Schneier on Security

Clive Robinson • August 19, 2009 12:52 PM

Does anybody remember Dr David Berryman (DNA expert) from Murdoch University?

And his 2003 paper,

“Forensic DNA Profiling: Infallible or Fundamentally Flawed?”

Or the stir he created when interviewed by ABC,

http://www.abc.net.au/catalyst/stories/s1199805.htm

Bruce posted about the stir he created (way back then) about getting DNA tests to give incorrect results (you can read a little more about the science of it at http://www.forensicscience.uwa.edu.au/__data/page/55470/Rebecca_Dent.pdf or http://www4.gu.edu.au:8080/adt-root/uploads/approved/adt-QGU20050818.155533/public/03Main2.pdf )

As I pointed out then I had worked out a similar defect in the testing process some time prior to that (and even Emailed Bruce about it). Also that on trying to raise awareness of the issue I had been treated as though I was “slaying the Goose that laid the golden eggs” by those involved with the test verification process.

I could not find the original blog page in google but I did find some other pages where I posted about the same or similar method,

http://www.schneier.com/blog/archives/2005/06/more_on_the_dhs.html#c5801

http://www.schneier.com/blog/archives/2005/09/criminals_learn.html#c14128

http://www.schneier.com/blog/archives/2006/11/uk_car_rentals.html#c125636

What these researchers have done is move the process forward a few steps.

As the article linked to by Bernie (above at August 19, 2009 7:54 AM ) so aptly puts it at the end of this paragraph,

“Fortunately, in identifying the problem, the researchers have come up with a solution. DNA inside human cells picks up a chemical modification called methylation; DNA amplified in a test tube doesn’t. It’s possible to determine whether or not a given stretch of DNA has been methylated using standard lab techniques, although these are a bit laborious and time-consuming, and it’s the sort of technique that hasn’t made its way into forensic training yet. Still, testing for methylation in a DNA sample should provide an important quality control on the sample—at least until biologists figure out how to apply methylation in a controlled manner.”

I guess it will be within the next couple of years so watch this space…

Clive Robinson • August 19, 2009 1:57 PM

Unfortunately (as is becoming very common) the paper is behind a “Pay Wall”.

However a little digging around shows that the “researchers” have a start-up company called Nucleix Ltd.

From one of there blurb pages,

“Nucleix, an emerging life science company specializing in forensic DNA analysis, has developed a “DNA authentication” assay for forensic casework samples with potential applications across multiple DNA analysis and validation fields. DNA fingerprinting has been established as one of the most important forensic tools in criminal investigations. Nucleix scientists have demonstrated the viability of creating artificial DNA and “biological identify theft.”(1) Using basic equipment and know-how, DNA with any desired profile can be fabricated in the lab, and this artificial DNA can then be planted in crime scenes as fake evidence. Until recently, there has been no way to distinguish between genetic profiles obtained from falsified DNA samples, which can appear identical to real biological profiles based on current analytical protocols and technologies. Nucleix’s proprietary assays can distinguish between “fake” (in-vitro synthesized) DNA, and “real” (in-vivo generated) DNA. The company is committed to developing state-of-the-art “DNA authentication” assays that can be integrated into the standard forensic procedure, in order to maintain the high credibility of DNA evidence in the courtroom and other uses.”

In other words we have found a solution to a known problem that people where ignoring, now lets make some noise and sell you our patented solution (so we can get rich 😉

Oh and the bit,

“Until recently, there has been no way to distinguish between genetic profiles obtained from falsified DNA samples”

Is not quite right, there are some ways already known but… they are complicated and therefore expensive to carry out and thus not used in routine testing. Oh and the problem with this, some DNA tests are destructive of evidence so you cannot go back and check again…

But as has been noted most DNA evidence is supporting or circumstantial the criminal is already known (usually because of their big mouth, MO or they are connected with the crime fairly directly).

