Do Not Look Behind the Curtain...

[jfruser]

It is only reasonable to make the source code available, otherwise all you have is a magical "guilt detector." I am cognizant of intellectual property issues, but they come in a distant second to Joe Citizen's right to know how/why he is being hauled off to the pokey. Welcome to gov't contracting.

I do seem to recall some relating as to how a drunk driving suspect passed a SFST, but they hauled him in because the machine said otherwise.

US drink/drive laws could push open source

US drink/drive laws could push open source

'I'm not drunk, your software is'
Tom Sanders in California, vnunet.com 20 Oct 2005

A Florida court will hear arguments on Friday in a case where the accuracy of a breathalyser is being scrutinised because the manufacturer has refused to release the source code.

Lawyers representing more than 150 defendants who have been charged for driving under the influence of alcohol in two Florida counties will file the request.

They argue that they have a right to see the source code of the alcohol breath analyser that was used to determine their clients' guilt.

"None of the [software] programs that was used here is approved," said Robert Harrison, a lawyer representing some of the defendants.

"The question is whether the difference [between these programs] is material or not. Without seeing the source code, we do not know."

At the centre of the controversy is the Intoxilyzer 5000, a device made by CMI of Ownsboro, Kentucky.

A marketing brochure for the device claims that it has been used for more than 25 years, and touts it as the "standard for accuracy, reliability and courtroom evidence".

Information on the internet shows that the Intoxilyzer 5000 is being used worldwide, including in Norway, the US and Canada. CMI did not return repeated phone calls seeking further information.

Florida approved the Intoxilyzer 5000 in 1993, but the manufacturer has since made numerous changes which Harrison argues have not been certified. CMI had to recall its devices in at least one case due to a software error, he said.

Releasing the source code of the device could take away any doubt about its accuracy, but the manufacturer has said in the past that it refuses to do so because it considers that information a trade secret.

This refusal could have far reaching consequences, potentially giving those convicted of 'Driving Under the Influence' a reason to appeal against their rulings.

It also has caused a backlog of such cases that await the results of this case to determine whether evidence gathered by the Intoxilyzer 5000 is still admissible in court.

Florida Assistant State Attorney Jason Miller said that he will oppose the defendants' motion asking to see the device's source code at Friday's hearing. "It will be their burden to show that that information is material," he told vnunet.com.

Citing 'ethics rules', Miller declined to go into further details about why he opposes the request to open up the appliance's software.

Florida law is very specific about a defendant's rights in Driving Under the Influence cases. An appellate court ruling in February last year entitled defendants to learn about the inner workings of alcohol breath analysers by receiving copies of the device's manuals, maintenance manuals and schematics, as well as changes made to the device that are not in those documents.

"It seems to us that one should not have privileges and freedom jeopardised by the results of a mystical machine that is immune from discovery, that inhales breath samples and that produces a report specifying a degree of intoxication," the February 2004 ruling stated.

Friday's hearing will seek to add the device's source code to the information that defendants are entitled to see. Although the judges in the case are said to be determined to come to a quick resolution, a ruling could take up to four weeks.

Because Florida's laws are so specific about the rights of individuals accused of drink driving, Miller said that there are only "remote chances" that a ruling asking to release the source code can be used as a precedent for other states or countries.

The case does, however, signal a growing interest in the inner workings of computers and applications as they gain a larger role in our everyday lives.

With software bugs a proven fact of life, consumers and organisations could claim that they need to be able to verify an application's source code before they accept their calculations as accurate.

In another case illustrating that closed source could cause problems, authorities in the US last year called on makers of electronic voting machines to publish the source code of their devices.

Applications containing bugs could allow parties in an election to manipulate the results, or could illegally prevent votes from being counted.

The voting machine debate received much attention in the US after the 2000 presidential elections in Florida turned into a vote counting soap opera.

Irish authorities have also scrutinised electronic voting machines over a perceived lack of reliability.

Nedap, the manufacturer of the machines, refused to provide the government with a copy of the device's source code. The parties last year agreed to an audit by a trusted third party.

[Camp David]

Originally Posted by jfruser

It is only reasonable to make the source code available, otherwise all you have is a magical "guilt detector." I am cognizant of intellectual property issues, but they come in a distant second to Joe Citizen's right to know how/why he is being hauled off to the pokey. Welcome to gov't contracting...

I agree...

But some areas are arresting folks despite what the Breathalyzer says; see the District of Columbia:
Single Glass of Wine Immerses Driver in Legal Battle
http://www.duiblog.com/2005/10/13

And some areas are arresting folks that pass the Breathalyzer, but look suspect. Also some folks are failing Breathalyzer despite being sober when they are on cold medicine; i.e., codeine for cough...

So what's legal?

My opinion: Utilizing an electrionic device to measure alcohol impairment by itself is wrong...law enforcement should pair such a device with common sense...

[Smurfslayer]

So, if open source is such a burden, why doesn't some enterprising company come up with the "soberizer 1000", a device which monitors your breath, and displays an easily viewable green light at the driver's side window so long as you're below the limit. This would save the police scads of time in identifying drivers under the influence, and it would be good for civil liberties since the cops wouldn't even need to talk to you at a sobriety check point...

And, they wouldn't need to see the source either.

