I Spy

"Did you ever want to remotely monitor computers without having to physically access or install software?" That's the pitch for iSpyNOW.

Figure 6.7: iSpyNOW Web site

iSpyNOW is a new breed of industrial-strength spyware that offers the ability to remotely install the software from any location in the world! "Simply send iSpyNOW as an e-mail attachment to the workstation or PP you wish to monitor remotely, and the program will install immediately! Once iSpyNOW has been installed, you have full control and monitoring power in real time of that remote PC! View chat conversations in real time, keystrokes, passwords, e-mail, remotely view the desktop and more! No one will know it is running; employees , children, not even your spouse!" That's a direct quote from iSpyNOW's old Web site. Mirko Zorz of Help Net Security (http://www.net-security.org) labels iSpyNOW a "serious breach of privacy" and considers the program a Trojan horse. For steps to prevent this kind of infection on you PC refer to Part II, "Zone Defense."

iSpyNOW surveillance features include

• Internet Conversation Logging. Log both sides of all chat conversations for AOL/ICQ/MSN/AIM Instant Messengers and view them in real time, as they are happening!

• Window Activity Logging. Capture information on every window with which you interact.

• Application Activity Logging. Track every application/executable with which you interact and execute.

• Clipboard Activity Logging. Capture every text and image item sent to the Clipboard on the remote computer.

• Keystroke Monitoring. Track all keystrokes (including hidden system keys) and the windows in which they were pressed. You can also pass keystrokes through a formatter for easy viewing and exporting.

• Web Site Activity Logging. Log all Web sites that you access on the remote computer.

• System Control. Instantly reboot or shut down the remote computer, or log off the current user .

This is one hell of a scary application! How much do you think a program like iSpyNOW costs? A thousand bucks, or at least a couple hundred? That's what I would have guessed. iSpyNOW costs

• $79 per license for 1 “9 licenses

• $73.45 per license for 10 “19 licenses

• $65.40 per license for 20 “27 licenses

• $60.99 per license for 28 “35 licenses

• $55.99 per license for more than 36 licenses

Its cheap price and ready availability make iSpyNOW easily available to anyone. It could be running on your computer right now whether you're a remote user or on a corporate network. Anyone who invests $79 can install it on your computer so be forewarned. That's the kind of world we live in! Both Mirko Zorz and George Kurtz (Foundstone) have pointed out to me that UNIX and Mac are less susceptible to spyware than Windows. While this is true to a point - there is far less spyware and adware for the UNIX platform ”my research has uncovered spyware for both. Net Spy Software's Spector (http://www.netspysoftware.com/spectormac.html) is similar to iSpyNOW but runs on a Mac and UNIX keyloggers can be found at http://keystroke-loggers.staticusers.net/unix.shtml. The evils of technology can not be avoided! The best defense, indeed our only defense, is cognizance.

Workplace Surveillance

Is your employer using software like iSpyNOW to monitor you? According to a survey conducted by the Privacy Foundation, Nielsen/Net Ratings, the U.S. Bureau of Labor Statistics, and the International Labour Organization, 14 million employees ”just over one-third of the online workforce in the United States ”have their Internet or e-mail use under continuous surveillance at work. Worldwide, the number of employees under such surveillance is 27 million, just over one-quarter of the global online workforce. The online workforce is defined as "those employees who have Internet and/or e-mail access at work and use it regularly." A word to the wise: If you use your company's computer equipment and network, even off the premises, the odds are one-in-three that your employer is spying on you!

Minority Report

One look at Stanley Kubrick's masterpiece, 2001 , reveals how fallible we humans can be at predicting the future. There are no resorts on Jupiter or talking computers like HAL. Bill Gates still has a hard time keeping Windows from crashing (ditto for Steve Jobs and the Mac), and unfortunately there is no intergalactic travel. However, I recently saw Steven Spielberg's Minority Report , and its depiction of the future is dead on! Spielberg assembled a team of "futurists" beforehand to get the technology right. Among them were city planner Joel Garreau, anthropologist Steve Barnett, Neil Ger-shenfeld of the Media Lab, and Jaron Lanier, a composer and computer scientist best known for his work in virtual reality. The movie, based on a short story by Philip K. Dick, presented a parade of technology on the cusp of reality ”biometric identification, presence awareness technology, an array of digital surveillance methodologies, and targeted personal advertising. But this technology has nothing to do with the future. It already exists!

