Police Blotter: Intoxilyzer code must be disclosed

Police Blotter is a weekly News.com report on the intersection of technology and the law.

What: Kentucky man charged with drunken driving asks manufacturer of Breathalyzer-like test for the source code, a request that both the company and the state attorney general claim is unreasonable.

When: Kentucky Court of Appeals rules on January 18.

Outcome: Appeals court reverses ruling of two lower courts, saying the source code for the Intoxilyzer 5000EN must be turned over.

What happened, according to court documents:
For many years, police and prosecutors have told judges that breath tests are able to provide incontrovertible proof that a defendant violated laws against drunken driving.

But now some defendants are fighting back. Police Blotter reported on a Minnesota case last year in which the state supreme court ordered that the source code be revealed. That follows a 2005 DUI prosecution in Florida in which the defense also won the right to inspect the source. In some cases, prosecutors have dropped DUI charges rather than turn over the source code.

The most recent case involves a Kentucky man named Lennie G. House, who was charged with operating a motor vehicle while under the influence of alcohol, with additional penalties for allegedly having an alcohol concentration of 0.18 or higher. House failed a breath test given by the closed-source Intoxilyzer 5000EN, which is manufactured by CMI of Owensboro, Ky., and is one of the most popular alcohol level-testing devices used by police nationwide.

House was charged with DUI on March 8, 2006. Four months later, his attorney requested that prosecutors turn over the source code for the Intoxilyzer 5000EN. When the state attorney general did not comply, the defense attorney sent a subpoena for the source code directly to CMI. Computer source code is, of course, a series of human-readable instructions that are eventually compiled into the object code that a computer executes.

Access to the source code is key. Without it, a Breathalyzer-like device is a black box that can determine a defendant's guilt without being subject to independent scrutiny or evaluation. Inspection of the source code can discover programming mistakes or even intentional skewing.

Both CMI and the state attorney general, Jack Conway, opposed the subpoena for the source code--which led the defense counsel to ask the trial judge to suppress the results of the breath test in their entirety. In September 2006, a trial judge sided with prosecutors, and four months later, a circuit court did too.

House appealed once again, this time to the Kentucky Court of Appeals. By a 2-to-1 margin, the court agreed that requesting the source code--as long as confidentiality procedures were followed--was not unreasonable.

Excerpts from the Court of Appeals of Kentucky's opinion:
A subpoena may be quashed only upon a showing that compliance therewith would be unreasonable or oppressive. We do not believe the commonwealth and CMI have made this showing.

The request is not unreasonable because its purpose is to challenge the validity of the breath alcohol readings produced by the Intoxilyzer 5000 instrument, which is anticipated to be used at trial in support of the Commonwealth's DUI charge against House. The reading was also used to support the aggravating factor of driving with a breath alcohol reading of .18 or more.

Relevant evidence is admissible unless excluded by some other rule. Because a flaw in the computer source code of the Intoxilyzer 5000 would be consequential to the accuracy of the reading intended to be relied upon by the commonwealth, such evidence is relevant and admissible. Accordingly, requesting the computer code to test the verity of the readings produced by the instrument is not unreasonable.

Moreover, the burden upon CMI in producing the code is not oppressive. The record discloses that the code could be copied to a CD-ROM computer disc and produced in that form at minimum expense. It appears that the only other requirement would be that the passwords to access the code would need to be supplied. Thus, the burden of providing the information is minimal, and the expense de minimis.

The commonwealth and CMI argue, however, that the computer code is a protected trade secret and that this should weigh against disclosure. However, House has expressed his willingness for he, his attorney, and his expert witness to enter into a protective order stipulating that the code or its contents are not to be shared with any party outside of the case.

The district court is authorized to enter such orders. We further note that the order may provide that any copies or work product generated as a result of the software engineer's review be returned to CMI upon completion of the review. As civil and/or criminal penalties could result from the disclosure of the code to other parties, such a protective order should obviate any concern CMI may have with respect to protection of its source code.