And that is the real issue of “means, motive and opportunity”. If you are going to frame somebody with a crime,

Step 1, is to provide a recognised “motive” for them (which may not be as easy as you think).

Step 2, is to use a “means” that is directly linkable to them (again it may not be easy)

Step 3, remove any alibi for them, and preferably have them at or close to the crime at the correct time (possibly easier).

Obviously the better acquainted you are with the individual the better your chances of framing them but… it also potentially puts you closer to the crime for an investigator as well.

Possibly the best way is still the old way of framing people, which is to delay the discovery of the crime so that there is a great deal of uncertainty in the details, and then put “hard evidence” into the possession of the person you wish to frame in some way (like some of the crime evidence in a bag hidden on their property).

Clive Robinson • August 19, 2009 10:01 PM

@ Shane,

“C’mon… What’s to stop the investigators themselves from planting (or ‘finding’) all the DNA they want at any crime scene already?”

Nothing at all it used to be a popular pastime with certain Policemen in the UK….

So as you say,

“Nothing really. Doesn’t take a huge consipiracy and government spooks to frame someone for a crime. Basically all it takes is the will to do so.”

Or a lot of “Political Pressure” from above (for which we now have a large number of politically embarrassing releases of wrongly convicted persons as evidence and investigations are shown to be “flawed”.

“The justice system also works in our favour, for the most part. Or that is the hope… and one we have to cling to lest we cry wolf and run for the hills. No system is infallible.”

Sadly more than a thousand years of legal historical safe guards have been removed or are in the process of being removed from the actions of the previous UK Prime Minister the RH Tony Blair, and his old side kicks “Charlie” Falconer (now Lord Falconer of Thoroton) the RH Jack Straw MP, David Blunkett et al.

The rot got going in 2003 ( http://www.independent.co.uk/news/uk/politics/falconer-heads-historic-shakeup-of-judicial-system-540517.html ) and has progressed step by step.

In England and Wales we now have the Orwellian sounding “Ministry of justice” (Run by Jack Straw MP), that supposedly protects the legal
process.

Amongst other things we are losing or have lost,

1) the right to a tribunal of truth (jury),
2) the right to silence
3) the right to not be pre-judged by previous behaviour.
4) the right to only be tried once.
5) weakening of the right to representation

All in order to save money / court time.

Amongst other little schemes we have coercion where you are given a “fixed penalty” which is only fixed if you pay without question. Start defending your rights and you will pay and pay and pay (for instance the London Congestion Charge, due to the laziness of the organisation people have been hit with “fines in the post” for which they have not committed the offence, most people payed up but when one person went to court whoops the lazy behaviour and illegally sited cameras came out, likewise with Gatso Cameras, and at-least one occurrence of deliberate evidence tampering by an official organisation where they “photoshoped” in a parking restriction sign that was not actually there at the time).

Oh and the latest proposal is effectively to get rid of the last vestiges of “legal aid” through the back door. Legal aid is the process where your legal representative gets payed by the public purse to defend you in criminal cases where you might not be represented otherwise. The sums involved have been whittled down one way or another over the years to a very low “fixed rate” so low that few competent legal representatives will work for the sums involved. The latest wheeze is to replace the current low “fixed rate” with a “Dutch Auction” bidding system, where the lowest bid for the work gets it…

As has been noted in the past,

“Justice has to be seen to be done, not done in reality”.

Clive Robinson • August 20, 2009 9:25 AM

@ John,

“Clive forgot to say that, in the UK, we do have a database that will soon contain DNA samples from almost the entire population. It has been ruled illegal, but the police have decided to ignore the law and are continuing to build the database anyway.”

Unfortunately it is just one of many DBs that are paid for from the UK public purse that are illegal.

In the UK there is a charitable organisation “The Joseph Rowntree Reform Trust” ( http://www.jrrt.org.uk/ ) who are well known and respected for the work they sponsor. In their own words,

“We fund political campaigns in the UK to promote democratic reform, civil liberties and social justice.”

