Schneier on Security
A blog covering security and security technology.
« 4th Amendment Rights Extended to E-Mail |
| Credit Card Gas Limits »
June 26, 2007
Surveillance Cameras that Obscure Faces
From Technology Review:
A camera developed by computer scientists at the University of California, Berkeley, would obscure, with an oval, the faces of people who appear on surveillance videos. These so-called respectful cameras, which are still in the research phase, could be used for day-to-day surveillance applications and would allow for the privacy oval to be removed from a given set of footage in the event of an investigation.
An interesting privacy-enhancing technology.
Posted on June 26, 2007 at 7:41 AM
• 55 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
"and would allow for the privacy oval to be removed from a given set of footage in the event of an investigation"
The illusion of privacy...
Should we coin a new phrase - 'privacy theater'?
Probably just as damaging as 'security theater'.
A couple of years ago, I heard that France Telecom were using a similar technology to provide webcam views in nightclubs. Owing to European privacy laws, they were not allowed to show identifiable people, so they masked the faces. The idea was to let potential customers of nightclubs check out the ambience before visiting.
As I recall, they were using NSLU2s to do the processing and a conventional webcam!
"The illusion of privacy"
With the right legal framework (requiring a warrant to remove the masking) then it's no more illusory than your privacy of your telephone, mail, and other such things.
Of course the truly paranoid encrypt all their important stuff.
"The marker requirement is a trade-off, Goldberg admits, but he says that face-detection algorithms are simply not up to task for real-time operations in complex environments."
In other words, it doesn't even work - you pretty much explicitely have to tell the camera that you don't want to be identified, and then you still have a 7% chance of the whole thing not working ("At a construction site where the researchers tested their camera with the vest, the system correctly identified the marker 93 percent of the time.")
That being said, I'm also not sure what the purpose of the whole thing is. A surveillance camera, by definition, is intended to - well - surveil (is that a word?), so my immediate feeling is that in the models that will actually hit the market (when/if they do), adding those ovals will not be an irreversible operation.
I thus definitely agree with Keith - it's privacy theater, a smokescreen. And it's not even opt-in; you specifically have to opt out by wearing a brightly-coloured, distinctive marker. Hmm, maybe they could use a yellow star as a marker in the future.
i find it increasingly hard to encrypt my face. its kinda painful...
"Of course the truly paranoid encrypt all their important stuff."
Way cool! Tell me how to encrypt my face! I want to encrypt my face. I want to use dual key encryption so only my friends can recognise me.
Now that's what I call privacy.
No way anyones getting my face on camera. I'm gunna Hash it!
The algorithm to encrypt faces is known as "balaclava".
Wouldn't wearing a disguise be a form of encryption?
Of course, as the article mention, the system is still in development, it doesn't flawlessly.
I doubt however that you have to tell that YOU don't want to be identified (how would you do that? wear a RFID chip to let the camera track you and apply the mask?). Rather some algorithm analyse the image and identifies shapes that seems to be attached to other shapes - such as heads on bodies, and adds an obfuscating mask.
This is great. It means that for live vigilance where a person monitors the cameras that person won't know that you pick your nose or who's skimming the porn mags. If somebody steals the porn mags, that person can be identified by authorized personnel.
I think that with remote controlled movable cameras, a monitor should be placed visible so people can see they are being monitored (and which part of them) - independent of such privacy enhancement.
Would be useful for services like Google StreetView.
Hmmmm... Now just get one of these and sneak it inline on a friend's TV. Then watch him calling his cable company's tech support: "No, really, the only thing I can't see is faces."
I'm all for turning the world into a Shirow Masamune graphic novel.
"Of course the truly paranoid encrypt all their important stuff."
The crypto-competent encrypt their unimportant stuff too, in case of traffic analysis.
Dudes. All you have to do is watch that movie from The Ring. There *is* an unfortunate side-effect, besides the face-obscuring, but you have a week to try to avoid it.
so, i'd prefer an oval around my naval area to obscure my spare tire. are they working on that too?
In what way does this enhance privacy? It sounds like the people in possession of the tapes still have access to the faces. I guess it prevents casual recreational browsing (of the faces) by security staff, but that's the only privacy benefit I can see.
@BunBun: Youch. I was thinking along those lines, but you trumped anything I'd come up with.
Don't forget that if this tech takes off (and is constitutional), there'll be competing companies with their own proprietary opt-out badges. Americans will have to be covered in a bunch of badges to opt-out of all systems.
"In what way does this enhance privacy? It sounds like the people in possession of the tapes still have access to the faces. I guess it prevents casual recreational browsing (of the faces) by security staff, but that's the only privacy benefit I can see."
It is a large privacy improvement. Much of our privacy is protected by laws, and technology that makes circumventing those laws hard. No, it's not perfect. But I wouldn't call it "privacy theater," either.
@Andy Dingley: traffic analysis works whether or not the content is encrypted.
The markers to date (hat, vest) aren't very practical. Can't you just see a bouncer or cop saying "That dude is wearing a vest, he's up to something. Better pull him over (seat belt check)/not let him in." More work is needed.