The commonwealth and CMI also argue to the effect that the Intoxilyzer 5000 has been previously accepted as scientifically reliable in various appellate court cases, and thus the verity of the Intoxilyzer 5000 has already been determined to be established. A review of these cases, however, discloses that the issue herein was not squarely addressed in any of those cases. We find nothing in those cases which provide that the computer source code of the Intoxilyzer 5000 is above challenge. As such, we are unpersuaded by this argument.

[hotrod]

People will do anything to get around the LAW!

Come on!!!!! You got a DUI, you have to face facts.

This case is a big waste of time and my taxpayer dollars. This case is as frivolous as the lady that spilled hot coffee in her lap at McDonalds. Don't people have any common sense anymore.

[SeizeCTRL]

Concur

He's just looking for a way out.

There was an article on Wired.com today about a guy getting 15 years for downloading child porn which is bad, but the guy never molested any children. To me, DUI is just as bad as downloading child porn, especially when involved in accidents and vehicular homicide. So why do people get off so easy on DUI's when they have killed someone when behind the wheel drunk as a skunk... yet some poor pharmacist who downloaded a bunch of disgusting pictures gets 15 years?

I see people around where I live getting 3 and 4 DUI's without losing their licenses. When involved in accidents they get maybe 2 years of jail time. That's just as disgusting as child porn!

[chrisfrary]

Sort of

While I agree mostly with your statement, there does need to be some sort of independent analysis of the code and device since it is used so often.
There needs to be this sort of thing for all devices that are used to prosecute people, not just breathalysers.

[Galaxy5]

Sadly, No!

I seem to remember that in our country, the accused is both
innocent until _proven_ guilty, and that one has the right to face
one's accuser.

Under both tenets of the law, subpoena of the source code to
examine it for bugs or bias is not only proper and fair, but also
the duty of the defense counsel.

Even if the guy was pie-eyed drunk, he has the right to subpoena this code and examine it. Drunks on the road are a
bad thing (just as bad as soccer moms yakking on cell
phones...why aren't we prosecuting them?) - but a machine
which judges citizens in anything but a completely impartial
manner is a bad thing too.

[bodycoach2]

Our government should FOLLOW the law

In this country, we have a right to face our accuser in a court of law. We have a right to question witnesses. When a person is charge with a crime, and a device using a computer is part of the process of investigation, the computer code itself becomes a witness in the investigation.

While the guy may have actual been drunk, he still has a right to question witnesses, including the examination of the computer code.

All code used in computers for police activity should be OPEN SOURCE only. Using closed source is a slippery slope -one only preferred by police state advocates. If you advocate the use of closed source in criminal investigations, then by default you are FOR a police state.

[The_Decider]

Shortsighted

How do you know that the device is accurate?

You don't!

This will help ensure accountability and transparency, two things justice needs.

[Reiley]

HOW DO U KNOW?

Maybe this guy wasn't drunk and he has good reason to believe this machine's results were flawed..

[MTGrizzly]

What about due process????

So, basically, you are saying, we should believe what the cops
say, without question? That a person who gets arrested for DUI
is presumed guilty before trial? That the guy coding the software
for the machine could never make a mistake?

Cops lie as a matter of routine. They lie to trick people. They lie
so they can make themselves look better to their superiors, get
promotions and raises. Some lie because they are on power
trips. Think about it, cops do not get raises or promotions for
preventing crime. They get them for arresting people after they
commit crime. If there were no crime, we wouldn't need cops.
Cops have a vested interest in making sure that crime persists.
Even if they have to make it up by using a machine that reports
false positives on DUI suspects.

This is why we have courts and due process. To act as a barrier
to people being railroaded by the cops. The Bill of Rights wasn't
written because the framers of the constitution were bored, it
was written to protect citizens from an overzealous government
- including cops who buy machines that report false positives
on breath tests.

[alegr]

Not sure about MacD

"This case is as frivolous as the lady that spilled hot coffee in her lap at McDonalds."

Try the following:
1. Bring a cup of water to boil.
2. Pour that cup of water on your pants.

Now you'll see if the case was frivolous.

[galacticgufus]

yes anything to get around the law

even check the prosecution's evidence. we all know it's infallible. how could a box with a secret code (that no one has ever seen) which says whether you've been drinking be wrong? seriously, when the cops investigate someone for murder and they pull out a magic eight ball and ask if the suspect is guilty, that ought to be incontrovertible evidence.

