The US Privacy Strategy

Keywords: privacy, surveillance, NSA, privacy-enhancing technologies, signals intelligence, online identity

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

This paper tells a tale of two privacy debates -a debate about surveillance, and a debate about online identity. The first debate concerns government access to data, and is related directly to the NSA surveillance programs disclosed in the past few years.

The second largely concerns the practices of companies, not governments, as the private sector works to establish a new system of online authentication. Nevertheless, company misuse of personal information, no less than NSA spying, has raised widespread concerns among the public. [START_REF] Cox | Who should we fear more with our data: the government or companies? The Guardian[END_REF] I participated in both the surveillance and the online identity debates while I served in the Obama White House as a privacy advisor. In both cases, we were aware of potentially groundbreaking technologies that could help us achieve our goals without sacrificing privacy. Nevertheless, we did not manage to make use of them. Unfortu-nately, little has changed: the hard work of implementing privacy-preserving technologies has barely begun.

2

Time for a revolution -or a requiem?

The title of this year's IFIP summer school -"time for a revolution?" -is a fitting one. The world continues to grapple with the fallout from revelations that began in June 2013 of extensive surveillance by the United States National Security Agency and allied intelligence services. Although Edward Snowden, a contractor for the NSA, disclosed government surveillance programs, the debate he began has sparked a broader global conversation about digital privacy. Ordinary people have become acutely aware of privacy as a value that is in the process of being lost. Only a revolution, it seems, can reverse the process. At the IFIP summer school venue in Edinburgh, the theme of privacy resonated well beyond dry conversations of academics in the fields of law, policy and technology. Surveillance, privacy, and a loss of trust were the themes of an evocative audiovisual performance at the Edinburgh festival, a work of music and visual art by Matthew Collings and Jules Rawlinson that explored these issues on an emotional level. The performance struck a deep chord.

The title of Collings' and Rawlinson's work, "A Requiem for Edward Snowden", captures a deep distrust of the US government and especially of its intelligence agencies. Explaining the title, Matthew Collings described his view that Snowden would not survive his break with the NSA. "I was convinced that he would shortly be dead", Collings said. Collings also explained that he conceived of his "requiem" in a broader sense. "The death of the excitement of the internet" was a theme of the piece, Collings explained. "It's about the death of privacy, too". [START_REF] Pollock | How Edward Snowden inspired a musical vision of the future[END_REF] Edward Snowden, of course, remains alive, although on the run. Perhaps the same may be said of privacy. While the causes for diminished privacy are numerous, one culprit is the ignorance of lawmakers, policymakers and business leaders. While they should know better, they continue to insist that we trade privacy for security and convenience. Many people are willing to accept the argument that we have no choice but to sacrifice privacy for other important values only because they are not aware of privacy-enhancing technologies. These technologies may mitigate such trade-offs -if we choose to deploy them.

3

From "Yes, We Can" to "Yes, We Scan"

The election campaign of Barack Obama in 2008 raised expectations in the United States and around the world for a season of progressive change. Perhaps the mood was captured best in the iconic poster created by artist Shepard Fairey, featuring a stencil portrait of Obama, shaded in red, white and blue. Obama gazes thoughtfully into the distance. Below, there is the single word: "Hope". Other versions featured Obama's campaign slogan: "Yes, we can!" [START_REF] Barton | Hope -the image that is already an American classic[END_REF] As Barack Obama took office in 2009, privacy and civil liberties advocates had some reason to be optimistic. During his campaign, then-Senator Obama faulted President George W. Bush for excessive claims of executive power in the "war on terrorism". In remarks on the campaign trail, Obama denounced the NSA's "warrantless wiretapping" program, authorized by Bush shortly after September 11, for exceeding Bush's constitutional authority. He promised that, if elected, he would ask his legal team to review NSA surveillance programs and would reverse excessive executive orders "with the stroke of a pen". [START_REF]Remarks by Senator Barack Obama in Lancaster[END_REF] While the stage seemed to be set for a major shift on issues of surveillance and privacy, careful observers noticed nuances in Obama's remarks that were lost on much of the general public. On the campaign trail, Obama did not echo his supporters in denouncing the USA PATRIOT Act, the much-maligned law that broadened surveillance powers. Instead, Obama reserved his sharpest criticism for the way in which Bush had authorized surveillance programs, not for the programs themselves.

