CyLab Researchers Alessadro Acquisti and Marios Savviddes featured on CBS Sixty Minutes

[NOTE: This CyBlog story is cross-posted as a CyLab Chronicles on the CyLab home page.]

In the wake of the Boston Marathon bombing investigation, there has been some mainstream news media attention paid to facial recognition software. After years of NCIS and other popular law enforcement TV dramas, there is an expectation that such technology could have led to a speedier conclusion to the manhunt, or perhaps even have prevented the savage attack.

In recent weeks, looking for meaningful answers, major news organizations turned to researchers at Carnegie Mellon University CyLab. Why? Because they are at the forefront of research into related technologies; and that's the forefront of not only research on how to deliver these technologies, but also the forefront on their broader implications on society as a whole.

On the May 19th edition of CBS Sixty Minutes, the work of two Carnegie Mellon University CyLab researchers were featured: Alessandro Acquisti, Associate Professor of Information Technology and Public Policy (Heinz College), author of some blockbuster privacy studies, related to the convergence of facial recognition software and social media and other vital issues, and Marios Savvides, Carnegie Mellon University Associate Professor (Electrical and Computer Engineering Department) and Director of the CyLab Biometrics Center.

Here is the CBS Sixty Minutes video, followed by some transcript excerpts:


This may look like a high school science project, but this is Carnegie Mellon's CyLab, a world-class research center.

[Lesley Stahl: Look at that!]

Marios Savvides and his students outfitted this ordinary toy drone with their new advanced facial recognition software... that locks in on a face from a distance, and then identifies it. [Drone: Hello Lesley, nice to see you.

Lesley Stahl: It got it.]

The students are taking surveillance technology to the next level. They can now turn a blurry face into a clear one; a flat image into a 3D model.

[Lesley Stahl: Oh my goodness.]

Their technology can take a masked face and by focusing only on the eyebrows search a catalog of faces, come up with several people with very similar eyebrows and eventually find the identity of the person.

Marios Savvides: So Utzav is going to take a normal photo of you. The software maps a face using dots like electronic measles and creates something as unique as a fingerprint: a faceprint.

Lesley Stahl: This is your facial recognition technology working right now to find me? Utzav: Yes.

For this demonstration, they had added my picture ahead of time to the university's database. Marios Savvides: That's the top match.

[Samsung Lady: To use face recognition, use the color-coded button on your remote.]

Facial recognition is already in some of our home appliances like TVs. In our mobile devices, PINs and passwords are giving way to faceprints. And the technology can single us out in real-time as we go about our daily business, often without us ever knowing ...

Alessandro Acquisti: The ability of remaining anonymous is shrinking. And the places where we can be anonymous are getting fewer and fewer.

Alessandro Acquisti is a professor at Carnegie Mellon who does research on how technology impacts privacy. He says that smart phones may make "facial searches" as common as Google searches and he did an experiment to show how easy it could be. He took photos of random students on his campus. He then ran the pictures through a facial recognition program he downloaded for free that sifted through Facebook profiles and other websites. And he was able not only to identify many of them instantly, he also got their personal data, including in some cases, their social security numbers.

Lesley Stahl: In order for this to work, does the person you're trying to identify have to be on one of these social networks?

Alessandro Acquisti: You must have, somewhere on the Internet, a face with your name on it. Lesley Stahl: Well, let's say someone doesn't have a Facebook account, but his or her daughter or son does, and they've got your picture. So are they now automatically in the mix?

Lesley Stahl: Well, let's say someone doesn't have a Facebook account, but his or her daughter or son does, and they've got your picture. So are they now automatically in the mix?

Alessandro Acquisti: It's funny because one of the participants, before doing the experiment, told us, "You're not going to find me because I'm very careful about my photos online." And we found him. Because someone else had uploaded a photo of him.

