From: baumbach@atmel.com ( )
Date: Thu, 17 Mar 94 19:30:23 PST
To: cypherpunks@toad.com
Subject: encrypt me
Message-ID: <9403180118.AA09717@minnow.chp.atmel.com>
MIME-Version: 1.0
Content-Type: text/plain


Forwarded from RISKS DIGEST 15.62:
------------------------------

Date: Wed, 2 Mar 1994 23:17:29 -0500 (EST)
From: Paul Robinson <PAUL@TDR.COM>
Subject: 'We {Will} Find you...'

In an article on the cover of the February 10, 1994 {Washington Technology}
magazine of the same name, talks about a specialized use of biometrical
information (specific details unique to a person like size, etc.) to identify
them.

The idea behind this is that in an airport, an infrared camera is mounted near
the arriving passengers section, taking pictures of every person who is
passing through the facility.  This captures the 'aura' or underlying facial
vascular system (pattern of blood vessels and such).  In 1/30 of one second,
it captures the data and forwards it via high-speed data lines to an FBI
database that has stored auras of the worlds most-wanted criminals and
terrorists, then matches generate an order to nab a suspect, supposedly
producing "a piece of evidence that is as rock-solid as any presented to a
court."

Currently, infrared cameras are being attached to desktop computers to create
digitized thermograms of people's faces in 1/30 of a second.  The company that
is working on this technology, Betae Corp, an Alexandria, VA government
contractor, claims that the aura is unique for every single person.  The
photos in the front of the article show two clearly different thermographic
images that are claimed to be from identical twins.

The facial print does not change over time (and would allegedly require very
deep plastic surgery to change it), retains the same basic patterns regardless
of the person's health, and can be captured without the person's
participation.  The technology will have to show it is a better choice than
current biometric techniques such as retinagrams (eye photographs, voice
prints and the digital fingerprint.

A Publicity-Shy Reston, VA company called Mikos holds the patent for certain
technology uses of this concept.  Dave Evans of Betac who has obtained certain
"non exclusive" rights in the technology claims that "thermograms are the only
technology he has seen in his more than two decades of security work that meet
the five major criteria of an ideal identification system: They are unique for
every individual, including identical twins; they identify individuals without
their knowing participation; they perform IDs on the fly; they are
invulnerable to counterfeiting or disguises; they remain reliable no matter
the subject's health or age," the article said.  Only retinal photos are
equivalent, but potential assassins aren't likely to cooperate in using them.

Right now it takes about 2-4K per thermograph, (it says '2-4K of computer
memory' but I suspect they mean disk space) and that's not really a problem
for a PC-Based system of 2000 or so people going to and from a building; it's
another magnitude of hardware to handle millions of aircraft travelers in
airports.  Also, infrared cameras are not cheap, in the $35,000 to $70,000
range, which, for the moment is likely to keep small law enforcement
facilities from thermographing all persons arrested the way all persons
arrested are routinely fingerprinted.  But we can expect the price to come
down in the future.

The writer apparently had to agree with Evans not to raise privacy and
security issues in the article, it says, since first they have to show the
technology works.  But even it raised questions:

- The technology could be a powerful weapon in a "big brother" arsenal, 
  with cameras in front of many stores and street corners, scanning for
  criminals or anyone on the government's watch list?
- Does the government have the right to randomly photograph people for
  matching them against a criminal database?
- What guarantees do we have that thermographs are actually unique for
  every person, or that the system is foolproof?
- What is the potential for blackmail, with thermographs to prove people
  were in compromising places and positions?

There are also my own points.

- While this can be used to protect nuclear power plants against 
  infiltration by terrorists (as one example it gives), what is to stop it,
  for example, to be used to find (and silence or eliminate) critics and
  dissidents?  I wouldn't give China 30 seconds before it would use 
  something like this to capture critics such as the victims of Tianamen 
  Square. 

- Long history indicates that better technology is not used to improve 
  capture of criminals who violate the lives and property of other private
  parties, it is used to go after whatever group the government opposes.
  That's why people who defend themselves with guns against armed
  criminals in places where gun controls are in effect, can expect to
  be treated harsher than the criminal would have been.  Existence of
  criminals supports the need for more police and more police-state laws;
  defending oneself against criminals shows the ineffectiveness of those
  laws.

Paul Robinson - Paul@TDR.COM

------------------------------