Smart Watches and wristbands: who is watching the watches?

Over the last few weeks a number of stories have appeared about new “wearable” technology that has the means to track you and your children.  NBC News has a comparison of several “Smart Watches” that are either on the market or could soon be.  Think Dick Tracy.  Some have phones built in, while others can send and receive email.  These things don’t replace smartphones or other PDAs in general because their screen size is so small.  They’re likely not to have much of an Internet browser for that reason, and they may only support a few simultaneous applications on board.

Still, smart watches may find their own nitch.  For instance, a smart watch can carry an RFID that that could be used to control access to garage doors, or perhaps even your front door.  A smart watch might be ideal for certain types medical monitoring, because of its size.  In all likelihood these devices would have limited storage, and would take advantage of various cloud services.  It’s this point that concerns me.

Any time data about you is stored somewhere, you have to know what others are using it for, and what damage can be done if that data falls into the wrong hands.  And so, now let’s consider some of the examples we discussed above in that light:

  1. Voice communications: as one large vendor recently discovered, anything that can be used as a phone can be used as a bug, to listen into conversations.  Having access to a large aggregations of smart watches through the cloud would provide an entire market for attackers, especially if the information is linked to specific individuals.
  2. Medical monitoring: similarly, if you are using a smart watch or any other device for medical monitoring, consider who else might want to act on that information.  Insurance companies and employers immediately leap to mind, but then perhaps so do pharmaceutical companies who might want to market their wares directly to you.
  3. RFID and location-based services.  There have already been instances of people being tracked electronically and murdered.  Children wearing this or a similar device could be kidnapped if the cloud-based services associated with the device is broken into.

This is what concerns me about Disney’s MagicBand.  Disney makes a strong case that having such a band can actually improve service.  But should their information systems be broken into by a hacker, how much might a deranged estranged parent pay that criminal to find out where the child is?

It is the linkage of various attributes that must be considered.  Add location to a name and all of a sudden, a hacked cloud-based service can really do someone damage.  We give away a lot of this information already with many smartphone applications and other devices we carry.  Before we give away more, perhaps we should stop and think about our privacy in broader terms and what is necessary to protect it.  In Europe, the Data Privacy Directive covers a lot of this ground.  But America and other countries are far behind that level of protection.  Further, every new service on a smart device is going to want to monetize every last bit of data they can get.

Should the ITU Handle Cybersecurity or Cybercrime?

Cybercrime and cybersecurity are two very important topics that are largely being lost in the noise around the American elections, the Arab Spring, or the European banking crisis.  Nevertheless, there is an attempt by the ITU and some governments to take a more active role in this space.

Roughly defined, cybercrime is a crime that occurs or is facilitated by computers.  Cybersecurity is the actions taken to protect against cybercrime.  This includes protection of devices so that they don’t get broken into, and remediation.

Cybercrime itself is a complex issue.  It relates to many things, including fraud, data theft, privacy theft, and just about any criminal endeavor that happened before the term “cyber” ever came to be.  There’s a great paper by a laundry list of Who’s Who in the economics of cybersecurity that proposes methods of estimating actual losses, breaking down crime into various categories.  Statistics in this space are remarkably fluid- that is, there are poor standards for data collection.

As it turns out, there is a treaty on cybercrime, conveniently called The Convention on Cybercrime, developed in the Council of Europe.  Nearly all of Europe, as well as the U.S. and a number of other countries have ratified this treaty, and there other signatories.  Research from the University of Singapore has already shown that either accession to the treaty or even becoming congruent with it will reduce a country’s cybercrime rate.  While the causalities are not clearly explained in that paper, one part is obvious: the first part of the treaty is what amounts to a best practices document for governments, on how they should develop legislation.

The treaty itself is fairly involved and took many years to get as many signatures as it did.  It has to deal with diverse societies who have differing constitutional views on freedom of speech and expression, as well as on due process.

The Secretary General of the ITU and his staff, as well as a few governments, have been under the impression that the ITU could do a better job than what was done by the Council of Europe.  There is little chance of this happening, and in all likelihood, they would make matters worse, if for no other reason (and there are other reasons) that anyone who already signed the Convention would have to reconcile differences between that and whatever would be created by the ITU.

There are other reasons the ITU cannot do better, not least of which is that they lack the technical expertise to actively engage in cybersecurity.  Part of the problem is that most Internet standards are not ITU standards, but come from elsewhere.  While the ITU has any number of standards involving fiber optics management, and good codec support, the computer you’re reading this blog on uses mostly the work of others.  Another reason is that the state of the art in both cybercrime and cybersecurity is rapidly moving, beyond the ITU’s capability to adapt.  Here’s just one example: contrary to what people had thought, the battle ground for cybercrime has not really moved to mobile devices.  As we’ve previously discussed, this has a lot to do with the update mechanisms and business models in play, but the most notable one being that applications on the iPhone in particular are both reviewed by Apple and signed.  The only iPhone you hear about being vulnerable is the one that has been cracked by the owner, and that doesn’t account for a whole lot.

One WCIT proposal that refers to spam as a threat demonstrates how far off some governments are on the subject.  Spam itself has never really been much of a threat, but more of an annoyance.  80-90% of it is never delivered to the end user, and most Evil Doers have moved on to more sophisticated approaches, such as spear phishing.  Worse, the ITU-T’s study group 17 had to take years simply to come up with a definition of spam, when it really was a problem.

