Security hole would let offenders on home detention roam free, says IT expert, but Corrections disagree.

A computer hacker has demonstrated how home detention bracelets can potentially be fooled into letting criminals roam free.

The Department of Corrections last night denied the vulnerability affected prisoners under its care - but the hacker said its systems ran on the same cellular network he exploited.

William Turner yesterday demonstrated his ability to defeat electronic monitoring bracelets relying on the cellular phone network through a practice known as "spoofing".

Mr Turner, known in the industry as Ammon Ra, showed Wellington's Kiwicon conference how a bracelet could be wrapped in foil, preventing it from reporting its location, then the signal mimicked by a laptop using a $500 transmitter and some custom software.


Mr Turner then instructed the "spoof" transmitter to report movements, despite the hacker and his bracelet remaining on stage.

"And here it is now, it shows tracking down the road," he said, to applause from the audience, as the signal showed him apparently moving down Courtenay Place.

Rethinking Crime and Punishment director Ced Simpson said there was a danger in Corrections relying on electronic monitoring when in-person checks would provide greater surety.

"There is a temptation towards a simplistic mechanism. Ultimately not just victims, but people out there in the community, will benefit if we are doing everything we can to reduce the chance of reoffending," he said.

Corrections last night said in a written statement any offender trying to circumvent home detention could face criminal charges.

"To date our electronic monitoring system has proved reliable and accurate," corrections services national commissioner Jeremy Lightfood said.

Corrections Minister Sam Lotu-Iiga did not return calls.

Labour Party spokesman Kelvin Davis said Corrections needed to guarantee to the public the integrity of its systems as soon as possible. "If the system is broke, then damn well fix it and fix it fast. It's great Kiwicon has highlighted these problems."

Mr Turner conducted his demonstration using a bracelet made by Taiwanese firm GWG International. Corrections said its bracelets were manufactured by British firm Buddi, but would next year transition to United States company 3M.

Mr Turner said accessing such devices was difficult, but he believed all bracelets using the cellular network for position monitoring were likely vulnerable to the flaws he identified.

Corrections confirmed its systems relied on the cellular network, but believed they were resistant to problems identified by Mr Turner.

"This has proved extremely effective," Mr Lightfoot said. "We do not intend to contact Turner as the system we believe does not suffer from this vulnerability."

Mr Turner, working in Australia but raised in Christchurch, made a splash last year at the same event demonstrating flaws in Environment Canterbury's Metro public transport charge-card service.

He showed how he could credit one card with $167,000, leading to ECan complaining to police. No further action was taken by authorities.

Mr Turner said the electronic bracelet problems should "probably" be fixed, as the flaws could be exploited by criminals. "But I don't really care, I'm doing it for fun, not social justice. I don't think there's a non-criminal application for it."

Civil liberties campaigner and IT professional Thomas Beagle, who attended Kiwicon, hoped Mr Turner's presentation would lead to the electronic monitoring system being repaired. "I hope they respond and fix the problem. Disclosure of weaknesses makes the system stronger."

Doing time at home

• At the start of last week, 1707 people were on home detention - and wearing ankle bracelets as a condition of their sentence.

• Two more high-profile names yesterday were added to the list. Serial sex-offender Stewart Murray Wilson has been granted parole, which will begin in March. He is serving 21 years for sex and violence offences against women and girls.

• Former South Canterbury Finance director Edward Sullivan was yesterday sentenced to 12 months' home detention. The 73-year-old former lawyer was found guilty on five charges of making false statements in offer documents and obtaining by deception