Tech Support : support@safience.io

Contact

Blog

Future Shock? ‘Building Siris,’ Building Trust And Securing A Smarter World

Posted on by kmurali@biometrica.com

(Above: The initial conceptual master plan for Kingdom City, Jeddah, Saudi Arabia; courtesy Paul Doherty.)

By Kadambari M. Wade

Architect. Innovator. Integrator. Traveler. Paul Doherty, President & CEO of TDG [The Digit Group, Inc.], is one of the world’s foremost authorities on the coming together of the worlds of built spaces and technology, and the processes that bind and define them. He now spends his time traveling around the globe, implementing Smart City solutions for governments and private groups. Biometrica caught up with Doherty, also the co-founder of the AEC Hackathon — which launched at the Facebook Headquarters three years ago — for a fascinating conversation on the future of security in the cyber-physical environments our world is moving toward. Here is Part I of that discussion.

KMW: Let’s get down to the basics straightaway. How does innovation change the game as far as built spaces go?

PD: Innovation changes things, sometimes, it changes everything. A hundred and fifty years ago, an innovation like the elevator changed the shape of cities. What we’re looking at right now, whether it’s the Internet of Things, the advent of autonomous vehicles, etcetera, they’re also going to change the shape of cities. Take autonomous vehicles. Our roads will be narrower, because you don’t need extra space to drive. There won’t be any need for traffic lights, and parking lots will be a thing of the past.

Why will roads be narrower?

© Monicaodo | Dreamstime.com
© Monicaodo | Dreamstime.com

Well, because you don’t have to make allowance for the human fudge factor. The reason roads are so wide is because, in case you lose control, you have the space to get back control of your car relatively easily — that’s why roads are far wider than the actual width of vehicles. In the world of autonomous vehicles though, you have no need for that extra room; the driving will be more perfect than human, and it [the vehicle] will have a different type of relationship with humans — it has the intelligence to not run you over. This, in turn, would lead to a different way of thinking about things like how you walk through a city, or how you cross a road. Those intersections of design are really interesting, and it really does create a cyber-physical relationship with the results. Those results are narrower lanes, and curbs that are necessary only because that’s where the streetlights will be.

So we will still have streetlights? Would that with safety and security needs in mind?

Actually, we have no need for big street lamps in our Smart Cities, because of the way we’re able to use optics, and because of the way we’re able to use LED. A road will be fed by a kind of thermal profile way of distributing a stream of light.

That seems quite out of the movies, doesn’t it?

We’re actually using the technology being used by the Department of Defense with the U.S. Navy, it’s what they use when they line up aircraft carrier runways. Now we’ll put that into roadways, but the road, additionally, will also have an additive in it, which will reflect and allow for an even flow of light, so the entire roadway gets lit up, almost like a bolt.

Logically, that probably also means more energy efficiency, because we’re not using high-energy street lighting.

Yes! And with lower amounts of energy, you get better safety because of the way light is dispersed. Then, because it’s LED, and LED has a certain type of wavelength, you can run Internet Protocol on top of it. So now you also have the 10G Wi-Fi network that’s built within the lighting of the roads.

It’s pretty incredible, how it all ties together.

It does. It’s like an ecosystem.

But that brings us to the question of someone hacking into that physical ecosystem. That’s got to be a worry, it would be for most of us.

That is our biggest question actually — security. How do you lock that down? We’ve all seen science fiction or futuristic thriller-type movies, and have watched bad people take over the traffic lights of cities.

At the very least. Among other things!

TDG CEO Paul Doherty (left, in black) in conversation with colleagues.
TDG CEO Paul Doherty (left, in black) in conversation with colleagues and outside design consultants, on the layout for Kingdom City, in TDG’s office in Guangzhou, China.

We’ve been thinking of that as well. And the question we’ve focused on is this: What are we trying to do in terms of security? We want to make sure that the physical and the cyber are both protected in terms of security in very big ways, and some of those ways are to take a look at the actual bits and bytes that make up a piece of data themselves. Instead of waiting for that data to be put into a document, like we do with computers, it’s really the flow of data that is more important to us — to city managers, city designers, city constructors. And because of that flow of data, we have to make sure that, at any given time, wherever that data wants to go, it’s secured, even through transmission.

Isn’t transmission secured already?

The way technology is secured today, we first wait for the effect of what is available to really then “wrap” it, like a file, a document, a folder, or even a transmission like a VPN [Virtual Private Network]. What we’re now saying is this: Let’s get ahead of that, and start to secure that digital piece of data so that it wraps itself like it’s invisible, wherever it goes.

Wow. So if you can’t see it, you can’t hack it?

Yes. One of the big complaints out there with autonomous vehicles is, “Oh, you know, the hackers are going to get in.” Well, what happens when your operating system is invisible, so they don’t even know what to hack? That’s the cat and mouse game that’s being developed, with some really cool stuff coming out of places like MIT.

Back to cyber-physical systems, they’re pretty much already there: From the Smart Grid to the smartphone to talking refrigerators to intelligent buildings. From the security of physical spaces aspect, what would the new nature of security look like? One part, of course, would be to make the OS invisible to malcontents, as you’ve mentioned, but how would you look at the future of security in our connected ecosystem?

Great question. When it comes to the building itself, it’s already been affected by technology in many different ways. There are, as you mentioned, buildings that are intelligent. For instance, there are sensors now that know, through autonomous ways of looking at data, that there are 15 people on the third floor. What would take it further, is understanding that you can then push it down to, say, access controls.

In what way would those access controls be more refined?

© Tyler Olson | Dreamstime.com
© Tyler Olson | Dreamstime.com

The system will know those 15 people’s names, their emergency numbers … Essentially, there would be different protocols of access based on more and more information pertinent to the individual, and the rights that those individuals have. Access to certain spaces is certainly going through a bit of a metamorphosis. Think of the movies in which someone can get hold of a guy’s eyeball, hold it up to a retina machine, and gain access to all the controls.

Or they could cut off a finger, and that’s not just in the movies. 

Yes. Exactly. So what happens now is that it isn’t enough to get hold of that eyeball or finger. That biometric information, say, that particular person’s eyeball, had better be attached to that person’s body, and that person had better be alive. We’re gaining a granularity now, because of the access to greater and greater amounts of data, and big data. Our filtering mechanisms are becoming much more sophisticated through algorithms, and the emergence of what’s now called pattern recognition. As we start to move forward, the lockdown procedures, and the access controls to physical space, will become more and more refined for different types of systems within a building. Call the whole a “Building Siri.”

Artificial intelligence?

But very, very personalized. These Building Siris will become very commonplace, to where the building has a relationship with you. That building will know, because it has access to you — your emails, your text messages, your calendar, etcetera, that it’s you. It will also know what sort of mood you’re going to be in as you enter the lobby, there’s an empathy to it, to that Building Siri. That’s what we’ve learned with AI over time, people begin to trust it, trust a voice, because it’s at your place of work, your place of play, where you go to work out. Wherever you go, whatever your relationship is with the building, that building will begin to know you, just like your best friend.

That sounds, well, somewhat scary, perhaps and very intrusive …

It might be at first. But it’s a relationship of trust, a kind of trust relationship with a built environment that has never happened before. But because of how and where we’re going, in certain cases, we have to have that relationship of trust. For instance, we’re building this building in Jeddah right now [the Jeddah Tower, previously called the Kingdom Tower], which is the world’s tallest building. It’s going to be one kilometer tall. Now, lots of things can happen, as you might imagine, lots of catastrophic things. To start with, it’s also going to be the world’s largest terrorist target, just by default, because of where it is.

Security is obviously of prime concern.

We have to think of security first, but safety as well, and safety and security issues are going to need both macro and micro solutions. The micro solution is going to be that you have a trust relationship with that building over time. The building will let you know, for example, if you feel the building sway, that your anxiety over the building collapsing or something, is okay, but you really needn’t worry.

A building will talk to you, reassure you, build a relationship of trust. © Peshkova | Dreamstime.com
A building will talk to you, reassure you, build a relationship of trust with you.
© Peshkova | Dreamstime.com

You’re saying it’s like having building therapy!

It will almost be like therapy in a sense, where it will listen to you and reassure you, and you’re okay with it doing that. That conversation, or reassurance, could be about anything: What if there’s a fire, and you need to get down, or there’s an explosion of some sort? It will tell you what to do.

Having that trust relationship is two-way, the building also knows that your safety is its primary objective and responsibility. So instead of following some instructions like a floor plan near an elevator that says, “In case of emergency, take this stair” or something, this is much more.

Well, it would need to be more, with the world’s tallest building, wouldn’t it?

Yes, at a kilometer tall, that floor plan pointing to the nearest exit to run out of is probably not the best solution you want! But a building that is programmed to understand that it needs to follow a certain protocol level depending on the situation, which understands that there are certain things that need to happen under certain conditions, which talks to you and reassures you, and is your constant companion, those are the kind of developments we’re now seeing being accelerated.