So if I'm on my way to, say, murder someone, I can simply walk past the security cameras wearing a mask -- an ordinary paper mask. If it's painted to look like a face, then it'll be obscured like a real face, and a guard watching the monitor won't see anything strange.
Hey! What if I wear a big grey paper oval over my face! "What's wrong with the machine, lieutenant? The killer's face is still obscured..."
I can see a market for a new type of balaclava with squares covering it of various skintones for the one camera pixellated look ;)
An expectation of privacy is not reasonable if the behaviors/communications in question were knowingly exposed to public view.
Stop the R&D. There, I saved you from wasting more time.
Well, instead of a grey oval, we could have a pinkish face with two small eyes and a little piggy nose. Pink Floyd, modern day prophets. Who would've known?
If the police can remove the obfuscation, then the information is there to be hacked.
Unfortunately, it has a very easy backdoor, called "take-off-the-damn-balaclava-or-i'll-shoot".
Still, no such thing as a perfect security system.
Come to think of it...
It sounds as if the system is storing the unobscured video and rendering the obscured stream in real time. If the system is well designed then there's no way to mix the two up, but if the security is bad some one could conceivably hack the software and record the obscured stream, perhaps in a certain time window when the murder takes place.
And how much longer will it be before it's possible to MODIFY faces in real time? On Monday we make everyone Rutger Hauer, on Tuesday we swap people randomly, Wednesday is Handlebar Moustache day...
@Andy Dingley "The crypto-competent encrypt their unimportant stuff too, in case of traffic analysis."
The paranoid AND crypto-competent even create extra unimportant stuff to fill the spaces where there was nothing, and encrypt that, too, to really defeat traffic analysis.
Now to figure out how to extend that concept to this case -- how do I create extra random faces?
Bruce, here's a story I think you might like to blog about:
Video recording leads to felony charge
"Brian D. Kelly didn't think he was doing anything illegal when he used his videocamera to record a Carlisle police officer during a traffic stop. ... Kelly, 18, of Carlisle, was arrested on a felony wiretapping charge, with a penalty of up to 7 years in state prison."
From the rest of the story it sounds like he's going to get off without much, or any, punishment, but the law is pretty egregious.
The problem appears to be that the people operating the cameras are not to be trusted with the data, or at least not with the faces.
This falls apart when the people operating the cameras are the same ones who would be granting access to the unobscured images. I'm sure someone will say that it's a "special review board" or something, but I don't buy that anymore than I buy the claim that Internal Affairs actually prevents the police doing anything wrong.
If people start wearing concealing clothing to avoid cameras, the people who placed the cameras will just make concealing clothing illegal, like the UK is working to do with hoodies.
The point of the whole exercise is not safety, it's control.
Wearing a balaclava or hoodie is just security through obscurity!
Of course you want a system which can identify and separate the faces from the bodies.
Many times the faces are obscured - hats, darkness, etc. Separating the faces from the bodies allows you to build a separate "body geography" database which you can then test against the "face database" to check whether you've yet got an acceptable CER.
Then you can identify people by their carriage, stride, height/weight ratios, etc, making it possible to identify them in bad imagery, or through infrared.
Oh, I'm sorry, were we looking for MORE privacy? What do you think this is, the European Union?
That's what we need: A world in which only marker-wearing faceless persons behave acceptably.
"I'm all for turning the world into a Shirow Masamune graphic novel."
Perhaps developers of the software could be persuaded to include a menu containing quotes from Salinger's works in their software.
I have a better idea. Obscure (with an oval, or whatever comes to hand) the lens of the camera.
@Hack face - That would be privacy through obscurity!
How about having the camera render everything into a version of "The Persistence of Memory".
Melting watches, faces, what fun.
Thanks Bruce for making us aware of this. I must admit that I am surprised at some of the ignorant, childish responses to this article. While this technology has many extremely valuable non-law enforcement applications, it raises many questions when it's under the control of law enforcement. We have many cases before us, illustrating the abuse of existing surveillance technologies by them, removing any possibility of us confidently allowing them to "police" themselves. Due to the unusual relationship between the Department of Homeland Spying and local law enforcement agencies, we now have delivery of military-grade surveillance hardware to police departments, which were never intended for use on private, non-crime commiting citizens, and bypasses any judicial review, with no concern for it's impact on privacy/moral concerns. An example of a widely abused technology by law enfoecement can be viewed at: camero-tech.com
This is a prime example of why "policing" the police should become a much higher priorty to us if we are to maintain control over the country that still does actually belong to us, right? The only way I can see "facial blocking" working in a law enforcement environment is if the judges maintain the "keys" to remove the faces, and issue them only upon a CREDIBLE warrant request. Thanks Bruce for your efforts in bringing these items to light.
This idea only offers the guise of privacy. Once widespread use of cameras is in place and accepted, the guise can be dropped with little protest from the citizenry.