But if an academic can easily mine our data with facial recognition, what about the government? Well, the government has a problem because to be effective, facial recognition requires a good database. Facebook for instance has one with billions and billions of photos. The government not nearly that many, and so the FBI is now assembling on these rows of servers the largest biometric database on Earth, costing over a billion dollars ...

Alessandro Acquisti: Often we are not even aware of how much data we are actually revealing or it is being gathered about us or, in fact, how it would be used. The idea that you can start from a face and predict social security numbers from that face seemed quite alien and surprising. But now we know that it can be done.

Lesley Stahl: So there's no place to hide, absolutely no place to hide.

Alessandro Acquisti: It's those places are shrinking.

CBS 60 Minutes, 5-19-13

(Savvides also appeared in a recent CNN news story on the same subject.)

-- Richard Power

CyLab's Marios Savvides Appears on CNN in Wake of Boston Marathon Bombing Investigation

In the wake of the Boston Marathon bombing investigation, there has been some mainstream news media attention paid to facial recognition software. After years of NCIS and other law enforcement TV dramas, there is some popular expectation that such technology could have led to a speedier conclusion to the manhunt, or perhaps even have prevented the savage attack.

Looking for meaningful answers, CNN turned to Marios Savvides, Carnegie Mellon University Associate Professor and Director of the CyLab Biometrics Center, a leading expert in the field.

Here is a video excerpt, followed by a transcript of the news story:



TOM FOREMAN, CNN CORRESPONDENT: "When the FBI released these photos during the search for the Boston suspects, there was hope that computers might help as they do on shows like CSI, comparing facial features with existing data and coming up with a name. But even though pictures of both brothers were in public databases, the computers that searched that data missed them, and came up empty. The government has been working on facial identification software since the 1960s, and companies like Facebook and Apple use similar technology to tag people in photos. But security analysts widely admit this technology is not good enough to spot a suspect in the crowd. At Carnegie Melon, Mario Savvides runs the CyLab Biometric Center.

MARIOS SAVVIDES, DIRECTOR, CMU CYLAB BIOMETRICS CENTER: While the toughest problems is low resolution, when you look at images collected from (inaudible) TV footage, the faces are way too small.

FOREMAN: His team is developing next generation software to change poor and partial images into much clearer pictures. They are creating programs that can reliably match images of people to their true identities, despite low light, movement, odd positions.

SAVVIDES: Off-angle is a big challenge. How do you match an off- angle image that`s say 50 degrees, 60 degrees, 45 degrees off angle to a face that`s just a frontal sort of, you know, passport-type photo.

FOREMAN: They`re even transforming flat pictures into 3D, look at what their lab did with a single photo of me. In less than an hour it was turned into a series of images showing how I might look from above, from the left, from the right. Savvides believes such programs can and will substantially improve the reliability of facial recognition and lead police to suspects much faster.

SAVVIDES: And ultimately, hopefully save life, because that`s our aim, that`s our goal, that`s everything we do here.

FOREMAN: For now, the FBI is installing its latest version of facial identification software to work with security cameras coast to coast as part of the billion-dollar program called "next generation identification." Still, in Boston, it wasn`t technology, but human investigators who triumphed. Tom Foreman, CNN, Washington.
 
CNN, 5-7-13

-- Richard Power

From Biometrics to BSIMM , & "50 Hurricanes Hitting At Once!" -- A Report on the Sixth Annual Partners Conference

Image: CyLab Biometrics Center


From Biometrics to BSIMM, & "50 Hurricanes Hitting At Once!" -- A Report on the Sixth Annual Partners Conference

by Richard Power

Throughout 2009, I have made a point of attending some important security conferences and delivering reports on what I saw and heard, some of these reports are posted here on CyBlog and in the Intelligence Briefing section of the CyLab Partners-Only Portal. The events covered include RSA, Black Hat Briefings and USENIX Security Symposium, as well as our own SOUPS and Mobile Health Workshop. (I have included a listing of the summary reports below in “Conference Coverage.”)

