Schneier on Security
A blog covering security and security technology.
« Anonym.OS |
| Friday Squid Blogging: Poetry »
January 20, 2006
Surreptitious Lie Detector
According to The New Scientist:
THE US Department of Defense has revealed plans to develop a lie detector that can be used without the subject knowing they are being assessed. The Remote Personnel Assessment (RPA) device will also be used to pinpoint fighters hiding in a combat zone, or even to spot signs of stress that might mark someone out as a terrorist or suicide bomber.
"Revealed plans" is a bit of an overstatement. It seems that they're just asking for proposals:
In a call for proposals on a DoD website, contractors are being given until 13 January to suggest ways to develop the RPA, which will use microwave or laser beams reflected off a subject's skin to assess various physiological parameters without the need for wires or skin contacts. The device will train a beam on "moving and non-cooperative subjects", the DoD proposal says, and use the reflected signal to calculate their pulse, respiration rate and changes in electrical conductance, known as the "galvanic skin response". "Active combatants will in general have heart, respiratory and galvanic skin responses that are outside the norm," the website says.
The DoD asks for pie-in-the-sky stuff all the time. For example, they've wanted a synthetic blood substitute for decades. A surreptitious lie detector would be pretty neat.
Posted on January 20, 2006 at 12:37 PM
• 37 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
"Active combatants will in general have heart, respiratory and galvanic skin responses that are outside the norm," the website says.
So will fearful yet innocent civilians. So will anyone in the vicinity of an urban firefight.
As to circumventing such a device used as a hidden-person detector, the principle of "chaffing" seems like it would be effective.
"without the subject knowing they are being assessed" - think somebody could sneak into the studio of the next presidential debate? ;-)
Here in Germany we have had legal
surreptitious lie detectors for years now.
They are called mothers-in-law ;-)
After disclosure of their results, this is often just shortened to "mothers!"
I don't think that this would prove very effective in an airport. If it works as designed it will alert the security staff of every person who is scared of flying, worried about his/her job or just plain angry at something.
Also what about a person who just ran for 5 mins to catch a connecting flight which was at the other end of the terminal (I have had to do that in London and in Paris). They would definetly have an elevated heartbeat, prespiration and responses outside the norm. Does that make them a security threat? Probably not...
Another something to keep in mind is that a lot of professional soldiers/combatants would probably be cleared by this system because if a person is not worried about anything or are happy that they will be going to heaven after they die then the system won't catch them.
Actually, this would be another example of where tech developed for the military has even better civilian uses. (Like say -- the Internet?)
Being able to monitor someones pulse, respiration, temperature, and a host of other metabolic information points makes this basically version 1.0 of the "tricoder".
JustInTime, That was actually the first thing I thought as well. This is pretty dubious stuff as-designed, but could have some fascinating applications (good and evil) in other settings.
But, as far as I can see, this is just a way to measure all the things that polygraph measures, but without the subject knowing it. As far as my understanding of polygraphs go, even under ideal conditions (and these are far from it), even the most avid advocates (the American Polygraph Association) do not claim to have a reliable success rate of over 80% (http://www.polygraph.org/validityresearch.htm). That is 1 out of 5 in IDEAL CONDITIONS, having asked the proper control questions by a trained professional, with the person completely at rest and their gaze fixed on an uninteresting thing (such as a blank wall), and with the control questions repeated and the reaction compared to the actual questions.
So, even if the remote sensors are 100% accurate in measuring all the biometrics that a standard polygraph measures, one would have to make sure all other aspects of the polygraph test are carried out correctly. I wonder how they will ask a subject to stare at a blank wall for half an hour while being asked questions if they don't know they are being questioned by a polygraph.
Aldrich Ames, the CIA agent who became a Soviet Spy, was arriving intoxicated at his office and leading a lifestyle way above his salary, still he wasn't touched because he passed two poligraph tests. Later, when asked how he did it, he told the interrogators that the Soviets told him to 'Just relax' during the tests. Now, the question is: if you are lying
(or preparing to blow yourself in a crowded area) and don't know you are being checked, are you more or less relaxed? The answer probably is that it depends on the individual...
Flutterbugs went to a 'calibration' stage to give their gadget the cachet of being scientific, and now the DoD wants a remotely-located gizmo to be 'just as good as' the polygraph, without even a pretense of 'calibration', and with the 'stimulus set' uttery uncontrolled -- random and unknown?
How would this distinguish a hot date or a full bladder from a gloriously joyous martyr taking his last steps on the way to paradise? If it did discriminate to any degree, it would finger for execution everyone scared of being killed by the authorities, and everyone trying to act calm so as not to draw attention that will get them killed.