There’s a but in there somewhere?

The but is because this is all now happening at such speed, and in such a way, that at some not too distant point in the future, we’re also going to have to rein in the public blowout over something like this.

Because it would scare the hell out of people.

Yeah, because it would spook a lot of people. But all that technology exists right now. And the way we’re moving, it has to exist for people’s own safety and security, which is why building that trust with built spaces is so important.

Including at the macro level?

Including the macro solutions. So at the micro level, the solution would be a Building Siri having a relationship with you at any particular moment, at the macro level, it would be about the building protocols we’re be looking at.

Could you be more specific about those protocols?

Let’s take the center of the building as the center of the target. Move outward concentrically, one kilometer at a time, till you hit 100 km. A hundred kilometers out from the center of the building, that’s when the security protocols kick in. Certain things happen from that point, through tools like surveillance, through the use of tools like what Biometrica has.

You mean using security and surveillance technology to map and monitor the physical world?

Yes. You can map that area as the stage from where we start to pay attention to anything that happens, perceived threats, cyber and physical. One kilometer in, each time, as you go in concentrically 99 times, there are different escalations of cyber and physical protocols that have to be put in place. So if you’re tracking someone that’s on an Interpol list, and they enter that 100 km perimeter, now a certain sequence of events begins to happen, of tracking, of surveillance, of interception, potentially.

And the protocols depend on the kind of threat, of course.

If it’s physical, whether it’s a missile, a bomb, some sort of threat, yes, there are protocols that go into effect, concentrically out, to 100 km. We also do that underground, up to 5 km, and then 3 km aboveground. So it’s a three-dimensional matrix, almost like a Rubik’s Cube, that we’re tracking, cyber and physical threats, weaknesses, but also our strengths, and potential opportunities.

Like a SWOT analysis?

We do use a SWOT analysis through the entire process. It’s a fascinating exercise that we go through at the macro level, which will then affect how Building Siri talks to you, when she tells you what to do, potentially ahead of time, so you’re never in danger. That’s what we’re seeing as what the future of Smart Cities is really about. It’s really about safety and security, and the better use of experiences as an after-effect of that.

[Part II of this discussion with Paul Doherty, including a focus on securing a building as an organism, the importance of analytics, ops centers in Smart Cities, dealing with threats in urban environments, and transparency in times of terror, and how physical worlds need to be smarter, will appear in the Biometrica Blogs on Tuesday, Aug. 30, 2016.]

Hope In The Time Of Trouble: Why The Tribal Gaming Protection Network Matters

Posted on by kmurali@biometrica.com

INTRODUCTION

Ten years ago, the National Indian Gaming Association Chairman, Ernest Stevens, Jr., put in place an initiative called the Tribal Gaming Protection Network. The TGPN was envisaged as an advisory body that could provide resources to protect Tribes from internal and external threats, and share information on cheats and scams.

The last decade has led to remarkable changes, within the Native American community and beyond. The Indian gaming industry has seen exponential growth, and while those early threats from fraudsters and tricksters remain, they have taken on more insidious forms, propelled in part, by advances in technology and communication. In addition, the security and humanitarian challenges of the day, combined with the successes of Indian gaming entities, make today’s threats far more potent than those of a few years ago. 

The need to share information and resources, and protect a Tribe’s integrity, assets and public image in a rapidly shifting environment, are integral to a renewed effort by Chairman Stevens, Andrew Hofstetter (who took over as TGPN’s chairman last November), and the TGPN board of directors to make the organization the go-to place for Tribes needing help — information, networking, training, or protection. In a freewheeling conversation, Hofstetter spoke to The Biometrica Blog Team on what lies ahead for the TGPN.

The numbers are staggering. In 2014, the year for which the most current data is available, 243 Native American tribes operated more than 350,000 gaming machines and just under 8,000 table games at 489 gaming establishments across 28 U.S. states. According to Casino City’s Indian Gaming Industry Report, gaming revenue for 2014 almost touched $29 billion, accounting for more than 40 percent of all U.S. gaming revenue for the year.

Additionally, non-gaming revenue at Indian gaming entities almost doubled that gaming revenue. Overall, in 2014, Indian gaming facilities directly and indirectly accounted for about $95 billion in output, well over 700,000 jobs, more than $32 billion in wages, $1.7 billion in taxes (federal, state and local), and $8 billion in direct revenue sharing payments to federal, state and local governments.

But all this came later. To understand where those numbers came from, and why the TGPN’s role as an advocacy resource is so vital, it’s important to go back to the beginning of it all.

Birthing Pangs

The birth of regulated Indian gaming was painful and complicated, the product of a series of courtroom battles in which different Tribes stood their ground in their quest to be recognized as sovereign entities that could run gaming activity as an economic enterprise.

It was a battle that raged from coast to coast. Seven years before the birth of IGRA — the Indian Gaming Regulatory Act passed by the United States Congress and signed into law by President Reagan in 1988, to ensure a jurisdictional framework that would govern gaming on Indian lands — the Seminole Tribe of Florida won a major victory in the U.S. Court of Appeals for the Fifth Circuit.

The crux of the matter was this: In December 1979, the Seminoles opened a high-stakes bingo hall on their reservation in Hollywood, FL. Promptly, the local sheriff’s department, headed by Robert Butterworth, then Sheriff of Broward Co., FL, tried to shut it down.

By 1981, that battle had reached the Fifth Circuit in New Orleans (the state of Florida was part of the Fifth Circuit at the time). The appeals court upheld the district court’s ruling in Seminole Tribe v. Butterworth, essentially stating that since bingo was legal in the state, any move to stop the Seminole operation would be considered civil and not criminal in nature, and would therefore fall outside the purview of the state. The U.S. Supreme Court, in 1976, had already established the difference between the civil and criminal jurisdiction of a state with regard to Indian lands.

That October 1981 Fifth Circuit ruling is generally considered a landmark in Indian gaming history, because it opened up the immense economic potential of tribal gaming across the United States.

Six years later, the U.S. Supreme Court, in another historic ruling (California v. Cabazon Band of Mission Indians), reiterated the sovereignty of individual Tribes. It ruled that gambling on reservations could not be regulated by states, unless the state itself prohibited all forms of gambling, thus paving the way for IGRA.

IGRA, and the creation of the National Indian Gaming Commission (NIGC) as an independent agency focused on the regulation of Indian gaming, provided the legitimacy and oversight the nascent Indian gaming industry needed to take flight. Meanwhile, a few years previously, the National Indian Gaming Association, (NIGA) a nonprofit trade association now representing 184 Indian Nations and other nonvoting members, had already been formed, with a mission to “advance the lives of Indian people — economically, socially and politically.”

Why the Tribal Gaming Protection Network?

Copyright Jeramie Lu Photography [www.jeramielu.com]; Courtesy Andrew Hofstetter
TGPN chair Andrew Hofstetter Copyright Jeramie Lu Photography [www.jeramielu.com]; Courtesy Andrew Hofstetter
According to TGPN chair Hofstetter, there was a “real need to educate tribes as to red flags, and what tribes could do to protect themselves.”

“The renewed push from late last year to early this year is because Chairman Stevens felt we also needed to update them in real time on information as it happens, on a variety of issues. We still do cheats and scams, but we’ve also dived into risk and liability, and we’re talking about regulating MMA sporting events.”

Hofstetter said that at the birth of regulated gaming, the IGRA, Tribes had the ability to have gaming facilities under certain conditions or laws in compacts. “With that and the success of Indian gaming, a whole new element came into play, with Tribes having slot machines, table games, and significant assets on hand. Under those circumstances, people began trying to experiment with fraud, fraudulent checks, fraudulent IDs, and counterfeit money. Tribes were experiencing cheats and scams in the table games and other departments. Everything from card counting to advantage play, to people actually taking cards and replacing them — stacking the deck if you will; Tribes were losing money.”

Hofstetter said that while some Tribes managed to bring in experts from Las Vegas to help them deal with situations, many did not have the resources, financial or human, to stop this. “Cheats and scams have also progressed significantly in the last 30 years, they are far more advanced now. We came about as a necessity to help educate tribes on one aspect. We’ve grown though, now you have tort claims, people trying to take advantage of Tribes through slips and falls, having some kind of (deliberate) injury on the property, trying to get a significant amount of money out of a Tribe.”

While dealing with cheats and scams remains on the radar, the TGPN is also looking at some specific areas of concern, including OSHA compliance, health and safety issues, and public protection — with a specific emphasis on active shooter situations and human trafficking. “We are working together on turning case studies into training programs to help educate tribes,” said Hofstetter. “We’re saying there are things you should be aware of, there are things that can keep you safe, there are red flags that should be shared within the industry.”

Gangs, Trafficking, Training, And Working Together

“Sharing data really does matter,” said Hofstetter. However, changing mindsets and making diverse groups understand that sharing information will not threaten a Tribe’s sovereign rights — even if there’s recognition within the Native American community of the urgency of the issues and the importance of shared resources — was never going to be an overnight task.

