Automatic license plate readers, which use networked surveillance cameras and simple image recognition to track the movements of cars around a city, may have met their match, in the form of a T-shirt. Or a dress. Or a hoodie.
The anti-surveillance garments were revealed at the DefCon cybersecurity conference in Las Vegas on Saturday by the hacker and fashion designer Kate Rose, who presented the inaugural collection of her Adversarial Fashion line.
Rose credits a conversation with a friend, the Electronic Frontier Foundation researcher Dave Maass, for inspiring the project: “He mentioned that the readers themselves are not very good,” she said. “They already read in things like picket fences and other junk. I thought that if they’re fooled by a fence, then maybe I could take a crack at it.”
To human eyes, Rose’s fourth amendment T-shirt contains the words of the fourth amendment to the US constitution in bold yellow letters. The amendment, which protects Americans from “unreasonable searches and seizures”, has been an important defense against many forms of government surveillance: in 2012, for instance, the US supreme court ruled that it prevented police departments from hiding GPS trackers on cars without a warrant.
But to an automatic license plate reader (ALPR) system, the shirt is a collection of license plates, and they will get added to the license plate reader’s database just like any others it sees. The intention is to make deploying that sort of surveillance less effective, more expensive, and harder to use without human oversight, in order to slow down the transition to what Rose calls “visual personally identifying data collection”.
“It’s a highly invasive mass surveillance system that invades every part of our lives, collecting thousands of plates a minute. But if it’s able to be fooled by fabric, then maybe we shouldn’t have a system that hangs things of great importance on it,” she said.
Rose likens her work to that of other security researchers at DefCon. “If a phone is discovered to have a vulnerability, we don’t throw our phones away. This is like that, disclosing a vulnerability. I was shocked it was so easy, and I would call on people who think these systems are critical to find better ways to do that verification.”
Elsewhere at the convention, Droogie, a hacker, described a rather less successful way of testing the cybersecurity of license plates: registering a custom license plate with the California department of motor vehicles that read “NULL”, the code used in a number of common database systems used to represent an empty entry.
Unfortunately, rather than giving him the power of administrative invisibility, Droogie experienced almost exactly the opposite outcome, receiving more than $12,000 in driving tickets. Every single speeding ticket for which no valid license plate could be found was assigned to his car. The Los Angeles police departmenteventually scrapped the tickets but advised the hacker to change his plates, or the same problem would continue to hit him.
The anti-ALPR fabric is just the latest example of “adversarial fashion”, albeit the first to be targeted against car trackers. In 2016, the Berlin-based artist and technologist Adam Harvey worked with international interaction studio Hyphen-Labs to produce the Hyperface textile, fabric printed with a seemingly abstract pattern designed to trigger facial recognition systems.
On Monday, the owners of the King’s Cross development in central London were revealed to be applying facial recognition without consent on any visitor to the 67-acre estate. The UK’s Information Commissioner warned the landowners that such use may not be legal under existing law.
