Showing off clever ways to remotely invade a smartphones has been a staple of hacker conferences for years. Now, you do not even need hacker skills to take over someone’s smartphone, because “there’s an app for that”—in fact, many of them. One is the notorious “Rastreador de Namorado” (Boyfriend Tracker) from Brazil.53 Once you slip this onto someone’s phone, it reports all of the device’s travels logged by the phone’s GPS. It reveals steamy text messages sent to other lovers. It even allows the scorned paramour to call the phone, and put it into audio eavesdropping mode.
People are coming around to the realization that our smartphones may indeed be traitors, but at least we can trust home appliances like our television sets. Or can we?
Seungjin “Beist” Lee shuffles nervously as he stands in front of the ragtag press room contingent at the Black Hat USA 2013 conference in Las Vegas. Seasoned business journalists mix with earnest young tech bloggers and local TV reporters awkwardly trying to explain hacking to the general public. It is not the easiest of tasks, because many of the exploits and vulnerabilities on display are pretty technical. Mr. Lee’s presentation, however, is understandable and frightening to everyone.
“Usually at home people have their TVs in the bedroom,” he says, “because you can watch the TV well.” OK, no surprises there. Reporters continue to doze and check email.
“On the other hand, the TV can also watch you very well.” Reporters look up. What did he just say?
“I want to say I hardly wear clothes at home, I just wear underwear.” Where is he going with this?
“But I don’t care about it, but I care about my family and my girlfriend.” Ahh, he’s saying that hackers can remotely activate the camera in those new high tech TVs. This is interesting.
Lee attempts to be coy about just whose Smart TVs he is talking about, since the company has now paid him a consulting fee; but the tenacious press corps relentlessly drags it out of him. We already know he is Korean and he drops the big hint that “the company starts with an S.”
In his presentation, Lee promises he will not only demonstrate the technical hack he discovered; he will also show how “Smart TVs monitor you 24/7 even though users turn off their TV, meaning #1984 could be done.” It is interesting, and somewhat chilling, that a young Korean graduate student would remind us of George Orwell’s dystopic world with a Twitter-style hashtag.
Lee can activate the camera remotely because a Smart TV is not just a TV. It is really a computer, microphone, and digital video camera wolf hiding in the sheep’s clothing of a familiar household appliance. Some reporters wonder whether anyone besides a stay-up-all-night hacker would bother exploiting vulnerability like this. The answer is a resounding “yes!”, because once the secret is posted online, “script kiddies” all over the world can start using it without even understanding how it works, often with tragic results.
Far too many people, of both genders, have committed suicide after having their intimate photographs posted online. Sometimes the pictures were given voluntarily to a “friend” who cruelly shared them with a wider audience. In other cases, acts of sexual brutality have been videotaped and posted for all to see. The most common scenario now appears to be “sextortion,” where the malefactor obtains some compromising photos, then demands more.
Two Canadian teenagers, Amanda Todd and Rehtaeh Parsons, were driven to suicide by online sexual harassment and bullying in 2012 and 2013 respectively. The Canadian government responded by introducing legislation to make it a crime, punishable by up to five years in jail, to distribute “intimate images” without consent. In the U.S., according to an article in ABA Journal, “only two states, California and New Jersey, make it illegal to post a sexual photo online without the subject’s consent.”54
Cassidy Wolf, Miss Teen USA 2013, was the victim of a webcam-enabled sextortion attack in which the perpetrator “used malicious software and tools to disguise his identity in order to capture nude photos or videos of female victims through remote operation of their web cams without their consent.”55
The FBI press release on the case goes to say that the nineteen-year-old perpetrator, Jared James Abrahams, “threatened to publicly post compromising photos or video to the victims’ online social media accounts, unless the victim either sent nude photos or videos, or engaged in a Skype session with him and did what he said for five minutes.” Abrahams pled guilty and has been sentenced to eighteen months in a Federal prison.
Miss Wolf has done a huge, if unwilling, service by bringing this type of attack into the public’s consciousness. While the motivation here seems to be of a sexual, not commercial, nature, that did not stop companies from finding a way to take advantage of it. A Google search on “Cassidy Wolf” produces stories from mainstream news media such as CNN and the Los Angeles Times. However, many of the other “hits” are in fact rewrites of those mainstream news stories sponsored by a company that makes, you guessed it, lens covers for web cams and Smart TVs. Using aggressive search engine optimization, this company managed to insert its “Protect yourself now with a web cam cover by … ” message into the conversation about Cassidy Wolf.
The commercial exploitation of web cameras took a frightening, and definitely illegal turn in a case involving rented computer equipment. If you were unfortunate enough to lease a computer from one of seven U.S. firms, or their international affiliates, you also received hidden software called “Detective Mode.” According to the U.S. Federal Trade Commission, “when Detective Mode was activated, the software could log key strokes, capture screen shots and take photographs using a computer’s web cam.”56 The software also contained a “kill switch” which could disable the computer if it was stolen or, more commonly, if the renter fell behind on the payments.