But Hofstetter believes the TGPN will increasingly become an invaluable resource to Indian Nations as they look to protect themselves and their assets from a range of modern day threats, and work with each other for the common good.

They are getting specific requests already — from a Tribe on the East Coast wanting a bid for an IT training program, to multiple requests on how to deal with gangs, active shooter situations, and human trafficking. These three, in fact, are the top areas of concern this year, going by the requests the TGPN has been getting. And there’s no question that there’s a need for urgent intervention on the part of Tribes, and lasting solutions.

A fascinating, if horrifying, five-part Al Jazeera America project in 2015 on Native American gangs, stated, “Compared with their African-American or white counterparts, Native American gangs and gang members are a relatively new phenomenon, tracing their roots back to the 1980s and ’90s, when city gangs introduced themselves to Indian Country and began recruiting.” The article laid the blame on a three-pronged issue: Historical Trauma, Federal Policy and Tribal Pride.

Other issues, centered around access to higher education and mental health services (a problem for other population subsets too) coupled with the rising drug use across the country, have also led to a renewed resolve to tackle a not-so-new problem that is quickly reaching epidemic proportions in Indian country: Human Trafficking. An article in Indian Country Today on Aug. 1, 2016, reported that a Northeastern State University study on methamphetamine use in tribal communities, found several disturbing trends, including organized gangs targeting tribal jurisdictions for both drugs and sex trafficking.

How Difficult Is Information Sharing?

TGPN will work toward helping Tribes build emergency preparedness plans. © Digitalstormcinema | Dreamstime.com
TGPN will work toward helping Tribes build emergency preparedness plans.
© Digitalstormcinema | Dreamstime.com

While this is a work in progress, Hofstetter is optimistic that change is in the air. “When you have tribes with common concerns, you have tribes that will share information, even if it’s at different levels. We’ve also found that the case studies we help put together, information that is relevant, help protect tribes and their assets.”

As to sharing information with U.S. federal, state and local law enforcement, Hofstetter said that he’s been in gaming for 22 years, and there was a definite change in attitude, and the importance of working together.

“We have NIGA’s mid year conference and expo coming up at the Seneca Niagara in September. Active shooter situations are becoming more prevalent, and because we are getting numerous requests from Tribes on training related to such situations, we are focusing on that: Matters like how we survive, how we write our emergency plans, what policies need to be addressed. Some of our trainers are actual federal law enforcement officers; we’re bringing in the Department of Homeland Security [DHS] and the Federal Bureau of Investigation [FBI], and they are teaching, in tandem with us. That in itself demonstrates how our collaboration has improved.”

Additionally, Hofstetter said that while they had not addressed human trafficking in depth as yet, they would be doing so. The TGPN will look to work with the DHS, specifically ICE (U.S. Immigration and Customs Enforcement) on educating and training Tribes on preventing and dealing with human trafficking. “They [ICE] are the leading authority on the topic. Law enforcement is already in the loop because they’re our trainers.”

A Better Framework, A Stronger Future

MMA Fighters John Doomsday Howard and Chris Cappi Woodall bow to each other after Howard beat Woodall in their match June 7, 2016 at Twin River Casino, Lincoln, RI. © Jerry Coli | Dreamstime.com
MMA Fighters John Doomsday Howard and Chris Cappi Woodall bow to each other after Howard beat Woodall in their match June 7, 2016 at Twin River Casino, Lincoln, RI.
© Jerry Coli | Dreamstime.com

“The TGPN is getting recognition now, people are starting to realize who we are,” said Hofstetter. “You’ve got to remember, we’re not a law enforcement body, we’re not the National Indian Gaming Commission [NIGC], we’re an advisory body that can help educate, train and provide information to Tribes, to help them protect their assets. We’re working toward certification training classes on health and safety, risk and liability, public protection and licensing, licensing and regulating Mixed Martial Arts [MMA]. We’re doing symposiums and background licensing and surveillance.”

Interestingly, because of a renewed interest in entertainment as a differentiator in a competitive casino landscape and a sudden profusion of what he called “one-stop shops that are looking partner with smaller casinos,” the TGPN is even putting together templates for MMA events, especially the smaller, less high profile ones.

“Those templates cover everything from sanctioning the event, to making sure the Tribe’s approved rules and regulations are detailed, and ordinances are approved,” said Hofstetter. “They also detail proper medical protocols, anti-doping needs, fitness and fight records, and fighter licensing and status and Tribes can customize them for their own use to cover risk and liability.”

The initiative, he added, comes down to this: “We’ll teach you, assist you, provide the information and documents you might need. After that, it’s up to you to carry it forward, through your rules and regulations, policies, processes, and your authority, to customize those teachings, pass them on, and share information that can help each other as best as possible.”

And because in the end, it’s all for the common good of future generations, he’s confident that together, they can build a regulatory landscape that will not only help shield communities from internal and external threats, but also help protect the assets, integrity and public trust of Tribes.

Bitcoin: Building A Better World, Block By Block

Posted on by kmurali@biometrica.com

Contrary to what people think, bitcoin isn’t made for the bad guys. It’s actually the perfect tool for regulators, investigators, banks and NBFIs like casinos that want an absolute audit trail

By Joseph Ciccolo

The world of financial surveillance is moving into plain sight. As we continue to go down that path of the physical to the digital and the digital to the physical, digital stores of value, whether currency or other assets, will become easier to track and analyze. And no, this does not mean this is a validation of George Orwell’s dystopian novel “Nineteen Eighty-Four”. Ironically, perhaps, for Orwellian supporters, it’s quite the contrary, and is more of a refutation of that all-seeing authoritarian state. Here’s why.

“Follow the money” is and always has been the maxim for investigators, whether in journalism, forensic accounting, counterterrorism or anti-money laundering (AML). Of that last, whether you’re a once green analyst, or a leading consultant in the field of AML, that guiding principle stays strong and true, as does one more fact: The bad guys will continue to refine their craft, and push the boundaries of creativity to hide the source(s) of their ill-gotten gains, and obscure any physical or audit trail.

© Matt Haines | Dreamstime.com
© Matt Haines | Dreamstime.com

However, with time, these trails, obscured by money-launderers and other criminals, will no longer be fragmented pieces of data residing on the centralized, siloed servers of financial institutions and non-bank financial institutions (NBFIs). These trails of disconnected digital breadcrumbs, often across multiple categories of NBFIs like money transmitters and casinos, will instead become immutable travel logs on a large map for all to see. In time, investigators will be able to quickly follow the money and document with certainty the source(s) of funds and actors involved.

This might sound like “Nineteen eighty-four”. But think 2008. November 2008 to be more precise, when an unknown individual or group of individuals under the pseudonym “Satoshi Nakamoto” published a whitepaper entitled “Bitcoin: A Peer-to-Peer Electronic Cash System”. That whitepaper, originally posted to an obscure cryptography blog, has since given rise to a burgeoning new sub-sector within the financial services industry.

At its core, however, bitcoin has much less to do with a medium of exchange and more to do with trust and transparency. Trust in a permission-less, decentralized, consensus-based network; transparency in the form of an absolute, unchallengeable record.

That much-heralded technical innovation of bitcoin, known as the “blockchain”, serves as the public ledger of bitcoin transactions. Participants connected to the network can send new transactions for verification, which are then ultimately published on the blockchain for all to see. As an open-source, permission-less platform, anyone with a mobile device and Internet connectivity can review any and all transactions dating back to the first bitcoin transaction.

© John Takai | Dreamstime.com
© John Takai | Dreamstime.com

What’s more, the transactions posted to the blockchain are date and time-stamped and contain the wallet address of both the sender and recipient. Once posted to the blockchain, this data cannot be changed by anyone. The benefits of blockchain from an investigatory perspective should be obvious. It’s the perfect audit trail!

There’s a decent chance you haven’t heard bitcoin and audit trail in the same sentence, and if you have, it probably wasn’t anything positive. After all, the general understanding of bitcoin is that it’s anonymous because one can send and receive bitcoin without sharing any personally identifying information. That’s just not true. Bitcoin, actually, is pseudonymous. This is a feature, not a bug. It allows participants in the system to securely and transparently record their transactions, while offering assurances that funds may be traced using old fashion investigative activities — should the need arise. Follow the money indeed.

Transactions posted to the blockchain offer the investigator certain clues as to identity of parties involved. Wallet addresses may be linked together or traced to individuals and entities such as bitcoin exchanges, online trading platforms, and casinos too, in a not-so-distant future. In fact, it would probably raise some interesting internal questions for organizations like casinos, because of the ability to track “cash” transactions.

When the need arises, parties involved in transactions can be deposed by legal counsel or subpoenaed by law enforcement to produce records of the identity behind the wallet address, lifting the veil of pseudonymity through due process, and without compromising data security, integrity, and crucially, the innocent.

