eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Non-obvious relationship awareness (NORA) software probes databases in any language, searching for obscure matches between relevant information. Anonymized data (ANNA) software uses the same technology to investigate data that has been encrypted.
SRDs patented technology allows users to discern obvious and so-called “non-obvious” relationships between data sets in multiple databases. This view can help identify connections that can span more than 30 degrees of separation.
One degree of separation would be two people who work at the same casino who also listed the same address on their resumes. The second degree might be finding out that a third-party vendor providing cards to the casino attended the same high school as one of those two employees. The third degree might be discovering that all three of these individuals maintain checking accounts at the same bank. In the case of Atta, NORA would have identified that he at one point shared a home address with two other 9/11 terrorists, Khalid Al-Midhar and Salem Alhazmi.
The software instantly triggers a “trip wire” that flags high-risk individuals—from casino cheats to known terrorists—and then compares what it knows about them with information in airline-reservation, passport and other databases.
The CIA, FBI and DHS all have started to deploy NORA in the past two years. Such software allows organizations to make “critical conections that otherwise would never have materialized, says Shepherd at the Venetian.
SRD chief executive Jonas says that, had the government been using NORA prior to 9/11, most, if not all, of the terrorists involved in those attacks could have been captured long before they boarded those flights. He says a list of names supplied by the State Department listing foreign nationals still in the U.S. on expired visas could have been used to identify anyone of a similar name making an airline reservation or taking a room for a night at an Econo Lodge.
“Theres so much information out there available, but making sense of it and finding links between people, locations and events is the tricky part,” Jonas says.
Soon, the government and casinos—along with virtually every other industry that tracks and records large volumes of data—will have another tool from SRD that takes information gathering and relationship awareness to a whole new level.
ANNA, an offshoot of NORA, is in its final testing stages right now. This “double-blinding” technique of encryption makes it possible for investigators to search databases without seeing the names, addresses and other information theyre picking through.
With ANNA, owners of data would send data to a third party in a conventionally encrypted form. That third party would act as an independent holder of the data, using SRDs software to index its contents and, at same time, apply a second level of encryption that makes it impossible to read or restore the data to its original form. This second level of encryption is whats known as a “one-way” hashing algorithm.
An investigator can then pose queries to this hashed set of numbers and letters. But the person or organization making the queries cant see or figure out the original names, addresses or information that is contained in the scrambled data.
Then, if the investigators queries produce matches in two separate databases—such as, say, every physics student enrolled in the past 10 years at any U.S. university and anyone granted a temporary visa from Saudi Arabia in the past 10 years—they can then go back to the original sources and ask for the specific information underlying those matches.
That underlines the importance of the third party, which will have to “unblind” those numbers and letters to their original form so the investigating party can ask the source for information on a specific person, date and locale.
At the same time, it makes it possible for a variety of investigating organizations to share data without exposing it in any way.
This is crucial to the FBI, CIA and other government agencies. Because the hashed data cannot be reconstructed into its original form, the information cannot be compromised, sold or accidentally transmitted to the very organizations they are pursuing.
“We could one-way hash the list of all the Al Queda terrorists the State Department has and send an e-mail to Osama bin Laden and he wouldnt be able to decipher it,” Jonas says. “Thats the beauty of the software. It allows you to find matches of data that otherwise means nothing to anyone.”
How This Applies to Domestic Security: Homeland Security and FBI investigators using NORA and ANNA can now compare lists of suspected terrorists and other criminals on the lam to, for example, a database containing the names and addresses of anyone who has purchased a firearm in Florida or Oregon or, for that matter, the entire U.S. without compromising the names and addresses of every gun owner. Requests for data can be precise.
Be sure to add our eWEEK.com database news feed to your RSS newsreader or My Yahoo page:
Next Page: Collaboration techniques.
Collaboration Techniques
Collaboration Techniques
Casino operators use surveillance cameras, facial-recognition software, transaction-tracking systems and other software to create profiles of suspected cheaters and then distribute that information electronically between themselves, around the clock.
John Horton, director of security at the Stardust Resort and Casino, says using computer systems to share information, including physical descriptions, criminal history and the names of known associates of suspected crooks, scam artists and even terrorists has been standard operating procedure in Las Vegas for more than 10 years.
“We take it seriously because this is a one-economy town,” Horton says. “We have to train our staff to understand what to look for, who to look at and where to look. We take great pride in sharing our problems and successes with each other without any reservations.”
Most casinos use private investigators in conjunction with their own facial-recognition software systems to keep out would-be cheats as well as fugitives on the lam. Using a wireless network, a casino such as the MGM Grand can transmit a digital image taken inside the casino of a suspected cheat or crook to an investigator working from a laptop down the street or 6,000 miles away in the Caribbean. This can happen several times a day.
These same images are sent, either electronically through a wireless network or simply faxed, to all the Las Vegas casinos as well as the Las Vegas Metropolitan Police Department and the local FBI branch. The information also travels in the other direction: A daily report detailing new names and descriptions of suspected terrorists or targets from the NCHS and the FBI are faxed or e-mailed each day to the security chiefs at all the major Las Vegas casinos.
“We have to have a free flow of information,” Horton says. “One place might be getting hit by a specific group of criminals and although we havent seen them yet, we need to know who to look for and what actions theyre taking to prevent them from doing it to us.”
The exchange of information doesnt end with the casinos.
At least one FBI field agent is assigned to each casino in Las Vegas. This was originally intended to help investigate organized-crime activity and money laundering but has been expanded to terrorism investigations. The field agent is responsible for meeting with that casinos security chief at least once a week.
While casinos use a wireless network to exchange data, the FBI is still more than a year behind schedule in revamping its information systems. It was only in March 2003 that all 622 FBI offices were all finally connected to a secure, wired Ethernet connection. (See “Under the Gun,” Case 088, September 2003.)
Each week, FBI field agents in Las Vegas create a report that serves as something of a “Vegas primer,” complete with arrests, unusual behavior reports and detailed reports of what technology and surveillance techniques casinos are using. This information is then passed on to supervisors at the national level.
“Very few if any cities have the level of communication and input with the FBI that Vegas enjoys,” Horton says. “Thats because of the inherent [threat] of crime in the casinos and the sophisticated technology [we] use.”
How This Applies to Domestic Security: In February, DHS Secretary Ridge unveiled a new, unified national emergency communications system and database that will provide a secure, real-time connection between law-enforcement agencies in all 50 states. By July, a nationwide video conferencing system will allow a police chief in Nashville, for example, to immediately and simultaneously share photographs and data collected during investigations of suspicious tractor-trailer sales with his colleagues in Atlanta, Charlotte and Houston.
Customer Tracking
Customer Tracking
Loyalty cards, facial images, and even radio-frequency tracking tags built into gaming tables and chips allow casinos to analyze their customers every move.
Casinos are the ultimate practitioners of customer- relationship management. The more data they can capture about how their customers gamble—and how much—the more likely they are to keep them coming back for more. “Comps”—complimentary meals, room upgrades and even free nights in luxury suites—are used to lure high-end customers back again and again, for the efficient removal of their remaining cash.
The gaming industrys “player card” systems—such as the Caesars Entertainment “Connection Card”—tie together transaction information gathered everywhere from the casino floor to food service to guest rooms on the spending and gambling habits of repeat customers, across all of their properties.
“Casinos with loyalty programs certainly have amazing amounts of analysis of the success patterns for particular players,” says Jerry Brady, chief technology officer of Guardent, a security firm in Waltham, Mass. “They can choose whales [gamblers with big bankrolls] carefully—the ones that are least damaging to their organization—for comps.” The big-time gamblers who consistently leave their money behind at the tables get better treatment, while those that have a tendency to win too much might not see much of anything—and might even be asked to leave.