Does anyone think Mohammad Atta's black little heart was thumping away on the lead up to the hijacking? We already know that wifebeaters are very calm and relaxed during attacks.
Yeah, it'll happen -- and Junior Soprano will score with Angie Dickinson.
I'm going to have to go against the grain on this one. This sort of test, if it did exist, would certainly not be an infallible terrorist finder or what have you. That doesn't make it useless, though---as far as real-time statistical profiling goes, I think this is a pretty good element.
If you're working airport security or crowd control at a stadium or something like that where the total people-flux is huge compared to your security staff, being able to immediately pick out the top 20% most nervous, excited, or angry of the crowd is a great thing. Any decently trained security staff will be able to tell Sister Mabel (who hasn't been outside of the convent in 30 years) from the Unabomber. In a perfect world, the staff would be there both to apprehend the terrorist and assist the nervous person. Everybody wins.
The biggest complaint against static screening methods is that it's easy for the attacker to repeatedly test the system and work out the parameters. With this sort of screening, that's much less true. It's not trivial to guarantee that a particular person will or will not be picked up on this screen, and although it's true that it will be easier for an attacker to circumvent it once he's familiar with it, there are still a lot of variables that only change when he makes the real attempt.
Finally, if we take for granted that they're not going to hook it up to some creepy face-recognition or long-distance RFID passport scanning system, this screen is much less intrusive. Unless they actually stop me ("papers, comrade!"), they have no identifying information to go along with that biometric data. I prefer that to checking my name against a database.
My concern isn't about their development, but their application and clout, especially when regular lie detectors are dubious enough in validity.
I get the feeling it'll be like the superbowl face recognition which yielded a sufficient set of false positives for everybody to pat themselves on the back and magically convince themselves into thinking it worked. It'll get toted out and not used after making some press of it's "success", even if it does no better than random searches.
One thing everyone has to realize is that of course a polygraph won't catch a hardened spy or similar. I'd imagine thats not really much of the point, there are many counter-measures used to detect them.
What it is pretty good for is determining joe blow who might in the future reveal secrets or who is sitting and waiting for someone to make them an offer on state secrets. Remember that getting a clearance isn't only about who you are/what you have done, but also about who you may become, and what you may one day do.
Physiological parameters can be influenced by medication. How will you exclude it? Urine samples at the entrance?
"Would you fill this little container, (Madam|Sir), please?"
Does that mean I will get free diabetes tests with a subway ride?
There might be some usefull applications for that idea, but only for groups of people. It might be usefull to detect panic or, as Evan Murphy mentioned already above, aggressions some seconds earlier to open gates or send some security before something really bad happens. But a fast IR-camera with a high definition (>0.1K) is probably better suited for that kind of problem.
It would be quite usefull for a fast medical diagnosis of an individual in a crowd: had that person on the ground a heartattack or is he just drunk?
But to detect stress induced by and only by preparing an attack? I don't think so.
"A surreptitious lie detector would be pretty neat."
Would it really? I'm actually quite sure that that's an example of technology that we do NOT really want...
Heh, I can imagine the police walking around and pointing devices emitting laser beams to people with a green and a red led with the red one labelled as "possible terrorist".
@Ari Heikkinen - indeed, its not hard to imagine a cross between this and the number plate scanning that the brits are doing. There are plenty of places you could see the scanners being installed, train stations, airports, shopping centres.
... one night you return home and your internet fridge displays the message "citizen number 0193823845621038 please report to the police station for debrief, we know you have something to hide ..." (oh, and the fridge is locked until you do ...)
What the DoD _really_ needs is a Remote Absurd Belief System Detector with Dynamic Filters for innocuous beliefs as and when they are found.
Like Juergen my first thought was that I'd like to have such a device during political debates, speechs etc. I thought it also might be useful during sales pitches. Finally I considered that polygraphs aren't useful against pathological liars and decided maybe it wouldn't be as useful during those events as we might like.
Wouldn't be more accurate to have an "executive decision maker" gadget that randomly selects yes and no, and relabel it to terrorist and non-terrorist? Your error rate would be only 50%.
A couple of respondents seem a little unclear on this, so I thought I'd spell out why this is not so much "pie-in-the-sky" as nonsense. Or to be more accurate, it looks like pie-in-the-sky that has been turned into nonsense as it wended its way through the halls of bureaucracy and got a little "mission creep".
