Schneier on Security
A blog covering security and security technology.
« Dutch RFID Transit Card Hacked |
| Combined Taser and MP3 Player »
January 21, 2008
Almost three years ago I blogged about SmartWater: liquid imbued with a uniquely identifiable DNA-style code. In my post I made the snarky comment:
The idea is for me to paint this stuff on my valuables as proof of ownership. I think a better idea would be for me to paint it on your valuables, and then call the police.
That remark aside, a new university study concludes that it works:
The study of over 100 criminals revealed that simply displaying signs that goods and premises were protected by SmartWater was sufficient to put off most of the criminals the team interviewed.
Professor Gill said: "According to our sample, SmartWater provided a strong projected deterrent value in that 74 per cent of the offenders interviewed reported that they would in the future be put off from breaking into a building with a SmartWater poster/sign displayed.
"Overall, the findings indicate that crime reduction strategies using SmartWater products have a strong deterrent effect. In particular, one notable finding of the study was that whilst 'property marking' in general acts as a reasonable deterrent, the combination of forensic products which SmartWater uses in its holistic approach increases the deterrent factor substantially."
When scored out of ten by respondents in regard to deterrent value, SmartWater was awarded the highest average score (8.3 out of a score of 10) compared to a range of other crime deterrents. CCTV scored 6.2, Burglar Alarms scored 6.0 and security guards scored 4.9.
Of course, we don't know if the study was sponsored by SmartWater the company, and we don't know the methodology -- interviewing criminals about what deters them is fraught with potential biases -- but it's still interesting.
Also note that SmartWater is not only sprayed on valuables, but also sprayed on burglars and criminals -- tying them to the crime scene.
Posted on January 21, 2008 at 12:17 PM
• 50 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Of course it was sponsored by the company. "The report found that of the 101 offenders interviewed, 91% were aware of SmartWater and its abilities to forensically link criminals to a crime scene"
Wow, probably better brand recognition than Coke.
From this web page at the University of Leicester http://www2.le.ac.uk/ebulletin/news/...
"An Evaluation of SmartWater: Offenders' Perspectives
A report for SmartWater Technology Limited by Professor Martin Gill January 2008"
Totally biased results. The idea is dumb. AFter a certain market penetration the criminals can plead that Smartwater is everywhere. They use it at home themselves!
As you will know from my previous comments about Smart Water I work in an area where it has been trialed.
Guess what all the signs have been taken down and nobody seems to know about it any longer...
Also like CCTV the criminals will out evolve it.
How long before the smarter ones go out and buy a kit and play with it and find out (for arguments sake only) that it fluorescess under the light in (for arguments sake again) the light put out by a fake bank note detector?
Or some other characteristic that only requires a very cheap method of detecting and obliterating the Smart Water or just not taking the marked goods (after all who is going to mark everything of value they own?).
At first only those in the know will prosper by this then the word will spread (criminals never can keep their mouths shut thats how 80-90% of them get caught anyway) and then Smart Water will be as much use as tar paper for catching elephants 8)
You guys are right, the really smart ones will out-evolve it, but in some ways it'll work much like having an alarm on your house or car does. It won't stop a professional criminal, it's not "theft-proof", but it makes most of the non-professional ones simply look for the house without the alarm. If there are 20 cars in a parking lot and 10 of them have alarms, and 10 don't, all things being equal, why expend the energy to steal one that has an alarm?
Again, I don't think this is theft-proof, but it makes it harder, which means it decreases the risk to you (and also explaining why just displaying the sign decreases the risk), assuming we don't reach a point where everything has this on it, of course! :)
As a non-criminal, I don't know what to think :-) Of those that get caught, 100% surely talk amongst themselves. If they neglected to steal ONLY those things that were marked I guess I'd mark the most pawnable items. If 'everything has this on it,' is the 'DNA style' marking supposed to be unique?
