OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Social impacts of transport surveillance

Marcus WiganOxford Systematics

Professor of Transport Systems: Napier University EdinburghProfessorial Fellow: University of Melbourne Australia

Visiting Professor: Imperial College London

Roger ClarkeXamax Consultancy

Visiting Professor: Department of Computer Science: ANUVisiting Professor: E-Science: University of Hong Kong

Visiting Professor: Cyberspace Law and Policy: UNSW.

Social Impacts RNSA 29 May 2006Social Impacts RNSA 29 May 2006

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Presentation Objectives

Transport is extremely pervasive, and so the security and dataveillance aspects are tightly linkedThis makes transport one of the more useful contextsIn which to examine the cumulative social impacts

Our approach is to:

• Explore the context of surveillance

• Specify a number of transport and traffic cases

• Place these in an appropriate security-trust context

• Summarise the social issues raised by this exploration

Transport is extremely pervasive, and so the security and dataveillance aspects are tightly linkedThis makes transport one of the more useful contextsIn which to examine the cumulative social impacts

Our approach is to:

• Explore the context of surveillance

• Specify a number of transport and traffic cases

• Place these in an appropriate security-trust context

• Summarise the social issues raised by this exploration

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Why transport?

• A prime surveillance target

• Already well equipped with surveillance technologies

• Already deployed for secret driver surveillance

- example: GO EMS recordings

• Well linked to enforcement agencies

- Police

- licenses and vehicle registrations

• Associated with unique IDs

- eTags for tolling

- ePassports

• Pervasive presence throughout the country

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Why is transport surveillance an issue?• Modifies behaviour in key locations and domains

• Asymmetries in information power already established

• Is actually a far higher risk environment than terrorism..

- ~ 1600 road deaths alone per year in Australia

- ~ 200 by drowning

- ~ 200 by assault

- ~ 2 bee and wasp stings

- ~ 0 to date terrorism

• Is this a failure in appropriate investment directions?

• Or a great (but unprovable) success in prevention?… …

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Categories of security measures

• Deterrence (threats of penalties)

• Prevention (control of access to -say- explosives)

• Premptive interception in anticipation of an event

• Interception or exclusion (access control/buffer zones)

• Detection of events that are of have occurred

• Investigation post event

• Retribution (Prosecution)

• Public confidence building (to communicate that ‘steps are being taken’)

All have both quantified and unquantified costs and benefits

• Rarely are social costs, privacy, or opportunity costs considered

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Surveillance as a security measure

• Personal surveillance - of an identified person• Mass surveillance - of groups (or claims of this such as face recognition, to affect behaviour)

• Object surveillance - static for movement detection- dynamic for individual person/vehicle

tracking

• Area surveillance - CCTV, pedestrian detection etc

• Electronic communications interception or use

And the internet of Things adds a rising stream of identified data flows to physical surveillance…

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Location and tracking usage

• To build up patterns of locations and routes used

• To identify connections between people and groups

Historically this could only be used retrospectively

• Real time identification and location exploits both

history and projections of current movements

• Both allow confirmation of both presence and absence of people at a given time and place

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Surveillance as a security measure

• Essentially an intelligence process to:

- Anticipate an event (probability assessment)

- Detect an event (as a basis for immediate action)

- Indentify a person (afterwards)

• These generally require to be tied to one option

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Deterrence

• Covert surveillance does not affect behaviours

• An expectation that covert surveillance is in effect does

- and has a general ‘chilling’ or threat effect

• Overt surveillance is assumed to have a preventative effect… but can only do so if:

- the person believes that it is working- that the person considers it to be a real

threat Suicide bombers are therefore unaffected

• Overt surveillance is known to displace activity, rather than to prevent it

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

A traffic example

• Overt speed and red light cameras do affect speed - but only around their specific locations

• Covert speed measurement increaces the perception of a speed gun around every corner: the modern Panopticon - and affect speeds across the whole state

• Thus the insistence by police that random mobile speed detection is essential for speed enforcement (management by perceived omnipresence)

• The balance is a fine one, as shown by the still widespread belief that speed cameras are used solely for revenue raising

• As these are now mostly automated events this is hard to counter, and so we must rely on community Trust

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Traffic - Prevention and interception

• Surveillance cannot prevent events unaided

• Ancilliary systems are needed to act swiftly enough

- ANPR systems +

- Automated access to vehicle registration and licensing databases+

- Telecommuncations with police on patrol

This combination is a typical surveillance+interception

response system - and is in use in the UK now..