Charlie Savage, a national security reporter for The New York Times, notes that Obama consistently advocated a "rule of law" critique rather than a civil liberties critique when discussing national security. Obama argued that the Bush administration's approach was a threat to the separation of powers between the executive, legislative, and judicial branches outlined in the U.S. Constitution, upsetting its system of checks and balances. Obama did not voice nearly as strong an opinion on whether Bush policies violated the individual rights guaranteed in the Bill of Rights. [5, pp. 50-55] What was lost on many Obama supporters was the fact that the "rule of law" critique had become less relevant as the Bush presidency was coming to a close. Bush's second term in office was marked by an effort to normalize counterterrorism powers. Bush administration lawyers had already stepped back from some of the maximalist positions that they had advanced in the early days after September 11. The NSA surveillance programs that Bush created in his first term by executive order were now authorized by orders of the Foreign Intelligence Surveillance Court.

Obama was briefed on these programs shortly after he took office. He learned they were no longer based on a theory that the president, as Commander-in-Chief, could override the will of Congress and bypass the federal courts in order to conduct surveillance of the enemy in a time of "war on terrorism". Instead, NSA surveillance programs were now firmly grounded in federal law, as interpreted by the surveillance court. The court had accepted the expansive interpretations that national security lawyers had urged to bring Bush's unilateral surveillance programs under the court's purview. As a result, Obama chose to continue these NSA programs without substantial change.

Obama turned his attention to a broader privacy agenda. The major items were strengthening consumer privacy and addressing the growing problem of cybersecurity. The privacy issues associated with cybersecurity monitoring were complex and difficult. Obama was the first U.S. president to devote a major address entirely to the subject of cybersecurity. In 2009, he announced an ambitious plan to strengthen security for government and critical infrastructure networks. As part of that plan, he ordered a new initiative to facilitate the development of a system of online identity management, led by the private sector, that would include significant privacy safeguards. [START_REF]Remarks by the President on Securing Our Nation's Cyber Infrastructure[END_REF] In Obama's cybersecurity address, he also announced that he would appoint a privacy and civil liberties official to the White House National Security Staff, serving its new Cybersecurity Directorate. I was chosen to fill that position. Obama's decision to create my position reflected how important privacy issues had become in national security policy. While the National Security Council had long employed a small staff to address human rights issues, I became the first privacy official to serve on the NSC staff.

In June 2013, the Obama administration was blindsided by an avalanche of unauthorized disclosures of NSA surveillance programs. Edward Snowden, a young NSA contractor then living in Hawaii, had absconded with a trove of highly classified documents detailing the United States government's aggressive world-wide signals intelligence collection operations. Snowden leaked his documents to Glenn Greenwald, Laura Poitras, and other journalists. Over a series of months, stretching into years, the public was treated to a series of alarming revelations of global surveillance operations.

For many of Obama's progressive supporters, already dismayed by his continuation of Bush counterterrorism policies, the revelations were a shocking breach of trust. A parody of the Shepard Fairey "Hope" poster captures the sense of betrayal. Obama's portrait is modified to show him as an eavesdropper. He is outfitted with headphones, and the slogan underneath the portrait mocks his promise of change: "Yes, we scan", it reads. Fairey himself shares the dismay. In an interview in May 2015, Fairey said that Obama had not lived up to the famous image he had created for him. "I mean, drones and domestic spying are the last things I would have thought" Obama would support, he said. [START_REF] Patches | Shepard Fairey on the Future of Political Art and Whether Obama Lived Up to His "Hope" Poster. Esquire[END_REF][START_REF] Jauregui | Yes We Scan: Shepard Fairey Likes Obama NSA Parodies[END_REF] The government confirmed many of the surveillance programs that Snowden leaked. The programs that have occasioned the greatest debate in the United States involve programs of domestic collection. They include bulk collection of telephone metadata under section 215 of the USA PATRIOT Act and collection of Internet and other communications content under section 702 of FISA, where the data is inside the United States but the direct targets are foreign. These programs involve oversight by the Foreign Intelligence Surveillance Court.