It sounds to me like, as with almost every other similar counter-measure, it's the sticker on the door/window/whatever that's valuable. The best defense is to make the other guy's stuff look easier.
I have my very own brand of smart water, If you let my German Shepherd mark each of your items with his SmartWater(tm) scent, then he can identify most items with 99%* accuracy.
(* Note: Some meat-based food items may trigger false positives.)
The title of this post is wrong: it should be "The Threat of SmartWater Works".
In other words, what works is SAYING you have SmartWater.
What the report does NOT show is that SmartWater was actually effective at convicting criminals, or even finding them.
And what happens if you drink it they spray the bushes?
I bought some SmartWater with the intention of having my posessions returned to me if they were found by the police. The unique code is registered to my address. UK police routinely scan stolen goods with UV to find details of the rightful owner.
I don't recall if they used the brand name, but something similar to SmartWater was featured on an episode of CSI:NY in the not too distant past. That could lead to potentially high recognition of the technology, assuming criminals watch crime investigation based drama television programs.
If you read SmartWater's own news log, it's full of articles of the form "Churches reduce thefts of roofing lead with SmartWater"
Now I don't dispute this. Metal thefts are rocketing, churches are presumably using this, maybe they've even seen a drop as a result. However the "fear of signs" effect alone will be large, albeit temporary. Additionally, although I can see SmartWater working for hi-tech gear that's fenced, how on earth does it protect somethign so easily camouflaged as scrap lead? I can re-cast to ingots in my own garage, with minimal effort. Even copper is only a little more trouble. No sort of tagging scheme like this will survive foundry temperatures!
Last I looked, back in the 80s when Radio Shack sold alarm systems, they also sold signs that said "protected by alarm system". I don't know what really happened, but in my mind I imagine somewhere a smart marketing person said "Holy cow! People are just buying the SIGNS without the ALARM -- we're losing sales!"
If you put up a sign that said "This Property Protected by Bruce's SnorfTech Anti-Theft Device", it'd be just as effective as SmartWater.
It's not a very effective deterrent. If you catch a person and match him to the "spray DNA" you might have a case, but catching the suspect is not facilitated by this technology. So it's just giving some evidence to the prosecution; which may or may not be accepted by courts.
There is no court case (that I have seen) where anyone has upheld the "unique" fingerprint of the chemical spray .. so Bruce you can come and paint all over my house and see if you can grab it :-)
Smartwater has been reviewed at length by various people in crime-fighting positions and has proven to be largely worthless. I work for a Government organisation and at one point in the 90's (as I remember) we used to love this stuff and paint it onto everything that wasn't nailed down and a few things that were. Theft against our property was certainly not noticeably reduced no matter how many stickers we put in windows, and we haven't had a single recovery of property that I am aware of due to it.
I'm fairly certain that in the UK there has not been as much as a single prosecution brought due to SmartWater marking and there is little independent evidence that it has ever helped in locating or retrieving stolen good. For starters....
Waste of time and money IMHO.
I can't say I'm very surprised at the study, even if it were unbiased; basically, what it says is "convicted criminals are unable to evaluate relative risks". Well, yeah, that's why they're both criminals and convicted.
Smart water may be fairy dust, but it's magic scientific DNA fairy dust. And DNA can't lie! It's worse than fingerprints! And they do it on CSI!
Brilliant marketing, if nothing else. I wouldn't be surprised if some people think SmartWater gives the cops YOUR DNA. And I wouldn't be surprised if SmartWater likes it that way.
If I put SmartWater on myself, does it make it more of a criminal act to kidnap me?
Of course they say this /now/, SmartWater is relatively new: CCTV, burglar alarms and security guards are widespread, criminals know how to deal with them.
Wow! Where can I buy these "Protected by SmartWater" stickers?
Oh never mind, I'll print my own.
Did everyone miss the point? Smartwater (etc.) is *unique* marking, per organisation/household so 100% market penetration doesn't matter. If you burgle 1000 homes, you'll have 1000 unique markings on you.
