in San Francisco). That’s because even though the days will keep getting shorter until December 22nd, sunrise will be getting later even faster.

(Calculated over at Express Tech’s Sunrise and Sunset Calculator, which is only one I could find that includes seconds.)

Earliest sunset of the year Read More »

Getting attention for your research

/ Uncategorized

Seth Finkelstein over at Infothought comments on the media attention being given to Psyphon:

I’m all for this project, but the activism lesson I draw from its prominent coverage is NOT necessarily a happy one. There’s been activists working on this sort of stuff for years and years. The critical variable here is not technology, since those reporters wouldn’t be able to tell a Tor from a FreeNet. What matters is *ATTENTION*. The backing from the various organizational sponsors is the reason for the widespread publicity.

Seth beats this drum pretty regularly (usually with lament) but echos what Bill Buxton phrased as a battlecry at CSCW, namely that making an impact in the world isn’t about having brand new ideas, it’s about understanding which ideas are ripe for exploitation and then having the ability to marshal the right resources to get them into the world. Buxton feels that the research community in general isn’t putting enough effort into that last bit, and believes in the overall philosophy so much that he’s essentially become a full-time evangelist and public speaker rather than doing his own research.

Getting attention for your research Read More »

Look hard enough, and you’ll always find two identical fingerprints

/ Security

Today’s LATimes reports that Brandon Mayfield just won his $2 million lawsuit against the FBI for his wrongful detention in 2004. Brandon is the Oregon lawyer who the FBI pinched in connection to the 2004 Madrid train bombings because a partial fingerprint found in Madrid was a “close enough” match to his own. One quote from the article:

Michael Cherry, president of Cherry Biometrics, an identification-technology company, said misidentification problems could grow worse as the U.S. and other governments add more fingerprints to their databases.

The problem is emphasized in the March report from the Office of the Inspector General on the case, which reads much like a Risks Digest post and has a lot of take-home lessons. The initial problem was that the FBI threw an extremely wide net by running the fingerprints found in Madrid through the Integrated Automated Fingerprint Identification System (IAFIS), a database that contains the fingerprints of more than 47 million people who have either been arrested or submitted fingerprints for background checks. With so many people in the database the system always spits out a number of (innocent) near-matches, so the FBI then goes over the results. The trouble is that in this case (a) Mayfield’s fingerprints were especially close, and (b) the FBI examiner got stuck in a pattern of circular reasoning, where once he found many points of similarity between the prints he began to “find” additional features that weren’t really in the lifted print but were suggested by features in Mayfield’s own prints.

People tend to forget that even extremely rare events are almost guaranteed to happen if you check often enough. For example, even if there was only a one in a billion chance of an innocent person being an extremely close match for a given fingerprint, that leaves about a 5% chance for each fingerprint checked of getting such a false positive. If we were to double the size of the database, that would rise to almost 10%. This kind of problem is inevitable when looking for extremely rare events, and applies even more broadly to fuzzy-matching systems like the TSA’s no-fly list and Total Information Awareness (in all its newly renamed forms), which try to identify terrorists from their credit card purchases, where they’ve traveled or how they spell their name.

Look hard enough, and you’ll always find two identical fingerprints Read More »