Presence Awareness Technology

Presence awareness technology is a new killer app based on the theory that appliances on a network can automatically detect other appliances on that network. For example, placing a phone call has always been a shot in the dark because you don't know whether the person you're calling is there. Right? Now imagine knowing, without dialing that person's number, whether his phone is in use ”or, if it's a cell phone, whether it's even on. That's the principle behind an emerging technology called presence awareness. In the near future, you'll be able to determine the whereabouts of any owner of a wired or wireless device, and vice versa! Other people will be able to determine where you are and figure out what you're doing.

According to Sonu Aggarwal, the CEO of Cordant, a company in Bellevue, Washington that develops instant-messaging technology

The days of phone tag are over! This is a very powerful concept with long- term implications. In the future, presence awareness technology will be so integrated that a traveler could wear a wireless badge that interacts with a computer on the back of an airplane seat. When the computer senses the traveler is seated, it could automatically redirect messages to the computer's screen or send word to the traveler's contacts that he was onboard.

In the foreseeable future, presence awareness technology will be as ubiquitous as communication devices themselves ! This year Motorola will roll out a new system that allows a caller to determine whether another person's mobile phone is on and in use. Nokia and Ericsson, among other telecommunications giants, are developing similar technology for wireless as well as landlines. Presence awareness technology is also being deployed on laptop computers and wireless PDAs, and in vehicle communications systems. The sky's the limit. New devices will be able to use GPS ( Global Positioning Systems ) to track the location of a person at any given moment!

Instant Messaging

Presence awareness technology has been around for a while in the guise of instant messaging programs. By tracking the activity of people on a buddy list, IM users can analyze login information to get a picture of people's routines ”when they arrive at work, when they leave, how long they've been on or away from their computers, and when they're online at home. Employers, coworkers, friends , family, and even curious strangers can now analyze information that was once private (or at least hard to obtain) with little or no effort. "When you use these technologies you really expose yourself and your day to a lot of people," asserts Bonnie A. Nardi, an anthropologist at Agilent Technologies, a Palo Alto company that develops high-tech monitoring devices. After spending years studying instant messaging, Dr. Nardi became acutely aware of the subtle impact presence awareness technology has on people's lives. Nardi cautions , "It's time to think about what we want people to know about what we're doing at any given moment!"

Figure 6.9A: MSN Instant Messenger

Figure 6.9B: Trillian Instant Messenger

On the flip side, many people find it reassuring that presence awareness technology can monitor the remote activities of their inner circle, family, and friends. Meanwhile, the software industry is hard at work dreaming up ways to capitalize on this emerging technology. Dynamicsoft, a developer in New Jersey, is exploring how presence awareness software combined with wireless hand-held computers and GPS tracking could notify a person when a friend is in the immediate radius. As noted, the only example of presence awareness technology in use today is instant messaging, but if IM's popularity is any indication, people may be ready to embrace the broader implications of presence detection without much debate.

More than 50 million Americans currently use instant messaging products. Many report that their favorite feature is the ability to see whether their buddies are online. But even IM's strongest enthusiasts acknowledge some trepidation about remotely broadcasting their whereabouts. Cordant's Aggarwal uses MSN Messenger, which displays a clock icon in the contact list to indicate when a person has not touched the keyboard or mouse for a short period of time. As soon as the person resumes use of his keyboard or mouse, the clock goes away. Often Mr. Aggarwal gets a phone call the minute he hits his keyboard, and the caller is invariably someone who had been waiting for that icon to disappear. "Without my being aware, people are watching me!" Aggarwal admits.

Software developers maintain they can create presence awareness systems to accommodate both those who seek privacy and those who want contact. Yahoo! and Microsoft both include privacy features in their instant messaging products. Users must grant permission before their names can be added to a person's contact list. But AOL Instant Messenger (both the stand-alone version and the one embedded in AOL's Internet service) does not allow that level of control. A user has no way of knowing whether someone has added his screen name to a buddy list! Whether people will use the built-in permission blocking features raises another question. Many teenagers who use instant messaging programs daily insist they won't block their friends because they don't want to insult them. It appears peer pressure and etiquette are powerful disincentives when it comes to protecting one's own privacy.