One aspect of these “political campaigns” is paying for research reports into government abuse of justice etc. A case in point is their report,

“Database State – a comprehensive map of UK government databases” ( http://www.jrrt.org.uk/uploads/database-state.pdf )

It makes sobering reading of how the UK is sleep walking into a police state via the needless collection aggregation and cross referencing of information and speculation on individuals in the UK, much of it completely illegally and with little or no audit or security, often hidden behind a gossamer veil of “Secrecy” or “Confidentiality” (to protect the guilty).

Often so much so that otherwise sensitive and well protected data on for instance children for their protection is laid bare to individuals with access to one or more databases. There are hundreds of thousands of people with access to just one of these databases and the audit and security is a complete joke as is the correctness of the information with in it (see Contact-Point Project)

Another is where your child’s entire academic record including teachers unqualified evaluations on them and their family, will stay in existence as long as the child is of employable age. Oh and all the data will be made available to “interested parties” like future employers with little or no let or hindrance (but neither you nor your child will be able to see/correct mistakes and lies about them).

This is the sort of power that Stalin would have given both arms and legs for without a second thought.

Lest you think the report is an extreme view by “self interested crackpots with an agenda”, have a look at the list of authors and google them etc.

One of the reports authors is a well known and well respected figure in computer security from Cambridge University Ross J Anderson (who has posted to Bruce’s Blog on a number of occasions)

From the report a comment on the UK Government that to my eye appears directly aimed at the clique of No 10 who dream up these stupid (back door party fund raising) databases is,

“If you think IT is the solution to your problem, you don’t understand IT, and you don’t understand your problem”

The introduction by Lord David Shutt has this memorable paragraph,

“Of the 46 databases assessed in this report only six are given the green light. That is, only six are
found to have a proper legal basis for any privacy intrusions and are proportionate and necessary
in a democratic society. Nearly twice as many are almost certainly illegal under human rights or
data protection law and should be scrapped or substantially redesigned, while the remaining 29
databases have significant problems and should be subject to an independent review.”

The report concludes at least that one in four of government databases that the report authors where aware of was effectively (ie a Court has not pronounced yet) illegal and that the 16 billion GBP that has been (officially acknowledged as being) spent on them, was a misuse of public funds.

For non UK readers if you normalised that to the US population/$ it would be about 144 Billion USD, which is no small pocket change…

By the way the expression “misuse of public funds” is a polite way of saying “criminal”. If you or I where to do the same we would be looking at jail time that would make Bernard Madoff “with the money” ‘s eyes water.

We have in the UK on the statue books such old crimes as “malfeasance in public office”, more often refered to as “Misconduct in Public Office” ( http://www.cps.gov.uk/legal/l_to_o/misconduct_in_public_office/ ).

It is very broad range in scope is always indictable and carries a maximum of “life in prison” (not 150 year maximum negotiable down to 12years which is what Bernie is looking at).

Unfortunately it is rarely if never used these days the Crown Prosecution Service (CPS) is responsible for deciding if it “is in the public interest to prosecute” or not which is in no way the same as saying if the person is likely to be found guilty (although that is the way it is often expressed)

The CPS look at two asspects to make their decission.

One is a four part guidance as to what the required elements of misconduct in public office are,

1) A public officer acting as such.

2) That wilfully neglects to perform their duty and/or wilfully misconducts themselves.

3) To such a degree as to amount to an abuse of the public’s trust in the office holder.

4) Without reasonable excuse or justification.

Of which the third and fourth parts give the CPS a great deal of latitude.

Especially when considered within the light of the second aspect of “life in prison” as the maximum sentence.

However as very unlikely as it is for a holder of “public office” to face being prosecuted there is now a new get out clause,

“Are they really a person in Public Office”

Due to “outsourcing” a number of jobs or roles are now carried out by people paid from the public purse but importantly “not directly so”. Frequently they may well have been in “public office” prior to outsourcing and in all other respects are doing exactly the same job.

