MythBusters is one of my favorite TV programs. There are two episodes that focused specifically on security technology: Episode 54, “Crimes and Myth-Demeanors 1,” which originally aired on July 12, 2006 and Episode 59, “Crimes and Myth-Demeanors 2,” which originally aired on August 23, 2006. I was elated. They finally tested something that I knew something about. Sorry MythBusters. You’re busted!

I am going to concentrate on Episode 59. I have to quickly note that I am confident that Discovery Channel has this program on a very aggressive production schedule and that funding only meets minimum requirements. They don’t have the time or the money to research the science as much as I’m sure they would like to. Having said that, although they occasionally bring in subject matter experts, they didn’t identify any security technology experts for these two episodes. Perhaps the producers did not think experts were necessary and that it was too elementary to need a guru.

Most of the shortcomings start with slightly out of kilter nomenclature. I’ve been involved with security technology for a long time and I have learned that the first clue that a person or an organization doesn’t understand the technology is by listening carefully to what they call things. This is the same way an “old salt” instantly recognizes a novice sailor.

FINGERPRINT LOCK

The Mythbusters were able to trick a biometric fingerprint lock by fabricating latex and ballistic gel appliqués of an authorized (viz. enrolled) thumbprint worn over a live thumb. Supposedly, the lock not only read thumbprints, but also measured body temperature, galvanic skin response and a pulse. Their technique in creating the appliqué was brilliant but I am suspicious about several aspects of their tests. A sharp close-up of the lock is never shown.

At the tail end of the show, co-host Adam Savage is able to fool the lock with a paper photocopy of the authorized print. The paper print would not have met the criteria for temperature, galvanic measurement or pulse.

There was a yet another important failing. The MythBusters biometric lock tests left out the most critical access control criterion – namely, entering a personal identification number. The lock had a numbered keypad but it was never used. In the real world it would have been used. The mantra for biometric access control is this: Use something only you are! And, use something only you know! Never rely on just one of the two. I guess they never heard the mantra.

THERMAL MOTION SENSOR

There are quite a few nomenclature missteps in this segment. First, the sensing technology is based on infrared energy. That is quite different from thermal energy. Second, passive infrared (IR) sensors have no innate ability to measure motion. The correct nomenclature is passive infrared (PIR) intrusion sensor. (Aside: the show's Grant Imahara did mention “infrared,” but only once.) Thus, it is neither a thermal nor a motion sensor.

Passive infrared detection is based on the appearance or the disappearance of specific wavelengths of infrared energy within viewing zones. You will remember from high school science that infrared energy is in the electromagnetic spectrum and travels at the speed of light – 186 thousand miles per second. Humans emit IR at wavelengths between 9 and 12 microns. Although body heat (thermal energy) tracks closely with infrared energy, they otherwise behave quite differently.

Let me highlight two major test failings. (1) PIR sensors not only alarm when human wavelengths of IR appear or disappear within viewing zones, but also if an object suddenly blocks a strong IR pattern in the background. When blocking happens, the background IR pattern disappears and then reappears in the same zone. This satisfies one of the criteria for alarm annunciation. This assumes, of course, that a quality sensor is used. Although glass blocks wavelengths longer than about 2.7 microns¹ (thereby the sensor can’t find humans), a large pane of glass moving in the field would make infrared hotspots in the background disappear and then reappear. Bingo! You get an alarm. If a neoprene wet suit was able to prevent IR from emanating (and that is feasible), walking in front of a hot spot could have the same alarming affect for the same reason.

(2) There are several parts in this episode when the MythBusters talk about the sensor seeing “body temperature,” 98 degrees Fahrenheit. As I noted, as thermal energy increases, so does infrared energy. One of the tests attempted to raise the room temperature to 98 degrees so that a human would blend into the background. There is merit to that theory. The problem is, however, that the sensor can only see “external” body temperatures, typically ranging from 89 to perhaps 91 degrees, not 98. The sensor can’t see inside the body. They made the room too hot.

When I helped with the writing of the motion picture Sneakers, I deliberately had the script introduce certain subtle technical errors so as not to be responsible for making a training film for criminals. Rent the movie some time. River Phoenix is in the basement raising the heat in the target room to 98.6 degrees.

ULTRASONIC MOTION SENSOR

This is named correctly, although it would have been nice if they noted that detection is based on Doppler Shift² – the effect a moving body has on a sound wave (or light, for that matter) as it approaches the sensor or moves away from the sensor. If the body is not in motion, it can’t cause an alarm. The sensor is designed to only receive frequencies slightly higher or slightly lower than the sound frequency it emits. In fact, the sensor can’t “hear” the sound it sends out. The sound emitted is higher than humans can hear – hence “ultra” sonic. It is important to note that most security professionals regard ultrasonic sensors as “low security” devices because of their vulnerability to being defeated by a variety of techniques.

The Mythbusters were unable to trick the ultrasonic sensor when the show's Kari Byron wore a suit made out of a thick shag run. A foam bed-sore pad (available at medical supply stores) would have worked better, but the rug suit should also have worked. It is likely that she simply walked too fast during this test. When Kari held a bed sheet in front of her, she was able to pass the sensor without being detected. Some sound energy penetrated the sheet and some was absorbed. The energy that penetrated the sheet bounced off her body, creating Doppler Shift, but then the sheet absorbed some of the reflected energy again and not enough “shifted” sound energy reached the receivers on the sensor to trip an alarm. It is that simple.

Kari was also able to defeat the ultrasonic sensor by walking very, very slowly. That is, of course, the very best technique to trick this sensor. If someone broke into an office building late at night (or hid until closing), they would have the time to use this method. If moving ultra-slowly is done in combination with sound absorbing materials wrapped around the body, it is a very effective defeat technique.

References

1. The specific wavelength can vary because other chemicals in the composition of the glass affect it.
   
   
2. Discovered by Christian Doppler in 1842 when (simplified) he tried to understand why some stars twinkle red and others blue.