N.S.A. Collecting Millions of Faces From Web Images
nytimes.com
nytimes.com
"Sir, he burned off half his face to resist identification."
"...Have him drop trough."
Serious note though, it's similar to how the kinect is sitting in households across America, and I think the new one with the XBOX One can't be turned off. A microphone and camera system right into people's living rooms.
And of course, the government now wants a database of consumers credit information.
I try to not be a conspiracy theorist but when you hand them this much information, it's hard to trust people to do the 'right' thing.
you are only half a year to the party
http://www.forbes.com/sites/erikkain/2013/08/12/microsoft-re...
99% of XBox owners will not physically unplug the XBox every time they are done using it because of hazy privacy concerns. Suggesting that a few people could is worse than doing nothing. Those with the knowledge and skill to understand the problem will be inclined to solve the problem only for themselves. A bunch of others will use the "they could just unplug it" line to blame the average user for being insufficiently dedicated/savvy. It dissipates the energy for solving the problem properly. And if the NSA is using the Kinect cameras, then they'll be perfectly happy with photos of 99% of users.
As an example, consider the iPhone. Smartphones existed before it. But by packaging the tech in a way that anybody could use it, they made smartphones mainstream. If we want to make privacy mainstream, we need to do something similar, not fall back on blame-y non-solutions like telling people to unplug things.
Are you saying that thus far it has never been the case that NSA or some other US Governmental agency has intercepted Snapchat images off the wire? How would you know whether or not it has ever happened? I think it is very reasonable to assume that NSA can do this.
> Except in the fantastical magical world of the conspiracy theorist.
This is an outright insult. Vent your frustrations elsewhere.
[0]http://vr-zone.com/articles/nsa-tapped-fiber-backbone-spy-go...
http://www.legislation.gov.uk/ukpga/2003/42/part/1/crosshead...
> (c)at the time of the offence charged he was a member of GCHQ, and it was necessary for him to make the photograph or pseudo-photograph for the exercise of any of the functions of GCHQ.
("Make" here includes "download from the Internet" becuase that causes a local copy).
Looking through all the legislation is a bit worrying. Perhaps it's all just exemptions asked for but not used as a way pf covering what they actually do; or maybe it's asked for because they might do it in the future but don't do it now; or maybe they ask for it because they do it?
"Pentagon declined to investigate hundreds of purchases of child pornography"
[0] -- http://news.yahoo.com/blogs/upshot/pentagon-declined-investi...
All those folks who share selfies of themselves anonymously online both of them clothed and unclothed, we are starting to see the ability to pinpoint who they are, just because they keep an online facebook.
Usually, threat of having to defend yourself in front of a judge keeps keeps this kind of behavior limited to smaller, often one-off events. When you have a proper Fear of getting caught, one event where you get away with some illegal and/or immoral behavior isn't a pattern yet, and so most people quietly go on with their life. After a sufficient amount of conditioning, this changes. A pattern emerges, and the idea that maybe you really can get away with anything starts to creep in. This is a rational decision on their part (Bayes Theorem obviously applies).
Worse, there seems to be a kind of "avalanche breakdown" effect in how we see our social position/role, due to the large amount of hysteresis[2] in how we interpret/rationalize our own social standing. The feedback loop between these two effects is probably why the current situation can appear to be impossible to turn back. It certainly will be impossible if left alone and unchallenged.
The soap box hasn't worked. The ballot box is a joke (and might be rigged, depending on who you ask). The use of the jury box is still pending in some areas places, and has failed in others. I would love to be wrong about this, but... nothing will change until the ammo box has been used to kill at least a few.
So I guess we should start preparing for the Civil War. /sigh/
[1] e.g.: Skinner ( http://en.wikipedia.org/wiki/Operant_conditioning )
[2] The ideas taken from this RSA[3] Animate, which explains the idea better than I ever could: http://www.thersa.org/events/rsaanimate/animate/rsa-animate-...
