Thursday 18th August 2005

Are scamera images inadmissable?

Bad security undermines speed camera evidence

---

Are its images secure?

Speeding convictions in Australia's state of New South Wales are under attack, following the possibility that the scamera images underpinning speeding cases could have been tampered with. The state's cameras make some AUS$1m a week in fines -- that's about £420,000.

According to one report (see link below), a group of maths enthusiasts has proven that the encryption algorithm, MD5, used to encrypt the images could be broken. This led to a case being thrown out of court by a local magistrate when the state's authorities could not prove that the speed camera's image was definitely taken when the police claimed it was.

No expert could be found to testify that the algorithm made the pictures secure, so the numbers showing time and place of the image could have been changed.

Local motoring group the NMA said that it was crucial the public had confidence in convictions, and called for "a full audit and a review of the system to ensure that it is working appropriately."

The result is that Australia's Roads and Traffic Authority admitted it that could not prove the authenticity of its pictures and that every fine underpinned by pictures taken by speed cameras could be invalid.

The case, seen by Sydney magistrate Lawrence Lawson, has been adjourned for eight weeks so that the RTA can unearth an expert willing to testify that the images are tamper-proof.

It would be interesting to see how much security surrounds images in the UK...

• Magistrate throws out speeding case

[bridgland]

I work in the IT industry and this research is full of holes, but the problem here is that the road traffic agency couldn't get a credible expert to refute the claims that this data wasn't stored in a tamperproof way.

For those of you who might like to know, they use this aglorithm to provide a unique key based on the binary map of a file or piece of text (it doesn't matter) but the claims are that you can get this file, modify it under the covers and put it back and still generate the same key. Very difficult to do right now, and you would have to have got past their network security to do it. Alternatively find the guy who wrote the application and make it an inside job and you're off scott free.

[bridgland]

puggit said:

annodomini2 said: Some big holes in the article though, you can't use MD5 to encrypt images for recovery, its a one way algorithm, they could encrypt the images, but once its encrypted they would be unable to recover the image. >> Edited by annodomini2 on Thursday 18th August 13:56 Ummm - not so sure about this... How about EMC Centera?

The product you talk about would knock this argument for six and the poor motorist would be paying. However that is a storage product and these people were doing all this up in the application and using it to provide a unique key of the details about when the photo was taken and therefore holding that as a guarantee of authenticity, when if they had only held it as an intrinsic part of the metadata of the image, then it would have been game over and a fine would have been inevitable.

The problem with this is that I have spouted on about something that wouldn't let anyone off with this sort of defense. So I am not really helping the cause of a motorist who uses his or her judgement of the road conditions, time of day, reading the surroundings, etc. to make swift and safe passage to their chosen destination, while at the same time enjoying the thrill of driving.

The key thing here is that the technology used to catch speeding drivers, can be blown away if you take time to understand the technology used.