Aggregated enterprise architecture wisdom
I recently went into a High Street branch of my bank and moved a bit of money between accounts. I could have done more, but I didn’t have any additional forms of identification with me.At the end, the cashier asked me for my nationality. British, as it…
I have been discussing Pay As You Drive (PAYD) insurance schemes on this blog for nearly ten years.
The simplest version of the concept varies your insurance premium according to the quantity of driving – Pay As How Much You Drive. But for obvious reasons, insurance companies are also interested in the quality of driving – Pay As How Well You Drive – and several companies now offer a discount for “safe” driving, based on avoiding events such as hard braking, sudden swerves, and speed violations.
Researchers at the University of Washington argue that each driver has a unique style of driving, including steering, acceleration and braking, which they call a “driver fingerprint”. They claim that drivers can be quickly and reliably identified from the braking event stream alone.
Bruce Schneier posted a brief summary of this research on his blog without further comment, but a range of comments were posted by his readers. Some expressed scepticism about the reliability of the algorithm, while others pointed out that driver behaviour varies according to context – people drive differently when they have their children in the car, or when they are driving home from the pub.
“Drunk me drives really differently too. Sober me doesn’t expect trees to get out of the way when I honk.”
Although the algorithm produced by the researchers may not allow for this kind of complexity, there is no reason in principle why a more sophisticated algorithm couldn’t allow for it. I have long argued that JOHN-SOBER and JOHN-DRUNK should be understood as two different identities, with recognizably different patterns of behaviour and risk. (See my post on Identity Differentiation.)
However, the researchers are primarily interested in the opportunities and threats created by the possibility of using the “driver fingerprint” as a reliable identification mechanism.
While some of these use cases might be justifiable, the researchers outline various scenarios where this kind of “fingerprinting” would represent an unjustified invasion of privacy, observe how easy it is for a third party to obtain and abuse driver-related data, and call for a permission-based system for controlling data access between multiple devices and applications connected to the CAN bus within a vehicle. (CAN is a low-level protocol, and does not support any security features intrinsically.)
Sources
Miro Enev, Alex Takakuwa, Karl Koscher, and Tadayoshi Kohno, Automobile Driver Fingerprinting Proceedings on Privacy Enhancing Technologies; 2016 (1):34–51
Andy Greenberg, A Car’s Computer Can ‘Fingerprint’ You in Minutes Based on How You Drive (Wired, 25 May 2016)
Bruce Schneier, Identifying People from their Driving Patterns (30 May 2016)
See also John H.L. Hansen, Pinar Boyraz, Kazuya Takeda, Hüseyin Abut, Digital Signal Processing for In-Vehicle Systems and Safety. Springer Science and Business Media, 21 Dec 2011
Wikipedia: CAN bus, Vehicle bus
Related Posts
Identity Differentiation (May 2006)
Pay As You Drive (October 2006) (June 2008) (June 2009)
Regardless of news stories and articles, companies and governments continue to suffer from major information breaches. I teach a course on Information Security Risk Management and Legal Issues to Masters students at the New York Institute of Technology…
I’m excited about the Internet of Things (IoT), and I expect it to create incredible opportunities for companies in almost every industry. But I’m also concerned that the issues of security, data privacy, and our expectations of a right to privacy, in general — unless suitably addressed — could hinder the adoption of the IoT Read more
I’m excited about the Internet of Things (IoT), and I expect it to create incredible opportunities for companies in almost every industry. But I’m also concerned that the issues of security, data privacy, and our expectations of a right to privacy, in general — unless suitably addressed — could hinder the adoption of the IoT …
When talking with people about privacy and information security I often come across a common misconception – that there is nothing more to privacy than security, or that the two are roughly the same. In particular this often comes up in discussions around the use of cloud services where people seem to think that if […]
This is my fourteenth post in my series on BYOD. This recent article on Infoworld about how the US Department of Veterans’ Affairs has put its BYOD plans on hold illustrates the point that you need to consider and cover off employee privacy when implementing BYOD. As I understand the article, they are putting their […]
Please join us on Tuesday, January 22 at 9:00 a.m. PT/12:00 p.m. ET/5:00 p.m. GMT for a tweet jam, moderated by Dana Gardner (@Dana_Gardner), ZDNet – Briefings Direct, that will discuss and debate the issues around big data security. Key areas that will be addressed during the discussion include: data security, privacy, compliance, security ethics and, of course, Big Data. Continue reading →
Last week, we announced our upcoming tweet jam on Tuesday, December 11 at 9:00 a.m. PT/12:00 p.m. ET/5:00 p.m. BST, which will examine the topic of IT security and what is in store for 2013. The discussion will be moderated by Elinor Mills, former CNET security reporter, and our panel of experts will include… Continue reading →
Earlier this week, we announced our upcoming tweet jam on Tuesday, September 18 at 9:00 a.m. PT/12:00 p.m. ET/5:00 p.m. BST, which will examine the topic of BYOD and current approaches to managing it. Check out the questions we’ll be asking next Tuesda…
The third Higher Education CIO challenge focuses on cloud computing services. These offerings allow higher education CIOs to radically re-think their enterprise architectures. “In the 2011 CIO agenda, 64% of higher education CIOs expected to move m…
Migrating more data and applications to the cloud is top of CIO’s to-do list right now. 52% of the 489 business and technology executives who responded to our 2012 Digital IQ study plan to boost their spending in the private cloud this year. Those same firms are simultaneously setting their sights on the public cloud. 57% of the leadership surveyed claim they are ramping up their investments in public clouds. Understandably, security is weighing heavy […]
If you liked this, you might also like: