From lists at internetpolicyagency.com Mon Jan 2 17:09:55 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 2 Jan 2012 17:09:55 +0000 Subject: Y2012k, or coincidence? Message-ID: http://www.mercurynews.com/breaking-news/ci_19656845 "New Year's guests at a Denver Marriott were locked out of their rooms when the clock struck midnight and their room keys stopped working." -- Roland Perry From tugwilson at gmail.com Fri Jan 6 16:48:23 2012 From: tugwilson at gmail.com (John Wilson) Date: Fri, 6 Jan 2012 16:48:23 +0000 Subject: Buckinghamshire CC ANPR cameras Message-ID: Bucks County Council have installed about a dozen ANPR cameras on roads leading in to Aylesbury and in Aylesbury town centre as part of a central Government funded "Urban Traffic Management" scheme. The idea is that this data is to be used to collect journey times to allow them to give warnings of congestion to motorists (quite what the motorists are supposed to do with the information is not explained). They also run CCTV cameras as part of this scheme. The cameras send data to the council control room and to Thames Valley Police as two separate data feeds. It appears that the council also gets data from some TVP cameras but they are a bit cagey about the details. They say that that "To ensure anonymity all VRN information will be depersonalised in accordance with the national UTMC protocol" I've looked at the UTMC site http://www.utmc.uk.com/ but can't find any specification of a "depersonalisation" algorithm. The Council seems to believe that whilst the CCTV images are covered by the DPA but that the "depersonalised" ANPR data are not. Has anybody got experience of similar schemes in other places? Is there a standard "depersonalisation" algorithm? If so anybody know what it is? It seems to me to be reasonably hard to anonymise this data stream and to retain its utility, especially if there is no central spec for the mechanism and Thales or whoever decide that running it through SHA-1 will do the trick. I've put in an FoI request which, amongst other things, asks for the details of the algorithm but with no lively hope of success. John Wilson From lists at internetpolicyagency.com Fri Jan 6 17:10:15 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Fri, 6 Jan 2012 17:10:15 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References: Message-ID: In article , John Wilson writes >ucks County Council have installed about a dozen ANPR cameras on >roads leading in to Aylesbury and in Aylesbury town centre as part of >a central Government funded "Urban Traffic Management" scheme. ... >Has anybody got experience of similar schemes in other places? I have no extra details, but last year ago it was announced that large numbers of car movements in Royston were to be logged by CCTV. http://www.bbc.co.uk/news/uk-england-beds-bucks-herts-13789111 -- Roland Perry From tugwilson at gmail.com Fri Jan 6 17:36:13 2012 From: tugwilson at gmail.com (John Wilson) Date: Fri, 6 Jan 2012 17:36:13 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References: Message-ID: On 6 January 2012 17:10, Roland Perry wrote: > In article > , John > Wilson writes > >> ucks County Council have installed about a dozen ANPR cameras on >> roads leading in to Aylesbury and in Aylesbury town centre as part of >> a central Government funded "Urban Traffic Management" scheme. > > ... > >> Has anybody got experience of similar schemes in other places? > > > I have no extra details, but last year ago it was announced that large > numbers of car movements in Royston were to be logged by CCTV. > > http://www.bbc.co.uk/news/uk-england-beds-bucks-herts-13789111 > f_things_to_come.htm> Thanks, Roland - I remember that one - they were Police ANPR cameras. These are council ones and I've not come across Council owned and operated ANPR cameras before. If I remember correctly a guy in Royston was warned off by the Police because he put the location of the cameras on a web site. This is where the Bucks CC cameras are located http://maps.google.co.uk/maps/ms?msid=211048623917040305292.0004b5b82468bc84f7974&msa=0 To their credit Bucks CC do intend to put the locations on their web site and put up signs saying what the cameras do. John Wilson From ben at links.org Fri Jan 6 17:03:10 2012 From: ben at links.org (Ben Laurie) Date: Fri, 6 Jan 2012 17:03:10 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References: Message-ID: On Fri, Jan 6, 2012 at 4:48 PM, John Wilson wrote: > Is there a standard "depersonalisation" algorithm? If so anybody know > what it is? No. Indeed, in general, it is not possible to "depersonalise" and retain any usefulness in the data. So step 1 is probably to find out WTF they're actually doing. From maxsec at gmail.com Fri Jan 6 18:57:19 2012 From: maxsec at gmail.com (Martin Hepworth) Date: Fri, 6 Jan 2012 18:57:19 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: Been around in Oxford for a few years for monitoring traffic flows around the ring road Would be nice to have this info under a common disclosure notice on county websites Martin On Friday, 6 January 2012, Ben Laurie wrote: > On Fri, Jan 6, 2012 at 4:48 PM, John Wilson wrote: >> Is there a standard "depersonalisation" algorithm? If so anybody know >> what it is? > > No. Indeed, in general, it is not possible to "depersonalise" andy > retain any usefulness in the data. > > So step 1 is probably to find out WTF they're actually doing. > > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: From tugwilson at gmail.com Fri Jan 6 19:17:10 2012 From: tugwilson at gmail.com (John Wilson) Date: Fri, 6 Jan 2012 19:17:10 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: On 6 January 2012 18:57, Martin Hepworth wrote: > Been around in Oxford for a few years for monitoring traffic flows around > the ring road > > Would be nice to have this info under a common disclosure notice on county > websites For what it's worth here is the record of the Council's decision to proceed http://democracy.buckscc.gov.uk/mgIssueHistoryHome.aspx?IId=20996&Opt=0 Here is a map of the whole project http://www.transportforbucks.net/Roadworks-Centre/Schemes-and-projects/Our-schemes-and-projects/Urban-Traffic-Management-Centre.aspx The PIA report is quite interesting. They admit that they may have to reveal the location of the Thames Valley Police cameras if presented with an FoI request and suggest