Other controversial programs include surveillance of foreign leaders, bulk collection of foreign communications and data, and NSA's efforts to undermine global communications security. These programs fall outside the Foreign Intelligence Surveillance Act. They are authorized by Executive Order 12,333, and are subject to looser oversight rules enforced entirely within the Executive Branch. They do not require oversight by any court.

The intelligence community's initial reaction to the Snowden revelations was based on the way it had responded to similar controversies in the past. Intelligence officials denounced Snowden for betraying government secrets, and defended surveillance programs by pointing to protections for the privacy of American citizens and residents -"United States persons", in the jargon of intelligence oversight rules. U.S. person information was protected, officials said, in all intelligence activities. For those programs subject to the oversight of the surveillance court, the rules were even stricter.

The strategy fell flat. According to opinion polls, a majority of Americans viewed Edward Snowden more as a whistleblower than a traitor. They did not trust the NSA's assurances that their data was protected by privacy rules. Congress was up in arms about bulk collection of telephone metadata. The backlash surprised an intelligence community that had become accustomed, ever since the attacks of 9/11, to receiving the benefit of the doubt when it came to programs said to be necessary to fight terrorism.

The reaction of the international community also put the Obama administration under considerable pressure. German chancellor Angela Merkel was deeply offended to learn that her communications had been a target of NSA spying, and the German public shared her outrage. Brazilian president Dilma Rousseff was also angry when she found out the NSA had monitored her communications. Brazil organized an international conference on Internet governance, and raised awkward questions about U.S. dominance of the Internet's physical and economic infrastructure. Other friendly countries were likewise demanding explanations.

The administration also found itself under pressure from the technology industry. In late December 2013, executives from major technology companies, including Apple's Tim Cook, Yahoo's Marissa Mayer, and Google's Eric Schmidt, met with President Obama at the White House to press their concerns about NSA surveillance. The intelligence community's standard defense -our surveillance is directed at foreigners and we have rules to protect "U.S. person" information -was not addressing industry's concerns. If anything, the argument was counterproductive, as it implied that the privacy of foreign citizens did not count for anything. American technology companies were facing a real danger of lost business abroad. Estimates of lost business ranged from $35 billion to $180 billion, according to industry groups. [START_REF] Rushe | Tech firms push back against White House efforts to divert NSA meeting[END_REF][START_REF] Miller | Revelations of N.S.A. Spying Cost[END_REF]

4

Obama's Surveillance Reforms

The harsh reaction to the Snowden revelations made surveillance reform an imperative for the Obama administration. Obama's first step was to order his Director of National Intelligence, James Clapper, to increase the transparency of intelligence programs. Clapper had become infamous in the days after the revelations had begun in June 2013 for his denial at a public Congressional hearing that the NSA had records belonging to "millions or tens of millions of Americans". Clapper believed his answer was, in his words, "the least untruthful" statement he was able to give at the time, while preserving the secrecy of the NSA's programs. Now, Clapper was put in charge of a drive to inform the public about how the NSA worked. He used a popular microblogging platform, "tumblr", to launch "IC on the Record", disseminating thousands of pages of declassified documents detailing the rules about how the NSA programs work. They included scores of once-secret surveillance court opinions. By the fall of 2013, one transparency advocate, Steve Aftergood, marveled, "Already we've seen a more extensive disclosure of classified infor-mation about current intelligence programs than we've seen for at least 40 years, and maybe ever." By March 2014, Obama's transparency reforms had resulted in the authorized disclosure of more than twice as many previously classified documents as Snowden had leaked. [START_REF] Aftergood | ODNI Rethinks Secrecy and Openness in Intelligence[END_REF][START_REF] Johnson | Snowden's Leaks Lead to More Disclosure from Feds[END_REF] Advocates remained skeptical that the transparency reforms would last, viewing the initiative merely as a tactic to fight back against the Snowden leaks. Still, the intelligence community also put in place more permanent policies. They include an annual "transparency report" detailing the number of targets affected by orders of the Foreign Intelligence Surveillance Court. Previously, only the number of orders was released -a relatively meaningless number, given new legal authorities that allowed one order to cover tens of thousands of targets. The intelligence community also created an implementation plan to institutionalize its newfound commitment to transparency.