[3] This RSA == The Royal Society, not the crypto by Rivest, Shamir and Adleman
Preparations which then will be used to reinforce the "justification" of mass surveillance by the gov't.
It is a political problem. Technical solutions don't matter when the other side has an effectively unimited budget and manpower.
I strongly recommend watching PHK's recent talk talk on that subject in the link above. Avoiding politics by claiming this is a technical problem is simply forfeiting any goals you may have had to the opposition without a fight. Technical issues don't mean a damn thing against the bad end of rubber hose cryptanalysis or the old Soviet trick of simply "disappearing" people, and the aren't particularly useful against the current game of gag-order-filled "National Security Letters".
THAT SAID
It is also a technical problem. As you say, there will always be people interested in eavesdropping, and the tech needs to be fixed regardless. Maybe now we can finally get some progress on that front - I've taught more people about PubKey encryption and the Web Of Trust in the last year than the previous two "B.S."[1] decades. There's still a huge amount of work to do, unfortunately.
Both aspects - political and technical - are important, and we cannot afford to neglect either.
[1] "B.S." => "Before Snowden"
Which leads directly to the annihilation of any form of privacy (total surveillance), given the exponential advances that technology embodies.
If our governments really think that this is what their voters/citizens want, then this subject should be put to a very explicit vote.
http://www.emptywheel.net/2014/05/23/four-reasons-usa-freedu...
Sometimes, it all falls onto one man, such as the Audit the Fed bill, which also got a huge majority in House, but Harry Reid refused to put it on the floor in Senate, or when Patrick Leahy single-handedly killed the recent patent reform bill.
All of this doesn't seem "democratic" at all to me.
I suppose you're looking for this type of system [0]. Switzerland is a proud and well-known defender of it.
If it was possible to get such bills put to a vote over the objections of singular individual representatives, then there would be less need for direct democracy.
First up, I agree 100% with the idea that this sort of thing is systematically wiping out both freedom and the illusion of freedom. Of course we all know that over time it will close in getting worse and worse until we become little more than controlled cattle. However.....
Government has every right to think its what people want. Or, to put it another way, it is not what they don't want. The mass population simply doesn't care, since they know that it probably won't ever affect them. And if it does, well, the mass population won't care, they'll just see it as a bit of bad luck, happening to someone they don't know, who is not them, their family, friend or colleague.
What I don't see anywhere, US, here in the UK, or anywhere else is any form of mass objection. When you look at the numbers, protesters/population, petitioners/population, and so on, you'll see it is a small minority who actually care. As a politician, I'd be concerned about the mass population and their votes. Thats where the power is, not with a loud(ish) minority.
Im with you, I really am. I actually suffer minor anxiety symptoms as I read and think about this stuff. It really creeps me out. But the tragic fact is, the vast majority don't give a toss.
This will only change when majorities show signs of really caring about the issue.
What? Why? You don't justify this bold claim in any way.
The shortest part of that statement that it would be reasonable to quote alone is: "Government has every right to think its what people want. Or, to put it another way, it is not what they don't want." You don't have to agree with this at all. But it is a single self-contained idea that can be comprehended and understood, before attempting to justify or refute it.
Anonymous releases how-to instructions on fooling facial recognition (VIDEO)
The N.S.A. collects iris scans of foreigners through other means.
http://en.m.wikipedia.org/wiki/US-VISIT
> The U.S. government states that the purpose of US-VISIT is to advance the security of both the United States and worldwide travel, through the use and sharing of biometric information for identity management. U.S. Department of State consular officers and U.S. Customs and Border Protection (CBP) officers collect biometric information (digital fingerprints and a photograph) from all non-U.S. citizens between the ages of 14 and 79, with some exceptions, when they apply for visas or arrive at major U.S. ports of entry.[4]
There are "some exceptions", and it doesn't cover people under 14 or over 79.
I would assume this is a major source, possibly along with the attempts to gain covert access to other nations' similar counter-terrorism biometric databases.
[1] http://www.wired.com/2010/09/afghan-biometric-dragnet-could-...