One thing it doesn't help with is 'insider threats', but that's a different game.
Our group risk analyst (ex. Police) said it's well known by thieves (because it doesn't wash off, and stays on for "6 months") so the clever ones avoid it like the plague. Also it's easy for the cops to bamboozle the courts and get a conviction - much easier than finger prints, DNA etc.
If nothing else, it ""proves"" (note quote) that the alleged offender has handled your goods at some point after they were marked, which appears to be enough to secure a handling charge at the very least.
I think it's key to remember this is high-tech, being used to convict low-tech/stupid thieves. I doubt it would work against a diamond thief with enough cash to take the case to the highest court in the land.
It's largely a case of "my expert witness is smarter/more-reputable than your expert witness"
If I, as a smart burglar, would be asked about what deters me most, I would tell them what really deters me the least, hoping they'll make propaganda for it, thus lessening the overall security.
As an underwriter for an insurance company, like you, I believe its quite right (but maybe a tad trendy?) to be cynical about new developments such as SmartWater.
But, sadly, unlike some of you (Sentinel, hang you head in shame) I have to do my homework, particularly when we're considering investing heavily in new technology.
For one thing, none of you have identified that SmartWater is a policing crime reduction strategy - and, if you look closely enough, you'll find that it works.
It is NOT a property recovery service and when they (SmartWater) presented the concept to us, they made it clear that they were not claiming it was a panacea to crime.
Their statistics were both impressive and, upon checking, robust. They claim an average 55% reduction in burglary in every city that operates their strategy properly. So, 45% still suffer burglary so you're bound to get the occassional bad news story.
We took the decision to make it mandatory for our clients to use SmartWater to protect their valuable items. Like Prof Gill, our research shows it to be the most powerful deterrent in the UK today.
So, I respectfully suggest that you do your homework first, find out how their strategy works and then the penny will drop.
Finally, have a look at the recent press article from Peterborough, one of many...
PS - they say they've had a similar result out of Tallahassee, Florida so it looks like its on its way to the USA...
-> “Additionally, although I can see
-> SmartWater working for hi-tech gear
-> that's fenced, how on earth does it
-> protect somethign so easily
-> camouflaged as scrap lead?��?
The problem with lead is that the police often have some ideal of who is stealing it, but can not prove it as anyone can claim they brought it as strap. Therefore if some of the lead in the persons garage is marked with smart water that is enough to prove it is stolen and where from.
Melting down the lead before selling it is the only way to get rid of a 100% of the smart water, only a single drop needs to be found by the police to link the lead back to the crime. However melting down the lead before selling it as scrap is a good sign that it has been stolen.
Therefore if a large number of buildings with lead roofs had them protected with SmartWater and the police started to check for it at scrap yards, a few criminals will quicker start to get caught. Only a very small number of criminals need to get caught for the other to decide that lead from church roofs it to “hot��? to handle.
It is even better if most lead roofs are marked with smart water, but do NOT have signs saying they are, and then the criminals will have to start to assume that all lead roofs are marked.
We just need the insurance companies to refuse to pay out on the theft of lead if the roof has not been marked with a system like SmartWater.
This is analogous to music fingerprinting. You know that law enforcement could prove its origin if found. That does not work well at all. In addition many things have identification markers such as vehicles, computers, diamonds, etc. and we all know those are never stolen. The key is that these systems might increase the odds of being prosecuted once caught but does not increase the odds of being caught.
Further to my comments above, the bare bones of the strategy are as follows:
1. The police are equipped by the company to look for SmartWater;
2. They then embark on a mild form of pyschological warfare using the news media to 'educate' the criminal fraternity;
3. Police focus their activity on the 'receivers/fences' making SmartWater marked property too hot to handle;
4. Importantly, the police use SmartWater spray systems in intelligence driven covert operations, resulting in arrest and prosecutions.