The FTC noted that “using Detective Mode revealed private and confidential details about computer users, such as user names and passwords for email accounts, social media websites, and financial institutions; Social Security numbers; medical records; private emails to doctors; bank and credit card statements; and web cam pictures of children, partially undressed individuals, and intimate activities at home.”
The American Banking Association Journal reported that the retailers agreed “to restrict the use of PC Rental Agent software developed by Pennsylvania-based DesignWare that previously allowed more than 1,600 licensed rent-to-own stores in the United States, Canada and Australia to spy on over 400,000 customers.”57
Remarkably, the rental companies escaped without a fine. A school district in suburban Philadelphia was not so fortunate. It was accused in a lawsuit of using a similar technology, the now defunct “TheftTrack,” to spy on students in their homes. In the class action lawsuit, students alleged that school officials were activating the cameras in the computers while they were off school premises. In a tremendous display of either arrogance or stupidity, school officials actually disciplined one student using photos taken surreptitiously in his bedroom as evidence. The judge awarded that student $175,000 in damages.58
Most people agreed that these cases represented a creepy use of technology since the users were unaware that they were being watched. However, some people must consent to video surveillance as a condition of employment. Jobs including bank teller, bartender, day care worker, and even zookeeper come with the expectation that you will be watched to make sure that you are not stealing from the company or doing something even worse. Ordinary office workers have generally been immune to this expectation, though that is changing. For instance, it is now possible to spy electronically on government functionaries in the Office of the Chief Minister in Kerala, India. Anyone with Internet access can see who is snoozing on the job, or has gone off for chai, or, heaven forbid, is accepting a bribe.59
Do people actually look at workplace cameras? If we believe the visitor counter at Dental Office K in Aomori Prefecture, Japan, “the first WEBCAM of [a] dental office in the world,” over half a million visitors have taken a peek since that office began streamin
g live images in 1996.60
We may all be peering into a video portal at work if the folks at Vancouver-based Perch Communications are successful in marketing their “always on video portal.” In an interview with CBC Radio’s Nora Young, CEO Danny Robinson likens it to having a window into a co-worker’s office, except that “the people might be 3500 miles away.”61 While the video is continuous, the audio is off until you walk up and look into the device. It then activates the microphone until it sees you walk away. Even Robinson says that having this thing sitting on your desk is “just a little bit on the freaky side for most people,” and he suggests putting it in a hallway.
Confirmation that walls that watch us may be soon be commonplace comes from a fascinating if rather creepy experiment from Washington, D.C.-based iStrategyLab. Their S.E.L.F.I.E. (“Self Enhancing Live Feed Image Engine”) is a two-way mirror with a camera and computer mounted behind it. As they explain on their website, the device is “triggered by simply standing in front of the mirror and holding a smile.” When it sees you are at your smiley best, the device initiaties a countdown, then uses LEDs to simulate a ‘flash’ as your photo is taken. The resulting image is posted directly to your social media feed.62
Human-computer interaction experts agree that “always on” video links will take some getting used to, and people may find them disturbing, especially if they are installed by the boss. They are, in an uncanny valley sense, human (because human eyes and ears are processing the images and sound remotely) and simultaneously non-human since they are devices hanging on the wall.
Many police forces are equipping their members with body-worn cameras to document arrests and other interactions with civilians. A year-long study in Rialto, CA found that the cameras resulted in “more than a 50% reduction in the total number of incidents of use-of-force compared to control-conditions.”63 The authors suggest that the behavior of citizens may also have been modified: “Members of the public with whom the officers communicated were also aware of being videotaped and therefore were likely to be cognizant that they ought to act cooperatively.” One of the study’s authors was Rialto’s police chief, William Farrar. He reports there was some reluctance by his officers to wear the cameras, which they referred to as “Big Brother.” However, as Chief Farrar told the New York Times, he reminded them that civilians can use their own smartphone camera, “so instead of relying on somebody else’s partial picture of what occurred, why not have your own?”64
While the presence of cameras can make people more civilized, it can also have the opposite effect. Stories abound of bystanders pointing their smartphones at accident scenes and rapes in progress instead of calling for assistance. The Vancouver police blame cameras for fueling some of the violent rampages in that city, commenting that “the 2011 riot can be distinguished as perhaps the first North American social media sports riot.”65 The police report goes on to say that “the acting out for the cameras seen in the 1994 riot was multiplied many times more in the 2011 riot by the thousands of people cheering the rioters on and recording the riot with handheld cameras and phones.”
Cameras have come a long way since Matthew Brady captured the horrors of the Civil War on glass plates in the 1860s. They have morphed from a heavy object that sat on a substantial tripod and needed multi-minute exposures into chip-sized sensors that fit in our smartphones, laptops, even a pair of glasses. The next step is quite likely to be a camera in a contact lens. Korean researchers have created a proof of concept of this and tested in on rabbits.66 Mounting them on everything from traffic lights to dashboards to police officers changes cameras from something that we pull out, deliberately aim, and focus into an organic, omnipresent part of our environment.
Just as GPS chips became smaller and cheaper and are now installed in your smartphones and camera and perhaps soon in your newborn baby, camera chips will continue to proliferate. The 3D printing revolution will allow people to make a hollowed-out button and stick a tiny camera inside to sneakily capture your photo.
