Bruce Schneier points to a new product Smart Water. Each bottle has its own unique tag, and the water in it contains tagging elements (e.g., microdots), that will stick to an object if you spray the Smart Water on it. Then, if the item is stolen, the company says that the police can use the tags to identify the real owner.
Bruce, being a smart security analyst, immediately sees attacks on the system:
The idea is for me to paint this stuff on my valuables as proof of ownership. I think a better idea would be for me to paint it on your valuables, and then call the police.
He has a point, but this doesn’t mean that Smart Water is useless. As often happens with security products, one has to think carefully about what can be deduced from a particular fact. The fact that an item has Bruce’s tag on it doesn’t prove that the item belongs to Bruce, but it does prove that Smart Water from Bruce’s bottle has been near the object. (Actually, it doesn’t even prove that, unless the tags have certain anti-forgery properties. What exactly these properties are, and how to achieve them, is left as an exercise for the reader.)
If Bruce is your neighbor, and he has been in your house recently, then the presence of his tags on your valuables means little. On the other hand, if there is no apparent connection between you and Bruce, and an item locked in the safe in your house has his tags on it, and he was known to own an item like that which he has reported stolen, then you have some explaining to do.
This seems like a technology that will have unforeseen uses, some of which are sure to be annoying. I could put my tags on the shirt I give you for Christmas, and then check to see whether that same shirt shows up back in the store later. I could spray my tags onto my back porch, and then see whether they turn up on my neighbor’s cat. These are mildly annoying, but given enough people with enough annoying goals, I’m sure some interesting ideas will turn up.
Just wait until tags like these are RFID-enabled. Then the fun will really start.
Well lets follow this through. You pour half your bottle down the sink since you’ve used it all you want, and dont think about consequences. Shortly, everyone else downstream to the ocean who draws from that river starts beeping with your ID (and everyone else’s ID who is upstream). The fish in the market beep with your ID. It rains your ID. Hey, this is fun!
The police just came round to our house today to spray our electrical items with smart water (we live in the uk).
Spotted a flaw though. As we live in rented accomodation we move house quite regularly…so next year our stuff will be marked as being “owned” by the current occupier of the property.
Oh please … no. It hurts my brain.