Always: An Alluring Notion
September 30, 2020
DarkCyber ran a short video about a product called the Dronut. It looks like a small flying donut. You can get a link to the company, its patent document, and a snippet of the promotional video for your product at this link at the 10 minute 36 second point in the show.
I was interested in “Why You Should Be Very Skeptical of Ring’s Indoor Security Drone,” an article in IEEE Spectrum. My team and I have done lectures, briefings, and even a book chapter about Amazon’s policeware and intelware activities. I know first hand that no one, not even law enforcement and intelligence officers, care.
In fact, at one digital security conference last year in San Antonio, an attendee — an Air Force intel professional — summed up the attitude of the 100 people in the lecture hall:
My wife loves Amazon. The company may have some interesting technology, but, come on, even my kids depend on Amazon videos. Amazon is not an intelware player.
Not bad for a colonel’s analytic and content processing skills, right?
I am not going to rehash our research about Amazon’s intelligence related services. I want to focus on IEEE Spectrum’s write up; for example, this statement in the article:
Ring, the smart home company owned by Amazon, announced the Always Home Cam, a “next-level indoor security” system in the form of a small autonomous drone. It costs US $250 and is designed to closely integrate with the rest of Ring’s home security hardware and software. Technologically, it’s impressive. But you almost certainly don’t want one.
Clueless? Not completely. The Amazon surveillance drone is not marketed like the Dronut. Plus, the Amazon home surveillance drone is not a standalone product. The Always Home Cam provides the equivalent of a content acquisition “paint by numbers” module to the Amazon intelware infrastructure.
Little patches of data particularized and indexed by time, location, and other metadata can be cross correlated with other information. Some information is unique to Amazon; for example, the “signal” generated by processing payment history, video viewing, and product purchase information for an account holder. The cross-correlation (Amazon’s lingo from one of its blockchain related inventions) makes it possible to perform the type of analytic work associated with intelligence analysis software and subject matter experts.
The article notes:
Ring hasn’t revealed a lot of details on the drone itself, but here’s what we can puzzle out. My guess is that there’s a planar lidar right at the top that the drone uses to localize, and that it probably has a downward-looking camera as well. Ring says that you pre-map the areas that you want the drone to fly in, which works because the environment mostly doesn’t change. It’s also nice that you don’t have to worry about weather, and minimal battery life isn’t a big deal since you don’t need to fly for very long and the recharging dock is always close by. I like that the user can only direct the drone to specific waypoints rather than piloting it directly, which (depending on how well the drone actually performs) should help minimize crashes.
The author is either ignoring UAS characteristics of surveillance devices or unaware of those conventions. The write up does reference to the challenge of avoiding mobile cameras. The parallel between Amazon’s in home UAS and a telepresence robot misses the point. The data, not the device, are the story. At least the author reaches a reasonable conclusion:
But is it worth $250, questionably better security versus cheap static cameras, and a much larger potential for misuse or abuse? I’m not convinced.
If you are interested in a one hour briefing about Amazon’s policeware and intelware initiative, write benkent2020 at yahoo dot com. Someone on the DarkCyber team will respond with options and fees.
On the other hand, why not be like the intel colonel, “What’s the big deal?”
Stephen E Arnold, September 28, 2020
Body Cameras: A Study Review
September 22, 2020
Anyone interested in the use of body cams by police should check out this review of 30 studies assembled by Campbell Collaboration—“The Impacts of Body-Worn Cameras in Policing.” Adoption of body cameras by police has risen steeply over the last decade as costs have decreased and concern about police misconduct have escalated. While the intention is to increase transparency and accountability, some have been concerned the practice would discourage the reporting of crimes or cause officers to hesitate to take appropriate proactive or preventative measures.
The review summarizes studies that used either randomized controlled trials or quasi-experimental research designs that measured police or citizen behaviors. The studies reported on a dozen different types of outcome measures and examine 116 effects of the cameras on those outcomes. Most were conducted in single jurisdictions in the US.