Then again, they might just wink at you while wearing Google Glass.
Image Creep
I saw Google Glass before it was even a twinkle in Eric Schmidt’s eye.
As a technology writer and reviewer, I was sent demo versions of all sorts of products, including some that never made it to market. In the mid-1980s, a package arrived with one of the first heads-up television displays aimed at the consumer market. It was set of glasses with a tiny monitor and a prism that allowed you to watch TV while still participating in normal life.
The device, now consigned to the tech dustbin, did give me one moment of profound technocreepiness. I was testing it one night in my university office, using it to watch 60 Minutes. The cleaning lady came in to empty the trash. I will never forget what happened next. I saw a chimera—an elderly lady’s body with Mike Wallace’s head grafted on top. I screamed. She screamed. It seemed like a dumb way to watch TV, so I sent the thing back and wrote a lukewarm review: it was also extremely uncomfortable to wear.
The introduction of Google Glass has brought this type of technology literally to the public’s eye. All of a sudden, people are walking around with a device that enhances their ability to grab information out of the ether. Google Glass wearers can potentially recognize your face as they shake your hand, and then casually glance upwards to retrieve your kids’ names and birthdays.
But what really alarms many is that Google Glass can also secretly take a picture, or record a video, and immediately upload it to the Internet, just by the wink of an eye or the raising of an eyebrow. Google Glass does have a light to indicate when it is taking a photo or recording video. People promptly found ways to subvert it.
Chris Barrett, one of earliest users of Google Glass, said he was having trouble using the device in bright sunlight. So, he designed a clip-on sunshade, a piece of plastic that can be run off on a 3D printer. He has even made the code for it freely available online.67 In addition to blocking the sun, Barrett’s creation happens to cover that pesky light that tells others you are recording them.
Barrett loves wearing his high tech eyewear in places it is not supposed to go. He has reportedly filmed inside an Atlantic City casino and, in a stroke of luck, apparently became the first person to record an arrest with Google Glass. This little documentary was quickly posted to YouTube.68
Dozens of innocent bystanders, some of them children, appear in that video, and many are facing the camera. Coupled with massive facial image databanks, and advances in facial recognition software, they could probably be identified. A bizarre new social rule is emerging: if you are really trying to protect your privacy, you should stay away from arrests, car accidents, riots, and landmarks—anything that people are likely to photograph. Perhaps you should not go out at all.
The camera function of Google Glass and similar devices is really a giant social experiment to redefine where photography is acceptable and what behaviors will get you called a creepy “glasshole,” a cheeky term that even Google has started using.69 Even in a public place, where photos are generally fair game, people have reported being very disturbed by strangers taking their photos; especially pictures of their children.
Gym locker rooms have long been off limits for cameras. Cell phones are often now banned there, too. While I was embedded with the Canadian Forces in Afghanistan, my cell phone was confiscated for fear that I would take a photograph, perhaps even a geo-tagged one, of something I should not. Casinos have always banned cameras, except for the fleet that they operate themselves. Their latest challenge is gamblers with tiny cameras hidden in their sleeves to watch the cards as they are dealt.70 Google Glass is already forbidden at some sports arenas, movie theaters, and concert venues. Hospitals are implementing bans, as will many other workplaces. Even hotel lobbies may become off limits.
While working as a TV journalist, I was asked to leave a posh hotel while trying to shoot a “stand up” in the lobby. The manager explained that “we need to protect the p
rivacy of our guests—you just might catch somebody here with his mistress or something like that.” Legally, they have the right to do that in most jurisdictions.
Internet Rule 34 (“If it exists, there’s porn of it”) strikes here with vengeance. Soon after Google Glass became available, the “first Google Glass porn” appeared online at the adult app store mikandi.com. Their inaugural offering features a cameo appearance by Ron Jeremy, holder of the Guinness Book of World Records title for “Most Appearances in Adult Films.” Now a senior citizen, he keeps all his clothes on in this short piece of point-of-view pornography. A censored version is available on YouTube.71
There seem to be no limits to human stupidity when it comes to posting inappropriate images online. People have distributed photos of themselves in an unbuttoned airline stewardess uniform (Ellen Simonetti, the “Queen of the Sky” blogger who flew for Delta airlines) and taking a bath in the sink at Burger King (Timothy Tackett).72 Both were fired from their jobs, though they went on to other careers, propelled no doubt by the notoriety from their online misadventures.
Simonetti and Tackett are consenting adults, but things are quite different when children are involved. Often they seem either unaware of or unconcerned about the risks of releasing questionable comments and images into the Wild West of cyberspace. In a CNN report called “The Secret Life of My Sixth Grader,” a mother creeps herself out by spying on the texts and Instagram photos of her eleven-year-old son, who, she notes, “has never let on that he is remotely interested in girls.”73 The content of his messages and photographs soon convinces her otherwise. “Maybe it’s the digital photo-filters,” she muses, “but the girls seem sexy beyond their years.”
Technocreep Page 4