Privacy lost...

Thread Starter

cmartinez

Joined Jan 17, 2007
8,765

WBahn

Joined Mar 31, 2012
32,852
The one bit of reporting I saw today that touched on this seemed very disjointed and full of ill-informed speculation. They were talking about how because the cameras are on the home network that packets sent by the camera can piggyback onto packets sent by other devices and make it into the cloud that way. They made it sound like random fragments of images leaked out into the cloud and the FBI tracked them down and reassembled them. Yeah. Right.

It will be very interesting to learn more details of just where the information was and how it was tracked down. My gut feel is that the cameras just automatically feed data to Google whether you are paying for it or not. What you are really paying for with a subscription isn't for Google to store the information, it's for you to have access to what they store regardless. Sort of like buying a key to unlock the features in your oscilloscope. If this is the case, I'll bet it's disclosed in their Privacy Policy (which no one reads), though it might be worded in a misleading way. For instance, saying that they will store your video if you subscribe to that service implies, to most people, that they will store your video ONLY if you subscribe to that service. But that's not what it is saying from a strict standpoint. If they save it regardless, then they are being absolutely truthful when they say that they will store it if you subscribe.
 

MrAl

Joined Jun 17, 2014
13,707
Hello,

When I first heard about this story my guess was that they would recover at least some video if even a part of it was stored locally. That's because there are techniques that can read data that has been stored underneath other data on disks of different kinds. If the data gets stored and then written over, it is sometimes possible to recover the original data and that would be the recording that was written before the most recent.

This must be one of the strangest cases yet. A guess would be that she was abducted for ransom. It seems though that asking for proof of life would not be a good idea at this point because if she died then the perpetrators could simply disappear forever. It could also be they had something against the daughter and never intended to return her to her family.

Because of how strange it is there could be some suspicions directed at the family itself.
 

WBahn

Joined Mar 31, 2012
32,852
When I first heard about this story my guess was that they would recover at least some video if even a part of it was stored locally. That's because there are techniques that can read data that has been stored underneath other data on disks of different kinds. If the data gets stored and then written over, it is sometimes possible to recover the original data and that would be the recording that was written before the most recent.
This is largely a myth, particularly with today's recording technologies.

When "deleted" data is recovered, it is almost always the case that the data itself has not yet been overwritten, just that the file metadata in the directory structures has been modified to indicate that it is no longer part of the data set.

Long ago, it was possible to recover some truly overwritten data because of the imprecision in the location of the write heads when a bit was written, allowing residual magnetism from previous writes to be discerned from the fringes of the current bit. But today's area densities are so tight and the writes so precise, that this isn't really feasible. Plus, technologies like SSDs use wear-leveling and block remapping which makes it all the more difficult. Even in the old days, it was an extremely expensive and error-prone process that produced file fragments. When most files were text files, those fragments could result in the recovery of enough bits and pieces to provide analysts with meaningful clues. The cost and effort involved could made sense when, for example, examining drives of a significant adversary (criminal organization, terrorist cell, enemy state). But, today, even this is rarely attempted on modern devices.
 

MrAl

Joined Jun 17, 2014
13,707
This is largely a myth, particularly with today's recording technologies.

When "deleted" data is recovered, it is almost always the case that the data itself has not yet been overwritten, just that the file metadata in the directory structures has been modified to indicate that it is no longer part of the data set.

Long ago, it was possible to recover some truly overwritten data because of the imprecision in the location of the write heads when a bit was written, allowing residual magnetism from previous writes to be discerned from the fringes of the current bit. But today's area densities are so tight and the writes so precise, that this isn't really feasible. Plus, technologies like SSDs use wear-leveling and block remapping which makes it all the more difficult. Even in the old days, it was an extremely expensive and error-prone process that produced file fragments. When most files were text files, those fragments could result in the recovery of enough bits and pieces to provide analysts with meaningful clues. The cost and effort involved could made sense when, for example, examining drives of a significant adversary (criminal organization, terrorist cell, enemy state). But, today, even this is rarely attempted on modern devices.
Hi,