The Internet Engineering Task Force, a group that develops standards for Internet communication, has been defining new standards for presence awareness and instant messaging technology. Dr. Jonathan Rosenberg, a coauthor of the task force and chief scientist for Dynamicsoft, believes he has come up with a solution to the social dilemma of managing one's privacy without appearing rude. His idea is called "polite blocking," and it is based on the same principle as using a digital doppelganger. Users appear to be busy or off-line when in reality they're not, an alternative that keeps people guessing. For example, a contact may determine your cell phone is on, but the phone could be sitting on a table in your empty living room. Craig Peddie, a scientist working on presence awareness at Motorola, puts it this way: "Until we get to the bio-implant stage, we won't really be able to determine whether your cell phone is on you or not!"

Photo Surveillance

I bet you thought this chapter was going to be about nanny cams, lipstick cams, and photo enforcement? It is, but first I want to stress that surveillance often has nothing to do with a camera. With that proviso, the Unites States is a laggard in the deployment of CCTV systems (closed-circuit television). Americans have always prided themselves on the right to privacy as defined under the Fourth Amendment of the Constitution, which is the primary reason why the United States has been slower to adopt CCTV than allies like Great Britain and Canada. That's water under the bridge! CCTV is already up and running in major metropolitan centers such as Washington D.C. and New York City, and it is coming to your neighborhood soon! Advances in image stabilization technology made the implementation of CCTV inevitable ”even before the 9/11 attack made it a necessity, as many now argue.

Figure 6.10: Photo enforcement

Although the ACLU has no objection to cameras at specific, high-profile public places that are potential terrorist targets (such as the U.S. Capitol), the organization believes that the impulse to blanket our public spaces and streets with video surveillance is a bad idea. In Washington D.C., for example, the police are in the process of setting up a centralized surveillance center where officers can view video from schools , neighborhoods, Metro stations , and prominent buildings around the city. The use of sophisticated systems by police and other public security officials is particularly troubling in a democratic society, according to the ACLU. Here are the four primary reasons:

1. Video surveillance has not been proven effective.

2. CCTV is susceptible to abuse.

   • Criminal Abuse

   • Abuse for Personal Purposes

   • Discriminatory Targeting

   • Voyeurism

3. The lack of limits or controls on cameras use.

   • A consensus on limits for the capability of public CCTV systems

   • Legally enforceable rules for the operation of such systems

4. Video surveillance will have a chilling effect on public life.

Check out the ACLU archives at http://www.aclu.org/privacy/privacy.cfm? ID=12706&c=39 for more detail on each of these reasons.

Like any invasive technology, the benefits of deploying CCTV must be balanced against its costs and dangers. The bottom line for the ACLU is that the risks outweigh the benefits. They conclude CCTV has the potential to "change the core experience of going out in public because of the chilling effect surveillance will have on American citizens ." They also conclude that CCTV "carries real dangers of abuse and 'mission creep,'" and that it "would not significantly protect America against terrorism."

The arguments for or against the deployment of CCTV are academic. CCTV is here regardless of public opinion! My concern is that Americans will exhibit the same blas complacency toward CCTV displayed by our European counterparts. Here are the results from a recent newspaper poll held on Britain's Isle of Wight.

• Q: Should we be concerned by the increasing use of CCTV in public places?

• Results:

• Yes (27.0%)

• No (73.0%)

According to a recent study by Pew Research, 64 percent of American Web surfers have shared or are willing to share personal information to use a Web site. Sixty-eight percent report that they aren't worried that someone else knows what sites they visit. The greatest threat to our security and privacy is not from hackers, crackers, or Big Brother; it's from our own ignorance!

