Lagron Roman-Seminar On Vision Based Security 1

Blinkering Surveillance:Enabling Video Privacy through

Computer Vision

Andrew Senior,Sharath Pankanti,Arun Hampapur,Lisa Brown,Ying-Li Tian,Ahmet Ekin

Lagron Roman-Seminar On Vision Based Security 2

Abstract

Review of privacy in video surveillance

Using a computer vision approach to understanding the video can be used to hide superfluous details, particularly identity.

Lagron Roman-Seminar On Vision Based Security 3

Introduction

In recent years we have seen a world-wide rise in the use of Closed-Circuit Television (CCTV) cameras.Now we see rise in video processing systems:

Can interpret the videoExtract usable data: movements, identities, events.

Lagron Roman-Seminar On Vision Based Security 4

Introduction-cont.

Video surveillance can readily be used as a tool for statecontrol and oppression, to spy on people and for voyeurism.

Similar algorithms can be used to filter that same video,altering it and restricting the amount of privacy-intrusivedata contained in the video, while preserving enoughinformation to be useful for the original task.

http://www.youtube.com/watch?v=JqcEUdboN2o

Lagron Roman-Seminar On Vision Based Security 5

Rise of video surveillance Video cameras are being installed in urban areas throughout thedeveloped world- principally as a deterrent to crime.

- Only 4% reduction in crime. - CCTV moving crime out of the camera

boundaries. - Unmonitored zones become targets for

illegal activity- Criminal acts committed in a private

location, such as a locker room or restroom

- Helps to Solve crimes. - Areas under surveillance become crime-free.

http://www.youtube.com/watch?v=BLcmaITB_Lc http://www.youtube.com/watch?v=gcE106AMOWA

Lagron Roman-Seminar On Vision Based Security 6

Rise of video surveillance-cont.

Reasons for Surveillance is spreading:

Storage costs ↓

Installation costs ↓

Technology

↑ Production quantities ↑

Prices of video cameras

↓

Prices of saving the video

↓Prices of multiple

cameras installation

↓

Lagron Roman-Seminar On Vision Based Security 7

Public concerns

Recent technological developments and the threat of

blanket video surveillance have heightened publicconcern about the less benign effects of mass

surveillance“Big Brother" could know their every act and inspire the self

censorship intended by the Panopticon: (George Orwell, “1984”):

“So long as he remained within the field of vision which the metal plaque commanded, he could be seen as well as heard. There was of course no way of knowing whether you were being watched at any given moment”.( http://www.online-literature.com/orwell/1984/)

Lagron Roman-Seminar On Vision Based Security 8

Public concerns – cont.The ACLU (American Civil Liberties Union) has

outlineda number of concerns about video surveillance,describing five abuses of CCTV:

1. Criminal abuse

2. Institutional abuse

3. Abuse for personal purposes

4. Discriminatory targeting

5. Voyeurism

http://www.researchchannel.org/prog/displayevent.aspx?rID=5036&fID=345#

http://www.youtube.com/watch?v=DHarMDHRhC4

Lagron Roman-Seminar On Vision Based Security 9

Automated surveillance

CCTV systems have already publicly deployed face recognition software → the potential for identifying and tracking people.

Systems gather much richer information about the people being observed.

Beginning to make judgments about their actions and behaviors.

Lagron Roman-Seminar On Vision Based Security 10

Automated surveillance-cont.

Algorithms bring the potential to automatically track individuals across multiple cameras.

Systems tracking a particular person throughout the day: showing what happens at a particular time of day looking for people or vehicles that return to a locationAlgorithms exist for tracking people, understanding their interactions.

Compression algorithms have reduced the storage needs.

Lagron Roman-Seminar On Vision Based Security 11

CCTV cameras help Parking Services team to enforce both parking and traffic

contraventions.

Central London Congestion Charging scheme : it was first introduced in

February 2003 to discourage traffic congestion in central London

Automated surveillance-Example

http://www.youtube.com/watch?v=LQ0JMAV2DGg

Lagron Roman-Seminar On Vision Based Security 12

What is a general data privacy ?

Privacy means different things to differentpeople - what is considered acceptable orintrusive is a result of cultural but alsotechnological capability.

In the United Kingdom principles of data protection

(Data Protection Act-DPA) saying that data must be:

fairly and lawfully processedprocessed for limited purposesadequate, relevant and not excessiveaccuratenot kept longer than necessaryprocessed in accordance with the data subject's rightssecurenot transferred to countries without adequate protection

Lagron Roman-Seminar On Vision Based Security 13

Why video is different?