that they should claim they are covered by the EIR rather then the FoI as this is less restrictive. To give them credit there are a lot of good intentions as far as disclosure is concerned in this document. The problem is that the people tasked with implementing the disclosure don't seem to see it as a priority. My initial FoI request is for the location and operational status of the cameras, the Memorandum of Agreement with their partners, their data retention policy for the ANPR data and the technical details of the "depersonalise" technique. The last one is probably going to be a problem as I suspect there is no national spec for how it's done and I bet their supplier won't tell them. John Wilson From lists at internetpolicyagency.com Fri Jan 6 21:36:15 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Fri, 6 Jan 2012 21:36:15 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: In article , John Wilson writes >If I remember correctly a guy in Royston was warned off by the Police >because he put the location of the cameras on a web site. Are they especially clandestine ones, or the normal green things? http://g.co/maps/mrr43 There's also the much more tubular black ones (here in multiple): http://newsimg.bbc.co.uk/media/images/45626000/jpg/_45626322_anpr_226.jpg -- Roland Perry From ukcrypto at sourcetagged.ian.co.uk Sat Jan 7 02:31:07 2012 From: ukcrypto at sourcetagged.ian.co.uk (Ian Mason) Date: Sat, 7 Jan 2012 02:31:07 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: On 6 Jan 2012, at 17:03, Ben Laurie wrote: > On Fri, Jan 6, 2012 at 4:48 PM, John Wilson > wrote: >> Is there a standard "depersonalisation" algorithm? If so anybody know >> what it is? > > No. Indeed, in general, it is not possible to "depersonalise" and > retain any usefulness in the data. > > So step 1 is probably to find out WTF they're actually doing. > It depends. If they are strictly monitoring traffic flows and journey times then all they have to do is assign a unique journey number to a set of records for a vehicle and drop/delete the registration number when the journey seems complete. Each time the vehicle starts a journey it gets assigned a new unique journey number so that there's no link with previous journeys for the same vehicle and no record of the registration number at all once a journey has completed. Obviously there's detail to work through such as: a vehicle enters the area, is seen by ANPR on entry, then parks up for several days and isn't seen by a second ANPR camera; at what point do you delete the partial journey record that will, of necessity, still contain a registration number. Ian From lists at internetpolicyagency.com Sat Jan 7 09:27:21 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sat, 7 Jan 2012 09:27:21 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: In article , Ian Mason writes >>> Is there a standard "depersonalisation" algorithm? If so anybody know >>> what it is? >> >> No. Indeed, in general, it is not possible to "depersonalise" and >> retain any usefulness in the data. >> >> So step 1 is probably to find out WTF they're actually doing. > >It depends. If they are strictly monitoring traffic flows and journey >times then all they have to do is assign a unique journey number to a >set of records for a vehicle and drop/delete the registration number >when the journey seems complete. Each time the vehicle starts a journey >it gets assigned a new unique journey number so that there's no link >with previous journeys for the same vehicle and no record of the >registration number at all once a journey has completed. aiui the Trafficmaster system (blue cameras) works a lot like this. >Obviously there's detail to work through such as: a vehicle enters the >area, is seen by ANPR on entry, then parks up for several days and >isn't seen by a second ANPR camera; at what point do you delete the >partial journey record that will, of necessity, still contain a >registration number. About an hour after last seeing the plate would be plenty if you are looking at the "flow" of traffic. -- Roland Perry From tugwilson at gmail.com Sat Jan 7 12:06:58 2012 From: tugwilson at gmail.com (John Wilson) Date: Sat, 7 Jan 2012 12:06:58 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: On 7 January 2012 09:27, Roland Perry wrote: > In article , > Ian Mason writes > >>>> Is there a standard "depersonalisation" algorithm? If so anybody know >>>> what it is? >>> >>> >>> No. Indeed, in general, it is not possible to "depersonalise" and >>> retain any usefulness in the data. >>> >>> So step 1 is probably to find out WTF they're actually doing. >> >> >> It depends. If they are strictly monitoring traffic flows and journey >> times then all they have to do is assign a unique journey number to a set of >> records for a vehicle and drop/delete the registration number when the >> journey seems complete. Each time the vehicle starts a journey it gets >> assigned a new unique journey number so that there's no link with previous >> journeys for the same vehicle and no record of the registration number at >> all once a journey has completed. > > > aiui the Trafficmaster system (blue cameras) works a lot like this. > > >> Obviously ?there's detail to work through such as: a vehicle enters the >> area, is ?seen by ANPR on entry, then parks up for several days and isn't >> seen ?by a second ANPR camera; at what point do you delete the partial >> ?journey record that will, of necessity, still contain a registration >> ?number. > > > About an hour after last seeing the plate would be plenty if you are looking > at the "flow" of traffic. That's quite true but it seems clear from the Council documents that they intend to hold the camera even data for some time. There are perfectly legitimate reasons for this. They can, no doubt, get useful information from the bulk data which would help in planning traffic management. I've found the schema for the data packet sent by ANPR cameras which conform to the UTMC standard it has information like the direction of travel and the carriage used. It also has optional fields for vehicle speed and classification (presumably things like, car, motocycle, van, etc). Even if the cameras don't provide this extra information now you would want to build a database to hold it as and when the capabilities become available. John Wilson From lists at internetpolicyagency.com