Not sure exactly what the point was.
Surely you jest--I suppose next you'll be asserting that you can cause billions of dollars of economic damage using only some box cutters!
And as high-DPI screens get more common, ordinary snapshots online will probably move up from the low resolutions they are now.
"Army Reveals Afghan Biometric ID Plan" http://www.wired.com/2010/09/afghan-biometric-dragnet-could-...
"Could Iris Scans Stop a New Iraq Insurgency?" http://www.wired.com/2008/08/maliki-vs-sois/
And probably by infiltrating other countries' iris-scanning of undesirables like refugees:
http://jordantimes.com/iris-scanning-technology-streamlines-...
Start wearing them as a matter of course.
I'm pretty sure that's one of the only requirements for an NSA project.
"It is not clear how many images the agency has acquired. The N.S.A. does not collect facial imagery through its bulk metadata collection programs, including that involving Americans’ domestic phone records, authorized under Section 215 of the Patriot Act, according to Ms. Vines."
Why would a phone metadata program, which is basically call records ever be thought to include photos?
This asymmetry should bother everyone who has made the effort to consider information as power -- and to consider self-governance as necessarily based upon an informed self.
If nothing else, one should consider the horror of a world-spanning bureaucracy that seeks a singular, uncompartmentalized rule and control. Many thoughts flicker through my consciousness about the limits and diversity of human culture -- and the robustness that comes from that latter. Or, I can think of a more "basic" quip, that Nature abhors a monoculture.
People need to think seriously about how much they can "just let someone else deal with", and how much they need to step up and be at least partially responsible for, themselves.
"Liberal" or "Conservative", most seem to, one way or another, reach the conclusion that they have to take responsibility for their own affairs and community.
What we are currently developing seems to be an antithesis to this.
Sounds like this is the answer.
One of the difficult aspects of investigating terrorist networks through signals intelligence would be deciphering the network itself (which is why NSA would have been interested in phone metadata).
If you had a known list of terrorist suspects (TIDE) and could match those to legally-intercepted video feeds or pictures (which is what I'm assuming PINWALE is for) then you could identify the user IDs being chatted with and then use PRISM and other approved signals interception methods to decipher "who's who in the zoo".
With a better selectivity of who the targets would be then you could use targeted access operations to both get better fidelity on actual plots (instead of dumb keywords searches, actually assign analysts to get a "deep dive" into any of the plot(s) under discussion). This would also enable you to avoid wasting time and resources on people who are not a threat by filtering out "where the terrorists are not".
The ideal end result: Disrupting a bombing plot before it happens. Both the 2009 and 2010 bombings were disrupted only by luck, so "clearly" the NSA didn't have the tools they needed, which is why I warn you guys that the argument "oh but they didn't catch Tsarnaev" doesn't end the way you think it does. :P
----
I know you all like to claim that counter-terrorism is just rhetoric used to justify more sinister motives, but I've found it striking how almost every time a leak is presented the evidence shows a bunch of NSA analysts trumpeting... counter-terrorism.
This case is no different: "another 2011 N.S.A. document reported that a facial recognition system was queried with a photograph of Osama bin Laden.", "A 2011 PowerPoint showed one example when Tundra Freeze, the N.S.A.’s main in-house facial recognition program, was asked to identify photos matching the image of a bearded young man with dark hair.", "One N.S.A. PowerPoint presentation from 2011, for example, displays several photographs of an unidentified man — sometimes bearded, other times clean-shaven — in different settings, along with more than two dozen data points about him. These include whether he was on the Transportation Security Administration no-fly list, his passport and visa status, known associates or suspected terrorist ties, and comments made about him by informants to American intelligence agencies."
There's certainly an argument to be made about whether such investigative abilities are safe for democracy, but what we've consistently not seen is a bunch of people trying to subvert democracy, not even according to the very documents NSA and their managers thought would be safest from ever being publically disclosed.
