• PC World
• »Security

Some of the surveillance methods being looked at to fight terrorism probably won't make the world a safer place, but they could chip away at individual privacy rights, say a panel of experts.

Following the September 11 attacks on the United States, legislators and civil liberties groups have been at odds over how much additional power law enforcement should be granted to monitor communications, track the movement of individuals, and generally ward off further attacks.

Bills to expand police powers already have been wending their way through Capitol Hill, including measures that would broaden rights to tap e-mail and phone lines, and detain non-U.S. citizens for longer periods.

A panel at the Churchill Club in Silicon Valley this week didn't discuss the bills specifically but urged caution towards three technologies that have attracted attention since the attacks: facial recognition systems, backdoor software that provides access to encrypted files, and national identity cards for the United States tied to a central, government database.

On the panel were Lee Tien, senior First Amendment attorney with the Electronic Frontier Foundation, Doron Rotman, a partner with KPMG Consulting's Information Risk and Advisory Services group, and James Watkins, chief information officer at the California State Office of Emergency Services. In general, they said, lawmakers must find the delicate balance between wanting to beef up surveillance and needing to protect individual liberty.

Recognition Software Flawed

Using video cameras in public places with facial recognition software to identify bad guys carries a wealth of problems, the panel agreed. Big questions include who gets to decide which faces go into the database, and who will keep tabs on law enforcement groups to ensure they don't abuse their spying privileges.

"The guys who sit behind the screens watch girls, they watch people with dark skin, they protect shopping malls against undesirables and give a security blanket [to the public], but there's no evidence that mass video surveillance per se is useful," said the EFF's Tien. He added that video facial recognition has a low success rate and can produce matches with the wrong faces.

Watkins agreed that wide-scale deployment is probably a bad idea for public privacy and other reasons, but said a more limited use of facial recognition software at airports may be tenable. "It's a better idea than trying to look at everybody all of the time, because then you end up with the question of who's guarding the guardians."

Software Back Door

Software equipped with a "back door" that would allow investigators to view encrypted documents stirred more debate. Since police can obtain a warrant to access physical locations believed to contain information about crimes, there's no reason they shouldn't also have access to suspect documents, Watkins said.

"If we have perfectly encrypted documents with no back doors, then there's no way for law enforcement folks to get to a possible crime scene," he argued.

KPMG's Rotman disagreed. Even if some countries require strong encryption programs to include a back door, criminals will be able to find software that doesn't contain such access elsewhere in the world. "It won't matter from the bad guy's perspective, so why tamper with the basic right to send private information from one person to another?" he asked.

National ID Cards?

National identity cards, already used in some countries and now being proposed with new vigor in the United States after last month's attacks, also stirred disagreement.

Rotman was the lone proponent of a centrally managed, nationwide system because, he said, it would make it easier for law enforcement to share information and track the movements of individuals across the United States. The current system, managed at the state level, makes it easier for individuals to forge ID cards or slip through the cracks, he said.

Tien and Watkins shot the idea down. National ID cards would erode the sense of personal liberty enjoyed in the United States, Tien argued. Seeing a slippery slope, he said the government could require people to carry their cards at all times, or require them to present them in order to access public places such as libraries. They may also expand the types of information stored on the cards.

Creating a vast database of personal information is troublesome, both logistically and for security reasons, he said. Criminals could hack the database and forge identities, or businesses could abuse it for marketing purposes. The government probably isn't even capable of managing hundreds of millions of ID cards competently, he argued.

Watkins wondered if ID cards would have had any impact on the September 11 attacks, in which Islamic extremists hijacked domestic passenger jets in the United States and crashed them into New York City's World Trade Center and the U.S. Department of Defense Pentagon building, near Washington, D.C., killing thousands.

On a domestic flight soon after the attacks, he said, he was asked time and again by airport security staff to show his picture ID card in order to check that it matched the name on his electronic flight ticket. He seemed amazed that anyone would think such a system could lead to better security. "I'm willing to bet every one of those terrorists had an ID card that matched the name on an e-ticket!" he thundered.

Life or Liberty?

During a questions period after the debate, an audience member, apparently impatient with the emphasis on civil liberties, urged the panelists to consider their priorities.

"If you have to sacrifice something, then the highest value has to be placed on human life," said Philip Burton, a security marketing and product management specialist formerly with Sun Microsystems. "This is not a hypothetical any more; there are 6,000 people dead."

"I agree this is not a hypothetical discussion any more," Watkins replied. "But I haven't seen any evidence that national ID cards are going to solve the security problem."

"All we're trying to say is, let's look at it in a rational, deliberate way," Tien said. "We know we are in shock, and when we are in shock or discombobulated we don't always make the best decisions. Maybe we should try to slow things down."

• See more like this:
• face,
• recognition,
• software,
• backdoor,
• attacks,
• security,
• privacy