Well, ha ha, I think it is a 'myth' that it is a 'myth'. This is an evolving area in forensic science. It's interesting you got two 'likes' too :)
But did I ever imply that you could ALWAYS recover the data? I don't think I did but if I did then I have to apologize maybe I got overzealous :)

Long time ago you probably remember the recommendation by the DOD. They published some code to wipe hard drives so that no data could be recovered by even the most advanced techniques that they knew of at the time. This would be code that wrote over the whole disk, then wrote the inverted data over the whole disk, then repeated that several times (5 times would not be uncommon). That implies that there were remnants of old data that could be detected. Forensic science would possibly be able to recover some data that could lead to evidence that could help to solve a serious criminal case. More to the point though, they wanted to help destroy government data so it could not be recovered by foreign entities. They want to make the recovery of data physically impossible.

Then disks became more advanced, more advanced writing techniques that for one allowed smaller bit areas which causes the magnetically active data to be more fragile and thus harder to detect. This made it much harder to detect the old data. There were other changes too making it harder and harder. Almost no way to read any data, almost. However, we know that when a forensic scientist wants to discover something that has not been discovered before, the never seem to rest. They find a new technique, suddenly everything changes.
In the criminal case at hand, if we get just one scientist that gets interested enough in the case and the disk of the right (or should I say wrong) type, he may be able to find a way though the dust. This happens a lot in real life. It's not a guarantee, but it's always a possibility.

All that though is about one type of disk. If the type is a certain flash type, they can have some success by a scanning technique that can detect actual charge storage. The only people that can probably do this are the forensic guys who do stuff like this all the time. The equipment is very specialized and probably expensive. The main principle I think lies in secondary electron emission.

None of this rules out any new techniques that could come up tomorrow either, but of course it depends on what kind of disk they find has been used to store the data, and how new it is, and even if they find a disk at all. If they can't find a physical disk, then they have to rely on cloud based ideas.

There's also the possibility that even if they were able to recover every single frame of every video ever recorded from any of those cameras or even from cloud based data, that they still can't identify anyone of interest. There is a lot of chance built into all of this, and of course how professional the perps were. There is suggestion that they were amateurs and very disorganized.
Another guess would be that the grandmother saw somethign she was not supposed to see, and it was a murder disguised as a kidnapping.

I guess we will all be sitting on our hands and waiting for the next move.
 
Last edited:

WBahn

Joined Mar 31, 2012
32,852
Hi,

Well, ha ha, I think it is a 'myth' that it is a 'myth'. This is an evolving area in forensic science. It's interesting you got two 'likes' too :)
But did I ever imply that you could ALWAYS recover the data? I don't think I did but if I did then I have to apologize maybe I got overzealous :)

Long time ago you probably remember the recommendation by the DOD. They published some code to wipe hard drives so that no data could be recovered by even the most advanced techniques that they knew of at the time. This would be code that wrote over the whole disk, then wrote the inverted data over the whole disk, then repeated that several times (5 times would not be uncommon). That implies that there were remnants of old data that could be detected. Forensic science would possibly be able to recover some data that could lead to evidence that could help to solve a serious criminal case. More to the point though, they wanted to help destroy government data so it could not be recovered by foreign entities. They want to make the recovery of data physically impossible.

Then disks became more advanced, more advanced writing techniques that for one allowed smaller bit areas which causes the magnetically active data to be more fragile and thus harder to detect. This made it much harder to detect the old data. There were other changes too making it harder and harder. Almost no way to read any data, almost. However, we know that when a forensic scientist wants to discover something that has not been discovered before, the never seem to rest. They find a new technique, suddenly everything changes.
In the criminal case at hand, if we get just one scientist that gets interested enough in the case and the disk of the right (or should I say wrong) type, he may be able to find a way though the dust. This happens a lot in real life. It's not a guarantee, but it's always a possibility.

All that though is about one type of disk. If the type is a certain flash type, they can have some success by a scanning technique that can detect actual charge storage. The only people that can probably do this are the forensic guys who do stuff like this all the time. The equipment is very specialized and probably expensive. The main principle I think lies in secondary electron emission.

None of this rules out any new techniques that could come up tomorrow either, but of course it depends on what kind of disk they find has been used to store the data, and how new it is, and even if they find a disk at all. If they can't find a physical disk, then they have to rely on cloud based ideas.