[dosga]

The Law will do anything to get people

I wonder how many murders happened in that city while that officer was hassling this guy

[sal-magnone]

Does that include vehicular homicide?

Does that include vehicular homicide?

[plbyrd]

I bet this will work against traffic cameras, too.

I think that the automation of law enforcement is a bad, bad thing and I believe that these challenges will also put an end to the use of red-light traffic cameras and other automated "traffic-control devices" which are really nothing more than public safety hazards that are only created for the intention of taxing people for the operation of a motor vehicle (remember, we are already taxed for owning one and for placing consumables in it).

[m.meister]

yep - it's all about the money

Sadly these automated law enforcement machines are really just
about getting more money from the citizens.

Police enforcement gave up its integrity when the citation funds
funneled directly back to them. Sadly, I feel the police are no
longer here to protect and serve (unless it is to serve you a
citation) and they see the automated machines as an easier way
to extract money from the people.

Doubt me, go look at the revenue streams of police
departments. Look at just how much money they generate from
citations. If it is truly about safety (and *not* money), I would
ask that *all* the money from citations be given to a charity that
does not work directly with the police. Otherwise, the whole
"safety" thing is just a ruse.

[MTGrizzly]

Actually, this happened...

...several years ago in Southern California. A political entity
struck a deal with a private company to place red light cameras
on intersections and the entity agreed to give the private
company a portion of the revenue generated from the cameras.
The entity specified the interval for yellow lights. Unfortunately,
this did generate enough money for the private company, so
they changed the interval. More tickets resulted in more money.
Until someone challenged them in court. Resulted in thousands
of tickets being thrown out.
.

[m.meister]

Bad analogies will be the death of us

Sorry -- but this horrible analogy of comparing a DUI with a
pedophile only helps to avoid the real issue at hand. Police are
using a black box to determine your innocence or guilt.

I'm always concerned when the state avoid full discovery. If they
are as confident as the claim, they should be happy to comply
(with the given restrictions) with full disclosure of their black
box. The fact that they fight it as much as they do makes me
believe they are hiding something.

As a society, we seem to be relying more and more on black
boxes to determine important aspects of life: guilty or innocent?
Who will be elected? Secret No-Fly list.

The lack of transparency is killing our democracy and turning us
into a police state.

And I'll use the words they often use: if you are right, you have
nothing to fear. The facts will side with you.

[m.meister]

oops -- was reply to comment

Hit reply to story, the above was meant as a reply to "Concur" by SeizeCTRL.

[cameron.fromthepit]

What is the problem?

All code for items that are accepted as fact in criminal cases should be open as should the actual devices. It is not a undue burden on the manufacture or the court once a release of code is found to be valid or fair then a precedence can be applied to all devices using the same code and found to be technically working and properly calibrated. I can remember seeing a breathalyzer (not one used by the police)from the early 1980s give a positive to someone chewing a stick of Juicy Fruit Gum, I am sure this is no longer the case or is it.

[W2Kuser]

cool, now challenge embedded code & chips also

The right to review software for bugs seems reasonable to me, especially with all the publicity around errors in other "magical black boxes" like voting machines, etc.

But the review shouldn't stop there, and should dig deeper into the rest of the technology as well. For example, there are well documented cases of Intel's CPUs doing math wrong. No big deal for a computer game, but when your life is at stake you should have to right to challenge and review every aspect of the technology that threatens to take away your freedom.

And no, we can't trust the cops to do competent reviews either. Beside the fact that most cops can't even comprehend basic high school physics, there have also been well documented cases of such venerable instutions as the FBI Crime Lab of FAKING test result when the real results proved inconvient enough not to support prosecuters...

Just wait for the new Homeland Security "terrorism suspect breathalyzer" that magically detects terrorists (or just disloyal citizens). I bet a lot of the people aguing against this decision would change their minds then...

[zboot]

Not really

In what situation is an intel chip being used in situations where your life is at stake? BTW, what are these documented cases? Any links to one? Usually chips and source code are warranted for specific use and disclaimed against safety critical use. If you want a mission or safety critical chip/sw, you tend to pay for it.

