Tag Archive for Biometrics

Apple Wants to Patent Spyware

Apple Wants to Patent SpywareThe Electronic Frontier Foundation (EFF) is reporting that Apple, Inc., (AAPL) has filed a patent application for a “Systems and Methods for Identifying Unauthorized Users of an Electronic Device. ” The patent is for a device to investigate a user’s identity to decide if that user is “unauthorized.”

Information Apple plans to collect

  • EFF logoThe system can take a picture of the user’s face, “without a flash, any noise, or any indication that a picture is being taken to prevent the current user from knowing he is being photographed“;
  • The system can record the user’s voice, whether or not a phone call is even being made;
  • The system can determine the user’s unique individual heartbeat “signature”;
  • To decide if the device has been hacked, the device can watch for “a sudden increase in memory usage of the electronic device“;
  • The user’s “Internet activity can be monitored or any communication packets that are served to the electronic device can be recorded“; and
  • The device can take a photograph of the surrounding location to find where it is being used.

Who is the responsible party

Apple logoThe EFF believes that as a result of this new technology, Apple will know who you are, where you are, and what you are doing and saying, and even how fast your heart is beating. In some embodiments of Apple’s “invention,” this information “can be gathered every time the electronic device is turned on, unlocked, or used.”  When an “unauthorized use” is detected, Apple can contact a “responsible party.” A “responsible party” may be the device’s owner or as the EFF points out the “responsible party may also be “proper authorities or the police.” Once an unauthorized user is identified, Apple could wipe the device and remotely store the user’s “sensitive data.” Apple’s patent application suggests it may use the technology not just to limit “unauthorized” uses of its phones but also to shut down a stolen phone.

However, the EFF says Apple’s new technology would do much more. The EFF believes that this patented device enables Apple to secretly collect, store, and potentially use sensitive biometric information about the user. This is dangerous in two ways according to the EFF:

  1. It is far more than what is needed just to protect you against a lost or stolen phone. It’s extremely privacy-invasive and it puts you at great risk if Apple’s data on you are compromised. But it’s not only the biometric data that are a concern.
  2. Apple does not explain what it will do with all of this collected information on its users, how long it will keep this information, how it will use this information, or if it will share this information with other third parties. We know based on long experience that if Apple collects this information, law enforcement will come for it, and may even order Apple to turn it on for reasons other than simply returning a lost phone to its owner.
  3. Apple’s technology includes various types of usage monitoring — also very privacy-invasive. This patented process could be used to retaliate against users who jailbreak or tinker with their device in ways that Apple views as “unauthorized” even if it is perfectly legal under copyright law.

rb-

The EFF says this is a new business opportunity: spyware and what they are calling “traitorware.” The patent would allow Apple to find and punish users who tinker with their devices. The EFF says it’s not just spyware, it’s “traitorware,” since it is designed to allow Apple to retaliate against customers who do something Apple doesn’t like.

This patent is downright creepy and invasive — certainly far more than would be needed to respond to the possible loss of a phone. Spyware, and its new cousin traitorware, will hurt customers and companies alike — Apple should shelve this idea before it backfires on both it and its customers.

Steve Jobs wants you

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Keyboard Crud Fingers Suspects

Keyboard Crud Fingers SuspectsResearchers have developed a new technique to identify individuals by the hand bacteria they leave behind on their personal computers keyboard and computer mice. Researchers at the University of Colorado (CU) at Boulder have shown that “personal” bacterial communities living on the fingers and palms of individual computer users that were deposited on keyboards and mice closely matched the bacterial DNA signatures of users.

The development of the technique is continuing, but it could offer a way for forensics experts to independently confirm the accuracy of DNA and fingerprint analyses, says CU-Boulder Assistant Professor Noah Fierer, chief author of the study. “Each one of us leaves a unique trail of bugs behind as we travel through our daily lives,” said Fierer, an assistant professor in CU-Boulder’s ecology and evolutionary biology department, ” … we think the technique could eventually become a valuable new item in the toolbox of forensic scientists.

The team used gene-sequencing techniques to match bacteria DNA swabbed from individual keys on computers to bacteria on the fingertips of keyboard owners. Fierer said in the article that bacterial DNA from the keys matched much more closely to bacteria of keyboard owners than to bacterial samples taken from random fingertips and from other keyboards. In a second test, the team swabbed nine keyboard mice that had not been touched in more than 12 hours and collected palm bacteria from the mouse owners. The researchers were able to successfully match the owner’s palm bacteria and the owner’s mouse from a group of 270 randomly selected samples.

The study showed the new technique is about 70 to 90 percent accurate, a percentage that likely will rise as the technology becomes more sophisticated, said Fierer. The CU-Boulder team used a “metagenomic” survey to simultaneously analyze all the bacteria on the fingers, palms, and computer equipment, said co-author Rob Knight. The effort involved isolating and amplifying tiny bits of microbial DNA, then building complementary DNA strands with a high-powered sequencing machine that allowed the team to identify different families, genera, and species of bacteria from the sample.

Another reason the new technique may prove valuable to forensic experts is that unless there is blood, tissue, semen, or saliva on an object, it’s often difficult to obtain sufficient human DNA for forensic identification, said Fierer. But given the abundance of bacterial cells on the skin surface, it may be easier to recover bacterial DNA than human DNA from touched surfaces, they said. “Our technique could provide another independent line of evidence.”

Once further research is completed, Frier says the new technique may be useful for linking objects to users in cases where clear fingerprints cannot be obtained – from smudged surfaces, fabrics and highly textured materials, he said. The new technique would even be useful for identifying objects touched by identical twins since they share identical DNA but they have different bacterial communities on their hands.

The study was published March 15, 2010, in the Proceedings of the National Academy of Sciences. Co-authors included Christian Lauber and Nick Zhou of CU-Boulder’s Cooperative Institute for Research in Environmental Sciences, Daniel McDonald of CU-Boulder’s department of chemistry and biochemistry, Stanford University Postdoctoral Researcher Elizabeth Costello, and CU-Boulder chemistry and biochemistry Assistant Professor Rob Knight.

rb-

Fierer states that this new technique brings up bioethical issues to consider, including privacy. “While there are legal restrictions on the use of DNA and fingerprints, which are ‘personally identifying’, there currently are no restrictions on the use of human-associated bacteria to identify individuals,” he said. “This is an issue we think needs to be considered.”

It would be my recommendation that firms get ahead of this issue and review their employee privacy policies to deter the “expectation of privacy” until the courts decide if bacteria growing outside of an individual is eligible to be classified as “personally identifiable information” (PII).

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.