Schneier on Security

Davi Ottenheimer • October 20, 2005 9:06 PM

Ok, I’ll take another stab at answering your question, particularly since I’ve been wondering about whether the police should have some sort of emergency access (frontdoor) to the systems I’ve been working on:

“How soon before there’s a law requiring these webcams to be built with a police backdoor?”

The good news is that it’s fairly trivial to block/interfere with remote administration of networked surveillance systems so there’s a big technical hurdle to backdoors. The bad news is that, from my experience, very few systems are hardened enough (no logs, no encryption, etc.) to prevent just about anyone from stealing credentials and using the system secretly anyway. Don’t get me started on the security deficiencies of networked physical security systems…

Aside from that, timing of a police backdoor law would be based on a perceived need by the police and willingness by the businesses to give up their freedoms. The need expressed in the cited article seems overly broad and far too naive to win people over:

“Montanez’s son, a police officer, responded to a bank robbery in Corona. A good vehicle description would have helped officers capture of the suspects more quickly, he said.”

A good case of want (what investigator doesn’t want instant and unfettered access to all information). However, I do not think it qualifies as a pressing “need”. In fact, a more realistic need should originate from the business owners themselves. I mean how many businesses are going to think they should forget the 4th and 5th Amendment just because some local bank had a robbery? Or, for that matter, when was the last time local business owners said they’d be happy to give the government free access to their books just because some other company experienced fraud? Business owners are generally smarter about managing risk than that and I hope they do not give an inch without some kind of audit and protective control like a log of when/what the police monitored their space(s).

And then there’s the issue of whether the average police station is actually ready to manage a deluge of consumer-grade network video evidence. Given the wide range of formats and standards, I’d say the Corona police are also incredibly optimistic or talented to think that they can effectively access and aggregate a heterogenous neighborhood of surveillance systems. If they realize this, the “need” for backdoor might never be pursued at all, or at least until other standards/practices are in place to make it more feasible.

@ Moshe

If I remember correctly Chicago has invited business to join a centrally managed camera network that was meant to monitor public spaces. That means some significant infrastructure is already in place. Sending feeds to a central system is very different than Corona’s apparent request — “pay for us to be a fly on your wall and we’ll protect you”. Something tells me Corona’s approach would never have worked in Chicago…