5. All successful prosecutions are highlighted in the press, increasing the anxiety within the criminal fraternity.
6. All suspects are checked for SmartWater as they enter the police station (as per photo in press cutting).
I only have anecdotal evidence but I understand that G4S are using SmartWater to protect their cash in transit operation and they have reported a 40% reduction in robberies. So, criminals do seem to fear the potential risk of being forensically contaminated with SmartWater.
It made sense to us and the extent of police support for SmartWater was impressive also.
The criminals they interviewed, presumably they are ones that have been caught? It is poor statistics practice to select your sample using the criteria of dumbest/unluckiest.
How easy is it to duplicate SmartWater? Can you duplicate it using standard DNA duplication techniques like PCR?
Or, for that matter, how easy is it to duplicate a DNA sample of somebody and plant it at a crime scene? DNA samples are going to be duplicated after collection anyway, so I'm not sure how one could differentiate between original and duplicated samples.
Since this product is manufactured, at a theoretical level it can unquestionably be duplicated. Hopefully it's only used for identifying suspects rather than as actual evidence of guilt.
@Mark: "G4S are using SmartWater to protect their cash in transit operation and they have reported a 40% reduction in robberies."
How does that compare with "placebo"?
In other words, if I invent some completely ridiculous fake security measure, and then announce that (only) my company is now using it, what percentage of cash-in-transit robbers will opt to target my competitor instead of me, and how long will it take them to figure out that there isn't really any risk?
I'm not saying SmartWater doesn't work, mind. I'm saying that criminals have no idea whether SmartWater works. Once they start to get an idea, the effectiveness of SmartWater as a deterrent will change (either up or down, according to how well it works). Once everyone is using it, the extent to which it moves crime around rather than actually deterring it will be removed from the statistics.
What you really need is a sign reading "Beware of the Squid".
How expensive are the detection systems? Are the people fencing stolen property buying them to check for smart water? Can I just use a blacklight?
This isn't a new thing. I read a review of 3 different products 3-4 years ago in BIKE magazine (from the UK).
You paint it on your motorcycle & register it with the company. Police in the UK generally have detectors for this and can trace it back to the owner.
They also tested how hard it was to detect and wash off.
Read my post at the top, I work in an area where a notice was on virtualy every sign post.
Guess what they are not their now, maybe somebody stole them, maybe they where taken down for an inocent reason (such as painitng the lamp post) but they have not gone up again.
Go figure why and let us know...
You'll notice that the strategy has almost nothing to do with the product itself, and almost everything to do with the publicity campaign surrounding it -- and the police cooperation in cracking down on known fences and checking everything that comes through their jurisdiction.
SteveJ - not sure of your point? This isn't a placebo. We spoke to one officer in Yorkshire who'd used SmartWater to convict over 20 criminals. We've invested millions in the technolgy and I wasn't the only underwriter who investigated it. And our claims figures are down already which seems to indicate that it works, so lets all be happy shall we, for Hades sake! :)
Paul - again, its the effectiveness/threat of the products that creates anxiety within the criminal fraternity. They use the media to propagate the message. Seems a neat trick to me.
Clive - tell me the area and I'll go figure?!! (maybe there's no burglary there now!!!?)
And I thought the insurance industry were Luddites!! :)
@Mark: my point is just about how to conduct tests in such a way as to generate useful results.
The issue isn't whether or not SmartWater is a placebo - it sounds like it is actually helping to solve crimes, so that question is resolved. It's not a hoax. The question is, how much better is it than a hoax?
Suppose that my hypothetical bogus "placebo" security measure can be shown to achieve, on average, a 2% reduction in robberies. Then SmartWater is great. But suppose my placebo were to generate a 35% reduction on its own. Then SmartWater is still better than that, but it's no longer looking like the best thing since locks.
That's why we need to know how a "placebo" performs - to know how much of SmartWater's effects are due to the technology itself, and how much of them are generated purely by the marketing. How much I'm willing to pay for SmartWater (instead of just some cheap PR-based "security measures") depends on the difference in performance between the two.
