Breathalyzer source code

| Comments (2) | Misc
Minnesota resident Dale Underdahl got busted for DUI and decided that requesting the source code for the Intoxylizer 5000EN would be a good way to get off:
During a subsequent court hearing on charges of third-degree DUI, Underdahl asked for a copy of the "complete computer source code for the (Intoxilyzer) currently in use in the state of Minnesota."

An article in the Pioneer Press quoted his attorney, Jeffrey Sheridan, as saying the source code was necessary because otherwise "for all we know, it's a random number generator." It is hardly new technology: One criminal defense attorney says the Intoxilyzer is based on the antique Z-80 microprocessor.

A judge granted the defendant's request, but Michael Campion, Minnesota's commissioner in charge of public safety, opposed it. Minnesota quickly asked an appeals court to intervene, which it declined to do. Then the state appealed a second time.

What became central to the dispute was whether the source code was owned by the state or CMI, the maker of the Intoxilyzer.

Minnesota's original bid proposal that CMI responded to says that "all right, title, and interest in all copyrightable material" that CMI creates as part of the contract "will be the property of the state." The bid proposal also says CMI must provide "information" to be used by "attorneys representing individuals charged with crimes in which a test with the proposed instrument is part of the evidence," which seems to include source code.

I have no informed opinion on whether Underdahl has a legal right to get a copy of the source code, but from a technical perspective it's not clear what he's hoping to find. It's certainly possible that the source code contains a random number generator or incriminating comment that says "insert .10 BAC reading here", or "this sensor doesn't work" but that doesn't really seem that likely. More likely it will be that it's just typical embedded software. I certainly don't see any problem with it being old technology. The Z80 is old, but it's a perfectly reasonable piece of hardware. Heck, I had one in my TRS-80 Model 3 back in the 80s.

If I were trying to call a breathalyzer reading into question, I'd probably be looking for a different angle: the measured accuracy of the system. This isn't really an issue of the source code but rather of the accuracy of the sensor. You might be able to learn something from the source code—for instance if there was some explicit fudge factor in the code—but more likely you'd need to actually examine the hardware or at least have access to studies done by someone else.

Obviously, if the vendors aren't willing to give up their source code, then subpenaing them may be a useful angle for now, but it's not likely to be a long-term effective strategy. It's not like states are going to give up on breathalyzers and even if CMI refuses to produce their source, some manufacturer eventually will. According to this article, some already do.


First of all, Underdahl and his lawyer don't need a "long-term effective strategy"--getting off this once is already a win for them. Secondly, they don't need a technically plausible argument for a breathylizer error--just one that might cast enough doubt in the judge or jury's mind. Any single bug in the software, for instance, could probably be spun into an elaborate story about how the bug caused a false reading.

In Washington state, if you challenge a speeding ticket in court, the police must meet a very exacting standard to make the ticket stick, including, for example, full records of the radar gun's most recent calibration. Most of the time, they don't bother. (An exception is a particular county in eastern Washington which apparently gets a substantial proportion of its revenue from speeding tickets.)

It's obvious that the standard was the result of numerous Underdahl-type challenges, calling into question the validity of radar gun readings. The net result is that anyone with the cash and the savvy to hire a lawyer specializing in speeding tickets can get just about any speeding ticket disposed of. It looks like DUIs may be headed down the same road.

Well, I had a Model I. :) But it's Model III, not Model 3. Just remember: I, II, III, 4, 16, 12.

I'm shocked that the state thinks it can avoid providing source. I would also expect that the source can be made simple enough to be an appropriate target for formal verification. Once performed, I would think that the State would be in a pretty strong position.

Leave a comment