So, is the use of body cams doing more good than harm? The write-up summarizes the findings:
“BWCs are one of the most rapidly diffusing and costly technologies used by police agencies today. This review questions whether BWCs bring the expected benefits to the police and their communities. Existing research does not evaluate whether police accountability or police-citizen relationships are strengthened by BWCs. Much more knowledge is needed about when BWCs do create desired effects, and whether they are cost-effective. … For the many police agencies that have already purchased BWCs, researchers should continue testing for ways in which both police and citizens might gain benefits from the cameras’ continued use. These could include limiting the discretion that officers have with BWC use, using BWCs for coaching, training or evidentiary purposes, and finding ways that BWCs can be used to strengthen police-citizen relationships, internal investigations, or accountability systems.”
Count that as a definite maybe. To read the report in full, navigate to its Wiley Online Library page.
Cynthia Murrell, September 22, 2020
Predictive Policing: A Work in Progress or a Problem in Action?
September 2, 2020
Amid this year’s protests of police brutality, makers of crime-predicting software took the occasion to promote their products as a solution to racial bias in law enforcement. The Markup ponders, “Data-Informed Predictive Policing Was Heralded as Less Biased. Is It?” Writer Annie Gilbertson observes, as we did, that more than 1,400 mathematicians signed on to boycott predictive policing systems. She also describes problems discovered by researchers at New York University’s AI Now Institute:
“‘Police data is open to error by omission,’ [AI Now Director Rashida Richardson] said. Witnesses who distrust the police may be reluctant to report shots fired, and rape or domestic violence victims may never report their abusers. Because it is based on crime reports, the data fed into the software may be less an objective picture of crime than it is a mirror reflecting a given police department’s priorities. Law enforcement may crack down on minor property crime while hardly scratching the surface of white-collar criminal enterprises, for instance. Officers may intensify drug arrests around public housing while ignoring drug use on college campuses. Recently, Richardson and her colleagues Jason Schultz and Kate Crawford examined law enforcement agencies that use a variety of predictive programs. They looked at police departments, including in Chicago, New Orleans, and Maricopa County, Ariz., that have had problems with controversial policing practices, such as stop and frisk, or evidence of civil rights violations, including allegations of racial profiling. They found that since ‘these systems are built on data produced during documented periods of flawed, racially biased, and sometimes unlawful practices and policies,’ it raised ‘the risk of creating inaccurate, skewed, or systemically biased data.’”
The article also looks at a study from 2016 by the Royal Statistical Society. Researchers supplied PredPol’s algorithm with arrest data from Oakland California, a city where estimated drug use is spread fairly evenly throughout the city’s diverse areas. The software’s results would have had officers target Black neighborhoods at about twice the rate of white ones. The team emphasized the documented harm over-policing can cause. The write-up goes on to cover a few more studies on the subject, so navigate there for those details. Gilberston notes that concerns about these systems are so strong that police departments in at least two major cities, Chicago and Los Angeles, have decided against them. Will others follow suit?
Cynthia Murrell, September 2, 2020
Amazon Data: Yes, There Is a Good Reason
August 28, 2020
About three years ago, I gave my first lecture about Amazon’s streaming data marketplace. The audience was about 150 law enforcement and intelligence professionals. My goal was to describe some technical capabilities Amazon had set up since 2006. I stumbled upon the information reading through AWS public sector information available from open source; for example, patent documents and Amazon’s blog posts.
I was greeted with “We buy quite a bit from Amazon, but policeware?” I have included a description of the streaming data marketplace in my talks and posted some information in this blog. I was interviewed by reporters from Le Monde, the New York Times, and a couple of other “real news” outfits. Like those engaged in law enforcement and intelligence, no one cared.
One company developing specialized software expressed surprise when I recommended taking a look at what capabilities resided in the Amazon Web Services’ construct. The reaction was, “Everyone uses Microsoft Azure.” Most recently I gave three lectures at the 2020 National Cyber Crime Conference. One of them was about Amazon. I have about 250 people at my talks about investigative software and alternatives to the Dark Web. I still don’t know who listened to my Amazon lecture. I assume not too many people.
I read “Kindle Collects a Surprisingly Large Amount of Data.” The write up makes a single point. Reach a book or some other text on an Amazon Kindle and data flows to Amazon. There’s no awareness of the online book store’s streaming data marketplace or any of the related technology, features, and functions. Well, there is one article. That’s a start.
I scanned the comments and noted one which struck me as interesting:
There’s definitely no good reason why it should be sent to Amazon at all.
