3

I was looking at this question today:

How to defend against auto-scanning license plate cameras? (computer vision)

It was closed for the following reason:

"This question does not appear to be about Information security within the scope defined in the help center."

Out of general curiosity about the rules, I decided to take a look at the help center.

Topics include, but are not limited to:

.
.
.
* physically securing the office, datacentre, information assets etc.

The question is about physically securing an information asset.

The don't ask page does not give any reasons that justify closing this question either.

Why was this question closed?

Was it because it is a possibly controversial subject (an individual trying to protect themselves from corporations/governments)? Or is there some other reason?

Can the Help Center be updated to explain more clearly why this question was off-topic?

  • @TildalWave That's a good point. I haven't upvoted or downvoted any of the answers yet because I'm not satisfied with either so far. If the question was reworded so that it was only this part: "I'm wondering if a sufficiently bright IR light over my license plate would "obscure" the camera from reading all the numbers", would that be more acceptable? – jliv902 Oct 6 '14 at 15:39
  • I updated the question and hopefully addressed your concerns. I improved the wording in parts also. Hopefully now, there's a good chance of it being re-opened – IT Bear Oct 15 '14 at 18:27
3

I noticed you got only a limited answer, so I'll share my reaction.

I don't know. This doesn't sound related to Information Security, and I'm not sure you can expect people on this site to have relevant expertise. That said, I'm not sure. I'm not convinced it is off-topic for the site. I'm not sure it should have been closed for that reason. If the question was otherwise suitable, I would consider voting to re-open.

However, right now it is subjective and largely opinion based. It asks "What is the best way to...?" Generally, this wording makes it hard to evaluate answers and pick a single correct answer, so it makes the question not an ideal fit for this site. (I realize this is highly counter-intuitive. For what it's worth, it tripped me up when I first joined StackExchange.)

As a result, I think closing this question was appropriate, and as it currently stands it is not in a shape suitable for a vote to re-open.

If you would like to see the question considered for re-opening, you can edit the question to improve it. Here are the edits I would recommend:

  • Instead of asking for "the best way", it's usually better to list the evaluation criteria you will use to evaluate answers. Are there some hard requirements? Some metrics? What options have you considered and rejected? This will help you craft a more focused, objective question.

    For instance, maybe you aren't looking for the "best", "cleanest" way to defend yourself. Maybe you are just looking for a practical way to defend yourself. If so, ask for that.

  • Also, try to stick to one question per question. Right now you ask two questions: What's the best way to defend yourself? Would an IR light work? That's two questions. Admittedly, they are closely related, but you might do better to focus on just one, or ask them separately. Right now, I can imagine an answer that says "No, an IR light wouldn't work (for such-and-such reason)."

  • Lastly, show your research. Keep in mind that, as the help center states, "IT Security Stack Exchange is for Information Security professionals". The more you show that you have done detailed research, and can show that there is technical depth to the question, the greater the chances that it will be suitable.

  • +1 But just to clarify, I'm not the OP of the question, I just found the question to be genuinely interesting. There might be less expertise on physical security around here, so I guess the question could be considered too narrow. If the question was reworded so that it was only roughly this part: "I'm wondering if a sufficiently bright IR light over my license plate would "obscure" the camera from reading all the numbers", would that be more acceptable? – jliv902 Oct 10 '14 at 18:32
  • @jliv902, that sounds like a reasonable fit to me. I don't know how others would feel; this is subject to community voting. – D.W. Oct 10 '14 at 19:22
  • I imagine as more smart homes come online and they become more internet accessible, we're going to start facing security issues that reach into real life, like strangers being able to control your lights and locks or watch you from your own webcam. The lines between the physical and digital are definitely starting to blur, and it will only get worse. – IT Bear Oct 15 '14 at 17:11
3

Seeing as I have personal interest in this question, I might as well try.

Since this will obviously be biased in my favor, I will start instead with all the reasons to close:

  • Help center defines the "IT Security Stack Exchange [as] being for Information Security professionals to discuss protecting assets from threats and vulnerabilities."

    This prompts the question, "is personal location data an asset (as defined within the help center)?"