Obama's reforms went further than increased transparency. Obama also enhanced intelligence oversight to protect the privacy rights of foreigners. Presidential Policy Directive 28 (PPD-28), issued in January 2014, extends for the first time the mechanisms that the intelligence community uses to protect "U.S. person" information explicitly to protect information belonging to anyone, anywhere in the world. While the substance of the rules is relatively modest, the concept is revolutionary. [START_REF]Presidential Policy Directive -Signals Intelligence Activities (Presidential Policy Directive 28/PPD-28)[END_REF] Retention and minimization limits that once applied only to U.S. persons now apply to all "personal information". Other protections have been codified as well. Signals intelligence cannot be used to disadvantage anyone, anywhere in the world, on the basis of race, gender, sexual orientation, or religion. The rules now explicitly prohibit such misuse of intelligence information -for example, by blackmailing a foreign leader who is gay.

PPD-28 also places limits on "bulk collection of signals intelligence". Bulk collection is not prohibited, but it is limited to six specific national security threats. The NSA may no longer collect signals intelligence in bulk unless it is to protect against espionage, international terrorism, proliferation of weapons of mass destruction, cybersecurity threats, threats to U.S. or allied military forces, or transnational crime. Broader foreign affairs objectives may now be achieved only through targeted intelligence collection.

Congress has also taken action to reform surveillance. In June 2015, section 215 of the USA PATRIOT Act was set to expire. As we have seen, it was an expansive interpretation of section 215 that was the legal authority for bulk collection of telephone metadata. The bulk collection legal theory was under fire. Although the Foreign Intelligence Surveillance Court continued to issue orders under section 215, civil liberties groups had challenged bulk collection in other federal courts. In a major blow to the government, the United States Court of Appeals for the Second Circuit ruled in May 2015 that bulk collection was not authorized by section 215. [START_REF][END_REF] The Obama administration and a majority of both houses of Congress had negotiated an alternative to bulk collection, which was enacted shortly after section 215 expired. The principal sponsors of the reform bill, Senator Patrick Leahy (D-VT) and Representative James Sensenbrenner (R-WI), had been the original sponsors of the USA PATRIOT Act of 2001. Leahy and Sensenbrenner were responsible for that law's extravagantly Orwellian name, which is an acronym for the "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act". Leahy and Sensenbrenner gave their bill to reform surveillance a similarly extravagant name, albeit one that leans in favor of civil liberties. The law that ended bulk collection is the USA FREEDOM Act of 2015, which stands for the "Uniting and Strengthening America by Fulfilling Rights and Ending Eavesdropping, Dragnet-collection and Online Monitoring Act".

The USA FREEDOM Act extended the expiring provisions of the USA PATRIOT Act, including section 215, for another four years, while prohibiting its use for bulk collection. The USA FREEDOM Act replaces bulk collection with a system under which telephone metadata will remain with the companies, but is subject to rapid queries by NSA analysts. NSA analysts must use a "specific selection term" to retrieve data; much of the debate over the bill concerned the breadth of this definition.