It seems the concept of an open-source network is doing what no one else could do, replacing the patchwork of antiquated centralized systems inside siloed financial institutions, including NBFIs, with an immutable distributed ledger that is available for inspection by anyone, anytime, anywhere. No longer will banks or other non-bank financial institutions have to ask permission via formal written request to share information with each other in order to continue following that proverbial trail of breadcrumbs. Instead, we’re moving to a universally accepted map of transactions open and accessible to all without permission.

Whether bitcoin survives or some other digital currency, government-issued or not, takes its place, is immaterial. The underlying technology is here to stay. Financial transactions and surveillance thereof will be conducted in plain sight — not just by compliance departments and government regulators but also by ordinary citizens, journalists, and other watchdogs.

It’s easy to become territorial as investigators and think that financial transactions and investigations are the domain of governments and institutions. Yes, as compliance professionals, we ought to take the lead in preparing for the realities of distributed ledger technology, and any other innovation within our field for that matter. However, as my colleagues in the regulatory community so often say: “We’re in this together!”

This is about building communities and networks, and is best viewed as a partnership between institutions, regulators, and law enforcement. Will this create a free-for-all with every John and Jane “deputizing” themselves? Perhaps. But how reassuring would it be that more people, organizations and institutions feel vested in maintaining transparency and trust within our financial system.

(The author is an acknowledged expert in building and implementing successful Bank Secrecy Act and Anti-Money Laundering programs for traditional and non-traditional financial institutions that offer a variety of banking products and services)

Biometrica Heading To Oklahoma Meet To Discuss Tricksters And Trafficking

Posted on by kmurali@biometrica.com

Company Case Study, Released In July 2016, Shows Overlap Between Casino Cheats And Human Trafficking, After Arrest This Year Of England-Based Criminal

Las Vegas, NV: Biometrica Systems, Inc., a Las Vegas and Virginia-based SaaS company focused on creating products that link the physical to the digital in order to prevent crime and track criminals and their associates, announced on Thursday that a company team would be headed to the 22nd annual Oklahoma Indian Gaming Association (OIGA) conference in Tulsa next week, and was looking forward to positive discussions with OIGA members on human trafficking, among other issues.

“We don’t just make products that track and catch casino cheats, though we’re well known for that,” said Biometrica’s Vice President of Business Development, Kevin Parker. “Our systems target tricksters, thieves, traffickers and terrorists. And given the results of our case study last week, and the fact that the OIGA is proactively looking to clamp down on trafficking, it made sense to reach out to them.”

Three years ago, in the summer of 2013, a nationwide FBI anti-trafficking operation across 76 American cities netted 150 arrests, more than one-third of which were in Oklahoma City. Shortly thereafter, the 19th Oklahoma Indian Gaming Association (OIGA) convention that kicked off in Oklahoma City emphasized the need to clamp down on human trafficking, with OIGA Executive Director, Sheila Morago, telling a state television station, “It wasn’t a good thing to have your head in the sand.”

Last week, a Biometrica case study showed how some members of an England-based gang of Turkish-origin poker cheats, found guilty of a “conspiracy to cheat” earlier this year in London, had been spotted on several occasions operating in several casinos across the United States over a three-year period, beginning in 2013.

They had been spotted on Biometrica’s Security & Surveillance Network (SSIN), a fully encrypted, peer-to-peer private information system, which allows for the building of a community of surveillance, security and other law enforcement professionals for the notification of people, events, alerts or warnings. One of the members of this particular gang of thieves, Tarik Nergiz, had escaped England in January 2016, after admitting guilt but prior to sentencing. He was, however, detained in France on human trafficking charges, and sentenced 12 months in prison.

“The OIGA’s wanting to be proactive about this issue makes complete sense, and they should be commended for it,” said Parker. “An October 2015 FBI release on Operation Cross Country, as their ongoing anti-trafficking initiative is called, stated that the sting operations they conducted to recover children, focused specifically on hotels, casinos and truck-stops.”

With 38 federally recognized Tribes, Oklahoma has the second largest Native American population in the United States, behind California. According to a 2015 report by OIGA, about 30 of these 38 Tribes collectively own nearly 125 Indian gaming operations across the state of Oklahoma.

Parker added that from January 2017, Biometrica would be conducting a series of online and in-person workshops and seminars, which will focus on methodologies to catch criminals and track criminality in the casino and gaming industry.

The workshops, intended to support the community of gaming regulators and security and surveillance professionals, will each focus on a different topic of interest, and include field experts and staff from Biometrica’s own Fusion Center, the hub from where its global security and surveillance operations are run. The workshop schedule and details will be announced by November 2016 on the company website.

About Biometrica

Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital and the digital to the physical with the intention of minimizing criminality, or events that could lead to crime.

To this purpose, the company’s range of tools enable the recording of mala fide or criminal occurrences, recognize threats, identify politically enhanced personnel and their associates, track individuals or groups that have either committed a misdemeanor or felony, or have contributed to breaking the law, and finally, help security and surveillance teams of all stripes link all of the above.

Private Investigator License # 1295 [Nevada PILB]

For more information, please contact

media@safience.io

 

 

To Catch A Criminal: Why Being A Community Trumps Going Solo

Posted on by kmurali@biometrica.com

By The Biometrica Blog Team

This case study examines how members of an England-based gang of Turkish-origin poker cheats, found guilty of a ‘conspiracy to cheat’ earlier this year in London, had been spotted on several occasions operating in the United States over a three-year period, and at least once in Asia in 2015.

How do we know that? Better data. A couple of members of the gang could almost certainly have been caught with the help of SSIN, Biometrica’s peer-to-peer encrypted Security & Surveillance Network, if British casinos had been connected to it at the time.

The Case: A Backgrounder

Earlier this year, on Feb. 9, news publications in England, including the Evening Standard and the Daily Mirror, ran stories on a group of men who were reportedly members of a gang that had “swindled a casino out of thousands of pounds.” This bit is from the Standard piece: “The group raked in £33,600 playing three-card poker at the Grosvenor Victoria Casino, in Edgware Road. Their scam involved ‘card swapping’, where two players swap cards with each other covertly to make winning hands against the dealer. A third person distracted the dealer with talk while another acted as a lookout.”

The paper reported that Ali Kuyar and Ozgur Aytekin, who had admitted the charge in January, were given a 12-month sentence, suspended for two years, plus 250 hours of unpaid work, and barred from any gambling premises in the U.K. for a year; Murat Kolcak was given nine months, suspended for 12 months, plus 200 hours of unpaid work. Two more members of the group — that had pleaded guilty to “conspiracy to cheat” at gambling in January 2016, and were said to have carried out the cheat moves 32 times over nine days — were named as Ergun Yasar and Tarik Nergiz.

While Yasar was to be sentenced later, in another, twist, a bail warrant was issued against Nergiz, who failed to appear in court. It was reported in the Mirror that prosecutors told the court that Nergiz, a London resident, had left the country on the morning on Jan. 14, 2016, the day after he and the others pleaded guilty, but had been detained in France on human trafficking charges, and sentenced to 12 months in prison. He is expected to face his U.K. charges after that. The Mirror also stated that the group was believed to have comprised of nine members, but the other men were not identified or charged at the time.

Networks Within Networks

Trying to cheat iat card games isn't new, but as technology gets better, it's easier to catch a con. © Kgelati1 | Dreamstime.com
Trying to cheat at card games isn’t new, but as technology gets better, it’s easier to catch a con. © Kgelati1 | Dreamstime.com

Why are we talking about this gang of cheaters? Well, in the third week of September 2013, Lisa Povill, who heads up investigations for Biometrica at the Biometrica Fusion Center (BFC) in Las Vegas, received an urgent email from a Maryland-based customer.

The Maryland entity had been hit by what they suspected was a group of people that appeared to be of Middle Eastern origin, working together in a possible card-switching (also called card-swapping) scam. They wanted to let people at the BFC, the hub from where our global security and surveillance operations are managed, know. They didn’t have names for the men, but they had photographs taken on the premises.

Povill, who manages a four-pronged process — Threat Recognition, Threat Identification, Threat Analysis and Data Distribution, ran the photographs through the system and didn’t find an immediate match. In any case, in keeping with protocol, she began the process of uploading their data into Biometrica’s CID, then known as the Casino Information Database (now developed into the Casino Intelligence Database). The CID is a comprehensive database that allows for the building of a detailed digital CaseFile on any event, individual or group.

As she had no identifiable information on them (names, IDs etc), the photographs were put into the system as “unknowns,” labeled as card-switchers in four-card poker — as mentioned by the Maryland client — male, with some additional demographic and other data: Possible ethnicity, or place of origin, any facial or other features that stood out, like pattern baldness, an unusually large nose etc.

Note: It might be interesting to mention here that several security and surveillance industry professionals have noted that for some reason, while casino-focused gangs of people of Italian descent, for instance, have been found to have a penchant for roulette, gang members of Turkish ethnicity have been known to have an affinity for “carnival games” — three- or four-card poker, Mississippi Stud, etc. Logically, it is possible that the secrets to gaming the system are passed on to family and friends or other known associates.

And The SSINS Go Marching In

A couple of days after that message from Maryland, on Sept. 26, 2013, a casino subscriber in Ohio sent out a “global” alert on a similar group on the SSIN (Biometrica’s Security & Surveillance Information Network). This meant the alert went out to all other subscribers on Biometrica’s fully encrypted, peer-to-peer private information system, which allows for the notification of people, events, alerts or warnings.

At that particular time, in September 2013, this included entities in at least 26 U.S. states — Arizona, California, Colorado, Connecticut, Delaware, Florida, Illinois, Indiana, Iowa, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Missouri, New Jersey, New Mexico, New York, Nevada, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania and West Virginia — and five other countries, Aruba, the Bahamas, Canada, Saint Kitts and Nevis, and Puerto Rico, in addition to a global cruise line with its headquarters in Florida.

The alert stated that a group of unknown males pictured, of possible Middle Eastern origin, were involved in a card-switching poker scam on four-card poker. The man, later identified as Ali Kuyar, among those found guilty of cheating in England earlier this year, was one of them.

A little over six months later, in April 2014, an entity in West Virginia sent out an alert on what appeared to be a similar group of men involved in a card-switching poker scam. It’s interesting to note here that the reports out of London mention that the group of men found guilty were indicted on the basis of fraudulent activity in England in that same month, indicating that they practiced their scam around the world, and got around quickly.

Connecting The Dots

These particular gangs seemed to focus on carnival games, especially three- and four-card poker. © Soleilc | Dreamstime.com
These particular gangs seemed to focus on carnival games, especially three- and four-card poker. © Soleilc | Dreamstime.com

In July 2014, BFC head Povill was contacted by a top West Coast-based law enforcement agency, asking for further information on a card-switching situation in California. They had noticed Biometrica’s SSIN alerts and entries, including an alert sent out on July 17, 2014, and the images were a match to the perpetrators of that card-swapping ring out of California.

The law enforcement body was able to supply IDs (they had copies of issued identification cards) for some of the men involved, including four not mentioned in the London reports. Based on that, another SSIN alert was sent out on these five men just three days later, on July 20, 2014.

But it was almost a year before any further suspicious activity on the group was reported, and this time, it came from far away, when the BFC was contacted by an entity out of Asia. The organization in question was not a client, but had photographs of a group of men involved in card swapping (or switching), and wanted to know if Povill could have any of them identified.

She could. That man was Ali Kuyar — the Asian group had an ID for him. On June 2, 2015, as soon as the BFC was cleared to send out the information, Povill sent out a specific alert on Kuyar and three other known associates for being active in switching cards in Asia. It was mentioned that the group had been active in the U.S. over the past 12 months at least, and references were made to specific SSIN numbers (for the alerts). None of the other three was part of the group charged in London and we are not, at this point, privy to any information on whether they are among the four (of nine probable members) not identified or charged by British prosecutors.

Why SSIN And Sharing Information Makes Sense

Let’s look at some simple facts. Kuyar, as mentioned, was one of the five men found guilty of a conspiracy to cheat by British courts this year. Nergiz, one of the group, is reportedly serving time in France after being found guilty of a far worse crime — human trafficking. These men were clearly repeat offenders when it came to trying to cheat casinos. Equally clearly, the perps, and the crime, traveled globally.

All the men of this particular group were apparently residents of England. Would they have been caught earlier if British casinos and law enforcement agencies had access to Biometrica’s SSIN alerts and the images in the Casino Intelligence Database? Almost certainly — yes.

As things stand, if British or other authorities are reading this, we do have more information on other potential gang members that could also be shared, if that information is formally requested. Logically, we would imagine that any future charges might be a little different, if we can provide more information of suspected illegal activities committed in various U.S. jurisdictions and internationally. We’d be glad to help. At the end of the day, after all, we are one community of people just trying to catch the bad guys.

The Eye In The Sky: Life From A Surveillance Room

Posted on by kmurali@biometrica.com

By The Biometrica Blog Team

Butch Pracale, the Director of Surveillance at the Four Queens Resort and Casino doesn’t like to share information. “I’m paranoid,” he laughs. “I watch out for the bad guys.” He’s done just this — looking out for criminals and criminal intent on casino floors — for 35 years. That’s also why he didn’t want his picture up here either. We humored him on that.

The Biometrica Blog team decided that same professional distrust of everything, and those three-plus decades of experience, made him the perfect person to sit down with for a freewheeling discussion on surveillance, security, and sharing information — something that doesn’t come naturally to his kind of professional — in a new digital-meets physical age and a vulnerable world, increasingly built around a “community” of people that “watch out for the bad guys.” Read on.

We’re looking at all these TV monitors, and images from dozens of cameras. How do keep track of all of this, what do you look at or look for?

You can only look at one monitor closely at any given time. Really and honestly, beyond that, all you can do is catch some movement on others.

What kind of movement?

Movement, typically, is constant and consistent and repetitive. When things are that way, in repetitive patterns, things looks normal. When there are things that are delayed, or out of pattern, for instance, when a hand goes where it normally does not go, or a new hand comes in from a different direction, we notice those. Those are our keys to determine that something is wrong.

You also mentioned delays?

If there’s a delay and cards aren’t being dealt, if there’s a delay and balls aren’t being spun, then those things also key our attention to those [other] monitors.

Anything that causes a break in pattern is a key. © Ramon Grosso | Dreamstime.com
Anything that causes a break in pattern is a key. © Ramon Grosso | Dreamstime.com

So your experience tells you something is wrong, because you’re watching for those through your peripheral vision?

Yes, because whatever it is that causes us to react is a break in procedure. When things are supposed to go left to right and we see a right to left? Now there’s a problem. Is it ingrained? Yes. Is it training? Yes. Is it experience? Yes, again. You don’t know there’s something wrong till somebody draws your attention to it.

So you look for predictors — anything that’s off base, or off sync?

Absolutely. And we do practices. There are, what I call, subconscious actions to prompt conscious action. Bottom line? People [on the casino floor] have activity that they are required to do. That is also activity we are required to see being done. If there are any irregularities during the course of making that observation, we call attention to it. For instance, if a security officer takes a fill and instead of going to the table, he goes out the door, you know there’s a problem.

How do you protect against remote access? For $15, if I can get a proximity card reader that can scan access codes remotely, as long as I’m within physical distance of a person, and if I know who the people with access to a cash room are, what is to prevent me from cloning their cards digitally?

In our case, we don’t use proximity cards. We use physical keys. And doors manned by security personnel can only be opened by someone else, not the person going in. At the cage, for example, you can’t get in if you don’t have a key, or you’re not buzzed in.

So then someone wanting to break in has to do it the old fashioned way, bash someone over the head or something?

[Laughs]. Yes. But most other casinos probably use cards though. I don’t know what other casinos do otherwise, but hopefully their cage and soft count door are in view of the security podium. Ours are.

A cashier sign on a casino floor in Atlantic City. © Natalia Bratslavsky | Dreamstime.com
A cashier sign on a casino floor in Atlantic City. © Natalia Bratslavsky | Dreamstime.com

Interesting that they’re right opposite each other, across the casino floor.

They have to be. If there’s someone strange coming through the door, or something different happening, the security podium has got to have that [line of sight] to spot them immediately, and there are panic buttons all over the place. Some cages, in money-handling areas, are alarmed, so if someone were to penetrate the door one way or the other, surveillance cameras would automatically direct themselves at that door and identify the person going in.

Is there any overlap between security and surveillance teams, or situations where teams are in conflict?

[Laughs again]. Always! Seriously though, we are the eyes, they are the feet. We ask them to do something, and sometimes they have difficulty, no doubt, doing that thing. They do hear more though, and they trust us enough to agree to grab, say, that guy with the green hat and purple feathers, when we request it. At the end of the day, they trust us enough to do anything we specifically request, because anything we request is only for the safety of the property or people, and to protect us all from liability.

In the more than 30 years that you’ve been in surveillance, especially with the technological changes that have come in, are the basic threats the same? If you had to pinpoint the three major threats to a surveillance team, what would they be?

— No. 1 would be power. You can’t function without power. Which is why we have a 30kVA UPS and unlimited power supply at the back. Our cameras, for instance would remain powered, if in fact, there were a threat to our direct power supply, for at least five hours.

— The next would definitely be equipment. You can’t really function again without the equipment that allows you to have eyes on everything. Our cameras are running 24 hours a day, seven days a week, and can function even in the most minimal light. And with advances in tech, we have access to networks and systems that are very helpful.

— The third is information sharing. I’m terrible at sharing information. Part of our advantage is our mystique. It’s not secret, but the value of nobody knowing precisely what we do operationally, except us, is important.