Recently, casinos have gained the ability to track customer behaviors even more minutely. They record players movements on the casino floor, the time spent at slot machines and blackjack tables, and even individual bets. They do this by tying their customer- and casino-management systems to the same facial-recognition technology used to watch for “bad guys.”
Casinos are pushing providers of card tables and slot machines to put cameras in place that can snap shots of every player that visits. “If you sit at a slot machine, youre already the perfect distance away for a facial-recognition shot,” says Jim Pepin, vice president of Biometrica Systems, a unit of identification-systems-maker Viisage Technology of Littleton, Mass.
Even betting chips are no longer inert. Casinos are starting to deploy chips with embedded radio-frequency identification (RFID) tags in them. The casino can monitor betting patterns and detect attempts to cheat—such as moving chips after all bets have been placed.
How This Applies to Domestic Security: Biometric identification has wide application in ports of transit, from air to sea to rail. Radio tags embedded in “smart” passports could lead to security checks throughout a terminal, not just at the Customs stand. States might also apply the technology to drivers licenses.
Next Page: Employee monitoring.
Employee Monitoring
Employee Monitoring
From readings of employees hands, eyes or other features to trackable tags on security guards to deep searches of databases, Las Vegas casinos use both their own intelligence and analytical software to check the backgrounds and activities of current and future employees.
“People change and their circumstances change all the time,” says Shepherd, the security director at the Venetian. “Its not enough to do a battery of background or credit checks on an employee before you hire them. You have to know whats going on with them right now and six months from now.”
Casinos use databases that include the names of suspected terrorists, felons, money launderers and child molesters provided by the FBI, private investigators and local law- enforcement agencies to screen employees throughout their tenure. They also apply NORA software, for unexpected clues.
Its not unusual, for example, for a casino to use NORA to discover a blackjack dealer who recently filed for bankruptcy protection or a cashier who was arrested for possessing narcotics an hour after finishing his shift by collecting arrest information from the Las Vegas Metro Police Department. If the end-of-the-shift count at the cashier cage shows $200 is missing or if players appear to win at a disproportionate rate during a particular dealers shift, the investigation might begin with those wrestling with off-duty demons.
These details, including any changes in residence or marital status, are continually updated on a casino employees security profile.
Shepherd says the Venetian also plans to eventually use tags that can be read by radio waves to track security officers and equipment throughout the casino, rather than rely solely on video surveillance and radio communication.
At the north end of the Las Vegas strip stands the Stratosphere Casino Hotel & Tower. It features a 1,149-foot observation tower the hotel claims is “the tallest building west of the Mississippi River.”
Perhaps that was one attraction for Mohamed Atta and four other terrorists when they stayed in a hotel across the street a few months before they attacked New Yorks tallest buildings, the towers of the World Trade Center.
But if that was enough of an attraction that they actually entered the Stratosphere, Atta and his cohorts would certainly have been caught on camera. If the hotel had been told to watch out for individuals that looked like any of the five, they likely would have been noticed as they wandered onto the casino floor. Thats because the Stratosphere has been using facial-recognition software to monitor its casino operations for more than 5 years.
Facial-recognition software mathematically measures features such as the distance between eyes or the structure of a cheekbone to compare a face to stored images.
The Stratosphere figures its $7,000 system paid for itself in its first month of operation. But thats hard to prove, says Roger Williams, a former member of a team of “card counters”—gamblers who use statistical methods to beat the house at blackjack.
“The truth is that there is no way to audit these systems to see if they are really performing,” Williams says. “And both the casinos and the companies selling them have a large incentive to lie about their effectiveness.”
Card counting isnt illegal, but casinos have the right to keep gamblers employing the technique from playing or to eject them from the premises. So Williams, the members of his team and their leader, known as “Mr. X.,” keep a low profile when visiting Vegas.
The key, according to Williams, “is to not be noticed. Once you are noticed, you are toast; it doesnt matter whether they have a biometric ID [of you] or not.”
