Your camera's digital sensor has a unique fingerprint. Due to minute manufacturing variations across millions of pixels, some pixels are consistently "hotter" or "cooler" than intended.

Signal processing algorithms can extract this unique Sensor Pattern Noise (SPN). Since each sensor is slightly different, the SPN is also different — and unique — a fact that has been known for almost ten years.

Recently researchers in Europe — see their paper (pdf) On the usage of Sensor Pattern Noise for Picture-to-Identity linking through social network accounts — took the next logical step in our social media-mad culture: exploiting SPN fingerprints to see if they could link social network accounts to specific cameras.

How this works

A lot of computing goes into digital images. The artifacts of these processes can identify a brand of camera, but only if the SPN is unique. Here's a diagram from the paper:

Thanks to the popularity of photo sharing, specific cameras can be tied to specific social media accounts. The harder problem — and the one these researchers focused on — is given a certain picture, how do you find accounts that used that same camera?

Picture to identity linking

SPN is affected by compression, image resizing, filters and ISO speeds, but these make the job of linking a picture to a specific identity harder — not impossible. To test this, the researchers used over 1,900 pictures belonging to ten individuals to see if they could link the picture to a specific Facebook account — where photos are typically compressed and resized — as well as other media accounts.

The result: While not perfect, their scoring method was considerably better than chance. With better data — uncompressed photos, for instance — they could link each photo to the individual that captured it.

The Storage Bits take

We already know that intelligence services have intercepted huge numbers of photos to feed their web-scale facial recognition programs. It's safe to assume that they are also using SPN to tie cameras to specific people.

While these techniques are useful to investigators, they are — like all surveillance state programs — subject to abuse. As history has shown countless times, where power can be abused it will be abused.

Let's say — as really happened — you video a cop kill a man begging officers not to shoot him as he lies on the ground. Would you feel differently about uploading the video to YouTube if you thought the police could identify you?

This is just one more reason to put intelligence and law enforcement agencies on a tight leash. Otherwise we'll wake up some fine morning and discover that we live in a police state where liberty exists at the whim of the authorities, not in the Constitution.

Comments welcome, as always.