Schneier on Security
A blog covering security and security technology.
« Friday Squid Blogging: Sexing Squid |
| Master Thief »
March 29, 2010
Identifying People by their Bacteria
A potential new forensic:
To determine how similar a person's fingertip bacteria are to bacteria left on computer keys, the team took swabs from three computer keyboards and compared bacterial gene sequences with those from the fingertips of the keyboard owners. Today in the Proceedings of the National Academy of Sciences, they conclude that enough bacteria can be collected from even small surfaces such as computer keys to link them with the hand that laid them down.
The researchers then tested how well such a technique could distinguish the person who left the bacteria from the general population. They sampled bacteria from nine computer mice and from the nine mouse owners. They also collected information on bacterial communities from 270 hands that had never touched any of the mice. In all nine cases, the bacteria on the mice were far more similar to the mouse-owners' hands than to any of the 270 strange hands. The researchers also found that bacteria will persist on a computer key or mouse for up to 2 weeks after it has been handled.
Here's a link to the abstract; the full paper is behind a paywall.
Posted on March 29, 2010 at 7:15 AM
• 32 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
How many different ways can bacteria be transferred (sneezing, coughing, touching, tracking - just to name a few)? What about background bacteria - only 1 person generally uses a computer - how does it work in a lobby or better yet a bathroom? How well is the bacteria on your hand correlated to the last few items you touched? I could see this working well in the very controlled environment of a test - not so much in the real world. And even if (a big if) it works, it can be easily masked using rubber gloves, just like finger prints.
Hmm Lockards Principle in action...
Mind you there is something buging me beyond the bacteria in this...
It's the overlap of bacteria strains from one small population group to another.
Hmm I'm not paying the (paywall) price to see how they dealt with the issue though.
Bacteria present on a person are likely to be related to the surrounding environment. There may be significant difference when comparing with 270 people form the general population, but what about 270 people form the same office/building?
I doubt this will be of much practical use, unless the bacteria lifted form the scene are particularly unusual.
In an office environment, people will transfer bacteria from the hand to every doorknob they touch, and transfer from the knob to the hand. So the forensic analysis will identify the culprit as 'somebody who works here'?
Someone wearing vinyl gloves will leave no bacteria on your keyboard. Nor will someone pushing keys with the eraser on a pencil.
It's too person dependent. The problem nowdays is not identifying against known individuals but rather against the population as a whole. We're lucky that bacteria change with time and such or else we'll be all lining up to get our bacteria fingerprints taken.
Scientists keep inventing new methods for identification when the old ones are more reliable and better understood. There are already many cases where rape kits are not being used to check against the DNA database(LA I believe has several thousands of them unchecked), I think that shows that all the science you invent ultimately fails if it's not used because of time, money and people constraints
the first step to my favorite biometric.
Halatosis locks (hufff, huffff, hufff)
(cf Alien: Resurrection).
This was also discussed earlier with regard to using bathroom waste to identify drugs and potentially drug users with sewage stream robots. How about touchscreens? So, now we will be met with biosampling keyboards and mouse/mousepads along with biosampling screens for touch and breath. Since we already have keystroke analyzers and onboard video watching us, plus microphone recording, what is the value of the biosample? Can they check my prostrate and general health as well so I can eliminate the high deductible doctor's visits as well? Yet, with all this, will we really catch an more terrorists or criminals? NO! All they will have is tons of data that can be use to fire people or deny benefits.
I'm surprised at how many people scoff at this by saying, "big deal, it can be beaten by wearing gloves." Sure, but so can fingerprint analysis, and that was still a very important forensic break-through.
Let us assume that their first assumption (yet to be confirmed in any way) is the uniquness of the bacteria colonising an individual.
The question the arises as to how long this print is valid for.
In the case of a traditional fingerprint it has been found to remain fairly constant for the individuals life (say 75years).
However the life of a bacterium is very very short and can be just a few days, so the question then arises what specificaly are they measuring...
Is it the ratios between the quantities of bacteria types or the genetic mutations and filial line.
