Maker of US border's license-plate scanning tech ransacked by hacker
theregister.co.uk
theregister.co.uk
I’m critical of people like me (millennial, working in tech) and I think I have good reason. I hear so many bizarre technological “solutions” to what are ultimately policy issues. If we spent half that time instead lobbying our representatives we would be in a much better place as a society. Can you name your state rep? How about you write them a little today rather than succumb to cynicism or spitballing tech.
Sure you could create a bunch of pi cams able to handle a few reads per second, but then say you want to know what plates have traveled with your target plate between multiple camera sets to see if someone is being followed, or you have cell phone pings and want to search all cameras in the radius of that tower for a plate.
The reading isn't hard, its fully solved, the economical and real-time searching of plates and evidence compilation is the much harder problem.
Can you talk more about why this is difficult?
My very naive assumption is it would be pretty easy to partition/index the data by plate number and location/time and use something like Storm or Spark (?) to run various types of queries.
I'm near a major release actually, replacing my previous products with something called Parking Enforcer, which I believe is the best mobile app / vehicle grouping tool in market. I focus on business parks with 300-2000 parking spaces to patrol. It has been in beta for about 9 months.
I have been working algorithms related to ALPR data set matching a lot, primarily in Python.
I'm not familiar with storm / spark. However, one issue is that that license plate reads are not 100% accurate. So you are looking for a fuzzy version of the plate.
Its possible for collections of plates to sort of fuzz-out as incorrect members become more distant from previous ones, causing new matches to join groups they should not. You can write stuff to handle this but the original point was ~"this problem is in analysis not ALPR" which I agree with.
As far as computation, a new plate may or may not have a group to join. If it has been seen before, you need to look for the group "most likely" to be the same car. This can mean iterating over a large data set to look for the highest probable group.
There are some tricks to cutting down on the data set under consideration. For example it is much easier to only look at possible sightings from this past week in this area than every sighting from everywhere. (which when assembling a national database may be necessary)
But in my experience, even in the tens of thousands of plates, doing grouping requires task queues and tricks for quick identification and notification of matches. A watchlist (blacklist) is might be short, but the grouping task over months of data can be long.
Some plates are VERY similar but not the same car! Sometimes the ALPR camera forwards photos of fences or vehicle grills that are not license plates at all, and those must be ignored but not at a threshold where good data is thrown out. When bad stuff makes it to the user, they have to be easily disposed of if they make it through.
Data cleaning things can require additional capabilities of analysis, like breaking apart improperly grouped vehicles, yet ensuring they do not rejoin "bad" groups. Lots of details to handle, and to an end user, it is painfully obvious when "matches" are not correct. They expect magic.
One other note is that I found building an efficient and useful model architecture for these purposes to be challenging. There are more details in how the raw data comes in from ALPR scans that have to be handled before you even reach an individual "Sighting."
If I could I would have all my customers scan plates with the iPhone XS. But many work with 7 or even less.
Also introducing a lot more collected data to dedupe is a thing as well. One of the first algos I worked on was just realizing in short term new dats we already had a car and to not try and treat the same car like it was another car.
Senzing https://senzing.com/
Tech is empowering, much moreso than playing politics.
Consider something like the Kafkaesque nightmare that is applying for (and keeping) food stamps. It doesn't need to be complicated (nor should it be!), but you can either try to convince elected officials to make the poor a priority and fix the process or roll up your sleeves and write a script to complete the forms in triplicate, generate mailing labels with delivery confirmation, remind users of deadlines and pull phone records to prove the social worker never called like they said they did in the denial letter.
Or you could petition, harass, bribe and cajole your way into enacting change, and have it all overturned with a change in administration.
In some part these technical solutions exist to fix people problems. Look at the internet itself-- where problems exist (a country's politicians/dictator makes the nation unroutable), you don't wait for a coup, you route around it.
But also in some part these solutions are just modern rent-seeking, so...
No, we’re still waiting for a coup in China, North Korea, and on and on for the citizens to access the internet.
This is the reason why technological solutions are popular among the Silicon Valley crowd. No matter what, political solutions are plagued by human emotion and self-interest, and thus they become sticky, "corrupt", and slow. Technological solutions are subversive of that structure at the least, and a force multiplier in others.
The computer will generally do what you tell it to do. You can spend hours of effort on something and get a deterministic result that will do the thing. You can spend your whole life in politics and get nothing out of it because the entrenched power structures won't let it happen.
It’s just a different form of the same corrupt politics.
The biggest problem with technology is this delusion that it somehow isn’t a reflection of human failings.
If we at least admitted that then we’d be able to reason about it responsibly.
Technology is a band-aid, not a solution, and technology can also be used to make progress towards solving the problem decay, or actively worse.
I have long thought that this particular process was intentionally difficult as a means of helping to weed out people who aren't really in need.
I bet a little digging and we will discover that this network was hopelessly undefended and their software is horribly riddled with holes and poor security practices.
