8 ms·

Security lapse exposed a Chinese smart city surveillance system

212 points by gulbrandr 7y ago

MeteorMarc 7y ago
Curious that they have a column "attractive" in the person's features which seems to correlate with age ...
- crehn 7y ago
  Curious about the other variables affecting it. Perhaps facial feature ratios compared to some gold standard?
  - Angostura 7y ago
    Could well be a simple symmetry measure.
    - deleted 7y ago
      [deleted]
  - bonoboTP 7y ago
    It is probably just trained on labeled data.
  - HNLurker2 7y ago
    The in... in me: good jaw not weak chin, great forehead size, eyecolor with eyebrows, and overall Cha... Good face structure with low body fat 12%-13%
- yorwba 7y ago
  They're likely using a commercial facial recognition system which includes that feature for demos at trade shows. People love getting external validation, which also explains why the scores are all greater than 70. Edit: E.g. this article mentions a system being demoed with that feature: https://www.npr.org/sections/parallels/2018/04/03/598012923/facial-recognition-in-china-is-big-business-as-local-governments-boost-surveilla https://www.npr.org/sections/parallels/2018/04/03/598012923/...
  - saagarjha 7y ago
    Numbers don’t really say much unless you pin them to what they’re measuring: they might not be calibrated against a percentile. For example, on a linear scale with 0 being “horrendous” and 100 being “insanely attractive”, I’d rate most of the people I know much closer to 70 than a 50: the average person could stand to look a lot worse.
    - bluntfang 7y ago
      >Numbers don’t really say much unless you pin them to what they’re measuring That's why it has the label "attractive"
      - simonh 7y ago
        Sigh, there's always one. The point is that's not a sufficiently clear definition of what's being measured. Someone I find attractive you might find unattractive, because it's a subjective attribute, so 'attractiveness' isn't an unambiguous description of what the algorithm is actually measuring.
        johncolanduoni 7y ago
        If it’s a feature for making people who try your system at a trade show feel good about themselves as they said, it works best if it’s not measuring anything at all.
        bluntfang 7y ago
        have you read the thread you're participating in? I digress, surely naming is really hard. there's a sweet spot to hit short and sufficiently explanative. Perhaps this didn't hit it for you, but it probably did for the target audience, and if it didn't, they could call support for the product they paid for.
isoprophlex 7y ago
> The system also uses its facial recognition systems to detect ethnicities and labels them — such as “汉族” for Han Chinese, the main ethnic group of China — and also “维族” — or Uyghur Muslims, an ethnic minority under persecution by Beijing. I'm getting some strong ww2 death camp vibes from this...
- fit2rule 7y ago
  This is way, way beyond death camps, buddy. This is room 101.
  - barry-cotter 7y ago
    Oh come on. They’re attempting to “re-educate” a culture out of existence, to prevent the transmission of a language, a religion and an identity, a culture and using the most brutal methods to do so but there are no plans to kill everyone. It’s quite evil enough without trivialising actual attempts at genocide, like in Rwanda, WWII or the Dzhungar genocide. This is an attempt at cultural erasure, not a full blown plan to kill everyone of a particular ethnicity. The PRC party-state will gladly take any Uyghur who will cast off their culture and treat them as a loyal citizen.
    - SOMEONEISWRONG 7y ago
      The PRC party-state will gladly take any Uyghur who will cast off their culture and treat them as a loyal citizen. IIRC, that was the sole purpose of Room 101- to make people "love" their country / governing body.
    - 5trokerac3 7y ago
      They're smart enough to do essentially the same thing, but in a "soft" manner: overwhelm the area with Han Chinese and make it as difficult as possible for the local population to thrive, turning the once majority ethnic group into a almost non-existent minority over many generations (they've also done this in Tibet). The Chinese are calculating their empiric efforts over centuries. It's one of the "benefits" of a totalitarian regime.
deleted 7y ago
[deleted]
CallMePK 7y ago
This is just so sad. 1984 is not supposed to be a manual.
- chapium 7y ago
  China has a very different view of personal liberty.
- simonh 7y ago
  I read an interview with a former KGB officer who said that, while the book was formally banned in the soviet union, it was circulated among national security types as a useful fund of ideas.
  - pchr8 7y ago
    Do you have a link for the interview?
    - simonh 7y ago
      This was maybe a decade or so after the fall of the USSR, in one of those old fashioned paper magazine things.
- chmars 7y ago
  Neither the Snowden leaks. In many countries, the became the blueprint for new security laws …
- lioeters 7y ago
  Seeing the phrase "smart city" was the trigger for me, the stink of Newspeak and Doublethink is unmistakable. Shame on Eurasia, I mean, Eastasia..
yohann305 7y ago
from the article: “The security researcher passed details of the database to TechCrunch in an effort to get the data secured” How is the data more secured by sending it to a news agency? Can someone explain? IMHO it’s the exact opposite, data is getting more eyeballs now, right?
- curuinor 7y ago
  Schneier is of the opinion that the threat of full disclosure is what makes 'responsible' disclosure work, if i recall correctly https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html https://www.schneier.com/essays/archives/2007/01/schneier_fu... Now, obviously, this cycle hasn't been gone through in the PRC
- wigginus 7y ago
  Secure(d) has two meanings, in this case it has the meaning "obtained". See #10 at https://www.dictionary.com/browse/secure https://www.dictionary.com/browse/secure.
baud147258 7y ago
> Elasticsearch database Considering that ES db aren't secured by default, it's not surprising that someone downloaded the data
AFascistWorld 7y ago
Recently China captured a fugitive when he was sending friends to board a plane, 4 images with 98% similarity captured by the airport's cameras. https://www.scmp.com/news/china/society/article/3007827/chinese-student-wanted-killing-mother-captured-after-three-years https://www.scmp.com/news/china/society/article/3007827/chin...
headsoup 7y ago
Surely this is one of those technological advances where on reviewing the 'should we' it becomes clear the negatives far outweigh the positives and it is stopped... Surely. Reminds me of a radio interview I heard this morning from a mining CEO awaiting environmental sign-off for a new mine: equipment and resources ready to get going with a couple of days notice. Not even a matter of if, but when.