Furthermore, how much of the 40% reduction was a result of criminals thinking "OK, with SmartWater it's just too difficult now to rob armed vans. I'll do something else instead", and how much a result of criminals thinking, "OK, company A has SmartWater and B doesn't, so I'm better off robbing B for the time being, but if B gets SmartWater too I'll go back to robbing A"?
If there's a lot of the latter, then the secure delivery industry as a whole would be kidding itself if it thought that SmartWater could reduce robberies by 40% across the whole industry. If it's entirely the former, then SmartWater can do exactly that. Company A has an interest in knowing which it is, because they (and their insurers) need to know how much of the 40% reduction will be cancelled out once companies B, C, etc. all have the new technology too. It might be none of it, all of it, or somewhere in between. I'm just curious to know which.
Does it have a half-life? How about a transfer of ownership? Can you tag it a second time with SmartWater? Can you remove it? So I buy something with cash. And they say I stole it.
>G4S are using SmartWater to protect their cash in transit oper
Can I assume they're not tagging the cash itself?
Of course, the thing about sticking the "This property is protected by DeviceX(tn)" is that you are advertising that you have something to lose, that is some valuables of interest worth protecting.
I would rather stick no signs or advertisements on my property, If I get burgled, then they get subsequently caught, then thats one less team of thieves on the streets (at least for a little while (UK Justice is the best *sarcasm intended*).
In fact, better to surprise the criminals with high tech anti theft devices, like spike traps cunningly hid in front of the TV, we all use remotes right, no one goes up to it these days. Also, the TV stand could be a pressure plate, simply lift the TV to activate the boulder and poisoned darts.
I think you get the idea.
I am a widow living in an old (1908) bungalow with a lead lined 'hidden valley' between two roofs. Has anyone any good ideas for deterrents. I have a dog but he's not fierce and doesn't bark! I wondered if there's any hi-tech electrical device. Also do insurance companies cover theft of roof lead? Thanks in advance for any info.
My question to mark, if I may.
I'm very interested that insurers are starting to look at solutions like smartwater.
What competitive analysis did you do comparing smartwater to its main rival selectadna? How did they compare? http://www.selectadna.co.uk
They claim to reduce burglaries and theft in a similar way but stress their DNA technology being more secure than smartwater's. My understanding is that smartwater has nothing to do with DNA at all - rather an older technology using less sophisticated earth chemicals. I remember it being around for years.
Selectadna seems to be popping up a lot in the press recently - especially their DNA Grease to stop lead theft for Churches. What does everyone know about selectadna?
I had some tools stolen that were marked with an engraver. The trouble is that even though they were marked, they never showed up anywhere where someone cared about the engraving. If smartwater is to be effective, you have to find the goods that were stolen and "read" the mark. tough gig to recover stolen goods...
Yes, we did look at Selectadna but we found most of their claims to be, erm, being polite, 'flimsy' to say the list.
We found that most police forces were actually looking for SmartWater, whilst, despite their claims to the contrary, practically none were looking for Selectadna. They simply seemed to be stealing SmartWater's clothes.
We were also quite concerned about Selecta's reluctance to provide operating temperatures e.g. at what temperature did DNA disappear?
We were not concerned about the 'secure' bit because that more to do with anit-counterfeiting which isn't our remit, we were more interested in deterring burglars and thieves.
Incidentally, I was part of the team that assessed SmartWater suitability for use on church roofs. We've just placed an order to protect 20,000 churches in the UK as a result.
I had some smart water delivered free from a leading musical instrument insurance company to place on some high value musical instruments. I was sceptical at first, but on relfection it would be v difficult to remove if placed inside (as washing would damage the delicate wooden instrument) and my guess is dealers will be much less likely to fence stolen property if they know lots are indelibly marked.