[nrthrnNYker]

It's all about the money.

C'mon, who's kidding who here ?
DWI laws, Seat Belt laws, etc, etc. were NEVER about 'ensuring public safety'. These laws are PURELY a device to generate revenue for the state. That's why, when instances of DWI began to drop like a rock, did the state congratulate themselves for a job well done ? They did NOT ! They simply responded by lowering the threshold for DWI intoxication and/or raised fines & other penalties....anything to keep that massive source of revenue flowing into state coffers, and to ensure that those that were hired to "fight DWI" keep their jobs (which were only supposed to be short-term in the FIRST place).

[alegr]

Seat belts

Go ahead, don't wear the seat belt, get into an accident, have your brains splashed all over the road. That happened with people so many times, it's not funny anymore.

[zboot]

I think Not

What do you mean work against? You're assuming that the makers of the red light camera's would refuse to disclose their source code under reasonable non disclosure agreements. Besides, for a specific code base, UNLESS the manufacturer is fudging the results or there are significant errors that would skew results against drivers, all they have to do is release the code once to allow someone to investigate. If no flaws are found, then they're done. they never have to release the code again because there is a preceeding court case that has already established that there is nothing codewise that would adversely screw up results.

[zboot]

This was in response to the working against traffic cameras comment

. . .

[bridge solution]

the court is right but the lawyer is wrong

i do business in kentucky, and am a former peacde officer certed by a state supreme court in alcohol matters.
lawyers have been arguing for years that since the local operator "doesn't know how the machine works" he cannot operate it. if i buy that argument, no one should be allowed to have a driver's license unless they can explain harry ricardo's math for the propagation of a flame front.
the court is right--there's nothing onerous in supplying the code. the manufactuter is right, the code is proprietary.
there used to be a machine callede the s&w 900, which used streaight chemical reactions to evaluate bac....along wioth the same concept of interference with a passing beam of light to yeild a result. becuase it could be understood by the operator, it could be pakyed with, minimally. add or subtract almost 0.02% w/v in advance, by changing placment of a piecve of paper, etc. this is the precise reason why it was made obsolete, and replaced by the s&w 2000 which performed all the math interallly. there was a way for a corrupt cop to alter it's results by 0.01%w/v...but only if every singles test for a week had the error..and there wsas no spurpise inspection during the week.
for that reason, the intoxiliser was created.
whatever the code says, if it doesn's try to repeal the laws of chemistry, the test results will be the same.
except in the minds of lawyers and people who know that television doesn;t work, or the internet, since u cannot stuick a picture into the air and have it reassamble somewhere else.

[The_Decider]

It may be proprietary

But it should not.

Things like this and voting machines need to be open. The integrity of our government, justice system and government requires this.

Contrary to what corporate interests tell you, profits do not trump everything.

[MTGrizzly]

And computer based slot machines...

...can't be rigged to be biased against the players and favor the
casino...

You sound like every other cop I've ever heard trying to defend a
bogus position. It must be right, because you say it is right and
cops never lie.

In fact, cops routinely lie in just about every circumstance in
their jobs, but especially in order to get convictions. Machines
that determine blood alcohol content from exhaled breath are as
prone to errors in code as any other machine. Put the two
together and you have a recipe for tyranny.

If you, (the cops), and the manufacturer have nothing to hide
then you shouldn't have to worry about releasing the code. Since
you are worried about releasing the code, one is safe in
assuming that there is margin for error in the code. No matter
how much you protest to the contrary.

Given your spelling and grammar, I would love to be a defense
attorney opposing you.

[alflanagan]

Re: the court is right but the...

bridge solution said: "whatever the code says, if it doesn's try to repeal the laws of chemistry, the test results will be the same."

The laws of chemistry may determine the internal result, but what's displayed on the screen for the peace officer is entirely up to the software. If I was writing the software I could do all kinds of things to influence the result.

[Dr_Zinj]

The Appeals Court decision was the right one

If you can't satisfactorily explain what the law is, and how the person violated it; then any solution applied to the problem will be useless, they'll just keep breaking the law.