    • No: Assets include any property owned by a company, including intellectual property, customer data, patented materials, etc. (i.e. anything that can cause the company you are working for to lose money, sales, or customers.)
    • Yes: Assets are any type of information that can cause a company or individual to lose an amount of money. Additionally, assets are information that could be used to cause harm or harassment to an individual or company.

I think it will be good to mention here that leading this site to strictly favor one-side and not the other does not give this site the opportunity to grow into it's full potential. ITsec has always been about both, after all it is the individuals that make up the larger company entity anyways. Individuals can and always have had interest in protecting their personal information and data.

Trying to protect the corporate entity against theft and revenue loss, while turning your back on the individual who lost his identity due to a public Wifi hotspot does not progress IT security understanding and research—it deteriorates it.

Side Note – Reluctance to acknowledge Individual-based problems as being on-topic: I know as well as anybody who's worked in sales knows — we don't want the general public banging on the door. Please know I don't mean for this to affect the quality requirement for questions or the "some personal effort put in to finding the answer first" requirement; those rules, as always, still apply.

  • It's possibly illegal. It's not. First off,
    • There is no law on the books (in USA) that specifically protects a law enforcement officer's or repo driver's rights to collect such data. Even more specifically, no law exists that prohibits my (still theoretical) devices from being used to protect against dragnet data-mining attacks.
    • Laws for similar devices favor it. Radar detectors notify the driver that he is being scanned by a police radar gun, giving him time to slow down before the gun gets a "lock," which would give the officer cause to pull him over. For Laser scanners, the counterpart is a laser detector/jammer combo: If it picks up signal from a police laser gun, it sends out tons of "garbage" laser messages back — essentially confusing the gun and preventing a lock. These have been legal to own and operate for decades, except in D.C. and Virginia.
    • The Bill of Rights in my county (set of laws defining rights' protection for every citizen) implicitly protects an individual's liberties and rights to privacy. Even if the law does not explicitly include privacy in the list of protections, that's one Supreme Court case and a lot of media attention away from changing.
    • Discussing the legal merits any further than this (for cases undecided) on the IT Sec Stack Exchange is the wrong place to do it. We all know how firewall rules work around here, right?: No explicit deny rule, matches an existing pass rule, all is well in the kingdom.

So, if we've agreed that there's not enough evidence to support the claim that building and operating one of these (still theoretical) devices breaks any laws; and that the Security of Personal Information is within the scope of the Information Security board; then what other reasons for closing remain? The only I can think of:

  • It's unjust to interfere with Law Enforcement / Morality & Ethics: This is a debate that could last for days, so I'll just touch lightly on it — will this even still be a debate when it's discovered smartphone backdoors are leaking everyone's personal location data to LE servers in plaintext to be stored for several years? You should know it's going to be tried soon—if it's not already happening.

And that's it for me.

-1

Well there are a range of close reasons which would be appropriate here. We probably should have used:

  • Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

The question is not about physically securing an asset, but about circumventing detection controls required for a very specific purpose.

  • 2
    The question is not about breaking any security system; it is about defending one's personal property against an attack. More importantly though, the Help Center and the Don't Ask page do not have that reason listed. Is there anyway they can be updated? That reason sounds like a minimal understanding of the problem is required. A close reason along the lines of "a minimal understanding of the problem is required" seems more generic and better for this particular case. – jliv902 Sep 23 '14 at 16:42
  • We are limited in close reasons - we have a default and 3 custom ones. That is one of the ones in current use - perhaps we need to update the faq again. – Rory Alsop♦ Sep 23 '14 at 16:48
  • 2
    Hi guys, I was the one who asked the question. I'd like to point out that I understood the problem well enough to devise my own proposed solution to it. I was asking to see if anyone else had experience or special knowledge about it. Still, even this revised reason for closing seems weak to me—intent was never to compromise the security of a system, it was to protect location data. The security on the databases that house this history of location data is likely already compromised, if existent at all. Also, if "demenstrating an understanding of the concepts involved" is it, I can do – IT Bear Sep 23 '14 at 18:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .