Behavior analysis and video surveillance

Alleged member of the assassination team checks in at her hotel and waves toward the security camera. She's linked to the team by association. She wears various disguises during her stay.
Alleged member of the assassination team checks in at her hotel and waves toward the security camera. She's linked to the team by association. She wears various disguises during her stay.

For the last week, articles on the killing of Hamas operative Mahmoud al-Mabhouh in Dubai, have been a veritable smorgasbord of intriguing intelligence reports. Anyone working intelligence or security analysis has intensely followed the different, and often contradictory, summarizations of which organizations were behind the killing.

Experts and retired intelligence officers in both Israel and Europe have concluded with 99% certainty that it must be the Mossad. The most interesting conclusion was written yesterday as an opinion piece in the weekend edition of The Wall Street Journal, dated February 20-21, headlined Israel and the Dubai murder mystery, by Ronen Bergman (senior military and intelligence analyst for Yedioth Ahronoth, a daily Israeli newspaper).

Other observations and background bits that are far deeper and have more detail from the perspective of the intelligence community are posted as comments under Bruce Schneier’s blog post on the Al-Mabhouh Assassination. 

To quickly understand why Dubai officials and their own intelligence office were able to piece together so quickly what really happened, look at the 28-minute video Alleged Assassins Caught on Dubai Surveillance Tape on Wired.com

Two other alleged members in the hallway outside the victim's hotel room, making a turn to the right while looking to the left, where the victim's room is located.
Two other alleged members in the hallway outside the victim's hotel room, making a turn to the right while looking to the left, where the victim's room is located.

Ronen Bergman (and many others) wonders how the Dubai police could connect team members and their activities so quickly. In his next-to-last paragraph, he states that casino and hotel surveillance security have long used techniques to track and apprehend suspects, cheaters and thieves.

There are already companies in Las Vegas that specialize in software and database analytics of known cheaters, and cutting-edge algorithms that analyze suspect behavior. This is not yet foolproof, but is already in place in large chains where thefts by employees or employee associates are high.

In analyzing behavior, irregular movement, body language, and interaction with others, it is extremely difficult to define what is regular behavior versus irregular. But looking at the Dubai tape, there are many moments when the suspects appear to be loitering or turning or tilting their heads unnaturally. I am sure in years to come this video will be used as a case study in how not to behave to avoid surveillance analytics.

We know from our conversations with thieves around the world that the smart ones are very aware of camera surveillance and what they are capable of. The thieves simply avoid these locations and work elsewhere. A surveillance system is only as good as the monitor team. It takes a critical eye to quickly judge and determine what is suspect or irregular in order to stop crime before it happens.

A fourth alleged member of the team in the same hallway, standing with unnatural feet position, turned inwards.
A fourth alleged member of the team in the same hallway, standing with unnatural feet position, turned inwards.

Much more common is analyzing video after the fact. Once a crime has taken place, security personnel simply go back on the video timeline to establish exactly what happened and when. It then becomes essential to determine all the secondary …˜players’ around the incident, both before and after the event (attack, theft, or attempt), and to follow each individual backwards and forwards on the timeline to see who else is connected with these suspects. Examples include running the license plates of any car involved.

Facial recognition software is a good step forward if the individual already exists in a database. But this form of surveillance depends on camera angles, lights, and the suspects’ use of disguises. The Dubai suspects used many disguises, including wigs and different dress modes. The technology is in its early stages, especially the algorithms required to make irregular pattern recognition useful.

The Dubai debacle is particularly timely and interesting as a starting point for the security conference in Las Vegas today and tomorrow at the World Game Protection Conference and trade show. The keynote speaker will be Kevin Mitnick, the world-famous hacker who showed the security industry that terminals which are supposed to be fail-safe can be infiltrated. Several cases in the last few years involved clever gangs who succeeded in tampering with slots and poker machines, making huge illegal payoffs. Pattern recognition software was not able to block these modifications; only silly mistakes by the gang members tipped them off to casino management.

Kevin Mitnick is a social engineering sleuth of world-class reputation. In a few days, we’ll report on his work and keynote address. The rumor mill has been churning these past few weeks about the content of his presentation. We expect some intriguing revelations previously hidden by the gaming industry, or at least made to appear insignificant.

The manner by which the Dubai suspects moved about in hotel lobbies and around elevators, reminds us of how sophisticated pickpockets and other deception thieves operate when tracking a high target, be it a Japanese high-roller or a diamond jeweler attending a jewelry trade show. The bottom line is that it is difficult to appear natural or to blend-in as a regular traveler or tourist when your mind is running in a different direction.

More about the gaming security trade-show in a few days.

Video surveillance

Who’s looking at you when you buy a coffee? It’s creepy, when you know all they can see.

At the World Game Protection Conference in Las Vegas earlier this year, where Bob was a keynote speaker, I saw SmartConnect‘s live demo of actual video surveillance. The client we spied on was a coffee chain store at McCarren Airport. No surprise that I saw the employees and customers, but I also saw an image of each customer’s itemized receipt—as it was generated. I could see all stats pertaining to each transaction in real time, as if I were there. Did the cashier apply an employee discount to the sale? Did she leave the cash drawer open for more than x seconds? Just how many employee discounts did that cashier register today, anyway?

It was all there, laid out on one big screen, along with multiple video images of the employees and customers as they interacted. On a giant plasma display with almost life-size images, it truly felt like peeking over the shoulder of the employees.