It is wonderful to finish off the series with a report on the CyLab Partners Conference. It is an event accessible via invitation only, and developed as an opportunity for CyLab’s corporate partners to immerse themselves in an audacious program. The conference's agenda, like CyLab's research program itself, is sweeping in its scope and impressive in its implications.

The sixth annual CyLab Corporate Partners Conference, held on the main campus of Carnegie Mellon University (Pittsburgh, Pennsylvania) from Wednesday, October 14 to Friday, October 16, offered a deep dive into one of the world’s premier cyber security research programs. Over the span of two and a half days, attendees immersed themselves in presentations and panel discussions on a broad spectrum of research areas, including:

• Corporate Governance
• Secure Home Computing
• Usability of Security and Privacy Techniques
• Security of Cyber-Physical Systems
• Secure Mobile Systems and Networks
• Trusted Computing Platforms and Devices
• Secure Software Engineering
• Digital Forensics

The rich conference agenda also featured two keynotes, one from former White House aide Melissa Hathaway, and the other from Gary McGraw, CTO of Citigal, Inc.

In her remarks at lunch on Wednesday, Hathaway spoke of the vital role of business, government and the individual and emphasized the threat to critical infrastructure:

The specter of a "digital 9/11" is what still keeps the former U.S. acting cybersecurity czar up at night, Melissa Hathaway told a gathering of Carnegie Mellon University's CyLab corporate partners ...
To illustrate one possibility, Hathaway referred to the relatively low-level denial-of-service attacks that hit some federal Web sites for several days beginning over the July Fourth weekend.
A more powerful barrage that used more points of attack, perhaps against private-sector targets, could cause $700 billion in damage, she said.
"That's the equivalent of 50 hurricanes hitting at once," Hathaway said. Mike Cronin, Partners of Carnegie Mellon's CyLab warned that 'digital 9/11' threat growing, Pittsburgh Tribune Review, 10-15-09

At dinner on Thursday, McGraw championed the Building Security in Maturity Model (BSIMM) that McGraw's Citigal developed and is now promoting with SANS Institute, through BSIMM Begin

BSIMM is based on large-scale software security initiatives in nine enterprises: four financial services companies, three independent software vendors and two technology companies.

As McGraw remarked in his keynote, "BSIMM is not about good or bad ways to eat bananas or banana best practices. BSIMM is about observations."

The power of the observations offered by McGraw and his colleagues is in their practicality: e.g., "Ten Surprising Things," including "Nobody uses WAFs," "QA can't do software security," "PEN testing is diminishing," etc., and "Ten Things Everybody Does," including "Evangelist role,""SSG does ARA" and "good network security," etc.

BSIMM will help you know where your enterprise stands, and what direction you might want maneuver it. Perhaps most important, through BSIMM Begin, it is intended to be ongoing and participatory:

"BSIMM Begin aims to significantly broaden data collection. To keep the survey manageable, the scope has been limited to the BSIMM Level 1 activities. The goals of this survey are two-fold: to provide participants with a solid understanding of where they stand with respect to foundational software security activities; and to provide an understanding of where they stand relative to everyone else that participates. BSIMM Begin will broaden the collective understanding of what "keeping up" really means." Software Security Self-Measurement with BSIMM Begin Introduced by Cigital and The SANS Institute, 10-8-09

The BSIMM Begin survey can be accessed from the landing site: http://bsi-mm.com/begin/

For more information, read McGraw's Software [In]security: The Building Security In Maturity Model (BSIMM) in InformIT (3/16/09).

The body of the conference was devoted to updates on the diverse aspects of Cylab's bold research program.

For example, Marios Savvides, Director of Cylab’s Biometrics Center, and one of the four scientists of the Office of the Director of National Intelligence Center of Academic Excellence in S&T in Identity Sciences, delivered a report on his team's "Multi-Biometrics Research Effort."