Sat Jan 7 14:06:59 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sat, 7 Jan 2012 14:06:59 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: In article , John Wilson writes >>> Obviously ?there's detail to work through such as: a vehicle enters the >>> area, is ?seen by ANPR on entry, then parks up for several days and isn't >>> seen ?by a second ANPR camera; at what point do you delete the partial >>> ?journey record that will, of necessity, still contain a registration >>> ?number. >> >> About an hour after last seeing the plate would be plenty if you are looking >> at the "flow" of traffic. > >That's quite true but it seems clear from the Council documents that >they intend to hold the camera even data for some time. There are >perfectly legitimate reasons for this. They can, no doubt, get useful >information from the bulk data which would help in planning traffic >management. Unless the entire perimeter is covered (cf London Congestion Charge) then vehicles that 'disappear' could just as easily have taken an unmonitored exit. Indeed, schemes like the London CC only logs entries, and not exits, I thought. -- Roland Perry From tugwilson at gmail.com Sat Jan 7 15:45:51 2012 From: tugwilson at gmail.com (John Wilson) Date: Sat, 7 Jan 2012 15:45:51 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: On 7 January 2012 14:06, Roland Perry wrote: >> That's quite true but it seems clear from the Council documents that >> they intend to hold the camera even data for some time. There are >> perfectly legitimate reasons for this. They can, no doubt, get useful >> information from the bulk data which would help in planning traffic >> management. > > > Unless the entire perimeter is covered (cf London Congestion Charge) then > vehicles that 'disappear' could just as easily have taken an unmonitored > exit. Indeed, schemes like the London CC only logs entries, and not exits, I > thought. It seems the Highways Agency keeps their traffic data for ever http://www.highways.gov.uk/traffic/21002.aspx They use the 24 bit hash value returned from the camera not the registration number, I imagine that Bucks CC will do the same. It appears that the hashing algorithm is a national secret http://www.whatdotheyknow.com/request/anpr_capabilities John Wilson From lists at internetpolicyagency.com Sat Jan 7 16:27:03 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sat, 7 Jan 2012 16:27:03 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: <528XP6gXJHCPFAzy@perry.co.uk> In article , John Wilson writes > >It seems the Highways Agency keeps their traffic data for ever >http://www.highways.gov.uk/traffic/21002.aspx That explains one mystery (assuming they are telling the truth) which is why the police don't use data from those cameras to do useful things for the general public, like trace stolen cars. -- Roland Perry From tugwilson at gmail.com Sat Jan 7 16:37:11 2012 From: tugwilson at gmail.com (John Wilson) Date: Sat, 7 Jan 2012 16:37:11 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <528XP6gXJHCPFAzy@perry.co.uk> References:

<528XP6gXJHCPFAzy@perry.co.uk> Message-ID: On 7 January 2012 16:27, Roland Perry wrote: > In article > , John > Wilson writes > >> >> It seems the Highways Agency keeps their traffic data for ever >> http://www.highways.gov.uk/traffic/21002.aspx > > > That explains one mystery (assuming they are telling the truth) which is why > the police don't use data from those cameras to do useful things for the > general public, like trace stolen cars. In Buckinghamshire the police get a full data feed from the Council's cameras which includes the actual registration number. I'm trying to find a good formulation for an FoI request about these hashes. I'm thinking about something along the lines of "Given 1 million random, valid GB registration numbers what's the probability that two will produce same hash value" Suggestions for improvement welcome. In Holland they appear to use MD5 http://albertdeklein.nl/2011/03/13/dude-where-is-my-car/ John Wilson From lists at internetpolicyagency.com Sat Jan 7 16:51:24 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sat, 7 Jan 2012 16:51:24 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<528XP6gXJHCPFAzy@perry.co.uk> Message-ID: In article , John Wilson writes >In Buckinghamshire the police get a full data feed from the Council's >cameras which includes the actual registration number. Has that improved the recovery rate for stolen cars in Bucks? (Maybe another FOI request to make; perhaps phrased as "how many cars which are reported as stolen have been tracked by this scheme", which would include the ones that did get away after all.) It's quite possible the answer is "zero, we don't do that", which would be interesting anyway. -- Roland Perry From igb at batten.eu.org Sat Jan 7 19:39:23 2012 From: igb at batten.eu.org (Ian Batten) Date: Sat, 7 Jan 2012 19:39:23 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<528XP6gXJHCPFAzy@perry.co.uk> Message-ID: <86628682-BA71-449A-BD98-F7713EB35B3F@batten.eu.org> On 7 Jan 2012, at 1651, Roland Perry wrote: > In article , John Wilson writes >> In Buckinghamshire the police get a full data feed from the Council's >> cameras which includes the actual registration number. > > Has that improved the recovery rate for stolen cars in Bucks? (Maybe another FOI request to make; perhaps phrased as "how many cars which are reported as stolen have been tracked by this scheme", which would include the ones that did get away after all.) I got the results of ANPR in terms of convictions from West Midlands police under the FOI a couple of years ago. I'd have to fish them out, but my recollection is that it wasn't impressive. ian From bdm at fenrir.org.uk Sat Jan 7 18:03:03 2012 From: bdm at fenrir.org.uk (Brian Morrison) Date: Sat, 7 Jan 2012 18:03:03 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: <20120107180303.7806668d@peterson.fenrir.org.uk> On Sat, 7 Jan 2012 09:27:21 +0000 Roland Perry wrote: > >It depends. If they are strictly monitoring traffic flows and journey > >times then all they have to do is assign a unique journey number to a > >set of records for a vehicle and drop/delete the registration number > >when the journey seems complete. Each time the vehicle starts a journey > >it gets assigned a new unique journey number so that there's no link > >with previous journeys