• One requirement is severe penalties for failing to update ones address on ones licence… this has been enacted

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Detection

• Automated surveillance is not enough

• Links are needed between events and decisions

- for example speed camera pictures are often viewed by specialists as a check

• UK is covered with private ISIS speed detector poles, which are (correctly) claimed to be solely for speed averaging

• Trust is relied on that this is the case when the potential capacity is ‘evident’

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Investigation

• Surveillance can provide firm evidence that a specified event has occurred

• This still needs to be linkable to a human investigator

- CCTV records need to be kept for this

- reliance on automated systems abrades trust

Retribution

• Depends on data quality.. Much videotaped surveillance is inadequate for primary evidence in criminal trials

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Specifically transport surveillance

• Transport is rich in data recording systems

- real time

- retrospective

- readily linked to other data resources

• Freight movement uses automated driver logs, GPS and satellite tracking, and vehicle location monitoring

• Supply chains use barcodes and now RFID chips

• As freight often is very valuable ( eg. container of cigarettes), automatic location and monitoring is long established

• The range of existing potential surveillance systems is very wide, and attractive to intelligence bodies

• Transport itself is a key vulnerable society critical system, rich in interchange points, dangerous goods etc

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Public transport surveillance systems- Transport smart cards that deny an anonymous option

- Electronic tolling schemes that deny an anonymous option

- Electronic passports;

- Service-denial blacklists such as 'no fly' lists

To date not yet used in Australia, although there have been some instances of judicially-imposed denial of access to places such as sporting venues);

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Personal transport surveillance systems• Spatial logging of vehicles, locations and stops

• Chip enhanced licences with provision for extra data

• ANPR systems

• Medical alert systems linked to vehicles

• Driver monitoring via engine management chip records

• Time use surveys of individuals using GPS and GSM

- the latter is a research method easily reconfigured

• Black boxes that reocrd all events for a limited period as a crash investigation (and possible prosecution) tool

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

As consumers…

• RFID usage in supply chains extended to purchaser monitoring via products

- already in use, not always disclosed (see AutoID)

As workers involved in freight movement

• Positive vetting

• Location and activity monitoring and recording

• Injectable RFID chips for security controlled access

Like so many potential and actual surveillance systems, individually, and not connected to databases, all have there useful place… it is the cumulative effect!

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Speed management as an issue

• Covert cameras have greater and wider effects, but when used in visibly ‘safe’ areas can test public trust

• A common surveillance tension: total non disclosure is far less effective than partial disclosure

• Such balances between public trust and effectiveness must always be struck and explained

-one price can be a greater distance between police and community

• Positively: speed detection IS the offence, so the probabalistic anticipatory profiling and the legal and social problems of ’no fly’ lists etc. do not arise

• Inadequate use of automation leaves weeks before the reinforcement schedule occurs (penalties), reducing effectiveness in behaviour modification, the claimed goal.

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

ANPR

• Used for electronic road pricing

- but a 10% failure rate in accurate detection

• Used for picking out people of interest from a traffic stream in time to intercept them

- these may not be just for vehicle issues

• Can be used to profile movements of people of interest

-a good example of function creep due to cost lowering and expansion of capacity by automated surveillance

• eTags without anonymity can be used the same way via the legal liability of [owner == vehicle] and Licence address on database linkages

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Chip-Based passports

• Opportunistic action by government agencies after 2001 under the guise of US visa access pressures

• Australian initiatives far from transparent, but were to contain an unencrypted RFID chip

• Consultation crippled by lack of information and carefully limited terms of reference [use for border crossings under ICAO etc]

• Other locations or vulnerabilities were excluded…

• Enough information came out, with enough public pressure that it was eventually recognised - even in the US - that this would create huge identity theft opportunities and vulnerabilities

• The final passports appear to comply with a hastily cobbled together encryption standard (ICAO 2004)….

• It is still not known what information will be encrypted on the chip, or if the carrier will ever be able to fin d out….

Massive unaccountable information asymmetries can still occur..

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Social impacts, not just of transport

• Privacy audits have not been done or not released

• Implicit forcing of individuals to a single ‘identity’

- a major and subtle loss to the community

• A clear agenda to deny individuals anonymity- - or even strong pseudonymity

• Surveillance schemes are developed :- - without any guiding philosophy balancing human rights v

security- - very limited constraints or oversights or audits- - wide latitude in data matching and linkage- - clear lack of understanding of the huge room for error in

linking non homogeneous data sources- the limited (budgetry) role of Privacy commissioners has

seen meaningful audits almost eliminated- Without published PIAs and risk assessments

The probabalistic anticipatory aspects of many security applications fits uneasily with the law.. Which has yet to catch up..

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Conclusions

• Transport systems are pervasive in the social space

• Prime targets for security measures due to automation, retrospective and prospective actions

• A well established record of poor attention to privacy

• New developments will extend the reach considerably

• Many measures constrain ordinary citizens with but limited likelihood of affecting terrorist strategies

• Rights to anonymous movement are now at risk

• Trust is strained as this is realised, and schemes and constraints proliferate

• Transport and terminals are indeed key target areas for terrorism - but trust of the community is needed to do this - to date this has ben already strained..

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Result

• Rising asymmetries of information

• Lack of accountability for process,content and use

• Lack of access to audit the processes

• Rising scale of the coverage, archiving and linkage

• Limited understanding of social impacts

Are already all too evident in transport………

Linkages to other emergent and planned national databases will severely shrink the social space, at a cost unlikely to be matched by the reductions in terrorist risk

PIAs and published process audits are possible in transport but still largely unused

OxfordSystematicsAustralia

RNSA

University of Woollongong

29 May 2006

Antidotes to negative social impact