A good reason exists. Amazon is poised to provide a number of useful services to government agencies. Let me spark thinking with some questions:
What’s the value of a service which can generate a “value” score or “reliability” score or a “credibility” score for an individual?
Answer these and one is well on the way to grasping the Amazon policeware and intelware construct in my opinion. You can learn more by writing benkent2020 at yahoo dot com and inquiring about our Amazon for fee reports.
Stephen E Arnold, August 28, 2020
KnowBe4: Leveraging Mitnick
August 21, 2020
Many hackers practice their “art,” because they want to beat the system, make easy money, and challenge themselves. White hat hackers are praised for their Batman vigilante tactics, but the black hat hackers like Kevin Mitnick cannot even be classified as a Robin Hood. Fast Company article, “I Hired An Infamous Hacker-And It Was The Best Decision I Ever Made” tells Stu Sjourverman’s story about hiring Kevin Mitnick.
Mitnick is a typical child hacker prodigy, who learned about easy money through pirated software. He went to prison for a year, violated his parole, and was viewed as an antihero by some and villain by others. Either way, his background was controversial and yet Sjourverman decided to hire him. Sjourverman was forming a new company centered on “social engineering” or “hacking the human,” terms used to describe tricking people into clicking harmful links or downloading malware invested attachments. For his new cybersecurity company, Sjourverman knew he needed a hacker:
“That was a turning point for my startup, KnowBe4. By recruiting Mitnick, we gained invaluable insights about where employees are most vulnerable. We were able to use those insights to develop a practical platform where companies can see where their own employees stumble and, most importantly, train them to recognize and avoid potential pitfalls. This is essential for any business because if all other security options fail, employees become a company’s last line of defense—one unintentional blunder can infect the entire network and bring down the whole company.”
Mitnick’s infamous reputation also gave the new startup a type of legitimacy. Other players in the cybersecurity industry knew about Mitnick’s talents and using them for white hat tactics gave KnowBe4 an advantage over rivals. Mitnick also became the center of KnowBe4’s marketing strategy, because he was a reformed criminal, understood the hacker community, and gave the startup an edgy yet authentic identity.
Hiring Mitnick proved to be the necessary step to make KnowBe4 a reputable and profitable business. It is also a story about redemption, because Mitnick donned the white hat and left his criminal past behind.
Will KnowBe4’s marketing maintain its momentum? Cyber security firms appear to be embracing Madison Avenue techniques. Watch next week’s DarkCyber for a different take on NSO Group’s “in the spotlight” approach to generating cyber intelligence sales.
Whitney Grace, August 21, 2020
Amazon Policeware: Fraud Detection
August 4, 2020
We spotted “Fraud Detector Launched on AWS Platform.” As one pre pandemic, face-to-face conference organizer told me, “No one cares about Amazon policeware. The future is quantum computing.”
Yeah, okay.
Amazon does not buy big booths at law enforcement and intelligence conferences. For now, that’s the responsibility of its partners. No booth, no attention at least for one super charged quantum cheerleader.
The write up states:
With Amazon Fraud Detector, customers use their historical data of both fraudulent and legitimate transactions to build, train, and deploy machine learning models that provide real-time, low-latency fraud risk predictions. To get started, customers upload historical event data (e.g. transactions, account registrations, loyalty points redemptions, etc.) to Amazon Simple Storage Service (Amazon S3), where it is encrypted in transit and at rest and used to customize the model’s training. Customers only need to provide any two attributes associated with an event (e.g. logins, new account creation, etc.) and can optionally add other data (e.g. billing address or phone number). Based upon the type of fraud customers want to predict, Amazon Fraud Detector will pre-process the data, select an algorithm, and train a model.
And what does an Amazon person whom remains within the Amazon box with the smile on the side say? The write up reports:
Customers of all sizes and across all industries have told us they spend a lot of time and effort trying to decrease the amount of fraud occurring on their websites and applications. By leveraging 20 years of experience detecting fraud coupled with powerful machine learning technology, we’re excited to bring customers Amazon Fraud Detector so they can automatically detect potential fraud, save time and money, and improve customer experiences—with no machine learning experience required.
Several observations:
- Combined with “other” financial data available within the AWS system, Amazon’s fraud detection system may be of interest to some significant financial services firms.