for the same vehicle and no record of the > >registration number at all once a journey has completed. > > aiui the Trafficmaster system (blue cameras) works a lot like this. Trafficmaster claims that they tokenize the central part of the registration plate only, but I don't know for certain about this. Some time ago I recall a murder trial involving a murder in Scotland where the suspect(s) travelled up the motorways from England to Scotland and that the police were able to obtain evidence of their vehicle movements from Trafficmaster. I don't have any links to this, but I certainly remember hearing about it although it was a long time ago, possibly a decade. -- Brian Morrison bdm at fenrir dot org dot uk "Arguing with an engineer is like wrestling with a pig in the mud; after a while you realize you are muddy and the pig is enjoying it." GnuPG key ID DE32E5C5 - http://wwwkeys.uk.pgp.net/pgpnet/wwwkeys.html -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 190 bytes Desc: not available URL: From lists at internetpolicyagency.com Sun Jan 8 09:43:56 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Sun, 8 Jan 2012 09:43:56 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <20120107180303.7806668d@peterson.fenrir.org.uk> References:

<20120107180303.7806668d@peterson.fenrir.org.uk> Message-ID: In article <20120107180303.7806668d at peterson.fenrir.org.uk>, Brian Morrison writes >Trafficmaster claims that they tokenize the central part of the >registration plate only, but I don't know for certain about this. Some >time ago I recall a murder trial involving a murder in Scotland where >the suspect(s) travelled up the motorways from England to Scotland and >that the police were able to obtain evidence of their vehicle movements >from Trafficmaster. That's essentially the same as the 24-bit hash used by the Highways Agency, which while not unique to every vehicle is plenty good enough as evidence in a murder investigation. -- Roland Perry From chris-ukcrypto at lists.skipnote.org Mon Jan 9 15:16:38 2012 From: chris-ukcrypto at lists.skipnote.org (Chris Edwards) Date: Mon, 9 Jan 2012 15:16:38 +0000 (GMT) Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: On Sat, 7 Jan 2012, John Wilson wrote: > They use the 24 bit hash value returned from the camera not the > registration number I guess hashing a registration is pretty easy to reverse. With access to the DVLA database of all UK registrations, you simply compute the hash for each one. This is a one off task. Once you've done it, you know the registration for any given hash. From clive at davros.org Mon Jan 9 15:26:18 2012 From: clive at davros.org (Clive D.W. Feather) Date: Mon, 9 Jan 2012 15:26:18 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: <20120109152618.GE7359@davros.org> Chris Edwards said: > I guess hashing a registration is pretty easy to reverse. With access to > the DVLA database of all UK registrations, you simply compute the hash for > each one. This is a one off task. Once you've done it, you know the > registration for any given hash. You don't even need access to the database. The range of possible registrations isn't that much larger, and it will deal with fake registrations as well. (Hmm, how much larger is it? Let's see. The possible registrations are, roughly: aa nnnn, nnnn aa, aaa nnn, nnn aaa, aaa nnn a, a nnn aaa, aa nn aaa 6.25M 6.25M 14.4M 14.4M 302M 302M The last set is 153M so far, growing at 14.6M per annum. So about 800 million at the moment.] -- Clive D.W. Feather | If you lie to the compiler, Email: clive at davros.org | it will get its revenge. Web: http://www.davros.org | - Henry Spencer Mobile: +44 7973 377646 From tugwilson at gmail.com Mon Jan 9 16:34:51 2012 From: tugwilson at gmail.com (John Wilson) Date: Mon, 9 Jan 2012 16:34:51 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <20120109152618.GE7359@davros.org> References:

<20120109152618.GE7359@davros.org> Message-ID: On 9 January 2012 15:26, Clive D.W. Feather wrote: > Chris Edwards said: >> I guess hashing a registration is pretty easy to reverse. ?With access to >> the DVLA database of all UK registrations, you simply compute the hash for >> each one. ?This is a one off task. ?Once you've done it, you know the >> registration for any given hash. I've turned up some more information on the hashing mechanism. The Highways Agency say "The processor identifies the number plate in each image and uses optical character recognition to obtain the plate. The plate is then simplified and hashed with a large prime number, to give a non-reversible tag." (http://www.highways.gov.uk/foiresponses/FOIresponses/24242.aspx) This paper from Sheffield University says "a process known as ?character merging? is applied prior to generation of the hash value from the plate characters. In this process, character sets which are commonly mis-read by ANPR systems (such as O, D and 0, or 8, B and 3) are merged (e.g. all Ds are replaced by Os etc) which has the effect of reducing significantly the uniqueness of the hash value" (http://staffwww.dcs.shef.ac.uk/people/C.Fox/fox_ETC2010.pdf) However the number plate layout introduced in September 2001 should not require as much merging as the letters and digits are readily distinguishably by position. The mention of the prime number leads me to guess they are using the sum of products method to create the hash. As the hash is only 24 bits and there are 34.5 million licensed vehicles on the road there must be collisions even if the hash function were perfect (and it's not). It would be fun to run all the currently issued licence numbers through the hash function to see how well it works. Unfortunately the DVLA won't supply a list of the current licence plate numbers and the Highways Agency won't disclose the hashing algorithm. It seems clear that this method as a very poor way of anonymising the data. If I had access to the data I could easily identify and individual's car with out knowing anything at all about the hash function other than it always produces the same hash given the same number plate. I just need to know the precise time they pass one or more cameras or less precise information on several journeys. John Wilson From lists at internetpolicyagency.com Mon Jan 9 16:34:15 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 9 Jan 2012 16:34:15 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: In article , Chris Edwards writes >> They use the 24 bit hash value returned from the camera not the >> registration number > >I guess hashing a registration is pretty easy to reverse. With access to >the DVLA database of all UK registrations, you simply compute the hash for >each one. This is a one off task. Once you've done it, you know the >registration for any given hash. Unless the hash changes, with for example the date. You'd still get hashes consistent enough to work out how fast the traffic's flowing, but each day you get a whole new set of hashes. Although if you knew the date the hash was calculated, you could still compare the hash you wanted to reverse with the full table, but it's much more to compute and store, and could be accused of being security by obscurity. -- Roland Perry From tugwilson at gmail.com Mon Jan 9 16:46:14 2012 From: tugwilson at gmail.com (John Wilson) Date: Mon, 9 Jan 2012 16:46:14 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: On 9 January 2012 16:34, Roland Perry wrote: > In article , Chris Edwards > writes > >>> They use the 24 bit hash value returned from the camera not the >>> registration number >> >> >> I guess hashing a registration is pretty easy to reverse. ?With access to >> the DVLA database of all UK registrations, you simply compute the hash for >> each one. ?This is a one off task. ?Once you've done it, you know the >> registration for any given hash. > > > Unless the hash changes, with for example the date. You'd still get hashes > consistent enough to work out how fast the traffic's flowing, but each day > you get a whole new set of hashes. > > Although if you knew the date the hash was calculated, you could still > compare the hash you wanted to reverse with the full table, but it's much > more to compute and store, and could be accused of being security by > obscurity. The hash doesn't change over time. There's a FOI response from the Highways Agency which confirms that. (http://www.whatdotheyknow.com/request/48353/response/124187/attach/html/2/FOI%20response%20ref%2013068772.doc.html) John Wilson From lists at internetpolicyagency.com Mon Jan 9 16:53:25 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 9 Jan 2012 16:53:25 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> Message-ID: In article , John Wilson writes >It seems clear that this method as a very poor way of anonymising the >data. If I had access to the data Which raises the issue of what form of data loss the anonymising process regards as a threat. Having scooped up all the data form a central store is not the same as eavesdropping the feed from one camera. >I could easily identify and >individual's car with out knowing anything at all about the hash >function other than it always produces the same hash given the same >number plate. I just need to know the precise time they pass one or >more cameras Although if the camera's on a busy road, you may have several cars to choose from. >or less precise information on several journeys. Two samples should reduce the number of cars in both places at the same time to a very small number. -- Roland Perry From tugwilson at gmail.com Mon Jan 9 17:17:14 2012 From: tugwilson at gmail.com (John Wilson) Date: Mon, 9 Jan 2012 17:17:14 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> Message-ID: On 9 January 2012 16:53, Roland Perry wrote: > In article > , John > Wilson writes > >> It seems clear that this method as a very poor way of anonymising the >> data. If I had access to the data > > > Which raises the issue of what form of data loss the anonymising process > regards as a threat. Having scooped up all the data form a central store is > not the same as eavesdropping the feed from one camera. It's not beyond the bounds of possibility for these data to be released voluntarily (as happened in Amsterdam). I wonder what would happen if I put an FoI request in for the dataset which the Highways Agency supplied to the University of Sheffield? They are in quite a difficult position as that have made strenuous efforts to pretend that it contains no personal data and is therefor not covered by the DPA. If they've already extracted it it shouldn't fail the ?600 test. John Wilson From zenadsl6186 at zen.co.uk Mon Jan 9 17:21:47 2012 From: zenadsl6186 at zen.co.uk (Peter Fairbrother) Date: Mon, 09 Jan 2012 17:21:47 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> Message-ID: <4F0B222B.9090406@zen.co.uk> If all they want to do is monitor traffic levels and average journey times, then a short - say 10 bit - hash is appropriate. Still not private, but it's enough to get the needed data without overly complicating things. If the hash function is such that the hash changes say every day, or better for every rush hour, then very little private data would be available. -- Peter Fairbrother From tugwilson at gmail.com Mon Jan 9 17:32:04 2012 From: tugwilson at gmail.com (John Wilson) Date: Mon, 9 Jan 2012 17:32:04 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <4F0B222B.9090406@zen.co.uk> References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk> Message-ID: On 9 January 2012 17:21, Peter Fairbrother wrote: > If all they want to do is monitor traffic levels and average journey times, > then a short - say 10 bit - hash is appropriate. Still not private, but it's > enough to get the needed data without overly complicating things. > > If the hash function is such that the hash changes say every day, or better > for every rush hour, then very little private data would be available. Quite so. However they started with an 18 bit hash and then moved to 24 bits. It looks like they want to have some collisions (so that they can claim it's not personal data) but to have as small a number as possible to allow them to see long term patterns. I'm not against this. I can see that there my well be significant advantage for a planner to have access to detailed travel information over an extended period of time. My problem is that this is effectively personal data and they are using sleight of hand to deny that and hence dodge their responsibility for handling it carefully. John Wilson From lists at internetpolicyagency.com Mon Jan 9 17:32:16 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 9 Jan 2012 17:32:16 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <4F0B222B.9090406@zen.co.uk> References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk> Message-ID: In article <4F0B222B.9090406 at zen.co.uk>, Peter Fairbrother writes >If the hash function is such that the hash changes say every day, or >better for every rush hour, then very little private data would be >available. I seems it isn't. But if one has access to the output data, then it occurs to me that an easy attack on the hash function (for a particular plate) would be to drive a car, with that as a false numberplate, past a camera at 3am, then looking at the results in the morning. -- Roland Perry From lists at internetpolicyagency.com Mon Jan 9 17:53:58 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 9 Jan 2012 17:53:58 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk> Message-ID: In article , John Wilson writes >I can see that there my well be significant >advantage for a planner to have access to detailed travel information >over an extended period of time. My problem is that this is >effectively personal data and they are using sleight of hand to deny >that and hence dodge their responsibility for handling it carefully. Is it enough that the planners [presumably] don't have a tool to turn the hashed data into real cars (so they can for example spy on ex-girlfriends) or is it the danger that 3rd parties involved in more serious data leaks (legal or otherwise) potentially aided by specific attacks on the hashing, which is the bigger concern? -- Roland Perry From tugwilson at gmail.com Mon Jan 9 18:50:19 2012 From: tugwilson at gmail.com (John Wilson) Date: Mon, 9 Jan 2012 18:50:19 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk> Message-ID: On 9 January 2012 17:53, Roland Perry wrote: > In article > , John > Wilson writes > >> I can see that there my well be significant >> advantage for a planner to have access to detailed travel information >> over an extended period of time. My problem is that this is >> effectively personal data and they are using sleight of hand to deny >> that and hence dodge their responsibility for handling it carefully. > > > Is it enough that the planners [presumably] don't have a tool to turn the > hashed data into real cars (so they can for example spy on ex-girlfriends) > or is it the danger that 3rd parties involved in more serious data leaks > (legal or otherwise) potentially aided by specific attacks on the hashing, > which is the bigger concern? I would expect that if you have me a hour's M25 data I could reverse engineer the hashing algorithm in a day or so. Once the hashing algorithm is known many things can happen from a jealous spouse tracking a partner through celebrity staking to helping the planning of the assassination of a major public figure. The problem, as I see it, is that the people collecting and storing this information don't believe it's sensitive. If they think it's not sensitive they won't go to the trouble and expense of protecting it properly e.g. they will send raw data - probably on a CD in the post - to random academics and employees of engineering companies. Eventually somebody will buy a hard disk off eBay and find a years worth of traffic data fron central London. John Wilson From lists at internetpolicyagency.com Mon Jan 9 21:30:14 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Mon, 9 Jan 2012 21:30:14 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk>

Message-ID: <3cQ0FhDmx1CPFARZ@perry.co.uk> In article , John Wilson writes >Once the hashing algorithm is known many things can happen from a >jealous spouse tracking a partner through celebrity staking to helping >the planning of the assassination of a major public figure. There are probably simpler ways of knowing where someone will be. I only know of two green camera locations in the Nottingham metro area for example (and they are normally the sort of thing I notice). >The problem, as I see it, is that the people collecting and storing >this information don't believe it's sensitive. If they think it's not >sensitive they won't go to the trouble and expense of protecting it >properly e.g. they will send raw data - probably on a CD in the post - >to random academics and employees of engineering companies. Eventually >somebody will buy a hard disk off eBay and find a years worth of >traffic data And which year would that be? 2005 perhaps. >fron central London. I've never actually seen one of the green cameras in London - maybe the Highways Agency thinks it's unproductive to try and improve flows there. Does anyone here have a map of where the cameras are? -- Roland Perry From igb at batten.eu.org Mon Jan 9 23:04:35 2012 From: igb at batten.eu.org (Ian Batten) Date: Mon, 9 Jan 2012 23:04:35 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk>

Message-ID: <1150DAD0-8DA5-4619-9BF9-20CC6FF8AA7E@batten.eu.org> On 9 Jan 2012, at 1850, John Wilson wrote: > > The problem, as I see it, is that the people collecting and storing > this information don't believe it's sensitive. They might also make the point, which is not entirely without merit, that in order to use the data for most of the purposes proposed you would need to breach the data protection act to find the registered keeper of the vehicle, or find the vehicles that your subject is the registered keeper of. And in many cases, especially those you're invoking about assassinations, it's unlikely the target would be the registered keeper anyway. Knowing the registration mark of the vehicle David Cameron travels in from one day to the next is, I suggest, difficult. If your response is "ah, but I know the registration mark of my perhaps-errant spouse's car" then I'd suggest that, rather than go to the effort of stealing data from the ANPR systems, I'd just place a GPS tracker on his/her car, to which I presumably have access. Once you reduce the use-case to vehicles for which you can obtain registration marks without breaching other laws, but which you do not have physical access to, but where coarse-grained data on historic locations would be of value, you're really dredging for applications. > to random academics and employees of engineering companies. Eventually > somebody will buy a hard disk off eBay and find a years worth of > traffic data fron central London. > Suppose I have a copy of the movement data of vehicles from last year. So what? You local garage presumably has ANPR records of every vehicle which has bought petrol there