This two-step approach to removal of privacy rights is common, and I'm appalled that more people do not recognize it for what it is.
Thanks Bruce for making us aware of this. I must admit that I am surprised at some of the ignorant, childish responses to this article. While this technology has many extremely valuable non-law enforcement applications, it raises many questions when it's under the control of law enforcement. We have many cases before us, illustrating the abuse of existing surveillance technologies by them, removing any possibility of us confidently allowing them to "police" themselves. Due to the unusual relationship between the Department of Homeland Spying and local law enforcement agencies, we now have delivery of military-grade surveillance hardware to police departments, which were never intended for use on private, non-crime commiting citizens, and bypasses any judicial review, with no concern for it's impact on privacy/moral concerns. An example of a widely abused technology by law enforcement can be viewed at: camero-tech.com This is a prime example of why "policing" the police should become a much higher priorty to us if we are to maintain control over the country that still does actually belong to us, right? The only way I can see "facial blocking" working in a law enforcement environment is if the judges maintain the "keys" to remove the faces, and issue them only upon a CREDIBLE warrant request. Thanks Bruce for your efforts in bringing these items to light.
I agree that Bruce's post is of interest on merrit. I also recognize that policing the police is a serious matter. But ...
I also enjoy reading some of the sillier entries. They serve two purposes. Entertainment. And as a barometer of how people feel about the solution/idea.
I believe the barometer has value. Let me explain ...
I suspect a lot of the tone here, is because people are skeptical of this technology. It's hard to tell if the people making these posts see the solution as badly concieved, flawed, or whatever. That may be the motive for silly posts.
The solution/idea here is interesting. It's the unlocking part and the potential for abuse that is concerning. As this is a research project, much of this probably hasn't been fully addressed yet.
If I were promoting such a solution, I would also be interested in how people feel about it. It may tell me where my solution needs work. It may help me in how I promote it. It may help realise where it has limitations and where more work is needed.
One thing systems like this may do is to rebut the presumption that a video recording is a credible record of what happened in the camera's field of view.
I like it that he called other responses "childish," then went on to name-call the Department of Homeland Security, AND double-post his entry.
David ... I enjoyed reading your response and I probably should relax a little more, but on the other hand, the degradation of our freedoms since 911 are frightening, and It's hard for me to understand how people can be so unconcerned about it. Many people have given their lives in the past so that we may enjoy these freedoms today. The callous disregard for our constitutions original intent, and the assumption that it should be changed by the whims of our current corrupt leaders just because THEY think it's right, is a direct slap in the face to those who have, and continue the fight to keep America a republic, where the power lies WITH THE PEOPLE and not with the government. Instead, we are on a slow downward spiral towards a totalitarian police state which will make 1984 look like a slumber party. It's not here YET and probably wont be in the next 20 - 30 years. But for me, that is still too soon.
I believe that we did not inherit the earth from our parents and ancestors, we've BORROWED it from our children and future generations. What will we leave behind for them?
Be great if it misplaced the ovals in the first place.... `yer face, yer ass, what's the difference?' ;)
regarding Brian D. Kelly:
"From the rest of the story it sounds like he's going to get off without much, or any, punishment, but the law is pretty egregious."
Actually, not ony have all charges been completely dropped, but the DA has fairly clearly warned local police not to try the same stunt again.
This technology has no "valuable"--or legitimate--uses. Neither does any surveillance technology, of any kind, in any situation.
> This technology has no "valuable"--or legitimate--uses. Neither does any surveillance technology, of any kind, in any situation.
What a ridiculous overstatement.
"What a ridiculous overstatement."
@FooDooHackedYou: "...i'd prefer an oval around my naval area to obscure my spare tire."
Well, if the security-cameras are intended for live watchers to monitor developing situations (and presumably respond in real-time to appropriate events), rather than being used as after-the-fact evidence-gathering tools, I have an inexpensive solution for you:
Just unfocus the camera a bit, so everything is a little blurry. The security personnel will be familiar-enough with the static structures to recognize them in spite of the bad picture. People will still look like people, and general body-stance will be discernible. Personal identification will be difficult, and not easily reconstructed later by hackers OR "Big Brother".
Call it ridiculous all you like. No surveillance, of anything, by any method, for any reason, is ever legitimate, ethically valid, or morally acceptable.
Any undertaking that appears to depend upon surveillance is similarly invalid and may not be embarked upon.
Surveillance is a crime against humanity; a society that permits it displays a depraved indifference (to use the legal term of art) to the core, bedrock, essential principles of human existence.
There is no difference between surveilling someone and splitting their head in half with a fire axe. Both are acts of existential violence; the first is cheaper and more cowardly but there is no difference in intent.
I fail to understand how a CCTV system is conceptually any different than employing real police officers (at immense cost and expense) at street corners throughout a city.
IMO, such a camera is a virtual extension of a police officer's eyeballs monitoring a public venue where there is no expectation of privacy.
Rolling up the perps behind the attempted London car bombings will prove, once again, the merits of such systems in high-traffic public venues.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.