Difficulty in processing it automatically to extract useful information.

Harder to assess the privacy.

It takes time to review video to find “interesting” excerpts.

Even in a liberal democracy and with many checks and balances, the potential for abuse is large.

Laws which are rarely enforced end up being applied selectively and unfairly

Lagron Roman-Seminar On Vision Based Security 14

Technological video privacy Sony-system that detects skin tone and replaces it with another color.

Matsushita-system for obscuring a “privacy region” being observed by a pan-tilt-zoom camera.

Newton-a system for “de-identifying” faces by transforming faces in shared surveillance video

Cluster memberCluster memberDe-identified

http://privacy.cs.cmu.edu/people/sweeney/video.html

Lagron Roman-Seminar On Vision Based Security 15

A model for video privacy

Parameter Solution

What data is present

Consent

Who sees the data

How long is the data kept

How raw is the data

What form the data is in

Limit the data capture. Blinkers, blinds. Lens caps, indicators of when the camera is in operation, a low resolution camera, defocused lens.

Use signs to inform the public

Key is required to access the data. Access control rules. Playback, searching, freeze frame etc require different levels of authorization.

Minimize the data lifetime.

The crucial aspect for privacy. Mask out privacy-invasive features

Data should be stored digitally and encrypted. Encryption should be carried out at the camera

Lagron Roman-Seminar On Vision Based Security 16

Absolute versus relative ID A major distinction among video surveillance systems is

the level ofanonymity they afford.

Relative ID: Systems can recognize people they have seen before,

buthave no enrollment step. Can be used to collect

statisticsabout people's comings and goings, but do not know

anyindividual information. Use weaker methods ofidentification. Collect short term statistics. Unable torecognize people over periods of time longer than a

day.

Anonymous: Knows nothing about the individuals that are

recordedonto the tape or presented on the monitors. While

opento abuse by individuals watching the video, it does

notFacilitate that abuse.

Absolute ID: Have some method of identifying the individuals

observed(face recognition, badge swipe correlated with the

video)and associating them with a personal record in a

database.Require some kind of enrollment process to register

theperson in the database.

Lagron Roman-Seminar On Vision Based Security 17

Privacy preserving video console

“Privacy Cam”- A camera with onboard processing. Produces a video stream with the privacy-intrusive information already removed.

Prototype system to record and redistribute surveillance video.Designed to minimize the intrusion.It concentrates on what data is present and How raw is the data issues.Re-renders the video stream to hide the privacy-intrusive details.Preserving the information necessary for the system to be useful.

Lagron Roman-Seminar On Vision Based Security 18

System architecture

Selective video decoding system-operates under the control of a user authentication system.

Encoding system - consists of video analysis, transformation, and encryption subsystems

Lagron Roman-Seminar On Vision Based Security 19

Enrollmentdatabase

Authentication

Authentication module

The encoding system

Video sourceAnalysis &Informationextraction

Transformation Encoding

Transformationparameters

Keygeneration

Lagron Roman-Seminar On Vision Based Security 20

Analysis subsystem

Takes a stream and analyzes thevideo at more sophisticated

levels toextract separate streams ofinformation:

1.Appearance of background2.Extracting objects of

interest3.Separating people from

vehicles4.Distinguishing people who

walk in groups5. Distinguishing betweendifferent limbs within a

person

Video source

Backgroundsubtraction

Backgroundestimation

Connectedcomponent

analysisTracking

Object tracks

Enrollmentdatabase

Objectidentification

Authentication module

Objectclassification

Object class

Partidentification

Parttracking

Activity

Lagron Roman-Seminar On Vision Based Security 21

Analysis subsystem-cont. Generic object detection approach - all objects of interest are

dened interms of one or more attributes (features).For example - moving

objects.In a model specific approach, each object of interest is modelled andexplicitly detected using model-based techniques. For example-

humans andvehicles.

Lagron Roman-Seminar On Vision Based Security 22

Transformation subsystem

The transformation subsystem selectively transforms the

information extracted from the video based on the system

policy.

System policies may choose to partially/fully obscure orstatistically perturb one or more components of

extractedinformation such as location, pose, activity,track, and

so on.

The transformed information components constitute an

encoded video channel.