I think that drunk driving is for losers. Unfortunately, the losers are more often than not the survivors in a crash, where the sober victims are killed or severely injured. We treat this far too lightly as a society. We treat driving in general far too lightly as a society. Still, the rules shouldn't be "different" for traffic violations, the state should have to meet the same burden of proof as it would in a felony trial.

[trapperjohn]

this is just legal smoke and mirrors. they do not need to see the source code. all they have to do is test the models being used to see if they give accurate readings.
An ened user of a measuring device does not need to know all the internal workings and programing of a device to insure its accuracy, he just needs statnadardized calibration test to make sure the a measured BAC of say 0.08 is infact 0.08

[Leatherneck]

trapperjohn nailed it. Simply conduct a controlled camparative test with adequate sample size and accept the results as validation. Lawyer tricks.
TChttp://thehighroad.org/images/smilies/fce32f95.gif

[jfruser]

they do not need to see the source code. all they have to do is test the models being used to see if they give accurate readings.

Simply conduct a controlled camparative test with adequate sample size and accept the results as validation.

Leatherneck & trapperjohn:

You have more faith in the perfectability of software than do I, it appears.

So, would a similar demonstration with say, an electronic voting machine, also satisfy you? "No need to look under the hood...100 people voted and it recorded 100 votes. Our work is done, here!"

An Advanced Search of THR for the user "Jim March" and the terms "voting machine" might be enlightening.

[TallPine]

okay... but who are they going to get to look at the source code and determine whether it is correct or not...?

most people could no more understand the source code than ancient greek

even then, bugs aren't usually detected from just browsing the code, but rather from a performing a set of test procedures that mirror the original written requirements of the software

they would be better to subpeona the software development documentation and audit the procedures (what, you mean there isn't any documentation...? )

[TexasRifleman]

Lawyer tricks.

And the lawyer I want if I am ever in trouble......

[benewton]

Maybe you have to design the hardware and write assembly software to realize just how many bugs can work their way into the code.

Source code, in C, no doubt, is even worse, given that it's normally written by software types who've little or no idea of what the hardware can or can't do.

So, I strongly suspect that there are indeed questions regarding the device.


That said, I doubt that the cops are the people to exercise judgement.

Check out the DC event, and remember that most traffic stops are for revenue, not safety.

Then, too, how many cops get speeding tickets or are convicted for DWI?

[dpesec]

benewton, yes sad but true. Rrevenue being the reason for tickets was just a topic on a local radio station. A caller said he was pulled over by a Trooper because he was flashing his lights to warn other drivers of the speed trap. The Trooper said "we're doing this to reduce the number of speeders". The pulled over driver said "wel aren't I doing that by letting them know you're there?" According to the caller the Trooper was upset but left without issuing a citation.

Remember in guberment it's all about the money, follow it and you'll see where the power is.

[trapperjohn]

Leatherneck & trapperjohn:

You have more faith in the perfectability of software than do I, it appears.

So, would a similar demonstration with say, an electronic voting machine, also satisfy you? "No need to look under the hood...100 people voted and it recorded 100 votes. Our work is done, here!"

jfruser, i do not think it is greater fait, just greater understanding of measurement instruments and legal wranglings.

Do you trust scales digital scales you stand on. or digital thermometers that you read? IF so, do you understand the assembly langage that converts the reading from the transducer to the final output via the microprocessor? I bet you don't, but I also bet you still trust the output if it had been validated some other way.

The voting machine example is a completley different critter and a straw man. measuring BAC is something that is easily reproduceable just like measuring weight or temperature.

When I teach upper classman engineering measurements at my university, I spend a lot of time teaching them about calibration and verification. I also teach them that the inner workings of an instrument arent so much important as actually verfying the measureing instrument with a known standard.
When I work as an engineering expert in lawsuits I see all kinds of shenanegans like this going on. It is done to confuse the jury enough so that the lawyer can get them to vote his way via personality, persuasion, and any other thing he thinks he can use.

[MechAg94]

I would be more intersted in the testing and testing procedures used by the company and the govt in qualifying and accepting these devices since they are being used to determine guilt. Also, what are the calibration requirements for a new device or for devices in use. I have no idea what servicing is done to those things.

Also, if you are going to retest the breathalyzer units, you need to be able to randomly select breathalyzers currently in use by officers, not some unit off the shelf.

I guess I am thinking along the same lines as you Trapperjohn. My main concern is how was the device tested and by what standard. What are the known limitations of the device and what can affect the accuracy? That may not do any good convincing juries, but it is important to me.

Guys in chemical plants routinely trust their lives to portable oxygen meters and LEL (lower explosive limit) meters that detect flamable gases along with lots of other gases. Those meter are pretty accurate.

[Keaner]

The real problem with not releasing the code, and chip diagrams to a breathalizer, is that there could be cheats in it. There are hundreds of simple devices, that when used in a specific way, will give false readings.

Think of it this way: a developer can do WHATEVER he/she wants to do with a breathalizer. If he decides that holding down Key X, Y and Z at the same time will automatically give a positive reading, !EVEN ON A SOBER PERSON!, than something is flawed.

Also, what happens if something similar happens, but is unintentional? A ton of testing isn't going to figure out that something is wrong with a rounding equation, unless you are very particular.

Heck, look at the original Pentium processors, which would frequently get simple mathematics wrong, because one small thing was designed wrong. That chip went through a strenuous, multi-billion dollar testing process, and still failed.

Now get something that is harder to test, with a smaller market, and less profit. I would stand in line to look at the source for a device like this.