- The technology provides a glimpse of what AWS can support; for example, matching tax returns to “other” financial signals in order to flag interesting returns.
- The technical widgets in the AWS structure makes it possible for a clever partner to reinvent a mostly unknown financial task: Identification or flagging of medical financial data for fraud. Subrogation with the point-and-click Amazon interface? Maybe.
To sum up, we offer a one hour lecture about Amazon’s policeware initiative. I know “free” is compelling, but this lecture costs money. For details write darkcyber333 at yandex dot com. Note: The program is different from our Amazon lecture for the 2020 US National Cyber Crime Conference.
No, it is not about the Quantum Computer Revolutions, but we do discuss Amazon’s Quantum Ledger Database. It works. Some quantum computing demonstrations do not.
Stephen E Arnold, August 4, 2020
The Atlas of Surveillance: An Interesting First Attempt
July 22, 2020
Here is an interesting resource. The digital privacy organization Electronic Frontier Foundation has published an “Atlas of Surveillance: Documenting Police Tech in Our Communities.” Here one can find information on law-enforcement tech across the US, like drones, body cameras, automated license place readers, and facial recognition tools. Compiled by over 500 students and volunteers, the project incorporates datasets from public and non-profit sources. The Methodology page specifies:
“The data contained in the Atlas of Surveillance is open-source intelligence, or OSINT. This is a term used to describe gathering information that already exists online—from news stories, social media posts, press releases, or documents buried in government websites, often turned up through using advanced search engine techniques.”
Specifically, they use a combination of crowdsourcing and data aggregation. To crowdsource, the team built a software tool that auto-distributes short (20-30 minute) research assignments to students and volunteers, who then report their findings. Many of these assignments are derived from GovSpend’s database of government procurement records. The project’s data aggregation component brings in public datasets from journalists, non-profit organizations, government agencies, and even surveillance vendors. They admit their atlas is not perfect:
“First, the information is only as good as the source: sometimes government agencies withhold information and sometimes journalists misinterpret information. It’s possible that while there is information about a technology being adopted, the technology was later abandoned, and no reporters wrote about it. With thousands of data points to go through, it is impossible to exhaustively fact-check each one, despite the multiple reviews by students and staff. In particular, documenting the use of face recognition has proven challenging because of the changing policy landscape that has resulted in local governments abruptly freezing or abolishing the use of biometric identification software. The Atlas should not be interpreted as an inventory of every technology in use. It only represents what our team documented after a year and a half of research.”
With that caveat, the collection of data does give a broad overview of the surveillance technology now available to law enforcement agencies. Anyone who has not been keeping up is in for a startling surprise.
Cynthia Murrell, July 22, 2020
Microsoft Policeware in the Line Up of Vendors of Interest
July 20, 2020
The Intercept published “The Microsoft Police State: Mass Surveillance, Facial Recognition, and the Azure Cloud.” Better late than never, “real” news about Microsoft’s race to catch up to Amazon and other specialist vendors is helpful.
The article uses the NYPD and other departments as examples of enforcement entities interested in Microsoft technology.
- And the write up explains these as evidence of a “police state” operated by the Softies in Redmond:
- A Domain Awareness System run from the Azure cloud. Not a Banjo duplicate, but close enough for horseshoes.
- An Internet of Things MAPP patrol car and a connected officer
- Robots like the Jack Russell and the LT2-F Bloodhound
- Smart software which seems similar to the ZTE installations in Quito, Ecuador
- Facial recognition technology, which has become the poster child for questionable technology.
Several observations:
- Other vendors are in the game as well, and several are providing more sophisticated solutions. Intercept’s focus seems, how shall I put it, narrow
- In my talks at the National Cyber Crime conference this week I put one theme in each of my three lectures: “Smart software is the best bet for restoring parity between bad actors and law enforcement.” Maybe the NYPD and other departments should abandon technology trials, experiments, and acquisitions to make the social fabric so much better
- The purpose of the Intercept write up seems bifurcated. On one hand, the Microsoft capabilities struck me as a check list from a marketing sales presentation. On the other hand, law enforcement is not behaving the way the Intercept believes the police, regulators, and investigators should. Mixed message? Cognitive dissonance? Bias?
Net net: Technology and smart software are essential tools for the foreseeable future.
