Moscow's biometric surveillance system was breached, and insiders sold a $200 service that let anyone submit a photo to find which cameras captured that person. The speaker argues that massive surveillance data collected by smart cities is nearly impossible to secure once aggregated, leaving citizens vulnerable to cybercriminals and authoritarian governments.
Chapters
Privacy is at risk when cybersecurity fails, especially when it comes to surveillance data. Now, a recent incident in Moscow highlighted some of the challenges here. Now, Moscow has over 100,000 public-facing cameras that are enabled with biometrics, so facial recognition. Now, these are installed and managed by law enforcement there to be able to detect crimes that are happening and basically protect the citizenry of the city. However, a recent incident showed that somebody had gotten access to that database, to those systems, and they were offering a service. They were— for about $200, they would allow people to basically cyberstalk. If you sent them a picture of someone you were interested in and your money, they would generate a report and provide you a number of pictures of where the city cameras spotted that person. Now, there's a lawsuit pending because of some stalking issues there, and my guess is it's probably some insiders who have access to that system that are trying to make some side money, so they decided to do this. It's criminal. It's not what it's intended for. But the whole incident itself highlights some pretty fundamental challenges when it comes to privacy. You see, when data such as this— surveillance data in these growing smart cities— when it becomes so comprehensive, it enables cyberstalking, but it also enables other things as well. Can you imagine cybercriminals that want to know who's driving around in a specific type of expensive car and where they live? Identify people who often frequent and shop at high-end jewelry stores, and again, figure out where they live or where they work. These kinds of things can help cybercriminals target citizens, and that's just not a good thing. So privacy advocates have been concerned because it goes back to a tenet that if you have all this surveillance data, And whether it's video surveillance or biometrics, whether it's web browsing or shopping history, whatever it is, you have this vast amount of data. It can be compromised, it can be misused, and that becomes a major problem for all of us because the data is there. It can be analyzed, it can be aggregated, and it can be used with malicious intent to the detriment of citizens. So not only do privacy advocates have to worry about a surveillance state where governments are misusing surveillance information to persecute citizens and violate their rights, they also have to worry about cybercriminals gaining access to the vast amounts of data. And the reality is, with again that ocean of surveillance data, trying to protect it at that scale is almost insurmountable. Now, there are tools and processes and anonymity capabilities and all sorts of security controls that are possible, but up until now, most of the focus and the funding has really been geared towards figuring out how do we obtain this surveillance data and detect undesired activities. Very little focus is on actually protecting the privacy and the security of the data itself. And that opens up, unfortunately, huge opportunities for cyber criminals to go in and misuse that data. Bottom line is cybersecurity has to be wrapped around and protecting all the surveillance data out there, no matter what kind it is. Otherwise, it represents a huge risk to all citizens.