Lagron Roman-Seminar On Vision Based Security 23

The encryption subsystem

Extracted information is encrypted using the encryption

subsystem, using different keys for different information

streams.

The encoded video may contain multiple copies of essentially

the same information,although each of the copies may be

encoded with a different key.

The encoded video is modular in nature and each module (or

channel) represents one or more components of extracted or

raw video information.

Lagron Roman-Seminar On Vision Based Security 24

Secure encryptionWhat is a definition of secure

encryption ?• Key length?• Computation time?

The adversary sees the same distribution of ciphertext, regardless of the message sent. (perfect indistinguishability)

1 2Pr[ ( ) ] Pr[ ( ) ]

k kc cm mE E

1 2,

P plain text

E encryption scheme

k encryption key

two messages of the same lengthm m

Lagron Roman-Seminar On Vision Based Security 25

Secure encryption

Pr [ | ( ) ] Pr[ ]k

M m M c M mE

After seeing the ciphertext, the adversary doesn't know more about the message thanbefore seeing the ciphertext.

The a posteriori knowledge is the same as the a priori knowledge.

We think of M as known to the adversary.

Lagron Roman-Seminar On Vision Based Security 26

A (private-key) encryption scheme consists of three algorithms (G,E,D), as follows:

Symmetric (Private Key) Encryption

The encryption algorithm E is a randomized algorithm that takes a key and a plaintext and outputs a ciphertext

k K m Pc C

The decryption algorithm D is a deterministic algorithm that takes a key and a ciphertext and returns a plaintext .

k Km P

c C

Examples: DES, AES

The key generation algorithm G is a randomized algorithmthat returns a key

k K

Lagron Roman-Seminar On Vision Based Security 27

Public Key EncryptionA public-key encryption scheme consists of three polynomial-time algorithms (G,E,D), as follows:

The key generation algorithm G is a randomized algorithm that takes a security parameter as input returns a pair (pk; sk), where pk is the public key and sk is the secret key.

1n

The encryption algorithm E is a stateless randomized algorithm that takes the public key pk and a plaintext m and outputs a ciphertext c

The decryption algorithm D is a deterministic algorithm that takes the secret key sk and a ciphertext c and returns a plaintext .( )

skm cD

Examples: RSA

Lagron Roman-Seminar On Vision Based Security 28

The decoding system

Encodedvideo

Statisticalquery

processor

Enrollmentdatabase

Authentication

Authentication module

Keygeneration &authorization

Selectivedecryption

Decodedraw video

Transformedvideo

synthesis

Query

Query

outputA

uth

ori

zati

on

Query

output

Lagron Roman-Seminar On Vision Based Security 29

Granting access Layered approach - the different kinds of data extracted by the

system.

Video

Rendering

hide identit

y

hide times

alert on

event

hide actions

hide locatio

ns

Statistics

How many

people

Alert me if X

shows up

Average flow patter

n

Ordinary users access statistics

Law enforcement

access video on emergency or

court order

Privileged users access more information

Lagron Roman-Seminar On Vision Based Security 30

The PrivacyCam

Output is in the form of a re-rendered NTSC video stream.

On-board processing power. The video encoding,transformationand encryption take place on the camera before transmission.

Re-rendered output video stream, encrypted informationstreams can also be transmitted via other output ports, such

asover a wireless network.

http://cs.uccs.edu/~cs591/studentproj/projS2007/achattop/doc/Present.ppt

http://www.youtube.com/watch?v=vJkBCfPBzAU

Lagron Roman-Seminar On Vision Based Security 31

Guaranteeing video privacy Perfect performance can not be guaranteed

* Missed detection * False alarm. * Selecting the appropriate system operating point.

Single missed detection may

reveal personal information

over extended periods of time.

Occasional false alarm may have a

limited impact on the effectiveness

of the installation.

Even with perfect detection, anonymity cannot beguaranteed. Contextual information may be enough

touniquely identify a person.

Lagron Roman-Seminar On Vision Based Security 32

Increasing public acceptance

Q: Why anybody would accept this extra burden? A: In the future, it may be required by law that CCTV

systems impose privacy protection of the form that we describe.

Q: What guarantee a citizen has that a claimed privacy protection is actually in force?

A: A potential solution is certification and registration of systems

Lagron Roman-Seminar On Vision Based Security 33

Conclusions

Video surveillance and person-aware video systems are here to stay and will grow ever more powerful.We have presented a model for future systems that take a technological approach to defending video privacy.