Polygraphs are simply machines which -- as the name suggests -- measure several physiological responses at once. Typically, heart rate, blood pressure, skin resistance, respiratory rate and depth. The theory is that they can be used to detect stress by seeing these properties change against a measured baseline when the only environmental variables are the questions, and that by comparing stress levels produced by "Irrelevant Questions", "Control Questions" (questions not related to the interview, but which are presumed to produce stress in most people), and "Relevant Questions", it can be detected if the subject lies about any of the Relevant Questions, or is unduly distressed by them. That's not all of it by any means, but a reasonable summary.
Now it should also be said that even their most enthusiastic advocates only claim 90% accuracy (most suggest much lower), and they are more than somewhat controversial. For one thing, they don't actually measure lies, they measure stress, so anyone who can lie without stress (e.g. sociopaths) is home free, while anyone who is distressed by certain truths may look like a liar. For another thing, they don't even actually measure stress at all, but several proxy factors, and many people have different responses. Most seriously, despite the phrase "Control Questions", they don't actually have any real controls in the scientific sense, because the truth or falsity of answers to the "Control Questions" is not actually known, and the test is not conducted double-blind. As a result of this, in most jurisdictions polygraph evidence is considered pure junk science and is totally inadmissible in court.
Now, what does this tell us about the proposed remote polygraph? First, consider the proposed usage "pinpoint fighters hiding in a combat zone, or even to spot signs of stress that might mark someone out as a terrorist or suicide bomber."
1. It was highly dubious stuff to begin with;
2. We now have no Control Questions
3. We also have no Relevant Questions
4. Actually, we have no Irrelevant Questions either
5. There are lots of environmental variables (except, there aren't any questions!)
So what the hell is it supposed to measure then? Oh: "heart, respiratory and galvanic skin responses that are outside the norm,"?! This is utter nonsense. None of these parameters have a "norm". They have enormous variation not only between individuals, but within one individual according to environmental variables. Someone who has just run after his bus will likely have much higher heart rate, respiratory rate and galvanic skin response than someone just strolling along. How much higher it will be, and how long that elevation will last, depends on how often he works out, and whether or not he is acclimatised, and whether or not he is well or ill, and how much water he has had to drink today, and whether his collar is too tight, and a dozen other factors. With no measured base line to compare to, the measured physiological parameters simply tell you nothing at all. They do not give, say, 20% accuracy as Evan was hoping; they give you absolutely nothing.
However, there is another application that is worth considering: suppose we have a more controlled environment, a sort of interrogation, but where a polygraph can't be used. Say, for example, we have an agent in place who can gradually and cautiously slip some "Irrelevant Questions", "Control Questions" and "Relevant Questions" into the conversation, while the magic gizmo is hidden inside the espresso machine and monitoring the subject's response. In such a circumstance, the device _might_, in principle, be useful. I can imagine that the project started off this way: a request for a portable covert polygraph system, requested by field agents who didn't know how unreliable they are. But it is rather doubtful: polygraphs are dubious science to begin with, and the result will be made worse by the limited control over the environment (is the suspect rattled by that question, or is he looking at a pretty girl over the agent's shoulder?), plus the fact that outside a genuine interrogation most recommended "Control Questions" are likely to get a very hostile response. Further, there is a lot of evidence that when polygraphs work at all, they do so in part by frightening the suspect. If so, that makes a covert polygraph a contradiction in terms.
Still, suppose it could be done. What then? Well, for one thing it would spell the end of HUMINT, and allow the organised crime families to recover their power.
One thing you didn't touch on is that the childlike mindset of polygraph operators holds that the only kind of lies that exist are lies of commission.
If I answer all the operator's questions factually, will he be able to detect the lie I didn't tell -- that I wired dynamite to his ignition?
Even the 'theory' of polygraphy has no place for lies of omission.
Conventional lie detectors are nonsense, as I understand, so this technology would be, too.
But if it did happen to actually work, I think we should all insist that one of them be trained on politicians whenever they speak publicly. The Presidential "State of the Union" address would be a lovely training ground.
But then again, I'm sure they'd invest millions of taxpayer dollars in circumventing it if that were the case. The President would either come out looking like an Egyptian mummy, or he'd be encased like the pope, in glass that filtered the waves out.
A surreptitious lie detector would be pretty neat.
Yes it would -- especially since existing "lie detectors" work by conditioning the subject to respond, and basically pressuring him or her into a confession on the belief that the machine works in the first place.
"If you're working airport security ... being able to immediately pick out the top 20% most nervous, excited, or angry of the crowd is a great thing. Any decently trained security staff will be able to tell Sister Mabel (who hasn't been outside of the convent in 30 years) from the Unabomber. In a perfect world, the staff would be there both to apprehend the terrorist and assist the nervous person. Everybody wins."
