The source code behind a police breathalyzer widely used in multiple states -- and millions of drunk driving arrests -- is under fire.
It's the latest case of technology and the real world colliding -- one that revolves around source code, calibration of equipment, two researchers and legal maneuvering, state law enforcement agencies, and Draeger, the breathalyzer's manufacturer.
This most recent skirmish began a decade ago when Washington state police sought to replace its aging fleet of breathalyzers. When the Washington police opened solicitations, the only bidder, Draeger, a German medical technology maker, won the contract to sell its flagship device, the Alcotest 9510, across the state.
But defense attorneys have long believed the breathalyzer is faulty.
Jason Lantz, a Washington-based defense lawyer, enlisted a software engineer and a security researcher to examine its source code. The two experts wrote in a preliminary report that they found flaws capable of producing incorrect breath test results. The defense hailed the results as a breakthrough, believing the findings could cast doubt on countless drunk-driving prosecutions. (...)
The breathalyzer has become a staple in law enforcement, with more than a million Americans arrested each year for driving under the influence of alcohol -- an offense known as a DUI. Drunk driving has its own economy: A multi-billion dollar business for lawyers, state governments, and the breathalyzer manufacturers -- all of which have a commercial stake at play.
Yet, the case in Washington is only the latest in several legal battles where the breathalyzer has faced scrutiny about the technology used to secure convictions.
by Zack Whittaker, ZDNet | Read more:
Image: uncredited
It's the latest case of technology and the real world colliding -- one that revolves around source code, calibration of equipment, two researchers and legal maneuvering, state law enforcement agencies, and Draeger, the breathalyzer's manufacturer.
This most recent skirmish began a decade ago when Washington state police sought to replace its aging fleet of breathalyzers. When the Washington police opened solicitations, the only bidder, Draeger, a German medical technology maker, won the contract to sell its flagship device, the Alcotest 9510, across the state.But defense attorneys have long believed the breathalyzer is faulty.
Jason Lantz, a Washington-based defense lawyer, enlisted a software engineer and a security researcher to examine its source code. The two experts wrote in a preliminary report that they found flaws capable of producing incorrect breath test results. The defense hailed the results as a breakthrough, believing the findings could cast doubt on countless drunk-driving prosecutions. (...)
The breathalyzer has become a staple in law enforcement, with more than a million Americans arrested each year for driving under the influence of alcohol -- an offense known as a DUI. Drunk driving has its own economy: A multi-billion dollar business for lawyers, state governments, and the breathalyzer manufacturers -- all of which have a commercial stake at play.
Yet, the case in Washington is only the latest in several legal battles where the breathalyzer has faced scrutiny about the technology used to secure convictions.
Trial by Machine
When one Washington state driver accused of drunk-driving in 2015 disputed the reading, his defense counsel petitioned the court to obtain the device's source code from Draeger.
Lantz, who was leading the legal effort to review the Alcotest 9510 in the state, hired two software engineers, Falcon Momot, a security consultant, and Robert Walker, a software engineer and decade-long Microsoft veteran, who were tasked with examining the code. The code was obtained under a court-signed protective order, putting strict controls on Momot and Walker to protect the source code, though the order permitted the researchers to report their findings, with some limitations. Although the researchers were not given a device, the researchers were given a binary file containing the state's configuration set by Washington State Patrol.
Although their findings had yet to be verified against one of the breathalyzers, their preliminary report outlined several issues in the code that they said could impact the outcome of an alcohol breath test.
In order to produce a result, the Alcotest 9510 uses two sensors to measure alcohol content in a breath sample: An infrared beam that measures how much light goes through the breath, and a fuel cell that measures the electrical current of the sample. The results should be about the same and within a small margin of error -- usually within a thousandth of a decimal point. If the results are too far apart, the test will be rejected.
But the report said that under some conditions the breathalyzer can return an inflated reading -- a result that could also push a person over the legal limit.
One attorney, who read the report, said they believed the report showed the breathalyzer "tipped the scales" in favor of prosecutors, and against drivers.
One section in the report raised issue with a lack of adjustment of a person's breath temperature.
Breath temperature can fluctuate throughout the day, but, according to the report, can also wildly change the results of an alcohol breath test. Without correction, a single digit over a normal breath temperature of 34 degrees centigrade can inflate the results by six percent -- enough to push a person over the limit.
The quadratic formula set by the Washington State Patrol should correct the breath temperature to prevent false results. The quadratic formula corrects warmer breath downward, said the report, but the code doesn't explain how the corrections are made. The corrections "may be insufficient" if the formula is faulty, the report added. (...)
Draeger's breathalyzer is widely used across the US, including in California, Connecticut, Massachusetts, New Jersey, and New York. It's often the only breathalyzer used in the states where they were bought.
In both New Jersey and Massachusetts, defense lawyers raised concerns. By acquiring the devices used by the states, lawyers commissioned engineers to analyze the code who say they found flaws that they say could produce incorrect results.
But defense teams in both states largely failed to stop their state governments from using the devices, public records show.
When one Washington state driver accused of drunk-driving in 2015 disputed the reading, his defense counsel petitioned the court to obtain the device's source code from Draeger.
Lantz, who was leading the legal effort to review the Alcotest 9510 in the state, hired two software engineers, Falcon Momot, a security consultant, and Robert Walker, a software engineer and decade-long Microsoft veteran, who were tasked with examining the code. The code was obtained under a court-signed protective order, putting strict controls on Momot and Walker to protect the source code, though the order permitted the researchers to report their findings, with some limitations. Although the researchers were not given a device, the researchers were given a binary file containing the state's configuration set by Washington State Patrol.
Although their findings had yet to be verified against one of the breathalyzers, their preliminary report outlined several issues in the code that they said could impact the outcome of an alcohol breath test.
In order to produce a result, the Alcotest 9510 uses two sensors to measure alcohol content in a breath sample: An infrared beam that measures how much light goes through the breath, and a fuel cell that measures the electrical current of the sample. The results should be about the same and within a small margin of error -- usually within a thousandth of a decimal point. If the results are too far apart, the test will be rejected.
But the report said that under some conditions the breathalyzer can return an inflated reading -- a result that could also push a person over the legal limit.
One attorney, who read the report, said they believed the report showed the breathalyzer "tipped the scales" in favor of prosecutors, and against drivers.
One section in the report raised issue with a lack of adjustment of a person's breath temperature.
Breath temperature can fluctuate throughout the day, but, according to the report, can also wildly change the results of an alcohol breath test. Without correction, a single digit over a normal breath temperature of 34 degrees centigrade can inflate the results by six percent -- enough to push a person over the limit.
The quadratic formula set by the Washington State Patrol should correct the breath temperature to prevent false results. The quadratic formula corrects warmer breath downward, said the report, but the code doesn't explain how the corrections are made. The corrections "may be insufficient" if the formula is faulty, the report added. (...)
Draeger's breathalyzer is widely used across the US, including in California, Connecticut, Massachusetts, New Jersey, and New York. It's often the only breathalyzer used in the states where they were bought.
In both New Jersey and Massachusetts, defense lawyers raised concerns. By acquiring the devices used by the states, lawyers commissioned engineers to analyze the code who say they found flaws that they say could produce incorrect results.
But defense teams in both states largely failed to stop their state governments from using the devices, public records show.
by Zack Whittaker, ZDNet | Read more:
Image: uncredited