That is the only difference is that they are currently employed by a “private company” that is directly on contract to part of Government. This covers the range from security guards to consultants (and possibly even Ministers). In the case of the upper end only the gossamer of being paid “not directly so” is the only difference between being and not being in Public Office so acts as a “stay out of jail free card”.

The question then arises what of organisations such as OfCom who wield considerable power and get all their “lawful authority” directly from Government as well as their funding, Where many of their employees are still in effect civil servants and appear for all practical purposes to still be carrying out a “public office” role…

Clive Robinson • August 21, 2009 12:55 AM

@ Douglas Knight,

“The much bigger problem is that the police send both samples to the same lab, that knows the police want them to match”

There was a classic case of this in Scotland a few years ago where a Police Woman was sanctioned by her own force because one of her finger prints “supposedly” was in the crime scene.

Eventually it went to court where it became clear that the fingerprint lab had made a significant mistake and would not admit it (nor does it to this day which undermines the credibility of all it’s results).

There are actually two really huge issues with forensic evidence that those in the field do not like to talk about because it reduces their credibility to near zero…

The first is “interpretation”, nearly all forensic results are not hard and fast science but art. The results of any test have to be interpreted by an expert in the field of endeavour within the context of the crime and presented to the court as “opinion” (expert hearsay). This means that almost overwhelmingly forensic evidence is “subjective” and has no chance of reaching the “burden of proof” required for a criminal “beyond reasonable doubt”.

Worse “opinion” lags “reality” a specific example of this is cocaine residue in US bank notes. It used to be used as an argument that the person had been in contact with a “class a” drug and was either a user or a dealer. After some independent research it was shown that the overwhelming majority of US bank notes in circulation where contaminated with cocaine therefore the residue was to be expected, not the exception.

The second major issue is one of “noise”. In any measurement process there are two main issues sensitivity and variation. That is to what level can a test be made and what is the percentage error of the test at any given level.

However there is third issue which is starting to arise which is the very real law of physics that dictates there is a point at which measurements cannot be distinguished from noise.

However noise comes in two forms the “noise floor” which is the physical limit and the “back ground noise” which is usually way above the “noise floor” and is caused by environmental issues.

Most scientific tests are now at a sensitivity where they can measure well bellow the “back ground noise” level.

One of the reasons DNA was seen as a forensic “Gold Standard” was it’s supposed “infallibility” at being able to 100% determine the presence (or in argument absence) of a persons DNA at a crime scene.

Unfortunately as I have been well aware since the early 1990’s this is a complete nonsense, you only have to take a look at what is involved with a DNA test to realise just how fallible the test is to back ground noise and variations in test conditions and subjectivity of the operator.

This is even before you start thinking about how to “game the test” to make false results (the old garbage in garbage out principle).

What has consistently amazed me is how many people refuse to consider it or even investigate it.

I think you can be safely assured that these researchers would not have published their findings on DNA fallibility if they had not found a solution to sell.

Because history shows us they would have been shuned for trying to “kill the goose that lays the golden eggs” if they had not.

The legal process right from the legislators at the very top down to the meagrest of court clerks does not want problems only solutions. Forensic technicians are only to aware of this, as “expert witnesses” the court wants and needs them to take the “bag of snakes and straighten them out” for the court to make a simple comparison.

Well noise is the true Gordian knot of Forensics brushed under the carpet of faux science by the interpretation that is “expert opinion”.

If you go and sit on the side lines of a court you quickly realise that the only evidence judges can deal with is pieces of paper, and the only thing juries rely upon is the perceived credibility of those in the witness box.

The only cases where this is not the case are those for which neither a judge nor jury are required to determine the likely hood of guilt.

In the main Forensic Evidence is to a court proceeding what stage props are for a magician, and like any good magician the legal teams can paint just about any illusion they like with them just by altering the perspective by which the judge and jury view them in…