It was obviously done to impact the company as an entity rather than to target individuals or the government. It's quite obvious, to me, that the attackers wanted to dump a large liability in someones lap and perhaps for good reason. If this company can't secure the data it collects about innocent civilians then it shouldn't be allowed to collect it.
It's important, but I am a bit frustrated by shallow encouragement that makes politics sound like it's easy. It's like saying "get a job" rather than providing actually helpful resources and training to find a job.
The point is that if you have access to their systems you can affect what is reported. For example you could add a bogus plate to the data stream, or remove one, or perform a substitution. I think we can all imagine cases were doing such a thing might be useful to someone.
Others have also pointed out that it’s possible that this company has some particularly interesting recognition technology, but I agree with you that this is really a second order issue.
https://www.theverge.com/2019/4/23/18512472/fool-ai-surveill...
Yes I can name (all) of my state's representatives. No I'm not going to write them. Your letter and sending information get filed under an equivalent of "dissenters". That's kind of the entire point here.
I first noticed it in major centers years back, but now it seems even small towns have cameras at every intersection.
From an IT perspective it's a pretty interesting project, but from a tin-foil-hat perspective it's astonishing when you imagine the ability to link all these cameras together in real-time.
The explanation was that they were updating the stoplight controls. One of the inductive sensors in the road had failed, and it was cheaper to have a guy in a bucket truck stick a couple cameras on the pole than to rip up the road. The cameras are used to see the volume of vehicles in each lane and dynamically adjust light timings. And since I drive through the intersection multiple times a day, I have noticed an improvement. They skip the left turn sequence if no one is waiting, and rarely have a big backup when volume is high in one direction for the commute. Also, the left turn timer used to be very short (like 2 cars making it through on green, one on yellow, and the 4th car often took control and went on red), which was nice when there was only one car and you wanted to go straight, but annoying when you were one of 6 or 7 cars in line and an extra five seconds would let everyone make the turn but instead you had to wait through multiple light cycles. Now it seems to often hold the turn cycle long enough to let the whole line empty out.
But I totally agree that the idea of a soft update to either issue red light tickets or track license plate activity is extremely concerning. Might end up with a stray paintball from my backyard accidentally hitting the lens if they make that a policy change.
if there is no retention, or a press here to save last five minutes in case they witness an accident that would be good
Cameras are already everywhere. As they become even more dirt cheap, that will only hyper-increase, even if governments somehow completely stays out of it.
Sometimes you enter into a new technological era, and you have to accept that things have changed.
edit: We(citizens) don't like being spied on, and it just rubs salt in the wound that we have to pay for it.
I am already "doxxed" and it doesn't bother me.
It's the record keeping everywhere else and tracking that that enables that's not ok.
...for the people who would need to vote to change it.
They ain't gunna change something that will work against them after they change it...
This is the unfortunate weakness of the Western style democracies in the face of totalitarian states. We have a much more obvious divide between private and public entities. In China and Russia, the lines are blurred and often they get much better support from the government to defend and hack the opposition. Even to the point where China will hack US companies and just give the IP to Chinese companies.
You can be sure that the USA is giving the "acquired" IP to their us companies as well.
Quite an odd detail to add to the article, why was this seen as relevant?
https://www.cia.gov/news-information/press-releases-statemen...
Stevie Wonder and Cat Stevens tend to push it more toward the older end of that range.
AC/DC correlates with that entire cohort, so doesn't provide any additional or contradictory information. Unless we knew whether it was Bon Scott era or Brian Johnson, heh heh.
Expected age 46 ± 5.
There is so much cognitive dissonance and denial in the tech community and their role not just in building but also defending and whitewashing narratives that its becomes difficult to see movies and read about surveillance dystopia and be expected to feel creeped out and then return to current reality where its sort of normalized and ok.
same as my local supermarket's car park?
Some previous hacks that were attributed to Russians, like Shadow Broker leak, actually were executed by somebody else, I think. This one is more suspicious, in my opinion.
The choice of the venue to leak the information and some other minor details lead me to strongly suspect one of our state-sponsored APTs.
I have always when encoutering RARs rolled my eyes and then tried to remember the names of tools to do extraction.
Russian English is known for skipping or confusing articles, longer sentences, more commas than it’s necessary, wrong tenses, and some troubles with pronouns. There is almost nothing of that. What _is_ there instead is way too many abbreviations than a Russian would use, things like POTUS/SCOTUS etc. We don’t use those. Also, the word “caucus” — quite an americanism, if a non-American person would have used that, they would speak much better English.
I am 90% sure that the perpetrator here is either an American, or lived in the US for a long time, and wanted to disguise his writing by intentionally distorting it.
Also, any good hacker would be sure to leave behind multiple access paths. But maybe a professional hacker would refrain from dumping stuff, because that alerts the target. So the dump implies that they're not very professional.
Isn't it better to stay quiet, to help ensure long-term access?