Savvides' compelling presentation showcased how his research is tackling some of the field's most urgent and vital challenges, from Long Range Iris Recognition on the Move to Soft Biometrics to Automatic Landmarking Frontal Faces to 3-D Face Reconstruction from Single Images.

In his summary, Savvides outlined his Center's current status and goals, including:

-- Developed several key technologies of HIGHEST interest to the USG.

-- Already transitioning one technology to USG (FBI’s Universal Face Workstation)

-- Working with MIT-LL to develop Government Owned Face Recognition (GOTS-FR).

-- Working on refining and developing Iris acquisition and other technology to the USG for two more success transition stories.

"We collaborate and bridge across many USG agencies," Savvides concluded, "Our goal is to support the USG in developing key enabling technologies to deter terrorism and aid the war fighter."

The three presentations briefly cited here offer only a few glimpses into the scope of the sessions stretching over the two and a half day conference.

NOTE: A full archive of presentations, student posters, photo gallery and videos is accessible to CyLab Partners only from the Partners Portal.

Conference Coverage

A Report from the 18th USENIX Security Symposium: Android Security, Naked Keystrokes, Selling Viagra, Crying Wolf & More!

A Report from BlackHat Briefings (Las Vegas 2009): From Parking Meters to the Cloud, from SMS to Smart Grids, “Everything is Broken …”

Reflections on SOUPS 2009: Between Worlds, Cultivating Superior Cleverness, Awaiting a Shift in Consciousness

RSA Conference 2009: Summary of Posts

CyLab MRC's Martin Griss Declares,"I Do Not Want Us to be Just Another Big Consortium, I Want Us to Do Something"

NOTE: Full texts of my reports from USENIX, Blackhat and the Sixth Annual CyLab Partners Conference are available to CyLab corporate partners via the Partners Portal.

DoD Awards $1.5 Million Grant for CyLab Iris Recognition Research

"This is a huge breakthrough," said Robert Baer, a former CIA operative, who is familiar with Savvides' work on real-time iris recognition. Baer's book, "See No Evil: The True Story of a Ground Soldier in the CIA's War on Terrorism," was made into the 2005 film, "Syriana," starring George Clooney. Pittsburgh Tribune-Review, 4-19-09

DoD Awards $1.5 Million Grant for CyLab Iris Recognition Research

The CyLab Biometrics Lab, led by Mario Savvides, continues to the push the envelope.

Excerpt from the Pittsburgh Tribune-Review, with a link to the full text:

Iris and face recognition soon could be the new fingerprints for criminal investigators and even U.S. troops, thanks in part to researchers at Carnegie Mellon University.
Though troops use iris-recognition technology in Iraq, targets must remain stationary for several seconds and at a distance of about 13 centimeters, roughly 5 inches, for the camera to work, said Marios Savvides, a CMU professor of electrical and computer engineering who directs the school's CyLab Biometrics Lab.
"We are improving the way we do forensic analysis," Savvides said. "We're providing tools so computers do this automatically."
The Department of Defense awarded $1.5 million in grants to Savvides and his team earlier this week to help them develop an iris-recognition system that instantly will identify unique iris markers in the eyes of people moving up to 13 meters away, or about 43 feet.
"This is a huge breakthrough," said Robert Baer, a former CIA operative, who is familiar with Savvides' work on real-time iris recognition. Baer's book, "See No Evil: The True Story of a Ground Soldier in the CIA's War on Terrorism," was made into the 2005 film, "Syriana," starring George Clooney. Pittsburgh Tribune-Review, 4-19-09

Some Related Posts:

CyLab Chronicles Q&A with Mario Savvides

CyLab News: CyLab's Savvides Invited to Speak at NSA Conference

CyLab Researcher Selected To Join New Center For Academic Studies In Identity Sciences

CyLab News: Information Security Magazine Highlights CyLab’s Lead in Vital Research

CyLab Researchers Developing New Technology to Detect Enemies