To that end, Williams says “X” never stays at one casino for too long, and changes his appearance regularly to avoid being recognized by casino employees. “When he does come back to a place after a few weeks or months, he has different hair, clothes, et cetera. The key is to be just another businessman on vacation. Vacations dont last long, so neither does Xs play in a particular guise,” Williams says.
Facial-recognition systems are designed to see through disguises such as the ones X employs. Indeed, the Stratosphere believes it has saved $492,000 in losses each year that its system for recognizing faces has been in operation, says Derk Boss, its surveillance director. The casino also saves $44,000 each year in labor costs that otherwise would have gone to checking out the identities of players. All for a one-time cost of $7,000 and a few hundred dollars a year to subscribe to database and software updates and an Internet service that connects Stratosphere to the surveillance rooms at over 170 other hotels.
The Stratosphere uses a collection of software called Visual Casino from Biometrica Systems, the Las Vegas-based subsidiary of Viisage (see Dossier, p. 54). The software components compare images captured from casino surveillance video against a set of “mug book” databases and offer a selection of possible matches. “The software doesnt give an exact match,” says Biometricas Pepin. “It brings up the most likely matches, ranked from highest to lowest, in sets of nine.”
Visual Casino uses two sources of data for facial recognition: a CD-ROM database from Biometrica called Casino Visual Identification; and an in-house database built from the casinos own intelligence gathering, using the same tools and formats as the visual database. Each entry in these databases includes known associates, a collection of images of the individual (especially if he or she is known to use disguises) and a description of their modus operandi.
But the matches that the Stratosphere gets from its software are only as good as the people using it. According to Greg Shanton, the chief technology officer and security director for system integrator American Management Systems security group, computers alone arent enough. “You have to have trained operators making the decisions,” he says.
How This Applies to Domestic Security: Facial recognition currently is being used only at a handful of airports, only at security checkpoints and generally by lightly trained Transportation Security agents. If casinos practices were followed, images would be taken at check-in, while would-be passengers obtain boarding passes and check luggage. This would give surveillance agents more time to match faces with known identities as well as to check those identities against the drivers license and credit card presented by each passenger—and crosscheck with watch lists and other databases.
Next Page: Shared surveillance.
Shared Surveillance
Shared Surveillance
Using network-based alerts, wireless networks and fax-modems tied into surveillance-video systems, casinos can get pictures of potential threats into the hands of people who can act on them.
Mr. X and his team of card counters dont get caught often. But when they do get caught, it usually isnt because of facial recognition, or even because of the Griffin shared database most casinos have subscribed to for nearly a decade. Instead, its because of an alert sent from another casino, complete with pictures of their faces.
“When [our team was] less careful, especially about team members being seen together,” Williams says, “they occasionally got burnt by information sharing, not so much from mega-services like Griffin as from faxes sent between cooperating casinos. Being listed in Griffin since 1996 or so has only been a minor nuisance by comparison.”
Fax machines are now on the low-tech end of an informal surveillance data-sharing network built up between casinos. More than 150 casinos worldwide have joined a data-sharing network that Biometrica manages, called the Surveillance Information Network, or SIN. For about $75 a month, according to Pepin, agents of these casinos can use their computer keyboards to retrieve the latest intelligence on worrisome guests from other casinos, and send out queries about suspicious individuals.
When a member of Derk Boss team in the surveillance room at Stratosphere cant identify a suspicious patron, for example, he can broadcast the customers image out over SIN with a request for information from approximately 30 different casino surveillance rooms in Vegas and another 120 worldwide. Additionally, records and images of suspected cheats can be broadcast as well, arming other hotels with information they can add to their own databases and distribute to game watchers on the casino floor.
Pepin points to a forger found in a SIN report. “When this guy leaves the casino, hes not on his way to church,” Pepin says. “Hes probably going to go someplace else on the Strip.”