There's also the possibility that even if they were able to recover every single frame of every video ever recorded from any of those cameras or even from cloud based data, that they still can't identify anyone of interest. There is a lot of chance built into all of this, and of course how professoinal the perps were. There is suggestion that they were amateurs and very disorganized.
Another guess would be that the grandmother saw somethign she was not supposed to see, and it was a murder disguised as a kidnapping.

I guess we will all be sitting on our hands and waiting for the next move.
None of this is at odds at all with what I said. Note that your recommendation from the DoD was from a "long time ago". This is in no way inconsistent with what I said, which started, oddly enough, " Long ago, it was possible to recover some truly overwritten data ...."

Notice, also, that you are mostly talking about protecting national security secrets from foreign entities or helping to solve a serious criminal case. This is in no way at odds with what I stated, which was, "The cost and effort involved could made sense when, for example, examining drives of a significant adversary (criminal organization, terrorist cell, enemy state)."

I'm also talking about the technology of TODAY, not some technology a decade or a century from today, so throwing out sheet anchors involving "new techniques that could come up tomorrow" is a complete red herring. The data we are discussing was data that was recovered NOW, not a decade from now. It is data that was captured by a camera a week ago and recovered a day ago.

I'll say it again. My best supposition is that the "backend systems" it was recovered from are almost certainly servers that the camera sent the data to as a matter of course, irrespective of whether the customer had sign up for a subscription for that service. The apparent delay is not due to some ultra-sophisticated examination of physical media (which can take days or months to perform even in cases when it is possible), but simply the normal turn-around time for the legal process to work it's way through involving issuing a request to the company that is believed to have the data, the company getting the okay from its internal legal counsel on the validity and scope of the request, accessing and evaluating the data to ensure that it complies with the request without being too broad, and delivering the data. It's a process that normally takes about a month, but can be streamlined down to about a week, which happens to be right at what we've seen here.
 

MrAl

Joined Jun 17, 2014
13,707
None of this is at odds at all with what I said. Note that your recommendation from the DoD was from a "long time ago". This is in no way inconsistent with what I said, which started, oddly enough, " Long ago, it was possible to recover some truly overwritten data ...."

Notice, also, that you are mostly talking about protecting national security secrets from foreign entities or helping to solve a serious criminal case. This is in no way at odds with what I stated, which was, "The cost and effort involved could made sense when, for example, examining drives of a significant adversary (criminal organization, terrorist cell, enemy state)."

I'm also talking about the technology of TODAY, not some technology a decade or a century from today, so throwing out sheet anchors involving "new techniques that could come up tomorrow" is a complete red herring. The data we are discussing was data that was recovered NOW, not a decade from now. It is data that was captured by a camera a week ago and recovered a day ago.

I'll say it again. My best supposition is that the "backend systems" it was recovered from are almost certainly servers that the camera sent the data to as a matter of course, irrespective of whether the customer had sign up for a subscription for that service. The apparent delay is not due to some ultra-sophisticated examination of physical media (which can take days or months to perform even in cases when it is possible), but simply the normal turn-around time for the legal process to work it's way through involving issuing a request to the company that is believed to have the data, the company getting the okay from its internal legal counsel on the validity and scope of the request, accessing and evaluating the data to ensure that it complies with the request without being too broad, and delivering the data. It's a process that normally takes about a month, but can be streamlined down to about a week, which happens to be right at what we've seen here.
Hello again,

Sounds good except for this:
"I'm also talking about the technology of TODAY, not some technology a decade or a century from today, so throwing out sheet anchors involving 'new techniques that could come up tomorrow' is a complete red herring. The data we are discussing was data that was recovered NOW, not a decade from now. It is data that was captured by a camera a week ago and recovered a day ago."