In August 2013, a report by Reuters revealed that the Special Operations Division (SOD) of the U.S. Drug Enforcement Administration advises DEA agents to practice parallel construction when creating criminal cases against Americans that are actually based on NSA warrantless surveillance. [1] The use of illegally-obtained evidence is generally inadmissible under the Fruit of the poisonous tree doctrine. [2]
[1] http://www.reuters.com/article/2013/08/05/us-dea-sod-idUSBRE... [2] https://en.wikipedia.org/wiki/Parallel_construction
Even that has rules, and the rules are on the whole followed.
Parallel construction is about finding evidence that can hold up in the court of law, without divulging classified intelligence "sources and methods" (you know, much the very things NSA is complaining about Snowden having done).
It starts from evidence legally collected by NSA (which is why "fruit of the poisonous tree" would not apply). The law permits the NSA to share that legally-collected information in some cases with law enforcement.
But law enforcement can't build a case on that without burning the NSA source, so NSA advises them on how to start a new trail that can lead to a prosecution without NSA having to close off that intelligence source.
Is it unfair? Perhaps, but then so is Google using legal tax loopholes to avoid paying taxes. Distasteful perhaps, but legally permissible.
If the NSA wants to have person A detained then wouldn't it be a good idea for them to already know what that person looks like? Am I entirely missing the point?
Think doing relational SQL joins based on photos, IMO.
Age: Height: Sex: Eye Color: Skin Color: Build:
and I can fill it in and I will be presented with an image (or images) that matches that query, along with basically all the other information currently collected about that individual?
So, a use case would be...a 6'2'' individual with medium complexion and shinny build with heavy facial hair was caught on a camera doing some potentially illicit activity and the feds can feed that info into the DB and the output is a list of people who match that description, along with all available information such as (I'm guessing here), last known location (most likely according to their last internet login and/or cellphone ping), full transcripts of their emails, chat, voip conversations, etc..?
But how does the system match the photo to the name? [The app 'NSA' would like access to your Facebook Photos. This app will not be able to post on your behalf."]?
It's not hard to make reasonable guesses based on fundamental systems engineering principles though. E.g. the interface might simply be "Here's a known picture of the guy, find all matches to this picture" and start seeing which connections pop up. Almost like a Facebook Graph Search based on an image identifier instead of a Facebook UID.
[1] http://www.bbc.co.uk/news/magazine-25424290
[2] http://www.bbc.co.uk/news/uk-england-birmingham-24586050
[3] http://www.bbc.co.uk/news/uk-england-leicestershire-27633943
[4] http://www.bbc.co.uk/news/uk-england-leicestershire-27328590
PS: not one of these people was on any kind of list.
The FBI failed to properly follow-up with that lead, but that's not (itself) a failure of SIGINT.
Despite all that (and ironically), the Boston bombing was a scenario where we should expect the NSA to be unable to see early signs, since they are forbidden from tracking the communications of either of the Tsarnaev brothers since they were on U.S. soil. NSA would only have seen anything if they had reached out to a known foreigner, outside of the U.S., in the process of germinating their plot.
But even so, it may be that we have to "settle" for the existence of occasional homegrown extremism (America is no stranger to that either) while still foiling the external plots that can be foiled.
It is a theater, but the NSA got way too far. And even the motto of "100% security" by Obama is complete nonsense. Because it didn't stop the massive explosion in West, Texas, nor the Boston bombings.
Their problem is a lack of logical thinking.
Wasn't it Shneier who said that it wasn't the things you read about in the paper (by definition rare and exotic) that you had to watch out for but the banal ordinary things?
If you're trying to equate the psychological impact of things like 9/11 to the equivalent number of coal deaths or traffic accidents then I'm not sure the lack of logical thinking is limited to them.
Treating humans like they should be Vulcans is one of the most illogical things of all. People are not Vulcans, and any systematic policy that fails to take that into account is doomed to failure.
The executive branch of US gov, also didn't do one bit to relax the minds of "us". Instead they waved the red (and the US-) flag quite a lot and they put oil on the flame of fear. That by itself is criminal enough. But they went further and further... We know the history.