I would expect the ratios to change relative to the bacterial life span (half life) thus I would expect them to change relative to time from contact to sample.
Then there is the question of say washing the hands and clothes, some bacteria are more susceptable to some cleaning agents than others for instance fabric conditioner is a veritable smorgasborg for some bacteria and molds (which is why you have to clean the draw in your washing machine atleast once every week or two)
Then there is the question of the "body effect"... illness, hormanal, dietry and other changes in the individual over relativly short time periods will change the bacteria that are carried.
So just how long is this "bacteria fingerprint" going to remain valid.
That is a year down the road from now what is the likleyhood of your bacteria fingerprint matching that taken as a sample off of a keyboard taken today?
But I guess the real question is what is the cost benifit ratio?
With evidence level DNA testing costing upwards of 400USD, and not being that reliable whilst ordinary fingerprint matching is dropping in price all the time... What real chance has this new idea have of catching on...
Then of course is it going to survive "evidence seeding".
That is I take a sterile glass put a refreshment in it and offer it to you on a tray etc. Now I have not just your physical fingerprints, your saliva and DNA, I also have your bacteria fingerprint.
A simple photographic technique will give the physical fingerprints without damaging or contaminating the other "samples", the DNA can be chearfully replicated in the same way as the first stages of the ordinary DNA testing, to give whatever quantities you want. And a simple swap and growth culture will give enough base bacteria to grow as much as required.
Thus I can go ahead and "seed" (contaminate) a crime scene with your various fingerprints ...
Likewise I could just find an appropriate place to take swabs of multiple peoples traces and grow those. Then spray them all over th crime scene.
Which gives rise to the question of sorting out the wheat from the chaff and can this system do it?
"the full paper is behind a paywall"
PNAS papers are free on-line 6 months after print publication. So, if you're reading this after October 2010, you should be able to get the full content via Bruce's link.
Okay, so you can reliably distinguish between somebody who've been using the keyboard regularly for months/years, and somebody who've never touched it. It says nothing about people who typed a few words on it last week, or people who used it for the last hour.
Only considering the extremes seems to me to be a rather unambitious measure of success.
Can somebody please think up a movie plot where this distinction would have practical forensic value? Surely there are easier ways to determine the rightful owner of a stolen laptop?
"Can somebody please think up a movie plot where this distinction would have practical forensic value?"
I’ll give it a shot. A civilian scientist is capture by terrorist and forced to create a biological weapon for them. The terrorist got plastic surgery to look just like the scientist so that he could take his place. He also had his fingerprints altered to match the scientists. The president has been infect and has only moments to live. The formula for the antidote is stored on the scientist’s laptop along with several other formulas’ the scientists was working on. The military captures both the scientist and the terrorist but do not know which is which and haven’t got the time for DNA tests. If they choose the terrorist he will say one of the other formals stored on the laptop is the antidote and then the pres will die. So the military breaks out the mobile lab and determines that the scientist bacteria are on the keyboard and choose him. They wipe up an antidote with the mobile chemistry lab and the pres is saved
Copyright kog999, if this becomes a movie I want some royalties.
"Copyright kog999, if this becomes a movie I want some royalties."
I don't think even Harison Ford could carry it into profit.
The full paper says “on average, interpersonal variation in community composition exceeds temporal variation within people, even when individuals are sampled many months apart” and that on people’s palms they recover “with hours of hand-washing.” It provides these references for recent work this is based on:
5. Grice EA, et al.; NISC Comparative Sequencing Program (2009) Topographical and temporal diversity of the human skin microbiome. Science 324:1190–1192.
6. Gao Z, Tseng CH, Pei ZH, Blaser MJ (2007) Molecular analysis of human forearm superﬁcial skin bacterial biota. Proc Natl Acad Sci USA 104:2927–2932.
7. Grice EA, et al.; NISC Comparative Sequencing Program (2008) A diversity proﬁle of the human skin microbiota. Genome Res 18:1043–1050.
8. Fierer N, Hamady M, Lauber CL, Knight R (2008) The inﬂuence of sex, handedness, and washing on the diversity of hand surface bacteria. Proc Natl Acad Sci USA 105: 17994–17999.