Stephen E Arnold, July 20, 2020
Salesforce Acquires Diffeo
June 30, 2020
The announcement appears on the Salesforce Web site. Diffeo.com redirects to the customer relationship management firm’s government and aerospace page at this link. It appears that Salesforce will use the Diffeo technology to enhance its search, retrieval, and analysis capabilities. Plus, there may be some push by Salesforce to market Diffeo to the US government. As more information becomes publicly available, DarkCyber will update its information about this MIT incubator spawned firm.
Stephen E Arnold, June 30, 2020
Policeware: Fascinating Real Journalists Again
June 27, 2020
Imagine writing about policeware — software and specialized services tailored to the needs of enforcement authorities — this way.
You learn about a quinoa farmer in rural Virginia. You look into the farmer’s activities and find that the farmer sells produce to locals heading toward North Carolina. You add flavor to your story the way a cook in Lima converts quinoa into a gourmet treat for travel weary tourists. The farmer is an interesting person. The farmer is struggling to survive. The farmer labels the quinoa as “world’s best” and “super healthy.” The farmer becomes famous because he tells you, “I sell more quinoa despite the local regulations and the Food Lion supermarket.” The problem is that the story’s author is unaware of Archer Daniels Midlands, an outfit with an interest in quinoa.
The story is a human interest write up particularized to a single quinoa farmer in a state known for a mall, traffic jams, and government contractors. Micro story gives the impression that Virginia is a great place for quinoa. Accurate? A reflection of the business environment? A clear reflection of local ordinances?
Nah.
I thought about the difference between a quinoa farmer’s story and a general lack of awareness about Archer Daniel Midlands when I read “Firm That Tracked Protesters Targeted Evangelicals During 2016 Election.” The outfit providing data may have more in common with the hypothetical quinoa story that meets the eye. Coverage of the policeware or intelware market sector invites micro examples used to support large scale generalizations about the use of data from mobile phones or open source information like public posts on a social media site.
Furthermore, small companies like the one described in Vice Motherboard article exist in every business sector. Focusing on a single firm — whether a quinoa farmer or a commercial data provider — may not provide a representative description of the market.
News flash: Data are available to companies, government agencies, and not for profit organizations from hundreds of companies. Some of these are tiny like Mobilewalla. Others are beefy; for example, Oracle BlueKai. Still others occupy a middle ground like Dataminr. Others are loosely affiliated with other countries’ government entities; possibly Innity.
The fixation on policeware appears to be a desire on the part of “real” journalists to tell mobile phone users that the essential device is gathering data about the user.
News flash: Mobile devices which seek cell towers and WiFi connections emit data as part of their normal functioning. Individuals who use mobile devices to look at ads on ManyVids, surf the Dark Web from a mobile device, and use the gizmos to buy contraband and pay with Bitcoin are skywriting. Big messages are available to those with access to different sets of data.
Some of the data flows into the stellar giants of the online world; for instance, Facebook and Google. Other data gathers in the telcos. Quite useful data floods from online mobile game enthusiasts. Granny in the retirement home happily provides companies like Amazon with a flow of information about what’s hot from her quite particular point of view.
My thought is that chasing quinoa farmer stories is a new and exciting angle for some “real” journalists. But is there a different story to be researched, understood, and communicated.
“Real” journalists might begin by asking and answering with facts, not anecdotes, these questions:
What organizations are the equivalent of the agribusiness giants just in the commercial database sector? How are these data gathered, verified, and made available? What people, companies, and organizations license these data? Why does a commercial database business exist? When did data morph into mechanism for dealing with certain types of events? How many government agencies integrate these types of data into their “feet on the street” activities? What’s the upside to these data and their use? What are the downsides to these data and their use?
The stories about the quinoa farmer are okay. Moving beyond the anecdote to the foundation of commercial data licensing is more meaningful and more interesting.
The problem may be that moving beyond the quinoa approach takes work, time, and understanding. Hey, “real” journalists have to log into Slack and then jump on a Zoom call. This “go beyond quinoa” is just too much like “real work.”
That’s a problem I assert for individuals uninterested in what happened when trans-Atlantic telegraph messages began to flow. Why not look into that type of history?
Stephen E Arnold, June 27, 2020
-
- Subscribe to Beyond Search
Feature archive
News archive
-