I worked in Quality Analysis for over 2 decades; multiple, external reviews are way more accurate and relevant than anything done in-house. And every business or organization that self-evaluates is going to bias their results in favor of themselves. So it doesn't matter if the Intoxiliser manufacturer says they tested their algorithm, justice demands that the algorithm be trotted out as the "accuser" of the defendent; along with copies of when the device was last tested, what the test results were, and what the expected range of drift of results is for the difference in time and usage. And that still doesn't answer the question of whether the device was used properly or not.

I'd hate like hell to be 0.1 under the legal limit and be convicted of being over. Just as I'd hate to pay $10,000 for a level that was erroneously calculated when I should only have paid $500 instead.

[Jack K1]

It won't help

First, the expense associated with reviewing the code will be pretty high.

Second, once it's done and any flaws sorted out, no one will be able to challenge the source code in court again.

This will turn to CMI's advantage and serve as a major selling point. I'm surprised CMI hasn't jumped at the chance to have their code independently reviewed for free.

[sanenazok]

Hardly

I can't think of any company that would want to go through this. If the DUI driver actually gets the code (unlikely - charges will be dropped) then he can hire an "expert" to arrive at whatever conclusion the DUI driver wants. Then the software manufacturer will need to hire its own experts. If they don't win the whole product is out and gone.

This would be great for CMI, but ONLY if their code is perfect and can't possibly be challenged for some minutiae. How likely is that? No proprietary source company wants its code looked at and argued over in trial. Bad, bad for business.

I really can't decide with whom to sympathize with in this case.

[Drpixelphd2]

What?

The reason they don't want the code examined is 2 fold. First, these machines are temperature sensitive as the requirements to convert alcohol on the breath to a gas and using a gas chromatograph column, the volume is compared to the percentage of "air". Software is not always the problem! Inconsistencies in the testing area can have a broader affect. Second, the software cannot make up for inconsistencies in the testing environment.

If CMI is wrong and the case is dismissed, boom! All convicted cases using the machine will be subject to reversal or dismissal. They had better be right on with their software.

[geezzerr11]

It won't help says who

Software bugs are like lice, where there is one there is bound to be more. It is impossible to prove that a piece of code will not fail. If the errors inthecode are discovered it will always be suspect and continuously subject to scrutiny.
Read a software warranty. Typically it is warranted for nothing, Nada, squat Sweet Fanny Adams, not a groat, not for any particular purpose etc etc etc. If a piece of software ruins a user and sends all his children into slavery he might just get the price of the media (if any back) Other than that its Caveat Emptor.

[Sparky650]

Needs a better way

My brother is one of those people that can drink one beer and get giddy and slurred. By law he is not technically drunk but I would fear for my life if he were driving. (He doesn't drive like this)
My uncle on the other hand can drink a 12 pack or a bottle of wine and you wouldn't know by appearances that he had any. I mean he will drink it up (again not driving) and be able to do any task at his home without any kind of problems.

[axekick]

DUI's too serious of an offense not to disclose it

I was arrested for DUI in the late 1990's. At the time I had not consumed any alcohol in over 3 weeks, not one drop. I passed all legitimate field sobriety tests. When given a breathalyzer at the police station I blew a 0.00, when tested again I blew another 0.00. I was taken out of the room where the breathalyzer machine was located for about 10 minutes, then brought back and blew again, this time the results were 0.18. I immediately protested and request to be taken to a hospital so that a blood test can be performed. They asked if I had $140 to pay for it and I informed them I did, that it was in my wallet which was in their posession. They said someone would take me but instead put me in a cell and kept me there until morning when they allowed me to make a telephone call. I beat this DUI in court on a technicality, the officer failed to put in his report that I was read my miranda rights. However if not for this failure on the officers part I would have lost my license, faced severley increased insurance premiums, and likely paid thousands of dollars to the state. This police jurisdiction became the center of local media attention about one year later for issuing DUI's to those who were not intoxicated. As rare as this may be, it can happen and I know police officers who told me they can make the Breathalyzer "read anything we want it to read."

I also believe you should adopt a Zero tolerance for drunk drivers so that the technicalities are not such an issue. If you have been drinking at all then you cannot drive, period. But the burden of proof should be high and verifiable.