Minnesota and CMI reach agreement on release of Intoxilyzer source code

The State of Minnesota and CMI have reached a settlement agreement in a dispute over the release of the computer source code for the Intoxilyzer 5000EN. The agreement will supposedly allow anyone accused of DWI in Minnesota full access to the machine's computer source code.

Minnesota Department of Public Safety Commissioner Michael Campion said "We are very pleased that we have given the defense attorneys everything they need to analyze the source code..." Of course he didn't mention the $50,000 CMI is handing over to the state to hire experts to defend the source code from challenges.

The agreement calls for CMI to make the source code available for review at its Owensboro, Kentucky headquarters free of charge for any "authorized Minnesota litigant," his attorney and/or his expert. A bound version of the code will also be available to any "authorized Minnesota litigant,"his  attorney and/or his expert for no more than $250.

Some issues still remain, however. Requiring attorneys and experts to travel to Kentucky could price most defendants out of a source code challenge - especially since the bound version is a decompiled version of the source code that omits key aspects, according to Minnesota criminal defense attorney Chuck Ramsey.

The settlement was reached without the input of the Plaintiff/Intervenors and the court will hold a hearing on adopting the agreement just ten days after the agreement was reached -- quite a bit quicker than the 45 days usually required under local rules for the federal courts in Minnesota.

Another Minnesota court orders the release of the Intoxilyzer's source code

Today a Minnesota Court of Appeals reversed a lower court's decision to deny a request by a citizen accused of driving while intoxicated to examine the source code of the Intoxilyzer 5000EN.

Mr. William Robert Thompson was stopped by Minnetonka Police and requested to blow into the state's breath test machine. The machine determined Mr. Thompson had an alcohol concentration of .10.

Mr. Thompson challenged his license revocation asking the court to suppress the breath test result and to order the Commissioner of Public Safety to provide him with the machine's source code. Included in his request was an affidavit from Harley R. Myler, Ph.D., P.E. stating that without examining the source code, it would be impossible to determine whether the machine was operating properly at the time of Mr. Thompson's test. He also included two affidavits describing previous problems with the breath test machines used by Minnesota.

The Commissioner of Public Safety argued against the discovery request on the grounds that the state of Minnesota was involved in litigation against CMI (manufacturer of the Intoxilyzer) for breach of contract, breach of the implied covenant of good faith and fair dealing and copyright infringement.

The district court denied Mr. Thompson's requestt on the grounds that Mr. Thompson had failed to demonstrate that the source code was relevant to his defense. The court of appeals overturned the lower court's decision on the grounds that "the source code may reveal deficiencies in the accuracy of the Intoxilyzer 5000EN that would be relevant to a claim or defense..."

The tide is turning quickly on the "trade secret" defense used by CMI and the "it's not in our possession" defense used by prosecutors in DWI cases. The blueprint seems quite clear for obtaining breath test machine source code -- testimony from an expert regarding the need to examine the source to determine if the software functions correctly; evidence of machine malfunctions; case law from Kentucky, Minnesota and New Jersey where courts have ordered the state to turn over the source code; and, most importantly, a showing that an examination of the source code is relevant to the defense of the case.

Software bugs may compromise breath test machine

As previously noted here, courts in Minnesota and New Jersey have ordered the state to provide the source code that runs their breath test machines to defense counsel for independent testing. The defense bar has long hypothesized that these machines are unreliable at their core due to problems in the computer programs that "run" the machines.

In the New Jersey litigation, John J. Wisniewski of Base One Technologies analyzed the source code in Draeger's Alcotest 7110 Mk III C and his conclusions are eye-opening, to say the least.

Testing the Alcotest 7110Mk III Source Code uncovered 24 major defects. For the
purposes of this overview,we have identified 9 defects with thegreatest impact on the instrument test results, and the validity of those tests.

The study concluded that the Alcotest software would not pass industry standards in the U.S. for development and testing because Draeger refused to make the code available for audit. I find it very disconcerting that the companies that manufacture these breath test machines that are used to brand our fellow citizens as criminals, claim they cannot release the source code because it is a trade secret.

He also stated that the Alcotest software had yet to be tested completely. The program contains more than 45,000 lines of code of which 3,200 lines are used to make decisions. The report states that the lack of use of industry coding standards prevented testing of critical paths in the software and prevented errors from being removed.