212 points by gulbrandr 7y ago

MeteorMarc 7y ago

Curious that they have a column "attractive" in the person's features which seems to correlate with age ...

crehn 7y ago
Curious about the other variables affecting it. Perhaps facial feature ratios compared to some gold standard?
- Angostura 7y ago
  Could well be a simple symmetry measure.
  - deleted 7y ago
    [deleted]
- bonoboTP 7y ago
  It is probably just trained on labeled data.
- HNLurker2 7y ago
  The in... in me: good jaw not weak chin, great forehead size, eyecolor with eyebrows, and overall Cha... Good face structure with low body fat 12%-13%
yorwba 7y ago
They're likely using a commercial facial recognition system which includes that feature for demos at trade shows. People love getting external validation, which also explains why the scores are all greater than 70. Edit: E.g. this article mentions a system being demoed with that feature: https://www.npr.org/sections/parallels/2018/04/03/598012923/facial-recognition-in-china-is-big-business-as-local-governments-boost-surveilla https://www.npr.org/sections/parallels/2018/04/03/598012923/...
- saagarjha 7y ago
  Numbers don’t really say much unless you pin them to what they’re measuring: they might not be calibrated against a percentile. For example, on a linear scale with 0 being “horrendous” and 100 being “insanely attractive”, I’d rate most of the people I know much closer to 70 than a 50: the average person could stand to look a lot worse.
  - bluntfang 7y ago
    >Numbers don’t really say much unless you pin them to what they’re measuring That's why it has the label "attractive"
    - simonh 7y ago
      Sigh, there's always one. The point is that's not a sufficiently clear definition of what's being measured. Someone I find attractive you might find unattractive, because it's a subjective attribute, so 'attractiveness' isn't an unambiguous description of what the algorithm is actually measuring.
      - johncolanduoni 7y ago
        If it’s a feature for making people who try your system at a trade show feel good about themselves as they said, it works best if it’s not measuring anything at all.
      - bluntfang 7y ago
        have you read the thread you're participating in? I digress, surely naming is really hard. there's a sweet spot to hit short and sufficiently explanative. Perhaps this didn't hit it for you, but it probably did for the target audience, and if it didn't, they could call support for the product they paid for.