Image Stabilization Technology

When I started shooting commercials back in the seventies, image stabilization amounted to a crazy cameraman grasping a hand-held camera and hanging out of a helicopter by a bungee cord. Nowadays, police, military, and news choppers are outfitted with distinctive ball-shaped pods that house remote-control video cameras enhanced with image stabilization. Without image stabilization, there would have been no Rodney King, no L.A. riots, and no slow-speed freeway pursuit of O. J. Simpson. Image stabilization technology is the genie that let photo-reconnaissance out of the bottle . Therefore, it's only fitting that these events transpired near Hollywood, because Hollywood and the military-industrial complex codeveloped aerial surveillance.

Figure 6.11: Wescam aerial pod

The granddaddy of aerial surveillance is the Wescam ”short for Westing-house Camera ”developed in the early 1960s by a Canadian subsidiary of Westinghouse as a battlefield surveillance tool for the Canadian military. Eliminating the vibration from the helicopter was the first step. The original Wescam ball was attached to a helicopter by shock absorbers that used springs and other motion damping devices. Simply eliminating vibrations didn't restrict three other types of camera movement ”pitch (plunging up and down), yaw (rotating on a vertical axis), and roll (side-to-side rotation that creates a moving horizon). To deal with pitch, yaw, and roll, the inventors of the original Wescam used large gyroscopes to create inertia. Three gyros inside the camera ball are oriented to offset each of the three unwanted motions . Motors attached to the camera allow an operator inside the helicopter to view images on a video monitor and aim the camera as needed. The Wescam gyro stabilization system proved so steady that it has not significantly changed in more than three decades!

The Wescam system did have one significant drawback. Upkeep! It was prohibitively expensive to own because gyroscopes require routine maintenance. After a management-led buyout in 1987, the engineers who purchased Wescam devoted themselves to introducing image stabilization that was more robust, hence more affordable. Instead of providing stability, the three gyros in the second-generation Wescam wobble slightly when the rig changes directions. Sensors measure the wobbling and feed that data to microprocessors that use high-speed electric motors to move the camera and offset the unwanted motion. New systems built around electronic motion-sensing technologies are so stable that only the horizon and haze limit how far an observer can see. And the new technology is far more affordable; that's why police and news choppers have become so ubiquitous.

If the Orange County Sheriff's Department needs a car followed discreetly, Sergeant Frank Sheer can keep tabs on it from 3,000 feet in the air and a considerable distance behind the vehicle. The average motorist would never be aware that a helicopter is even around, let alone watching him. Flying in his chopper, Sergeant Sheer can be literally miles away from the action, but that does not mean he doesn't know what's going on. Sheer often has a clearer picture of a crime scene than his fellow officers on the ground. Nobody disputes the importance of technology that enables the police to capture criminals and rescue people, but some privacy advocates express concern that the recent proliferation of airborne cameras and their growing capabilities means that anyone who steps outside his front door could be the unwitting target of aerial surveillance.

"At 1,500 feet we can't read license plates yet," says Sergeant Sheer, "but we can tell if it's a man or a woman on the ground." Like many systems used by the police and the military, one of Orange County's two Wescam systems has a night-vision camera that creates images by capturing the infrared radiation emitted by warm objects, including people and marijuana grow houses ! However, a ruling by the United States Supreme Court last June forced the Orange County Sheriff's Department and other police organizations to change the way they use thermal imaging photography. The Court ruled that the police "could not train thermal imaging cameras on private homes without a search warrant ."

The legal skirmishes over surveillance and privacy have just begun! In the meantime, the technology continues to evolve . Four years ago Wescam introduced a third-generation image stabilization system that combines even greater stability with the reliability of cameras like those used by the Orange County Sheriff. It replaces spinning mechanical gyroscopes with fiber- optic gyros, which use bursts of laser light to calculate movements in each direction by the camera system. Not only is the new system much faster, it also provides a steady image within the magnification range of any manmade lens. The atmosphere and the impossibility of seeing beyond the horizon are the only factors that limit how far one can see. Wescam calls their new system a "ground-based Hubble telescope ."

We're all subject to surveillance! Cameras are watching us, and presence awareness technology, including spyware, is tracking our every movement.

If I made this statement 20 years ago, they would've locked me up in an asylum and thrown away the key. Today it's not even subject to debate. That's the problem: It should be! That's why I wrote this book.