How do you balance the need for mystique with the need to know and sharing required in information systems like SSIN, Biometrica’s Security and Surveillance Information Network?

I really don’t like to share. So this has been a change. If our cases are pending, we don’t share that information till they’re settled. That’s a great point from where to send out relevant information and share. The problem is that once we release it to be shared, some clerk somewhere shares that video footage with a TV channel, and the next thing you know, we’re on some program about cheating in Vegas. We would prefer no one has our layout, how we function etc. But yes, it’s a little different now, with technology. It just depends on the information that’s being shared.

You essentially distribute it into two piles then: Operational functions, that are kept private, and crime prevention and crime tracking, that depend on whether your cases have closed or not. How useful is SSIN to you?

SSIN, in my opinion, is more useful when it comes to education than anything. Sometimes though, I don’t believe half the things that come through on it directly [in unfiltered mode]. I’ve been in the business for 35 years, in surveillance, and some of the narrations that I get on SSIN, they come from some novices.

[Note: SSIN’s early warning system works at two levels, alerts or information in real time that are unfiltered, shared by a network of background-checked security and surveillance professionals, and second, material sent out through Biometrica’s Fusion Center. The latter is made up of validated alerts, but has a slight time lag for obvious reasons].

What unfiltered narrations or alerts do you not keep as relevant?

Say somebody is arrested for presenting false identification in Atlantic City. Who that is doesn’t mean much to others when you’re 2,500 miles away. It really doesn’t. But when I see those perpetrators participate in other scams, when I see them manipulate cards, when I see them manipulate games to their advantage, that means a lot to us.

False IDs are available on underground black markets on the web. © Stockhits | Dreamstime.com
False IDs are available on underground black markets on the web. © Stockhits | Dreamstime.com

Interesting. False IDs though, can travel, even if the person doesn’t. You can buy ID on the underground black market.

Yes, so it really depends on the information. Certain things stated by certain users [of the network], are very local. The people-related alerts related to local information in the East are not valuable nationally, not to Las Vegas, or other venues, because it generally isn’t profitable [to an ID fraudster] to travel in person. If it was a particular card scam, they would go from Atlantic City to state to state to state, till they get to Las Vegas and California, in order to profit by it. But if it’s a simple scam, we’ll discount it.

There are four aspects to information being shared on our digital network — where it’s done, the person doing it, what it is, and the techniques used by the perp, and you use whatever is relevant…

Yes, we love to get that information [on techniques]. In fact, because it [technique or method of fraud] can occur here, even if it’s not the same person that’s done it in Atlantic City that will do it here, the type of scam could occur here, we’d be interested in hearing about it to know what they did and how they did it.

Interesting perspective. The good thing though, is that you can discard the SSIN alerts you don’t think you need, and keep the ones you think make sense to keep.

We do appreciate all of them. There are times though, that some users become excited by something that has occurred on their property, and send out an alert that isn’t relevant. Or when we get Christmas Trees.

Christmas Trees?

[Laughs]. Yes, during the holidays, people actually send out alerts attached to [zoomed in] photographs of the Christmas Trees on their property. We don’t really mind, but it can get somewhat frustrating when you’re checking alerts. The word “Christmas” in an alert could also be a reference to a thief during the time, or something else. But it’s like a community thing, and it’s Christmas.

We’d have to think about managing those trees! But the only way we could stop that perhaps, unless surveillance teams decide not to do it, is by vetting any SSIN alert that goes out, and that just kills the reaction time.

You’re right, and then, once you begin to filter, edit or cut someone loose, cut somebody off, you’re starting something else.

We would be. Think of it as Google, where you get a ton of information. Except that, unlike Google, because everyone on the network is a background checked security or surveillance professional, most of what you get is solid information … besides the trees!

We do share when we are required to. Like when Gaming [the Nevada Gaming Commission] says so [we are interrupted by laughter] we do share. We have to, by law. I love the information though, getting it, and yes, in light of what goes on nowadays, given various incidents around the world, the sharing of information is very important.

In your opinion, would the security and surveillance of people and places, through digital information sharing, trump privacy? Especially when law enforcement guidelines have made it very clear that if you see something suspicious, you report it. “See something, say something.”

I do Title 31 training for employees. [Note: The Bank Secrecy Act of 1970 requires U.S. financial institutions — casinos are non-banking financial institutions — to assist government agencies in detecting and preventing money laundering, as does the USA Patriot Act sections 314 (a) and (b), and the Basel Accords].

We talk about situations, about 9/11. All these government agencies didn’t share information with each other before 9/11. In fact, they weren’t allowed to share information even if they could help. That was a changing point in information sharing. And it is a different world after that. You do what you have to do to keep people safe.

You do, and of course, someone has the option not to enter a casino or hotel or store, if they don’t want to have their information shared.

They do. And they choose to come in.

One last, quick question: From the digital to the physical. You think metal detectors, like those at airports, should become the norm in the US, like they are in hotels and malls elsewhere in the world?

They should. Either that or arm everybody!

Proactive & Pragmatic: How India Rethought Security Post The Mumbai Attacks

Posted on by kmurali@biometrica.com

By Colonel Sushil Kumar Singh

In the 2003 historical epic, The Last Samurai, a striking conversation plays out between Ken Watanabe’s Katsumoto (the Samurai lord) and Capt. Nathan Algren, the war hero turned wastrel turned Japanese Imperial Army trainer.

Algren, played by Tom Cruise, is haunted by thoughts of the atrocities he committed in the battles against Native Americans. Katsumoto wants to know more about these battles, and Algren’s role in them. “I wish to learn,” he says. Algren rebuffs him, suggesting he “read a book” instead, to which Katsumoto responds by saying he’d rather have a conversation, “… because we are both students of war.”

Students Of Tactics, And Terror

During a recent visit to London, I was surprised as my cab drove straight through to the hotel porch without being stopped at the gate. As a matter of fact, I walked to the reception desk without going through a single security check myself, or having my bags vetted. I’m given to understand that this is also how it is in the United States and most other western countries.

Contrast this with a visit to any halfway decent hotel in India, or, in fact, several other countries in south and west Asia — where you’d have to run the gamut of the following security measures:

  1. Having your vehicle scrutinized by security at the hotel gates.
  2. Having your bags go through an airport-style baggage scanner at the gate, irrespective of whether you’re a hotel guest checking in, or someone that’s dropped by for a meal or something.
  3. Getting past a full-body handheld metal detector check by someone from a security team. Typically, most places will have women and girls get behind a screen of some kind for this.
  4. Walking through a door-framed metal detector.
  5. Providing proof of identification and filling out a number of relevant forms if you’re checking in.

Apart from the last point, the remaining aren’t really part of routine security measures in much of the western world, including England, which has been at the receiving end of terror attacks even before the well documented IRA strikes during “The Troubles” in the latter half of the 20th Century, leave alone modern day terrorist attacks like the 7/7 bombings in 2005.

For a student of war and terror like me, the glaring disparity in the approach to security drills is reflective of a couple of things: First, that despite shared concerns, and increasingly, a common enemy in the modern era, be it the Islamic State or an Al Qaeda or Taliban offshoot, a radical splinter group, or lone wolves inspired by extremist propaganda, there is no single thought process that seems to govern how countries fight terror, including when it comes to basic tactical measures as a first line of defense.

Second, in many western societies, despite a spate of targeted attacks since April 2013 — when the Islamic State in Iraq and the Nusra Front in Syria made an unholy alliance they called the Islamic State in Iraq and Syria, and began their so-called “Soldier’s Harvest” campaign in Iraq — there has been a sustained resistance to putting in place routine security measures for soft targets like hotels, malls, nightclubs, even airports, because perhaps, of a resistance to anything that inconveniences people or affects, “our way of life.”

A Practical Approach To Fighting Terror

In countries like India though, especially in the aftermath of the 2008 Mumbai attacks, when militants spent four days carrying out 12 coordinated attacks across India’s financial capital, including planned strikes on signature properties of two major hotel chains, the Taj, and the Oberoi Trident, there has been a more pragmatic response to modern day terror.

One of the first steps taken by the Indian Government in the aftermath of November 2008 was the decision to create four Regional Hubs of the National Security Guard, India’s elite terror-fighting special forces, in the major metropolitan areas of Mumbai, Kolkata, Chennai and Hyderabad.

The intention behind having regional hubs of specially-trained CT commandos was to reduce the force’s reaction time in the event of a future attack on civilian and defense installations in the country. The Hubs were to be first responders to any attack, to be later supplemented, as needed, by a greater counter-terror force arriving from New Delhi, where the headquarters of the force is located.

Each Regional Hub was made responsible for certain states and the area of responsibility delineated. For instance, the Hub in the southeastern city of Hyderabad, the first to be operational, was given responsibility for the states of Andhra Pradesh, Chhattisgarh and Karnataka.