Oh really? Says you? I went on a flight recently. Had your vision of "Everybody Wins" security been in place, I would have had my ass hauled into a room somewhere at the airport, and been interrogated by the TSA. Not because I am the "Unabomber", but because I have a aviophobia.
Anyone with intelligence and a bit of skill can disguise himself or herself to look quite innocent. Your statement about security staff picking out the innocent from the evil is beyond optimistic.
I wouldn't have wanted any "assistance" from them--for the person with a distinct fear of flying, the only possible assistance is a general announcement along the lines of "All flights have been cancelled; go home".
If this could be mounted on a sniper rifle's scope, we could place snipers in strategic places on airports/subways etc. and have them shoot all the terrorists caught by this lie detector. I'd volunteer for this "one man judge, jury and executioner" -job. I like to play God.
>>What it is pretty good for is determining joe blow who might in the future reveal secrets or who is sitting and waiting for someone to make them an offer on state secrets. Remember that getting a clearance isn't only about who you are/what you have done, but also about who you may become, and what you may one day do.<<
Yeah, that's great. 100% accuracy rate because they prevented all these terrorists from taking action.
Kind of like the psychics who claim to sense cancer or something, and when demonstrated incorrect, insist that the cancer is in a predetect state that will eventually be discovered.
"...the number plate scanning that the brits are doing"
This doesn't work quite like that. The numberplacte scanning onlyflags up a plate as being of interest if it has previously been flagged as being of interest by other means, i.e. verifiable involvement in a known crime for example.
Bruce: "A surreptitious lie detector would be pretty neat."
It would be the worst, most consequential surveillance machine ever invented. Every tyrant must be dreaming of having such a gadget. That the DoD even want this is shocking. Btw whether it really "works" doesn't matter a lot, it will do much harm in any case.
It's a no-go
RABSD/DFIB isn't a nice sounding acronym ;)
"...existing "lie detectors" work by conditioning the subject to respond, and basically pressuring him or her into a confession on the belief that the machine works in the first place."
As a potential polygraph subject some day, I'm worried a lot more by the belief of the inquisitor that the machine works.
"...existing "lie detectors" work by conditioning the subject to respond, and basically pressuring him or her into a confession on the belief that the machine works in the first place."
As a potential polygraph subject, i.e. an innocent civilian, I'm worried a lot more by the belief of the inquisitor that the machine works.
What if polygraph operators know their 'boxing' is a scam?
I think most of them do know. The gullible few are in for some painful agonizing over 'anomalies' they'll never explain.
These people are the modern day inquisitors, able, by their sorcery, to destroy lives -- while they are at the same time the basest sort of infidels.
Surprised noone has mentioned the obvious. I'll do it now.
Once they have tested the device to evaluate efficacy, and come up wiith an equation versus risk, then it is wired to an automated targetting device, and renamed 'smart bomb'.
Still think it's pretty neat?
A few years ago an Isreali software company claimed to have a product that could detect lying in an audio feed, and were planning to produce a home computer version. As far as I know, like many such press releases, it did not go anywhere...
But imagine the effect on political speeches and debates if such a product comes to market on a large scale (regardless of whether it really works). Political handlers will have a whole new set of issues to try to train their charges' performance. mmm the prospect is delicious.
Not to mention that such a test violates the individual's right to privacy under the fourth amendment
Of course there would be false positives and those capabale of circumventing the detectors. But the whole idea folks is to narrow down the field of those who warrant further screening or scrutiny. I think it is a great idea - one I had several years ago - and I am surprised it has taken so long to come around. I remember years ago seeing where they hooked up race car drivers to a heart/breathing monitor while they raced around a course at high speeds. I was amazed at the incredibly high heart rates - 150+ - recorded by these professional drivers as they neared every sharp turn. While I am sure there are a few people in excellent shape who could fool these detectors, I think most, if not all would-be suicide bombers, smugglers, terrorist would be equally unable to control these involuntary biological indications as they near checkpoints or their target destination. Why are there always so many who automatically find fault with any idea that deals with a problem we must all face. I suspect those are the same people who wonder after the fact why nobody did anything to stop the terrorist before they stike.
I spoke the truth in a lie detector test a few weeks ago and I was failed. I am still in shock. My husband gave the examiner a really good ;low down beforehand and I feel that the examiner failed me before I really had the test. I had a test last year and passed, but of course there was not the low down help before hand. I was judged as I was seen.
What do you think??
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.