@ Gopi and nick : Smartwater has NOTHING to do with DNA it is an rare earth system
SelectaDNA does use DNA and PCR type technologies (but of a type that cannot be detected without the correct keys and cannot be contaminated by DNA in the environment)
They both have thier strengths and weaknesses
Neither would survive the temperatures on a remelt in a furnace
in reality both of the systems rely on the UV system that the police forces pick up on and they say to the criminal you've been stealing a marked product.
WRT G4S another system similar to the smartwater cash protection has been in operation for 4-5 years with a major bank in the UK (multiples of 10's of thousands of codes out ) utiliseing real DNA again with dramatic results for that bank only
Tying you to a crime scene or location is only valuable if it can do just that. can you show there is no other way to get exposed? What if you just touched, or touched someone who touched? Secure the Smart water source to limit access-has anyone heard of chain of evidence?
You also need to make sure it doesn't travel too far. If it travels to every hand that person shakes, the laundromat, bank, McDonalds etc. then the significance of being tagged becomes, allow me, watered down.
Seems to still make sense to have existing access protection in place like door locks and fences. The people who have easiest access will be authorized and probably go home watertagged every night. Guess it is useless to ID them, their car, garage etc. Why not spend that money to just improve existing access protection?
And who says you have to melt down to cover your tracks. Many common industrial chemicals could clean a substance off steel. Just look in your kitchen cabinet.
I suspect this conversation has been rooted by the vendor selling this, and no doubt there are customes not really aware what they have. Sorry I'm just a skeptic and I think marking has it's place but doesn't stop theft like is claimed earlier.
Just put yourself in place of a thief, what you would do and you will find it really wouldn't deter you much. In a lot of cases, you, the insider ARE the thief
You can't use another Smartwater application on top of an existing, different, code. The UV lamp shows the presence of the base content of the Smartwater, multiple light sources at different wavelengths cause various elements to fluoresce and other elements to phosphoresce. The presence/absence of these elements form a binary code. This code is swabbed from a suspicious article and sent back to the lab to be analyzed. Due to the elaborate chemicals, many rare and not normally found in daily life, a criminal with the recognized code will be found guilty. One has to ask, those chemicals, has anyone tested their toxicity? You don't want a criminal suing you years later for some illness, however deserved it is!
Well I downloaded the pdf from sutton police force website about smartwater and it appears from the pdf as if each bottle of fluid contains millions of microscopic particles which literally are tiny number plates that you can read with a microscope.
So it really is unique and doesn't rely on chemical analysis and so how secure it is depends on how hard it is to remove the dried fluid. With modern chemicals I expect this could be made very very difficult indeed.
I'm not saying it would stop your stuff getting stolen, but certainly if your stolen property ends up in the hands of the police you would be very likely to get it back again. It also would help secure a conviction if the thief was caught in possession of your marked property.
WRT bobs comments,
only some of the smartwater products have the microdots and there are a couple of other companies using glue, UV and microdots.
(datatag /selectamark plus more )
All of their syatems have the chemical markers and these can be confused if more than one code is used in the same place for the reasons above
I'm sure you'll be pleased to know that SmartWater was featured recently on national TV show as a result of their technology being used to convict a team of professional armed robbers. (There's a clip on their site from the show, together with a loads of other stuff which shows their success in locking up criminals).
But, more importantly, guess what, as a result, the jewellry store chain concerned has not been targeted by criminals since. Whereas they nornally experienced a burglary/robbery every quarter, since the conviction there have bee - No robberies. No burglars. Wow, maybe because SmartWater was acting as a deterrent? Maybe?
Come'on, surely, reason to rejoice?
Yes, am paid to be a cynic but I'm also open-minded.
Guess I'll go buy some "Protected by SmartWater" signs and stickers that put them on my doors and windows... right next to my "Protected by ADT Security" signs. That oughtta keep those pesky burglars away from my stuff!
i just use urine ... well .. something like urine
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.