isoprophlex 7y ago

> The system also uses its facial recognition systems to detect ethnicities and labels them — such as “汉族” for Han Chinese, the main ethnic group of China — and also “维族” — or Uyghur Muslims, an ethnic minority under persecution by Beijing. I'm getting some strong ww2 death camp vibes from this...

fit2rule 7y ago
This is way, way beyond death camps, buddy. This is room 101.
- barry-cotter 7y ago
  Oh come on. They’re attempting to “re-educate” a culture out of existence, to prevent the transmission of a language, a religion and an identity, a culture and using the most brutal methods to do so but there are no plans to kill everyone. It’s quite evil enough without trivialising actual attempts at genocide, like in Rwanda, WWII or the Dzhungar genocide. This is an attempt at cultural erasure, not a full blown plan to kill everyone of a particular ethnicity. The PRC party-state will gladly take any Uyghur who will cast off their culture and treat them as a loyal citizen.
  - SOMEONEISWRONG 7y ago
    The PRC party-state will gladly take any Uyghur who will cast off their culture and treat them as a loyal citizen. IIRC, that was the sole purpose of Room 101- to make people "love" their country / governing body.
  - 5trokerac3 7y ago
    They're smart enough to do essentially the same thing, but in a "soft" manner: overwhelm the area with Han Chinese and make it as difficult as possible for the local population to thrive, turning the once majority ethnic group into a almost non-existent minority over many generations (they've also done this in Tibet). The Chinese are calculating their empiric efforts over centuries. It's one of the "benefits" of a totalitarian regime.

deleted 7y ago

[deleted]

CallMePK 7y ago

This is just so sad. 1984 is not supposed to be a manual.

chapium 7y ago
China has a very different view of personal liberty.
simonh 7y ago
I read an interview with a former KGB officer who said that, while the book was formally banned in the soviet union, it was circulated among national security types as a useful fund of ideas.
- pchr8 7y ago
  Do you have a link for the interview?
  - simonh 7y ago
    This was maybe a decade or so after the fall of the USSR, in one of those old fashioned paper magazine things.
chmars 7y ago
Neither the Snowden leaks. In many countries, the became the blueprint for new security laws …
lioeters 7y ago
Seeing the phrase "smart city" was the trigger for me, the stink of Newspeak and Doublethink is unmistakable. Shame on Eurasia, I mean, Eastasia..

yohann305 7y ago

from the article: “The security researcher passed details of the database to TechCrunch in an effort to get the data secured” How is the data more secured by sending it to a news agency? Can someone explain? IMHO it’s the exact opposite, data is getting more eyeballs now, right?

curuinor 7y ago
Schneier is of the opinion that the threat of full disclosure is what makes 'responsible' disclosure work, if i recall correctly https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html https://www.schneier.com/essays/archives/2007/01/schneier_fu... Now, obviously, this cycle hasn't been gone through in the PRC
wigginus 7y ago
Secure(d) has two meanings, in this case it has the meaning "obtained". See #10 at https://www.dictionary.com/browse/secure https://www.dictionary.com/browse/secure.

baud147258 7y ago

> Elasticsearch database Considering that ES db aren't secured by default, it's not surprising that someone downloaded the data

AFascistWorld 7y ago

Recently China captured a fugitive when he was sending friends to board a plane, 4 images with 98% similarity captured by the airport's cameras. https://www.scmp.com/news/china/society/article/3007827/chinese-student-wanted-killing-mother-captured-after-three-years https://www.scmp.com/news/china/society/article/3007827/chin...

headsoup 7y ago

Surely this is one of those technological advances where on reviewing the 'should we' it becomes clear the negatives far outweigh the positives and it is stopped... Surely. Reminds me of a radio interview I heard this morning from a mining CEO awaiting environmental sign-off for a new mine: equipment and resources ready to get going with a couple of days notice. Not even a matter of if, but when.