The Emotiv brain-computer interface was designed to let users control their computers with their thoughts alone, opening up a new avenue for hands-free computing as well as a potential means for those with disabilities to communicate through machines. So much for good intentions. Scientists at the University of California and the University of Oxford in Geneva have devised a way to steal a user’s sensitive information--account numbers, PIN numbers, etc.--via Emotiv’s off-the-shelf brain signal-reading technology.

Specifically they were monitoring for the P300 signal in their test subjects, a brain signal that is associated with recognition--a tip-off that a particular word or image is meaningful to the user. The researchers placed their Emotiv-clad subjects in front of monitors displaying a series of random images of banks, numeric keypads, PIN numbers, and various people, looking for P300 signals that showed a flicker of recognition. They found that over time they could reduce the randomness of the imagery and focus in on what the user found relevant. Slowly, they were able to zero in on the images--and numbers, and banks--most relevant to the subjects