Technocreep (5 page)

The one-way nature of surveillance cameras is one of their most unsettling features. Aside from the occasional blinking light, they tell us nothing. We tell them everything. One way to level this playing field is to wear our own cameras. University of Toronto Professor Steve Mann coined the term “sous-veillance” to describe the countermeasure of wearing cameras to record our own version of how things happen.

One of the first famous uses of this approach was the 1991 videotaping of the beating of African-American construction worker Rodney King by the Los Angeles police. The police officers were acquitted, despite compelling video evidence against them, sparking the 1992 riots in that city.

Now, dashboard cameras are commonplace, at least in the United States, and definitely in Russia, where they are almost mandatory to survive the country's traffic and scam artists who stage fake accidents.
46
Video evidence gives you an edge in many situations, and some people are already logging their lives as an offbeat kind of hobby. I spoke to one of these lifeloggers, and he estimates the cost of recording his every moment in audio and video at about one dollar a day for storage media. His cost in terms of relaxed social interaction, however, might be much greater. The possibility of recording everything you see, hear, smell, and touch was also the subject of a research project called Lifelog, funded by the Defense Advanced Research Projects Agency in 2003 but abruptly canceled in 2004 after privacy groups voiced objections.
47
According to many experts, the program has continued, at least in spirit, both inside and outside the U.S. government.
48

The movie
Déjà Vu
(2006) envisioned a world in which satellites look down at people and peer inside their homes with laser imaging, using computer reconstruction to replay a terrorist attack and then travel back in time to avert it. Camera technology is definitely moving in the creepy direction suggested by the movie. Scientists at MIT have announced the ability to see through solid walls to an accuracy of ten centimeters. PhD student Fadil Adib, speaking on a
Network World
video, says “we're doing localization through a wall, without requiring you to hold any transmitter or receiver, simply by using reflections off the human body.”
49

The researchers gave their project a benign name, “Kinect of the Future,” suggesting it might simply be the next evolution of Microsoft's popular gaming device. However, a system that can peer through walls will have applications far beyond video gaming. It probably would have been greeted much differently if they had called it the “Anne Frank Finder.” That may indeed be much closer to how this technology will really be used.

Even before the Boston Marathon bombings, the U.S. Air Force contracted with the 3D biometric imaging firm Photon-X for a new kind of surveillance camera. By using a combination of infrared and visible light, and by indexing muscle movements that are unique to each individual, the company claims it can produce a unique “bio-signature” for a person and then silently track them.
50

The company is also promoting something they call the Spatial Phase Imaging Technique (yielding an unfortunate acronym, SPIT), which purports to read your fingerprints at a distance of up to ten feet, with “longer distances being developed.” They also claim they can “passively capture 3D geometry for skin, hair, eyes, teeth, clothing, and anything else that is in frame, with no special preparation of the subject.”
51

While surveillance cameras do not yet follow us everywhere, we do a pretty good job of filling in the gaps with our own cameras. We snap billions of photos and many of them end up on Facebook and photo-sharing websites. By putting our real name next to photos, we provide the fodder for all kinds of nefarious data mining.

TV studio cameras have large red “tally lights” to show the anchorperson where to look, but far too many unwitting TV presenters have been embarrassed by their “off camera” comments that made it to air, so they don't really trust the lights.

While their lenses may be almost invisible, laptop computers and smartphones are equally risky. Unless you douse it in a glass of water, as a friend of mine did when he learned his smartphones was infected with some nasty malware, there is a decent chance that your camera can be hijacked by a hacker.
52

Showing off clever ways to remotely invade a smartphones has been a staple of hacker conferences for years. Now, you do not even need hacker skills to take over someone's smartphone, because “there's an app for that”—in fact, many of them. One is the notorious “Rastreador de Namorado” (Boyfriend Tracker) from Brazil.
53
Once you slip this onto someone's phone, it reports all of the device's travels logged by the phone's GPS. It reveals steamy text messages sent to other lovers. It even allows the scorned paramour to call the phone, and put it into audio eavesdropping mode.

People are coming around to the realization that our smartphones may indeed be traitors, but at least we can trust home appliances like our television sets. Or can we?

Seungjin “Beist” Lee shuffles nervously as he stands in front of the ragtag press room contingent at the Black Hat USA 2013 conference in Las Vegas. Seasoned business journalists mix with earnest young tech bloggers and local TV reporters awkwardly trying to explain hacking to the general public. It is not the easiest of tasks, because many of the exploits and vulnerabilities on display are pretty technical. Mr. Lee's presentation, however, is understandable and frightening to everyone.

“Usually at home people have their TVs in the bedroom,” he says, “because you can watch the TV well.” OK, no surprises there. Reporters continue to doze and check email.

“On the other hand, the TV can also watch you very well.” Reporters look up. What did he just say?

“I want to say I hardly wear clothes at home, I just wear underwear.” Where is he going with this?

“But I don't care about it, but I care about my family and my girlfriend.” Ahh, he's saying that hackers can remotely activate the camera in those new high tech TVs. This
is
interesting.

Lee attempts to be coy about just whose Smart TVs he is talking about, since the company has now paid him a consulting fee; but the tenacious press corps relentlessly drags it out of him. We already know he is Korean and he drops the big hint that “the company starts with an S.”

In his presentation, Lee promises he will not only demonstrate the technical hack he discovered; he will also show how “Smart TVs monitor you 24/7 even though users turn off their TV, meaning #1984 could be done.” It is interesting, and somewhat chilling, that a young Korean graduate student would remind us of George Orwell's dystopic world with a Twitter-style hashtag.

