Security Review: Advertisements That Watch You
The Associated Press reports that there is a growing chance that, while watching an advertisement on a video screen in a public place, the advertisement may also be watching you. Following a trend of increasingly prevalent automatic public monitoring, from security cameras to red-light cameras, advertisements may now attempt to identify the people watching them. This is done with small cameras that can be embedded either in or around the advertising video screen. The output from the cameras is feed into software which attempts to identify certain characteristics about the watcher. This includes both personal characteristics such as age, gender, and ethnicity and behavioral characteristics such as the amount of time spent watching the advertisement.
Some advertisers like the technology as it provides them with a way of targeting advertisements to consumers based on that individuals characteristics. Further, being able to analyze how long consumers watch a specific advertisement gives advertisers feedback on the effectiveness of their targeted advertisements.
The are currently significant limitations to the technology. It is best suited at identifying gender, which it determines correctly about 85-90% of the time. It is somewhat effective at identifying age, and less effective at identifying ethnicity. It is (supposedly) capable only of identifying some characteristics about an individual and cannot be used to associate a person with a specific identity.
Assets
- Consumer information: This technology is capable of determining an individual’s outward characteristics. It converts this information from visual data to an electronic representation (say, a constant that represents “female”), which can be stored or made use of by the rest of the system.
- Consumer demographics. This technology is capable of determining characteristics of many individuals within a single location at different times of day. This is essentially an aggregation of consumer information which can be statistically analyzed easily since it is already in electronic format.
Adversaries/Threats
- People who wish to use the data collected to maliciously target a specific group of people. For example, a pedophile may wish to make use of consumer demographic knowledge by being present when and where there is a high concentration of children.
- People who wish to use the video collected for their own purposes. Though the software cannot identify a person, people still can. This could allow stalkers a way of video taping their victims during everyday activities.
Potential Weaknesses
- By being placed in public places, these video screens are likely to be physically insecure. An attacker will almost certainly be able to get close to the device, if not actually touch it. Any defects in the case could allow physical access to the hardware. Similarly, any defect in the communications protocol (such as unsecured wireless) could provide the data to network sniffers.
- Significant trust is being placed on the manufacturers of this technology. They maintain that this information is not being stored, but a rogue employee could add storage / transmission capabilities to the device. Also, this claim of lack of storage seems at odds with other claims of allowing for demographic analysis: how can the data be analyzed if it isn’t stored anywhere?
Potential Defenses
- When targeting an advertisement, do not record how often an advertisement is shown or what characteristic prompted the display. This will help defend consumer information, as there is no database of data to steal.
- Ensure that the case of the technology is sturdy, and ideally include mechanisms designed to automatically notice if the case has been opened (at which point, operations should cease). This will help against some physical attackers.
Evaluate Risks
- A big concern for this technology is its possible evolution. Whatever one thinks of the current version, a version that could associate a person with a specific identify would be incredibly scary. There are reasons to doubt the possibility of this: after all, face scanning technology seems to be very difficult. But the fact of the matter is that this risk remains as long as their recording and attempting to identify consumers in public. Perhaps more worrisome is the potential use of high-definition cameras with another form of identification (perhaps iris scanning, which is seeing gains).
- As long as the technology remains in its present form, the only real added risk seems to be in the aggregation of data. All of the data obtained by this technology could be just as easily obtained at a single location by employing a person to sit there changing advertisements based on whomever was nearest and recording these changes. This person would have a higher accuracy than the machine. However, it is the aggregation of data which is more worrisome. This provides the advertisers with an incredible amount of information about many different locations simultaneously and at a high refresh rate.
In its current form, I think this is a technology that sounds considerably more invasive than it is in practice. However, future iterations have significant potential to reveal important personal information about individuals, which is a genuine cause for concern. Moreover, if we accept the current iteration as “acceptable”, we may be more likely to accept future, more invasive iterations without objection. And that is scary.
Comment by kosh
January 30, 2009 @ 7:42 pm
I certainly do agree that there are a lot most risks to the current implementation of the technology. It looks to be like a logistical nightmare to be able to identify the customer and deliver specific ads based on past information. I think a viable alternative would be to have several screens with different ads playing and cameras that catch your eye movement and focus/expand on a specific ad. This seems much more secure but it also brings up the question of whether you want the person behind you to know what you are interested in…
Comment by Erik Turnquist
January 30, 2009 @ 7:58 pm
I also agree that this has a great potential for abuse by the advertisers. Without proper restraint from lawmakers this technology could be very invasive, as many advertisers would be able to analyze how you respond to ads. Although advertisers would cite the fact that they could deliver content that was more targeted to your interests, I feel that even with this benefit, it is still far too invasive. One benefit of the current implementation for those being filmed and analyzed is that it doesn’t identify individual people or even remember them (by storing data), it simply identifies their characteristics and uses this information for ad content.
Another point made in the article, which I briefly mentioned before is that advertisers must make the public aware that details are being collected about them. Another potential legal issue is the use of this technology by law enforcement or other government agencies (NSA anyone?). If these organizations knew that a dangerous criminal was in the area of an ad with these capabilities, then they could use the feed and analyze individuals passing by so that they might spot the criminal. This would have the potential of an being an even larger issue if ordinary citizens knew that law enforcement or other government agencies might be spying on their every move as they peruse a local shopping mall, in hopes that they might catch someone they were after or even spot someone breaking the law. Although I realize that this situation is somewhat exaggerated from the current implementation, it is not entirely out of the imagination that this might occur.
Comment by eyezac
January 30, 2009 @ 8:16 pm
Is it really a problem if an attacker gets access to the video footage from one of these devices? It’s already easy enough to place a video recorder inconspicuously in a public place, and this is only becoming easier with the increasing integration between cell phones and cameras. I agree that the possibility of being tracked by cameras with software capable of identifying individuals is unsettling, but I think that’s a problem that we face with or without this particular technology.
Comment by sal
January 30, 2009 @ 10:57 pm
Seems like as long as technology doesn’t try to identify each person, it will come to be. However, I see how even categorizing people based on race or gender could raise concerns.
Personally, I don’t enjoy targeted advertisements on the internet very much. My yahoo mail very often shows me an advertisement of personals, based on my age and gender, I guess. And I don’t care very much if some employee at Yahoo sees it, but i might care if someone near me glancing at my screen can “deduce” that I am a regular visitor to personals. So, it feels very different if someone just “identifies” you from far away, versus having someone nearby seeing how you have been identified. And i see a lot of criticism coming against the technology.
Comment by Heather
February 4, 2009 @ 2:14 pm
When I read this post, the movie “Minority Report” came to mind. When Tom Cruise is trying to evade the police he enters a store and is immediately recognized, greeted, and targeted by an advertisement thus giving away his location. Granted, like post suggests, recognition of a specific individual seems difficult and not likely to happen very soon, however, if someone shops at a certain store frequently, the advertisement could gradually create an identity for that person based on the characteristics it can deduce. This could form the basis of a “shopper identity” that could be aggregated to other stores thus identifying an individual as a certain kind of shopper.
Another concern I have is that if the strategy that KOSH suggested in his/her (?) comment is falsely identifying what ads should be shown to an individual. If three ads are posted when I walk into a store and one is really flashy or for something that is provocative (say lingerie or alluring perfume), even if I’m not that interested in the product, my lingering eyes would indicate that I am. Personally, I would be rather embarassed if because of this I was targeted with tons of sexy ads when I walked into a store.
I suppose there is the rare occurrence when I actually buy a product because I saw an advertisement for it. However, I don’t think my interests are stereotypical enough for targeted advertising to increase my purchasing activity.