9. Costello EK, et al. (2009) Bacterial community variation in human body habitats across space and time. Science 326:1694–1697.
Oops, that should have been “within hours after hand washing”.
I'd be interested to see what the results are for PCs that more than one person has used, or of people that have recently shaken hands with other people. If they could separate the individuals, then that would be impressive.
It's not clear if the bacteria are unique to an untainted individual, or whether it's the combination of bacteria that's unique.
Frankly, that's a different paper.
("Frankly" in the previous sentence is a proper noun, not an adverb.)
@ DaveB: "I'd be interested to see what the results are for ... If they could separate the individuals, then that would be impressive."
Technology only gets better, and this kind of reminds me of spectroscopy/spectrometry. Initially it was pretty coarse, but now it can be used to measure distant stars pulsing to within a metre or two.
If this proves viable and practical, I would expect that within a couple of years 'they' could
1) determine how long ago someone last used the keyboard
2) how many different people have used the keyboard
3) how frequently each person uses the keyboard
Just from the quote above I get the feeling that extensive research was carried out on 3 keyboards and 9 mice...
And compared to 270 people, no mention if these were co-workers or people from another continent and how 'far more similar' the results were...
Very solid theory indeed!
Frankly my dear, I don't give a damn!
(sorry, someone had to do it!)
Thought I should make it clear:
"I schneer at this research"
Schneer (tm)(c): [sh.nee.r]
-verb (used without object)
1. to speak or write in a manner expressive of derision or scorn on topics related to security and security technology
If it really is true that the precise composition of the microflora of human hands is stable over long terms, then it is the only known ecosystem for which this is true.
In other words, this result is highly improbable, and I will regard it with considerable scepticism until it has been independently replicated.
I just finished reading "Bacterial Community Variation in Human Body Habitats Across Space and Time" by Costello et al. (hereinafter "BCV") and I believe that the present authors are seriously over-stating the results of BCV when they quote it in this paper. (I would be more polite and say that they misunderstood it, but that seems unsustainable when the two papers have 4 authors in common.)
For example, they claim "on average, interpersonal variation in community composition exceeds temporal variation within people, even when individuals are sampled many months apart" and cite BCV in support. It is true that BCV found larger variation between individuals on the same day than between samples from the same individual 3 months apart, and that this difference was statistically significant. However the difference it found was not large -- certainly less than 3 SD. And that is only when you can exclude variation due to habitat, i.e. you know exactly where the bacteria came from. As soon as you allow that someone might have picked at some earwax before typing, the difference due to individuals is totally drowned.
This test would be likely to produce false positives at a rate at least on the order of 1%, and probably much higher. It is thus likely completely useless for forensic applications.
One of the authors was interviewed on NPR's Science Friday and from what I gathered, it sounded like cross-contamination wasn't examined. A listener asked a question relating cross-contamination that the author didn't answer, but rather talked about something else instead. That made me think that, either:
1. The question was being purposely avoided, or
2. the author didn't understand the question.
If (1), that would make me believe that the question of more than one person touching the keyboard was examined and showed the method as forensically useless. If (2), then that would lead me to believe that the study didn't even look at more than one person touching the keyboard.
What the study determined was that the colonies of different bacteria occupying the fingers differed between individuals enough to pick out who touched a keyboard or mouse. However, if more than one person touched the device then the colonies would be a combination of all those touching it and possibly would not lead to conclusive evidence as to who exactly touched it. One other aspect that was discussed during the show was that the bacteria occupying the forehead of an individual _also_ differed from that occupying the fingers. So it's possible that if the tested individual touched some other part of the body and then the keyboard soon after, that the results would also be somewhat different and not necessarily conclusive enough for a court.
And then the Golginfrinchin civilizization on Earth was wiped out due to a lack of telephone sanitizers.
Query: Is this how dogs distinguish between humans?
hello sir, whether it is possible to implement in the real world...please explain with the detail.how can v compare with bacteria...
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.