Lee can activate the camera remotely because a Smart TV is not just a TV. It is really a computer, microphone, and digital video camera wolf hiding in the sheep's clothing of a familiar household appliance. Some reporters wonder whether anyone besides a stay-up-all-night hacker would bother exploiting vulnerability like this. The answer is a resounding “yes!”, because once the secret is posted online, “script kiddies” all over the world can start using it without even understanding how it works, often with tragic results.

Far too many people, of both genders, have committed suicide after having their intimate photographs posted online. Sometimes the pictures were given voluntarily to a “friend” who cruelly shared them with a wider audience. In other cases, acts of sexual brutality have been videotaped and posted for all to see. The most common scenario now appears to be “sextortion,” where the malefactor obtains some compromising photos, then demands more.

Two Canadian teenagers, Amanda Todd and Rehtaeh Parsons, were driven to suicide by online sexual harassment and bullying in 2012 and 2013 respectively. The Canadian government responded by introducing legislation to make it a crime, punishable by up to five years in jail, to distribute “intimate images” without consent. In the U.S., according to an article in
ABA Journal
, “only two states, California and New Jersey, make it illegal to post a sexual photo online without the subject's consent.”
54

Cassidy Wolf, Miss Teen USA 2013, was the victim of a webcam-enabled sextortion attack in which the perpetrator “used malicious software and tools to disguise his identity in order to capture nude photos or videos of female victims through remote operation of their web cams without their consent.”
55

The FBI press release on the case goes to say that the nineteen-year-old perpetrator, Jared James Abrahams, “threatened to publicly post compromising photos or video to the victims' online social media accounts, unless the victim either sent nude photos or videos, or engaged in a Skype session with him and did what he said for five minutes.” Abrahams pled guilty and has been sentenced to eighteen months in a Federal prison.

Miss Wolf has done a huge, if unwilling, service by bringing this type of attack into the public's consciousness. While the motivation here seems to be of a sexual, not commercial, nature, that did not stop companies from finding a way to take advantage of it. A Google search on “Cassidy Wolf” produces stories from mainstream news media such as CNN and the
Los Angeles Times
. However, many of the other “hits” are in fact rewrites of those mainstream news stories sponsored by a company that makes, you guessed it, lens covers for web cams and Smart TVs. Using aggressive search engine optimization, this company managed to insert its “Protect yourself now with a web cam cover by … ” message into the conversation about Cassidy Wolf.

The commercial exploitation of web cameras took a frightening, and definitely illegal turn in a case involving rented computer equipment. If you were unfortunate enough to lease a computer from one of seven U.S. firms, or their international affiliates, you also received hidden software called “Detective Mode.” According to the U.S. Federal Trade Commission, “when Detective Mode was activated, the software could log key strokes, capture screen shots and take photographs using a computer's web cam.”
56
The software also contained a “kill switch” which could disable the computer if it was stolen or, more commonly, if the renter fell behind on the payments.

The FTC noted that “using Detective Mode revealed private and confidential details about computer users, such as user names and passwords for email accounts, social media websites, and financial institutions; Social Security numbers; medical records; private emails to doctors; bank and credit card statements; and web cam pictures of children, partially undressed individuals, and intimate activities at home.”

The
American Banking Association Journal
reported that the retailers agreed “to restrict the use of PC Rental Agent software developed by Pennsylvania-based DesignWare that previously allowed more than 1,600 licensed rent-to-own stores in the United States, Canada and Australia to spy on over 400,000 customers.”
57

Remarkably, the rental companies escaped without a fine. A school district in suburban Philadelphia was not so fortunate. It was accused in a lawsuit of using a similar technology, the now defunct “TheftTrack,” to spy on students in their homes. In the class action lawsuit, students alleged that school officials were activating the cameras in the computers while they were off school premises. In a tremendous display of either arrogance or stupidity, school officials actually disciplined one student using photos taken surreptitiously in his bedroom as evidence. The judge awarded that student $175,000 in damages.
58

Most people agreed that these cases represented a creepy use of technology since the users were unaware that they were being watched. However, some people must consent to video surveillance as a condition of employment. Jobs including bank teller, bartender, day care worker, and even zookeeper come with the expectation that you will be watched to make sure that you are not stealing from the company or doing something even worse. Ordinary office workers have generally been immune to this expectation, though that is changing. For instance, it is now possible to spy electronically on government functionaries in the Office of the Chief Minister in Kerala, India. Anyone with Internet access can see who is snoozing on the job, or has gone off for chai, or, heaven forbid, is accepting a bribe.
59

Do people actually look at workplace cameras? If we believe the visitor counter at Dental Office K in Aomori Prefecture, Japan, “the first WEBCAM of [a] dental office in the world,” over half a million visitors have taken a peek since that office began streaming live images in 1996.
60

We may all be peering into a video portal at work if the folks at Vancouver-based Perch Communications are successful in marketing their “always on video portal.” In an interview with CBC Radio's Nora Young, CEO Danny Robinson likens it to having a window into a co-worker's office, except that “the people might be 3500 miles away.”
61
While the video is continuous, the audio is off until you walk up and look into the device. It then activates the microphone until it sees you walk away. Even Robinson says that having this thing sitting on your desk is “just a little bit on the freaky side for most people,” and he suggests putting it in a hallway.

Confirmation that walls that watch us may be soon be commonplace comes from a fascinating if rather creepy experiment from Washington, D.C.-based iStrategyLab. Their S.E.L.F.I.E. (“Self Enhancing Live Feed Image Engine”) is a two-way mirror with a camera and computer mounted behind it. As they explain on their website, the device is “triggered by simply standing in front of the mirror and holding a smile.” When it sees you are at your smiley best, the device initiaties a countdown, then uses LEDs to simulate a ‘flash' as your photo is taken. The resulting image is posted directly to your social media feed.
62