They don't even have to snoop.
Any "commercially available facial recognition technology" was a pre-Google thing, PittPatt is no more.
I see no reason to believe this. Google certainly had an obligation to honor existing PittPatt agreements after the acquisition. And I see no reason why they wouldn't continue working with the NSA if it was in their interest.
I am very pessimistic about bulk electronic surveillance reform. One of the few points of leverage I can see is publicly making it clear when companies work with the NSA, and avoid them when possible. I would include companies that acquire companies that work with the NSA. For example, I have slowly stopped using services of the PRISM companies, including Google.
[citation needed] one has to be privy to such contracts to make these conjectures, also they're software might have been of the "off the shelf" variety.
> One of the few points of leverage I can see is publicly making it clear when companies work with the NSA, and avoid them when possible. I would include companies that acquire companies that work with the NSA.
That's fine, but you should get the facts straight before lobbing accusations, as for 'companies that acquire companies' point, I don't subscribe to any guilt by association sort of animosity, this doesn't seem fair and lots of things are more connected than you think.
My main objection is that the NYT should have used "... now owned by Google" instead of "owned by Google" in their piece.
Fine, it's true, the contact could have said anything, including "if you are acquired, you are released of any obligations," although I find that hard to believe. Yes, and it could have been off the shelf with no support contact.
However, in my experience, having gone through an acquisition where the acquired company had existing obligations, those obligations were transferred to the acquiring company and understanding them were a large part of the due diligence.
> but you should get the facts straight before lobbing accusations
What was my accusation? All I did was quote the article. You tried to refute it -- claiming any interaction between PittPatt and the NSA was pre-Google -- by giving dates which were still entirely consistent with the article as written (docs from 2011, acquisition from July of that year).
> My main objection is that the NYT should have used "... now owned by Google" instead of "owned by Google" in their piece.
Again, I don't see any compelling evidence you've given for contracting the article as written. I'm going to have to go with the professional reporting on this one.
> as for 'companies that acquire companies' point, I don't subscribe to any guilt by association sort of animosity, this doesn't seem fair
That's fine, think whatever you want. We disagree.
I assume the faces on each frame of the video are extracted to be queried against the face database.
Would all the faces in the db loaded into memory and constructed in some data structure for efficient query? Or some mapping to SQL's standard B+ tree index with range searching can be done?
Also, the impossibility of organising a broad based political movement for change within the US in response to, say, severely worsening economic or climatic conditions because of 'self censorship' by US citizens?
These are weak signals working over a long timescale. But those things are important.
I do not think you know what the hell you're talking about - and I also don't think you understand the gravity of the power that having an octopus for total information awareness over the planet actually means.
You're lost.
_insert emoticon indicating sarcasm combined with emoticon indicating awful pun_
The fact that there exists danger in "an octopus for total information awareness", and that IMO it's entirely undesirable, it's also perfectly possible that a bunch of people disagree with me, and believe that the existence of such is indeed for the "common good."
You don't win a war like this by painting these people as evil or amoral. They are just wrong.
Jesus, you're a a condescending prick.
You don't mind because you think it'll only be used to catch "hardcore criminals & terrorist". Also, if everyone had the info the NSA has I'm sure all kinds of extortion, job dismissals and divorces would happen. Even those in power I'm sure don't want that info just out there on an API for any random person with interwebz.
Please don't speak for me. I was talking about the information collection, not what they're doing with that information.
Catching criminals? Sure, but that's very minor compared to the real harm that data can do to a bunch of relatively harmless people. Like using a gun to kill a housefly. The chances of you hitting the housefly are very low, but the chances of you harming a bunch of innocent people while trying are likely.
There's a reason Springer-Verlag publishes so many data-mining books.
Whenever some revelation about the NSA makes the news again, it sounds like something out of Mission Impossible or Batman. I'm beginning to think they just hired action movie writers to design their programs.