Polygraph explained

The Polygraph in InfoSec: Unveiling the Truth

Table of contents

Introduction

In the realm of InfoSec and cybersecurity, the polygraph, also known as a lie detector test, has long been a topic of interest and debate. This sophisticated tool, which measures physiological responses to determine truthfulness or deception, has found applications in various sectors, including law enforcement, intelligence agencies, and employee screening. In this article, we will delve into the depths of the polygraph, exploring its history, functionality, use cases, and its relevance in the InfoSec industry. Join us on this journey as we unveil the truth behind the polygraph.

What is a Polygraph?

The polygraph is a device that records physiological responses such as heart rate, blood pressure, respiration, and skin conductivity while an individual is being questioned. These physiological responses are believed to be indicators of stress or deception. The polygraph typically consists of several components:

1. Pneumograph: Measures respiration patterns and detects any irregularities.
2. Cardiovascular component: Monitors heart rate and blood pressure, looking for changes that may indicate deception.
3. Galvanograph: Measures the skin's electrical conductivity, which can increase when an individual is under stress.
4. Recording device: Captures and displays the physiological responses on a chart or graph.

History and Background

The origins of the polygraph can be traced back to the early 20th century. In 1915, William Moulton Marston, a psychologist and inventor, developed an early version of the polygraph, which he called the "lie detector." Marston's device measured systolic blood pressure changes while individuals answered questions. Although Marston's invention laid the foundation for modern polygraph technology, it was not until the 1920s that further advancements were made.

John A. Larson, a medical student at the time, refined Marston's invention by incorporating additional physiological measurements. Larson's polygraph, patented in 1931, included the measurement of respiration and galvanic skin response. This breakthrough led to the widespread use of the polygraph in criminal investigations and later in employee screening.

How Does the Polygraph Work?

The polygraph operates on the assumption that when an individual lies, their physiological responses will deviate from their normal baseline. During a polygraph examination, the subject is connected to the various sensors, and a trained examiner asks a series of questions. These questions typically include relevant, irrelevant, and control questions.

1. Relevant questions: Directly relate to the issue being investigated, such as "Did you steal the company's intellectual property?"
2. Irrelevant questions: Unrelated to the issue but are used to establish the subject's baseline physiological responses.
3. Control questions: Designed to elicit a deceptive response from an innocent subject. For example, "Have you ever lied to your employer?"

The examiner compares the subject's physiological responses to the different types of questions. Significant deviations from the baseline may indicate deception. However, it is important to note that the accuracy and validity of polygraph results have been a subject of ongoing debate within the scientific community.

Use Cases in InfoSec

While the polygraph has been primarily associated with law enforcement and intelligence agencies, it has also found applications within the InfoSec field. Some potential use cases include:

Employee Screening

Organizations may use polygraph examinations as part of their employee screening process to identify individuals who may pose a risk to sensitive information or assets. However, the use of polygraphs in employment decisions is subject to legal and ethical considerations, and their effectiveness in this context remains a topic of debate.

Insider Threat Detection

Polygraph examinations can be employed to identify potential insider threats within an organization. By Monitoring the physiological responses of employees during questioning, suspicious behaviors or deceptive responses can be flagged for further investigation. However, it is crucial to consider the legal and privacy implications when implementing such programs.

Incident Investigations

During the course of an incident investigation, polygraph examinations may be used to gather additional information from individuals involved. By analyzing physiological responses, investigators can assess the veracity of statements and potentially uncover hidden details. However, it is important to note that polygraph results should not be the sole basis for any conclusive judgments.

Relevance and Best Practices

While the polygraph has its proponents and critics, it is essential to approach its use in InfoSec with caution. The reliability and accuracy of polygraph results have been questioned, and their use may infringe upon an individual's rights to Privacy and due process. As a result, it is crucial to adhere to established standards and best practices when considering the use of polygraph examinations:

1. Legal Compliance: Ensure compliance with local laws, regulations, and guidelines regarding the use of polygraphs in employment and investigations.
2. Ethical Considerations: Transparently communicate the purpose, process, and potential consequences of polygraph examinations to individuals involved.
3. Supplemental Measure: Consider the polygraph as one tool among many in the investigative process, rather than relying solely on its results.
4. Trained Examiners: Employ qualified and experienced examiners who have undergone rigorous training in polygraph techniques and interpretation.
5. Ongoing Research: Stay informed about the latest scientific research and advancements in polygraph technology to assess its relevance and effectiveness in InfoSec.

Conclusion

The polygraph, with its ability to measure physiological responses and potentially detect deception, has found applications in various sectors, including InfoSec. While its use remains controversial and its accuracy debated, the polygraph continues to be employed in employee screening, insider Threat detection, and incident investigations. However, it is crucial to approach its use with caution, adhering to legal, ethical, and best practices guidelines. As the field of InfoSec evolves, ongoing research and critical evaluation are necessary to determine the true value and limitations of the polygraph.

References:

1. Polygraph
2. The Polygraph and Lie Detection
3. The Lie Behind the Lie Detector