for the past months or years. Suppose it were stolen. What's the risk? I think the idea that you can drive around in public, in a taxed, insured vehicle with big clear identification marks at each end, where there are clear public interests in ensuring that the vehicle is taxed, insured and MoT'd, and where a variety of crimes can be deterred, detected and punished by simply reading the identifying marks placed there for that very purpose, and still have an expectation that you can do so without your location being occasionally made available is fantastical. Cars are dangerous things, which society rightly regulates in terms of who can own and use and the conditions under which they can be owned and used. I think claiming that you have a right to anonymity under those circumstances is a real case of begging the question. ian From ukcrypto at sourcetagged.ian.co.uk Tue Jan 10 08:59:38 2012 From: ukcrypto at sourcetagged.ian.co.uk (Ian Mason) Date: Tue, 10 Jan 2012 08:59:38 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <1150DAD0-8DA5-4619-9BF9-20CC6FF8AA7E@batten.eu.org> References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk>

<1150DAD0-8DA5-4619-9BF9-20CC6FF8AA7E@batten.eu.org> Message-ID: <3EF22CFB-62A1-46D0-92FF-2ED7C13D9B7E@sourcetagged.ian.co.uk> On 9 Jan 2012, at 23:04, Ian Batten wrote: > > I think the idea that you can drive around in public, in a taxed, > insured vehicle with big clear identification marks at each end, > where there are clear public interests in ensuring that the vehicle > is taxed, insured and MoT'd, and where a variety of crimes can be > deterred, detected and punished by simply reading the identifying > marks placed there for that very purpose, and still have an > expectation that you can do so without your location being > occasionally made available is fantastical. Cars are dangerous > things, which society rightly regulates in terms of who can own and > use and the conditions under which they can be owned and used. I > think claiming that you have a right to anonymity under those > circumstances is a real case of begging the question. > What people have a problem with is their location being made available in circumstances other than those where it is clearly necessary. The clearly necessary circumstances are ones that the vehicle identification marks were designed for - causing damage, breaching the law, etc. Outside those circumstances you do have a right to anonymity and for your privacy not to be interfered with. While many hypothetical cases for privacy have been made here, stalking et al, there is a presumption in law (HRA) and in implicit social codes of conduct for a right to respect for privacy and family life, and systems that can breach those ought to be designed to effectively protect them except in the necessary circumstances and only in those circumstances. In the case in point, monitoring traffic flows by recording individual vehicle movements, there is clearly a risk to legitimate privacy and there are clearly steps that can be taken in the design of systems to do this that would protect privacy without defeating the purpose of the systems or increasing their costs in any significant way. Given that that is the case, these systems should be so designed. Failing to do so is sloppy and shows little respect or even contempt for people's privacy rights. Ian From ukcrypto at sourcetagged.ian.co.uk Tue Jan 10 09:07:57 2012 From: ukcrypto at sourcetagged.ian.co.uk (Ian Mason) Date: Tue, 10 Jan 2012 09:07:57 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk> Message-ID: <7B72668E-FC30-4C44-8F54-2F626F5484A8@sourcetagged.ian.co.uk> On 9 Jan 2012, at 17:32, Roland Perry wrote: > In article <4F0B222B.9090406 at zen.co.uk>, Peter Fairbrother > writes >> If the hash function is such that the hash changes say every day, >> or better for every rush hour, then very little private data would >> be available. > > I seems it isn't. > > But if one has access to the output data, then it occurs to me that > an easy attack on the hash function (for a particular plate) would > be to drive a car, with that as a false numberplate, past a camera > at 3am, then looking at the results in the morning. Or to put it in cryptographic terms - a known plaintext attack with complexity of O(1). When put like that, it's so starkly ineffective a protection it amounts to no protection at all. From james2 at jfirth.net Tue Jan 10 11:47:32 2012 From: james2 at jfirth.net (James Firth) Date: Tue, 10 Jan 2012 11:47:32 -0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120107180303.7806668d@peterson.fenrir.org.uk> Message-ID: <002f01cccf8d$a58f6bc0$f0ae4340$@net> Roland Perry wrote: > That's essentially the same as the 24-bit hash used by the Highways > Agency, which while not unique to every vehicle is plenty good enough > as > evidence in a murder investigation. Rather than give the entire feed to the police, surely it is possible to obtain a compromise whereby certain hashes can be added to a "watch list". Upon matching, the entire car index plate, location etc is revealed to the police. Oversight will then consist of accurate reports by the council/HA etc of the number of plates concurrently on the watch list each reporting period. This at least prevents some enterprising police forces storing the raw feed indefinitely. James Firth From igb at batten.eu.org Tue Jan 10 11:51:58 2012 From: igb at batten.eu.org (Ian Batten) Date: Tue, 10 Jan 2012 11:51:58 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <3EF22CFB-62A1-46D0-92FF-2ED7C13D9B7E@sourcetagged.ian.co.uk> References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk>