The source code also prevents the machine from detecting catastrophic problems and shutting itself down. As a result, should the machine encounter these conditions, the results of breath tests become unpredictable.

The Alcotest code also lacks the ability to determine whether motors or valves controlled by the software are functioning properly. As a result, the machine assumes its internal components are working correctly.

The Alcotest conducts its diagnostic routine on the Analog/Digital converter during the data measurement cycle -- not before the measurement is taken. In the event of a diagnostic failure, the machine will substitute default values.

The machine assumes there is no airflow through the machine at the beginning of a test. The machine takes a measurement and then uses that measurement as a baseline. The software is incapable of determining if the amount of air flow detected at that point indicates a problem. The machine also substitutes a default value in the event the measurement fails. So, if the machine was off at inception, it will continue to be off everytime is has to revert to a default value.

While the Alcotest will detect measurement errors, it will only report them if they have occurred a certain number of times consecutively.

The software doesn't guard against the entry of incorrect global values in other memory locations. As these global values are very important in the Alcotest machine, any errors in these global values can cause great variations in breath test scores.

There are also timing problems as the code is written in C and not assembly language. As a result, there may be delays in operation of the machine during a test.

Base One's testing also revealed:

the software has to beconsidered unreliable and untested, and in several cases it does not meet stated requirements. The source code supplied has creation dates and modification dates from 1993 to 1997, but the coding architecture, style, organization, and modification documentation (audit trail) more closely resemble the software principles used in the 1970’s and 1980’s.

The testing also found instances in which, instead of deleting unnecessary code, programmers merely disabled it by means of comments.

The study concluded that:

As a matter of public safety, the Alcotest should be suspended from use until the softwarehas been reviewed against an acceptable set of software development standards, and recoded and tested if necessary. An incorrect breath test could lead to accidents and possible loss of life, because the device might not detect a person who is under the influence, and that person would be allowed to drive. The possibility also exists that a person not under the influence could be wrongly accused and/or convicted.

No one has yet subjected the source code of CMI's Intoxilyzer 5000 to the scrutiny faced by the Draeger Alcotest, but I suspect we would see some of the same problems in the code running Texas' breath test machines as well. Is this really what we want determining whether our fellow citizens should be branded criminals for life?

See also:

• Buggy breathalyzer code reflects importance of source review (Arstechnica.com, May 15, 2009)

Minnesota court affirms access to computer source code

The Minnesota State Supreme Court ruled yesterday (read the opinion here) that a person accused of driving while intoxicated is entitled to the breath test machine's source code if it can be proven that the source code could aid their defense.

Under Minn. R. Crim. P. 9.01, subd. 2(3), it was an abuse of discretion for a district court to order discovery of the source code of the Intoxilyzer 5000EN when a defendant did not submit any evidence on how the source code may relate to his guilt or innocence; however, it was not an abuse of discretion for a court to order discovery of the source code to a defendant who submitted evidence that an analysis of the source code may reveal deficiencies that could challenge the reliability of the Intoxilyzer and would relate to his guilt or innocence.

Appellant Brunner submitted a memorandum and nine exhibits to support his request for the source code. The memorandum gave various definitions of “source code.” The first exhibit was the written testimony of David Wagner, a computer science professor at the University of California in Berkeley, which explained the source code in voting machines, the source code‟s importance in finding defects and problems in those machines, and the issues surrounding the source code‟s disclosure. The next exhibits detailed Brunner‟s attempts to obtain the source code, both from the State and CMI. The last exhibit was a copy of a report prepared on behalf of the defendants in New Jersey litigation about the reliability of New Jersey‟s breath-test machine. See State v. Chun, 943 A.2d 114 (N.J. 2008). The report analyzed the New Jersey machine‟s computer source code and uncovered a variety of defects that could impact the test result. Based on Brunner‟s evidence, the district court found that the integrity of the source code is essential to the scientific reliability of the Intoxilyzer 5000EN test result. Further, the jury instructions asked the jurors to assess the reliability of the testing method, whichcould not be done without Brunner having access to the software controlling that testing process.

Minnesota uses the Intoxilyzer 5000EN which is made by CMI (the same machine used in Texas).