A map of Vulnerable Areas (VAs) was drawn up with the help of the police chiefs of all three states. These identified VAs mainly comprised places that were known tourist attractions, like historical monuments, and other potential soft targets like 5-star hotels, the offices and premises of multinational companies (MNCs), defense and civilian installations, embassies and consulates, and legislative and judicial buildings, among others. The first order of the day was the complete reconnaissance of each of these VAs.

Ramping Up Our Recon

A prescribed format of reconnaissance was prepared. Teams would visit buildings and installations and prepare a detailed report on threats and vulnerabilities, creating a dynamic data bank for future use. Once the reconnaissance was complete, a set of recommendations was made and shared with the VAs concerned, to beef up their security in tandem with the state and India’s federal Ministry of Home Affairs, the equivalent of the U.S. Department of Homeland Security.

© Vadimone | Dreamstime Stock Photos & Stock Free Images
© Vadimone | Dreamstime Stock Photos & Stock Free Images

While I cannot get into specifics for obvious reasons, most assessments included the following suggestions:

  • The installation of CCTV cameras to cover the entire layout of a property.
  • The CCTV Control Room to be preferably located outside the premises or in a remote place and be monitored constantly. The rationale was that a counterterrorism team (CT) arriving in case of an event like a terrorist attack on a hotel, could immediately study movement inside a building without undue interference, evaluate options in quick time, plan, and move in a coordinated manner to neutralize gunmen and evacuate trapped innocents.
  • A diagrammatic layout of the property was to be available with security teams at the gates to assist planning in the deployment of a CT force.
  • Employees were to be briefed regularly on security measures and a secure zone/strong room was to be created within the premises, where employees and guests could be herded and isolated till sanity prevailed.
  • Security drills were to be carried out at least once a month, if possible.
  • Boom barriers — to block vehicular access through designated control points — were to be installed at the gates to a property, to control entry and enable checks by security personnel of vehicles and occupants.
  • Baggage Scanners, Door-Framed Metal Detectors and Handheld Metal Detectors were to be installed at all entry points.

What was heartening, from my perspective, was that most “soft target” institutions across India, like major hotels and MNCs, actually took these recommendations seriously, and put in place a number of the measures suggested.

Past Tense, And An Imperfect Present

However, it has been almost eight years since Mumbai, and an (fortunately) incident-free period over the past few years has (unfortunately) allowed complacency to creep in. Without proper supervision, recommendations haven’t really been followed precisely. Security audits have found some common issues hindering best security practices:

  • CCTV Control Rooms, more often than not (like Surveillance Rooms in U.S. casino properties), are located within building premises. In effect, a CT team cannot use a Control Room to study the layout of a property, or the movements of a terrorist or gunman, on their arrival at the site of a hostile, life-threatening event. At best, they’re of use to investigation agencies post an incident, to try and determine what exactly happened.
  • The practice of using relatively untrained personnel at the gates means that the people manning your first line of defense often do not have the remotest idea what they’re looking for. A gun or grenade can still be easily smuggled in a car. Even when teams are checking vehicles, these checks have become a cursory opening of a bonnet/hood or boot/trunk before allowing it entry. Inconvenience to a guest or visitor is still the paramount concern, not security, resulting in these checks being sped-up, rendering them effectively useless.
  • Security drills, if they exist, are rare, and secure zones or strong rooms in buildings are equally rare, with most employees unaware of specific security protocols in case of a hostile event or attack.

When, What, Why, How

It is often said that in modern-day warfare, it isn’t the number but the quality of weaponry that is the deciding factor in how things pan out. So when exactly does this factor come into play? As evidenced by the recent attack on an Orlando nightclub, one man, with superior weaponry and the advantage of planning and surprise, was able to terrorize vastly superior numbers with technology at their disposal. Yet, 49 people lost their lives and 53 were injured.

From Mumbai (as pictured in the documentary above, courtesy YouTube) to Paris, Sousse (Tunisia) to Sydney to San Bernardino, and Nairobi to Orlando, the three basic questions that have vexed counterterrorism forces have remained the same:

  1. Do we storm a location immediately?
  2. Do we wait till negotiations are exhausted, during which time more loss of lives may take place?
  3. Will the public and government accept some innocent lives being lost in crossfire or hostage-situations if we move in?

At some stage, we’re going to have to have a very public discussion on the answers to these questions, and find some common ground on acceptable measures in case of emergency events. It’s also imperative, in my opinion, that we make a push to have planned public education programs or modules, focused on battling terror together in the modern age. This isn’t scaremongering — it’s being proactive and practical.

Until then, we’d do well to keep in mind what Claude Lebel, the deputy commissioner responsible for tracking down the assassin, “The Jackal,” to Paris in Frederick Forsyth’s 1971 classic, The Day of the Jackal, had to say: In the absence of anything else, everyone “should keep their eyes open.”

(The writer, a colonel with the Indian Army, has specialized in counterterrorism operations, and raised the Hyderabad Hub of India’s National Security Guard)

Securing Our Security In A Brave New World

Posted on by kmurali@biometrica.com

By Wyly Wade

Last month, NIST, the National Institute of Standards and Technology, released an initial version of a framework of standards to help developers of cyber-physical systems (CPS) build cybersecurity and privacy into their designs. This week, NIST announced that their Smart Grid Advisory Committee would have an open meeting over July 13-14, to update the public on NIST’s Smart Grid and CPS initiatives, and discuss resilience and reliability issues related to cyber-physical systems.

If you’re reading this, you’ve probably heard the term “the Internet of Things” — that world where the physical and digital meet and merge, and make magic happen. Sort of.

Courtesy: NIST
Courtesy: NIST

The NIST defines CPS (see NIST CPS image on the right), sometimes used interchangeably with the IoT, more properly: As “smart systems that include engineered interacting networks of physical and computational components.”

This, by the way, includes anything from your smart watch to smartphone to new generation cars, to intelligent buildings, Smart Grids — computerized electric utility grids equipped with two-way communication technology — and a whole bunch of things in between that range from consumer items to critical infrastructure.

Why Do We Need A Discussion On Resilience And Reliability?

Well, imagine this. A criminal element, or a rogue foreign power, takes control of your local power station. In a different era, it would all have had to be done through surgically planned physical strikes on a substation, taking out multiple transformers. That, unfortunately, still happens. But with Smart Grids — a Rogue element X, this could be human, humanoid, a virus, even a bad line of code, could use that same technology to create chaos.

Think of Ukraine in December 2015, where the first publicly acknowledged and proven hacking of a power grid happened. Where, as this great article in Wired puts it, inside a control center of a power distribution entity, all an operator could do, “was stare helplessly at his screen while the ghosts in the machine clicked open one breaker after another, eventually taking about 30 substations offline.” That BlackEnergy malware attack eventually affected power to about 230,000 people.

As technology rapidly changes our world, and we just begin to understand the scope of the IoT and cyber-physical systems, we have understood that it’s not just utilities or manufacturing facilities, or military or civilian bases that can be electronically invaded. From smart locks for homes to remote keys for cars, from pre-op pods in hospitals to intelligent buildings and other M2M (machine to machine) technology, as everything in our own lives is customized digitally, how easy would it be for someone to invade your life?

  • Or turn off the heat in your home in sub-zero temperatures in a Wyoming winter?
  • Or open up the gates to a Supermax prison facility?
  • Or switch off the power, and generator backup to the ER at a busy hospital?
  • Or hack into an ATM or bank account to get all your details?
  • Or send an elementary school into lockdown with a miscreant inside?
  • Or take over the controls of your car, or bus, or plane?

What Do We Do Next? 

We secure our systems. And come back to establishing that our CPS are resilient and reliable. With a view to this, historically, there are three basic ways of securing physical or digital access, or the process of validating information to make something secure. These are

  • The things that you know
  • The things that you have
  • The things that you are

Historically, we used one of these points to validate information or grant access, or linked two of those in a two-step authentication process. We asked for someone’s name, or date of birth. We then added “the things that you are,” say, your biometrics, to “the things that you have,” like your driver’s license, into the mix. When you think about the process of somebody looking at your ID, they’re trying to validate that photo looks like you. In the case of a website with PII, on the other hand, it could be a combination of your name and a secret question (“the things that you know”) needed to validate access.

More recently, a third dimension was added, even to digital access — a process through which the person granting access could confirm that the picture on your ID was the person they were talking to, by your using biometrics on your laptop or smart phone.

All of this is at the level of an individual, but try and step back and picture this on a larger scale. We are now at the point where, if someone is attacking you, they’re not attacking you to try and steal information only specific to you. They are attacking you, typically, to gain access to your cyber-physical systems and those systems and networks they, in turn, grant you access to, to create disruption in a wide variety of areas.

This could be a disruption of service reputation, a disruption of physical access, perhaps a disruption of power production — something that is very visible, but unpredictable.