This is not to say that the ITU shouldn’t have a role to play with cybersecurity.  The ITU has extraordinarily access to governments of developing countries, and can work with them to improve their cybersecurity posture, through training and outreach.  In fact they do some of this in their Development or ITU-D Sector.  One thing that the D sector has done recently has been to put developing governments in touch with FIRST, the organization that coordinates discussion among Computer Incident Response Teams or CIRTs.  But the ITU should give up any idea that it can play more of a role than outreach and capacity building, all of which should be done in consultation with actual experts.

As if they read my blog…

The Wall Street Journal has a follow-up today that talks about how police track our locations with our cell phones.  Now, answering one of my own questions, thanks to some discussion with my wife, what is the difference between using a GPS tracker and a cell phone?

First, of course you can always turn off your cell phone.  Because you know you are being tracked, you have a means to defend your privacy.  Is it a reasonable means?  I would argue “no”.  In addition, the feds do not own the data.  Instead they have to go to the phone companies to get it.  And they do that quite a bit more than using GPS trackers, according to the article.  And why not?  You pay for the cell phone and your carrier retains the data.  It’s darn cheap for the police to make use of all of that rather than have to pay for the tracker and manage it.

There’s another big difference that I alluded to.  Police in America do get a court order for cell phone location information.  This is why I believe the Obama administration should fail.  It is not an onerous task, judging by numbers, to get such an order, and since it isn’t, the onus falls on the administration to show why they shouldn’t make use of the exact same mechanism when the technology changes.

GPS and the 4th Amendment: Can police track you without your knowledge?

Does the government have the right to know where you are at all times?  This is a question that will be answered by the Supreme Court over the next year.  The Wall Street Journal reports that the Supreme Court will examine today a case in which the police and the FBI attached a GPS tracking device to the car of a night club owner who was suspected of dealing drugs.  At issue is whether this constituted an unreasonable search or seizure by the government, a violation of the Fourth Amendment of the U.S. Constitution.

As the article points out, the Fourth Amendment protects us only from the government eye when there is some reasonable expectation of privacy.  That which occurs on the street in plain view is not usually considered private.  However, in this case, the question is whether the body of evidence gathered by the police would be considerably more than just some onlooker happening to see you at a particular point in time.  Instead, it would be more like an concerted army of people following you 24 hours per day for as long as the GPS unit were in place.

From a technology perspective, while it may be possible to detect such tracking devices, it might prove very difficult.  For one thing, there’s no reason the device would need to signal to the police every moment of the day where it is.  Rather it could store the information and transmit it only periodically.

What’s more, we all carry tracking devices with us nearly 24 hours per day.  They’re called cell phones.  While some use GPS, the cell phone network knows where you are (or at least where your phone is), with or without GPS.

Here are my questions:

  1. Does the government need a warrant to receive cellular network location data?  If so, what is the difference between cellular network location data and GPS tracking data?
  2. If the government has the right to install a tracking device, assuming you could find the device, do you have the right to remove it?  After all, it is your vehicle.
  3. If the government has the right to track you via GPS, can others do the same?  What is to stop insurance companies, employers, or criminals from tracking you?

It’s the first question I find most profound, because if the government is allowed to attach these devices to you without a warrant, without any cause, they can follow anyone from anywhere to anywhere at any time, from birth to death.  In fact, they could create an enormous database to simply keep track of the location of everyone.

This is not to say that the government shouldn’t track people it reasonably believes to be criminals.  That is why the judiciary exists- to provide oversight over the process so that peoples’ rights can be balanced.

One final scary thought: such a database might already exist, and might be in the hands of criminals.  As I wrote above, cellular companies already know where you are.  If they’ve been hacked and don’t know it, who knows where that data resides?

 

Hello Insecurity, Goodbye Privacy. Thank you, President Obama

Some people say that Internet Security is an oxymoron, because we hear so much about the different ways in which hackers and criminals break into our data, steal our identities, and even use information to commit “real world” crimes like burglary, when it becomes clear that someone’s gone on vacation.  Well now the Obama Administration along with the FBI and NSA are proposing to make things worse, according to an article in today’s New York Times.

According to the Times, the government is going to propose requiring that developers give up on one of the key principals of securing information– use of end to end encryption, the argument being that law enforcement does not have the visibility to information they once had, say, in the Nixon era, where the NSA acted as a vacuum cleaner and had access to anything.

As our friend Professor Steve Bellovin points out, weakening security of the Internet for law enforcement also weakens it for benefit of criminals.  Not a month ago, for instance, David Barksdale was fired from Google for violating the privacy of teenagers.  He could do that because communications between them were not encrypted end-to-end.  (Yes, Google did the right thing by firing the slime).

This isn’t the first time that the government has wanted the keys to all the castles, since the invention of public key cryptography.  Some of us remember the Clipper chip and a government-mandated key escrow system that the Clinton Administration wanted to mandate in the name of law enforcement.  A wise friend of mine said, and this applies equally now, “No matter how many people stand between me and the escrow, there exists a value of money for me to buy them off.”  The same would be true here, only it would be worse, because in this case, the government seems not to be proposing a uniform technical mechanism.

What’s worse– this mandate will impact only law abiding citizens and not criminals, as the criminals will encrypt data anyway on top of whatever service they use.

What you can do: call your congressman now, and find out where she or he stands.  If they’re in favor of such intrusive policy, vote them out.