In addition to sharing information instantly, each of Las Vegas casinos puts what it finds into the hands of its own army: security guards, pit bosses, cheat spotters and investigators moving about in cars, according to Brady of Guardent. “For 20 years now, theyve had mobile networks of former card counters driving around with images of potential cheaters,” says Brady. “Their [alert system] has been much more successful than even the FBIs Americas Most Wanted.”
Be sure to add our eWEEK.com mobile and wireless news feed to your RSS newsreader or My Yahoo page:
Instead of giant “mug books” or fax printouts, these front-line eyes now peer into digital assistants they hold in their hands, as well as networked computers at gaming tables and laptop computers they can take anywhere. All of these devices can be sent surveillance data from SIN—or images grabbed from the casinos own cameras—for immediate response to a threat over the casinos own secure wireless network.
How This Applies to Domestic Security: Attacks happen in the blink of an eye. “Situational” information is exactly what the Department of Homeland Security wants to collect and immediately relay. In February, DHS announced the expansion of the Joint Regional Information Exchange System (JRIES), an ad-hoc network for sharing sensitive but unclassified threat information between state, local and federal agencies. This exchange system is based partially on collaboration software from Groove Networks and is being developed under the direction of Ed Manavian, chief of the criminal intelligence bureau of the California Department of Justice.
Next Page: Following the money.
Following the Money
Following the Money
Casinos use software and surveillance techniques to identify unusual or illegal transactions. The aim: root out suspected money launderers or terrorists.
When Congress passed the USA Patriot Act in 2001, giving law enforcers greater access to medical, library, student and other records, casinos were among the first businesses affected.
The legislation charged the Financial Crime Enforcement Center (FinCEN), a 200-employee division of the Treasury Department, with collecting information from financial institutions and casinos that might lead to the uncovering of money-laundering operations.
Money launderers have long viewed Las Vegas casinos, which exchange chips for cash, as a handy place to “wash” drug money or other illicitly obtained funds. As a result, every cashier cage or gambling table with chips in play must have at least one camera dedicated to it. Most tables and every cashier cage actually have several cameras recording transactions, 24 hours a day.
Now, each establishment must file whats known as a Suspicious Activity Report by Casinos (SARC) to the Treasury Department every time a patron completes a cash transaction of more than $5,000. Moreover, casinos are obligated to fill out a SARC if a person makes multiple cash transactions that total $5,000 in any single day. Recording software provides details on transactions and bets.
The SARC reports are supposed to be kept secret—from the individual. That means the casino has the responsibility to find out as much information about the person conducting the transaction and share it with law-enforcement agencies, but do so without alerting the person in question.
Even if no law is broken, information collected by cashiers and recorded by surveillance cameras becomes part of a new file. Casino security chiefs submit a report to the Treasury Department detailing all activities they witnessed during the persons visit. They may also provide photographs of the person, information on how long that person stayed in the casino and even whether the person met or was accompanied by anyone else.
How This Applies to Domestic Security: Businesses that cash payroll checks, sell money orders and trade in cashiers checks could use the same camera and profiling techniques to comply with the Patriot Act. Domestic agents would be notified of individuals who traffic in money orders or payroll checks of substantial value over a certain period of time. Transaction details and images could serve as a starting point for more-detailed investigation by the FBI and DHS.
Digital Video
Digital Video
The advent of digital means of capturing moving images gives casinos the ability to record almost unlimited views of what goes on inside (or even outside) their walls every day. Mining software then can search and analyze the images intelligently.
Even when “Mr. X” or members of his team arent caught winning big, casinos may spot his actions hours or days later, while reviewing digital files. Casinos typically keep seven days worth of video in active memory on computer systems for immediate analysis—and longer, in more permanent storage, for legal records.
Thought Police would love a modern Las Vegas casino, monitored as it is by thousands of cameras—in every hallway, elevator, and public space, aside from bathrooms and guest rooms. A single poker table might have as many as 60 cameras trained on it.
