Your Brain Can Be Hacked

The paper's title is "On the Feasibility of Side-Channel Attacks with Brain-Computer Interfaces". Given that, yeah, I can see how you could get a LOT of information out of someone without them realizing it. If e.g. you're playing a game, and the surroundings occasionally reflect something you've seen, that's information that such an interface could detect. Maybe a NPC has a disorder that runs in your family, and you react to it more strongly than others - insurance companies would probably love to know it.

All of which is to say, if you assume the worst, and brain-computer interfaces become ubiquitous, yes, I can see there being a serious potential for you to leak things you don't want to leak, just by being exposed to something similar. Done on a grand enough scale, the possibilities could be terrifying.

OK, sensationalistic headlines aside, this is what is actually going on.

Using EEG, you can look for something called a P300 Event Related Potential (ERP). This is a positive deflection from the baseline activity in the brain signals approximately 300 milliseconds after an anticipated event occurs. Note two key facts about this:

1) P300 actually varies by person; it can appear sooner or much later than 300 ms and have different amplitudes. Because of this, a training phase is required to train the classifier.

2) The P300 happens when an event happens the subject is anticipating or recognizes, so they have to be primed in some sense. For instance, the researchers asked subjects to think of an imaginary PIN, then flashed single digits at them one at a time and tried to infer what the first digit of the PIN was by that. Because they were thinking of, say, 1234, when 1 flashed on the screen, a P300 may have been generated.

What the researchers did was interesting, in that they made the case for potential malware in a consumer BCI game. Their accuracy rates weren't that great, however. This is a far far cry from nefarious agents pulling secret info from your brain.

"...via brute force methods."

Seriously, this registers barely above a lie detector for me. They have to just guess my password and then, when they get it right, they'll record a different brainwave pattern? Sounds simple enough. Okay, my passwords typically consist of several words with some numbers thrown in. I wager we can go through 40 trials each minute for 16 hours each day. How many millions of years do you have?