<1150DAD0-8DA5-4619-9BF9-20CC6FF8AA7E@batten.eu.org> <3EF22CFB-62A1-46D0-92FF-2ED7C13D9B7E@sourcetagged.ian.co.uk> Message-ID: On 10 Jan 2012, at 0859, Ian Mason wrote: > While many hypothetical cases for privacy have been made here, stalking et al, there is a presumption in law (HRA) and in implicit social codes of conduct for a right to respect for privacy and family life, and systems that can breach those ought to be designed to effectively protect them except in the necessary circumstances and only in those circumstances. I would be somewhat surprised were Article 8 rights to extend to driving cars. I'd certainly want to see some case law. > > In the case in point, monitoring traffic flows by recording individual vehicle movements, there is clearly a risk to legitimate privacy I'm not so sure: I think it's at least arguable that driving a car is a privilege, not a right (cf the license you need in order to do it) and the state therefore has different obligations and constraints as compared to something that doesn't require a license. I don't have a dog in this fight, and I'm more interested in exploring the issues rather than declaiming a fixed position, but I'm not at all convinced that a right to drive without data being incidentally gathered about you really exists. Perhaps it should, but I don't think it exists today. ian From lists at internetpolicyagency.com Tue Jan 10 12:01:21 2012 From: lists at internetpolicyagency.com (Roland Perry) Date: Tue, 10 Jan 2012 12:01:21 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <002f01cccf8d$a58f6bc0$f0ae4340$@net> References:

<20120107180303.7806668d@peterson.fenrir.org.uk> <002f01cccf8d$a58f6bc0$f0ae4340$@net> Message-ID: In article <002f01cccf8d$a58f6bc0$f0ae4340$@net>, James Firth writes >> That's essentially the same as the 24-bit hash used by the Highways >>Agency, which while not unique to every vehicle is plenty good enough >> evidence in a murder investigation. > >Rather than give the entire feed to the police, surely it is possible to >obtain a compromise whereby certain hashes can be added to a "watch list". >Upon matching, the entire car index plate, location etc is revealed to the >police. > >Oversight will then consist of accurate reports by the council/HA etc of the >number of plates concurrently on the watch list each reporting period. > >This at least prevents some enterprising police forces storing the raw feed >indefinitely. I'd have thought historic data was of more use, and it depends on the query how intrusive it is. If hypothetically the police asked for "every Range Rover[1] in West London on 26th April 1999", that would be reasonably proportionate and not involve releasing the entire database. [1] HA would have to ask DVLA for some correlating information. -- Roland Perry From tugwilson at gmail.com Tue Jan 10 12:03:26 2012 From: tugwilson at gmail.com (John Wilson) Date: Tue, 10 Jan 2012 12:03:26 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: <002f01cccf8d$a58f6bc0$f0ae4340$@net> References:

<20120107180303.7806668d@peterson.fenrir.org.uk> <002f01cccf8d$a58f6bc0$f0ae4340$@net> Message-ID: On 10 January 2012 11:47, James Firth wrote: > Roland Perry wrote: >> That's essentially the same as the 24-bit hash used by the Highways >> Agency, which while not unique to every vehicle is plenty good enough >> as >> evidence in a murder investigation. > > Rather than give the entire feed to the police, surely it is possible to > obtain a compromise whereby certain hashes can be added to a "watch list". > Upon matching, the entire car index plate, location etc is revealed to the > police. > > Oversight will then consist of accurate reports by the council/HA etc of the > number of plates concurrently on the watch list each reporting period. > > This at least prevents some enterprising police forces storing the raw feed > indefinitely. In the Bucks CC scheme the Council owned and run cameras produce two data streams. One contains only the hash (it is claimed) and is polled by the Council's data centre. The other contains the full number plate data and is polled by Thames Valley Police. There is a reciprocal arrangement whereby the hash values from the Thames Valley Police cameras around Aylesbury are sent to the Council. In effect all traffic management ANPR cameras are also Police ANPR cameras. I'm not clear on the details of this arrangement but I have an FoI request pending and fully expect to get a copy of the Memorandum of Agreement which covers this. This Bucks CC scheme was funded by central government to the tune of ?350,000 for ANPR and CCTV cameras alone (govt funded the Aylesbury Urban Traffic Management and Control scheme to the tune of ?4m in all). This appears to be seen as a model for further schemes by the traffic management community. Whist the location of the Council owned cameras are published the location of the TVP cameras used by the scheme are not. It's possible an FoI request to the council might force disclosure but I haven't tried that yet. John Wilson From clive at davros.org Tue Jan 10 12:43:23 2012 From: clive at davros.org (Clive D.W. Feather) Date: Tue, 10 Jan 2012 12:43:23 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

Message-ID: <20120110124323.GC59956@davros.org> John Wilson said: > The hash doesn't change over time. There's a FOI response from the > Highways Agency which confirms that. > (http://www.whatdotheyknow.com/request/48353/response/124187/attach/html/2/FOI%20response%20ref%2013068772.doc.html) Actually, it doesn't say that. If the person writing the answer thinks of the hash algorithm as being based on (say) the date rather than the date being something that's hashed, they would have answered the way they did. -- Clive D.W. Feather | If you lie to the compiler, Email: clive at davros.org | it will get its revenge. Web: http://www.davros.org | - Henry Spencer Mobile: +44 7973 377646 From clive at davros.org Tue Jan 10 12:49:24 2012 From: clive at davros.org (Clive D.W. Feather) Date: Tue, 10 Jan 2012 12:49:24 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> Message-ID: <20120110124924.GD59956@davros.org> John Wilson said: > However the number plate layout introduced in September 2001 should > not require as much merging as the letters and digits are readily > distinguishably by position. Unfortunately not. Compare YB 54 ODK with Y 854 ODK with YBS 400 K. All valid registrations. (If you delve far enough, it's possible to find registrations that differ only in the use of I v 1, such as EI 2 versus E 12.) -- Clive D.W. Feather | If you lie to the compiler, Email: clive at davros.org | it will get its revenge. Web: http://www.davros.org | - Henry Spencer Mobile: +44 7973 377646 From ukcrypto at sourcetagged.ian.co.uk Tue Jan 10 13:21:20 2012 From: ukcrypto at sourcetagged.ian.co.uk (Ian Mason) Date: Tue, 10 Jan 2012 13:21:20 +0000 Subject: Buckinghamshire CC ANPR cameras In-Reply-To: References:

<20120109152618.GE7359@davros.org> <4F0B222B.9090406@zen.co.uk>

<1150DAD0-8DA5-4619-9BF9-20CC6FF8AA7E@batten.eu.org> <3EF22CFB-62A1-46D0-92FF-2ED7C13D9B7E@sourcetagged.ian.co.uk>