Walk through one of the unmarked doors off the casino floor at the MGM Grand, and up a few flights of stairs, and youll find yourself in a scene seemingly out of George Orwells “1984”—a dimly-lit, cluttered space filled with video screens. This is the MGMs gaming-surveillance room, from which Ron Buono, executive director of surveillance and his crew watch the feed from the hundreds of cameras that stud the casinos ceiling. You cant scratch your nose near a gaming table at MGM without having it recorded on one of the 900 videotape recorders mounted in racks in a room across the hall.
Nine hundred recorders means 900 tape changes every eight hours. To keep seven days of tape on record, Buonos staff must manage nearly 19,000 tapes—and thats just active ones.
The days of videotape recorders are numbered. In a smaller rack in the same room is their replacement: a digital video-recording system from American Dynamics, a San Diego subsidiary of Tyco International. Digital video is revolutionizing surveillance, making it easier to use software to control camera coverage and to search through hours of video—all without ever swapping a VHS tape. (See Dossier, September 2003.)
Digital video does more for Buono than cut down on tape swapping—it makes it easier to program video systems to alert operators to unusual activity, provides better facial images and reduces time required to find specific frames of video from hours to seconds. It also gives regulators the ability to check in remotely on any of the MGMs 1,400 cameras.
In its private gaming rooms, the MGM Grand has been testing a small system from American Dynamics, in conjunction with the Nevada Gaming Commission. The system stores video images on a disk drive, while also transmitting them directly to the gaming commission. While the cost of connecting one video stream to a digital-recording port is about $1,000—ten times the cost of an analog VCR—the total cost of ownership is tiny in comparison. Buono says the savings in labor and reduced replacement cost alone will quickly pay for the difference.
The only limit is disk space, which has grown increasingly inexpensive. Meanwhile, every minute of activity captured by every camera can be searched for a specific event. Detail can be critical. A system such as this can search hundreds of hours of video for changes in a small area of its field of view—a stack of chips, for example, or someone surreptitiously pocketing those chips . This search now takes minutes, where searching tape took hours.
“You can narrow down the search to a specific time frame, and look for changes in areas down to a pixel,” says Wayne Dorris, an American Dynamics sales engineer serving the MGM Grand.
Thats a feature thats even more important to casino surveillance in many respects than facial recognition. According to Buono, about 95% of the time a fraud occurs, it involves an employee or a former employee—either because they made a mistake in procedure, or because they were colluding with a gambler to get a cut of his winnings.
How This Applies to Domestic Security: Tom Ridges homeland-security operations could use digital-video systems to monitor train platforms and other remote locations, spotting unusual activity and alerting responders quickly to suspicious activity—such as a person placing an object on the tracks or touching overhead wires. Even busy train, plane and bus stations could benefit. Until a fatal shooting incident on July 4, 2002, Los Angeles International Airport had just five surveillance cameras.
Next Page: Surveillance either accepted or ignored.
Surveillance
: Either Accepted or Ignored”>
All this technology and surveillance hasnt stopped hundreds of thousands of leisure gamblers from visiting Las Vegas casinos every week.
Sure, they most likely have no inkling how much information on their behavior and movements is being recorded. But there is no organized movement that shows they care. They recognize the stakes, financially speaking, are high. Surveillance is either accepted or ignored.
“There are cameras and people watching everything that happens on a casino property,” says Nevada homeland security chairman Bussell. “No place has the dedication and technology to police its people and property like a casino. But that doesnt stop people from coming here in droves. Thats the beauty of it and thats what the [DHS] at all levels is just starting to see.”
With the coordinated train blasts in Madrid following the destruction of the twin towers by 911 days, theres a lesson to Tom Ridge and other domestic-security chief executives: Public places remain appealing targets for terrorists, and these same technologies and processes can be applied throughout the country without necessarily impeding commerce or the freedom to move about that make public places appealing in the first place.