With Malice Toward All

© Harperdrewart | Dreamstime Stock Photos & Stock Free Images
© Harperdrewart | Dreamstime Stock Photos & Stock Free Images

Whether it was the Ukraine power crisis, the SWIFT attacks, or the data breaches at the DNC, including the most recent one, all of these were people of various stripes using digital systems to cause disruption in the physical world.

In some cases, the malice is extreme. When someone hacked the electric grid in Ukraine, it was to show how vulnerable systems are, and how easy it would be to reach out and touch, even terrorize, a quarter of a million people.

And it is about terror; it is about gaining digital access to a soft target to influence the most common or basic elements of the physical world, causing questions to creep in about the basic principles of safety and security, cause primal fear, pervert your normal sense of self, and result in an irrational response.

Protecting Our Brave New World

There is no question that technology brings positive change, and that cyber-physical systems allow us to lead better lives, leading to the evolution of Smart Cities, being more fuel efficient, and less negatively impactful on land, among other things. However, there is also no question that the further we travel down the IoT, and the further we get to the standardization of cyber-physical systems, a single vulnerability, even a remote one, will have a much larger impact than ever before on the way we live.

With that in mind, we can try and get the basics right. As NIST, or anyone else, goes down the path of standardization and building processes that protect and guide cyber-physical systems, they would be looking at building those around versions of these three fundamental points:

  • Have multi-factor authentication to verify physical access to something: Where verifying access is a combination of Who You Are, What You Have and What You Know.
  • Limit the way access to data is allowed in shared systems: Where we deal with complex, dynamic environments by limiting data access to people with a combination of flexible, on-a-need-to-have basis of role-based and access-based controls (RBAC and ABAC), and separate the policy aspect of data from the technical management of a system. Essentially, create networks, systems and products where every role does not have access to all the data or systems traditionally connected to having that role.
  • Maintain commonsense security hygiene to restrict physical access to your computational systems: Lock doors. Lock cars. Use passwords to access your laptops or other devices, and use robust password management. Why? Because in a connected world, once someone has physical access to you, they pretty much “own” you, and it takes a world of effort and heartache to change that state of things.

We are undoubtedly at the very beginning of a very different world, a better one, but a more vulnerable one. The path to rethinking our new, connected, digital-meets-physical world order, to make it safer and more secure, is not easy, and we do have many miles to go before we will collectively sleep easier, and breathe easier. It isn’t just a path less traveled, it is a path never traveled. But it is the path that needs to be taken.

(This article was first published on LinkedIn Pulse, here. Wyly Wade is CEO & President of Biometrica Systems, Inc.)

Biometrica Names Wyly Wade, Global Biometrics And Cybersecurity Expert, As CEO

Posted on by wpmu support

A Board Member and Former Company Advisor, New CEO Wyly Wade Has Worked With Security Groups, Intelligence Agencies And Governments Across Five Continents

LAS VEGAS, NV: The Board of Biometrica Systems, Inc., a Las Vegas and Virginia-based SaaS company focused on creating products that link the physical to the digital in order to prevent crime and track criminals and their associates, announced on Thursday that Board member and technology maven Wyly Wade will lead the company’s multi-sector domestic and international expansion as its new Chief Executive Officer & President.

“This is an exciting time for Biometrica,” said Kawaljit “Tony” Singh, the chairman of the Biometrica board. “We already protect roughly 45% of U.S. casino revenue through our range of products. During this time, as we go from being only casino-focused to moving into the hospitality and retail sectors, and look to expand our presence from five countries to many more, it makes perfect sense to have Wyly lead that process of growth given his multifaceted background in cybersecurity, biometrics and identification, and his work with different governments, intelligence agencies, and the private sector.”

Wade, who has advised Biometrica on strategy and direction for two years, has worked with both private security groups and government agencies in multiple countries, including the United States, Japan, Brazil, Columbia, India, Pakistan, Bangladesh, Vietnam, Haiti, Rwanda, Mexico, Maldives, Tajikistan, Nepal, Afghanistan, Germany, and Ghana, on biometrics, benefit delivery, identification and security issues.
He was part of the original group that built the world’s largest health insurance program (called RSBY) for people below the poverty line in India, and also part of the founding core team at the Unique Identification Authority of India, which built Aadhaar, a project that, with more than 1 billion people enrolled, is now the world’s largest biometric program.

“Biometrica is a company on the cusp of changing how the world recognizes and identifies threats, tracks patterns that lead to crime, and people that commit criminal events, from thieves to traffickers to terrorists. I’m looking forward to leading the company as we grow into becoming a global leader in the security and surveillance sector across industries and regions,” said Wade.
In the two decades since the time when, barely out of his teens, he solved a bug that was obstructing what later became the release of Lotus Notes 4, Wade has worn multiple hats. He helped set up the security practice at technology consulting services pioneer, Cambridge Technology Partners, in the mid-1990s, focusing on South America and the drug cartels. In 1997, he and his team at Cambridge hacked into the Federal Reserve, with permission, on live television — for ABC’s 20/20 — to show The Fed just how vulnerable banking systems could be.

Later, as CTO of Holliston, the U.S. passport maker, he advanced product offerings to include producing passports and security documents for 85 countries, and helped develop biometric standards for the U.S. passport. In that capacity, as an advisor to the International Civil Aviation Organization (ICAO), he was instrumental in defining the requirements for the e-passport.
Wade will be based out of Biometrica’s Virginia office.

About Biometrica

Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital and the digital to the physical with the intention of minimizing criminality, or events that could lead to crime.

To this purpose, the company’s range of tools enable the recording of mala fide or criminal occurrences, recognize threats, identify politically enhanced personnel and their associates, track individuals or groups that have either committed a misdemeanor or felony, or have contributed to breaking the law, and finally, help security and surveillance teams of all stripes link all of the above. 

Private Investigator License # 1295 [Nevada PILB]

safience.io

For more Information, please contact
media@safience.io

From Casinos To Hotels And Malls, Biometrica Looks To Protect And Save

Posted on by wpmu support

Given The Enhanced Global Threat Scenario, Biometric and Facial Recognition Products Leader Eyes Expansion into Retail and Hotels after Successful 2015

LAS VEGAS, NV: Anyone that has seen the 2001 comedy heist starrer, Ocean’s Eleven, is probably familiar with futuristic surveillance rooms, security centers and the concept of the “eye in the sky.” They are then already acquainted with some of the work of Biometrica Systems, Inc., a Las Vegas and Virginia-based SaaS company that protects an estimated 45% of U.S. casino revenue across almost 200 casinos. They are also about to get even more familiar.

Biometrica, which was previously focused on creating biometric and facial recognition products and systems for security and surveillance teams in the casino and gaming industry, announced Tuesday that it was expanding into the retail and hospitality sectors on the back of a very successful 2015.

“2015 was a very exciting year for us,” said Biometrica’s Vice President of Business Development, Kevin Parker, adding that the technology products company had seen a more than 30% growth in sales, while maintaining profitability. “Given the natural connections between the casino and hotel sectors, it made perfect sense to move first into the hospitality industry, and simultaneously look at moving into another natural fit, the retail sector,” said Parker.

Through a suite of products built around its industry-defining interface, Visual Casino, Biometrica helps its customers in recognizing, identifying and analyzing threats, and then tracking them through its data distribution platform and networks. In 2015, the company grew its international presence to five countries, propelled by the rapid adoption among customers of LOGiT, a Security Management and Incident Reporting (IR) tool.

“With LOGiT, we created a security-focused Incident Response module that is the basis for the building of a digital CaseFile of every security-related incident,” said the company’s Chief Financial Officer, Nigel F. White. “It had significant uptake, leading to a 12% growth in customers, in addition to the 30%-plus growth in sales.”

While previously, security and surveillance teams in organizations typically worked in silos, LOGiT allows security and surveillance records to be tied together at the local (intra-organization) level and beyond through alerts generated through another unique Biometrica product — the SSIN, or Security & Surveillance Information Network.

The SSIN is a fully encrypted, peer-to-peer private information system, incorporating both shared watch-lists and intra-organizational watch-lists, which allow for the notification of people, events, alerts or warnings.

This year, the company is dramatically expanding its international presence, in addition to the multi-sector expansion into the hospitality and retail sectors. Over the next few weeks, Biometrica will showcase a brand new product and also introduce new versions of the complete existing product set, as it continues to support its customers’ missions in protecting their customers and businesses.

About Biometrica

Biometrica Systems, Inc., a Nevada corporation, is in the business of creating software and systems that link the physical to the digital and the digital to the physical with the intention of minimizing criminality, or events that could lead to crime.

To this purpose, the company’s range of tools enable the recording of mala fide or criminal occurrences, recognize threats, identify politically enhanced personnel and their associates, track individuals or groups that have either committed a misdemeanor or felony, or have contributed to breaking the law, and finally, help security and surveillance teams of all stripes link all of the above. 

Private Investigator License # 1295 [Nevada PILB]

safience.io

For more Information, please contact
media@safience.io