It's not a 'red herring' if it happens all the time. It happens all the time. You just need to look into the important cases where it did happen.
Also, it just so happens that I am talking FUTURE, like tomorrow, next week, next month, next year. Evidence does not just disappear. If it is important enough it is kept for a long, long time, just waiting for someone to come up with some new way to deal with it.
For example, DNA fingerprinting, Forensic Entomology, and others.
Those were on the fly as the need arose and that's how some crimes were solved that were not solvable just before that, but there has been other research that originated in the lab like VMD.
One of the most evolving technologies does involve data storage. New techniques that look at the way data is stored not just what is stored there, for example. The techniques kind of follow the storage technology, and why wouldn't it. Do they just stop at some point and say, "Well, we are never going to be able to do this so let's all go home and have coffee and cake" :)
Also, my comment was a general comment that is conditional based on what else is found that could be examined. If they don't find anything else, of course they can't examine it.

It seems silly to think that a new technology is not likely, but due to the timeline of some of these cases that it could not be used on a case that happened just an hour ago. It could be next year when the new technology is used and that's because there is no statute of limitations on some crimes.
There have been cases solved 10 or more years later. One striking example was when a detective did a little simple language analysis and realized the perp had revealed some knowledge that was borderline guilty knowledge. He went back to question him again and got him to admit where he hid the bodies.

Today they use all sorts of technology, and it's always getting better, and it often does not matter if it takes a year to figure out with the new tech. Of course, they probably won't dig too deep for a parking ticket :)
 

nsaspook

Joined Aug 27, 2009
16,326
https://www.cnbc.com/2026/02/12/ama...-partnership-amid-super-bowl-ad-backlash.html
Amazon’s Ring cancels Flock partnership amid Super Bowl ad backlash
“Following a comprehensive review, we determined the planned Flock Safety integration would require significantly more time and resources than anticipated,” Ring wrote in a blog post. “As a result, we have made the joint decision to cancel the planned integration.”
Your data is a profit center for them, they will try again.
 

nsaspook

Joined Aug 27, 2009
16,326
https://www.theregister.com/2026/02/18/generating_passwords_with_llms/
Seemingly complex strings are actually highly predictable, crackable within hours
The team used two methods of estimating entropy, character statistics and log probabilities. They found that 16-character entropies of LLM-generated passwords were around 27 bits and 20 bits respectively.
For a truly random password, the character statistics method expects an entropy of 98 bits, while the method involving the log probabilities of the LLM itself expects an entropy of 120 bits.
In real terms, this would mean that LLM-generated passwords could feasibly be brute-forced in a few hours, even on a decades-old computer, Irregular claimed.
1771527406148.png
 

joeyd999

Joined Jun 6, 2011
6,300
Further, you would expect that an AI should excel at producing order, not disorder (though with a dramatic increase in overall system-wide entropy).
 

joeyd999

Joined Jun 6, 2011
6,300
I just had a funny thought: asking AI for a password is asking for increasing entropy by increasing entropy. An AI password is entropy^2. I'm LOLing in my head.

Think of how many truly random passwords you could generate from the waste heat!
 

WBahn

Joined Mar 31, 2012
32,852
https://www.theregister.com/2026/02/18/generating_passwords_with_llms/
Seemingly complex strings are actually highly predictable, crackable within hours


View attachment 363698
This is actually not surprising, and has some other related issues that should be taken into account.

LLMs generate things based on predictive models, so it should not come as a shock to anyone that what they output has a high degree of predictability associated with it.

Also, when given similar prompts, we would expect and LLM to output roughly similar content. The consequence of this is that if we ask an LLM to output a million passwords, especially if done one at a time the way that most users would do it, we would not be surprised to see repeats.

Finally, the LLM training set is going to include huge lists of known passwords (such lists, along with their hashes, exist in numerous places), so it's not unlikely that they password it produces for you will be one that is in its training set, meaning that it is immediately crackable via dictionary lookup of the hash.

A far, far better way to generate a pass phrase is to pick two unrelated three or four character phrases that are memorable to you and then interlace the words. For instance, you might do something like:

Olympic dream comes true
Banana splits taste good

Then, your big-time high-security password might be

OlympicBananadreamsplitscomestastetruegood.

You can also use this to generate numerous other passwords, especially if you create absurd phrases that can be visualized in some way, as this makes it much easier to remember the password, even months or years later, without ever having written it down. The fact that those are not truly independent is actually not much of a concern. So you might use passwords like:

Bananadreamtastegood
 
Top