Congress also enacted reforms to the Foreign Intelligence Surveillance Court. Congress required the court to issue declassified versions of significant opinionssuch as opinions that would interpret "specific selection term". Congress also created a mechanism for the court to appoint a "special advocate" -a lawyer with a top security clearance who could potentially challenge government lawyers before the court.

5

Using Technology to Protect Privacy: A Missed Opportunity?

The debate over surveillance reform in the United States has largely been a debate about law, usually among lawyers. Does section 215 of the USA PATRIOT Act authorize bulk collection? Is it constitutional? What should be rules for surveillance of foreign targets under section 702 of the Foreign Intelligence Surveillance Act? Is section 702 constitutional? The assumption is that a more refined set of legal rules can better calibrate societal trade-offs between privacy and security.

In the legal debate, privacy is often on the defensive. Of course, civil libertarians argue for legal rules that restrict collection, retention and use of personal information as a bulwark against abuse. Nevertheless, the public is likely to discount such arguments if it is sufficiently fearful of terrorism, reasoning that preventing attacks may be worth some risk of privacy abuse.

Technology offers an opportunity to reframe the debate. Some of the trade-offs that the policy debate takes for granted have increasingly become obsolete. Advances in cryptography over the past decade now provide new alternatives to mass surveillance programs. Cryptography often gives us the opportunity to "have our cake and eat it too", according to Anna Lysyanskaya, a computer scientist at Brown University. She argues that, "at least in theory", we can "gain the benefits of the digital age without sacrificing privacy". The argument for privacy is far stronger if there are practical alternatives that meet government's legitimate objectives. [START_REF] Lysyanskaya | Cryptography Is the Future[END_REF] In PPD-28, President Obama tasked the Director of National Intelligence with providing a report "assessing the feasibility of creating software that would allow the [intelligence community] more easily to conduct targeted information acquisition rather than bulk collection". It was a hopeful sign. An organization within the DNI's office, the Intelligence Advanced Research Projects Activity (IARPA), had funded substantial research in the areas of cryptography that could be helpful in preserving the privacy of data. The DNI, in turn, assigned the task of writing the report to the National Academy of Sciences (NAS).

The NAS report was something of a disappointment. While it recommended new software "to more effectively target collection and to control the usage of collected data", it discounted the more ambitious goal of replacing bulk collection altogether.

For one thing, the report noted, unless information is collected in bulk, there was no guarantee that data about past events would be available when needed; the database owner might not retain it. No cryptographic technique can recreate data that no longer exists. Cryptography also requires more computational power than collection and analysis of the bulk data in unencrypted form, i.e., "in the clear". [16, pp. 9-10] The report concluded that "there is no software technique that will fully substitute for bulk collection; there is no technological magic."

While the report's conclusion was valid, its tone sent the wrong message. The disparaging use of the term "magic" was especially unfortunate, as advanced cryptographic techniques can produce results that, to the non-specialist, seem precisely like magic! One example is private information retrieval. Imagine that one party, such as the NSA, would like to retrieve information from a large database held by another party, such as a cloud computing provider, under section 702 of FISA. Without private information retrieval, the NSA must either trust the provider with its highly classified list of selectors, or the provider must trust the NSA with unrestricted access to its database or provide it with a complete copy. Private information retrieval uses cryptography to allow the NSA to search the company's database without the company learning the NSA's query, but with complete confidence that only data matching those selectors will be provided to the NSA.

Similarly, bulk collection of metadata could benefit from the use of secure twoparty and multiparty computation. Under the USA FREEDOM Act, the NSA may no longer use section 215 of the USA PATRIOT Act to obtain in bulk all telephone metadata maintained by the telephone companies. Under the new law, those bulk records will remain with the companies. The NSA, however, may rapidly query metadata about people in communication with its targets and also about people in communication with those people -out to two "hops". It would seem the NSA's only choice is to trust the telephone companies with its target list so they can retrieve the information, hopefully without leaking classified information.

If that trust turns out to be misplaced, would the NSA's only solution be to ask Congress to restore bulk collection so it can go back to doing this for itself? Secure multiparty computation provides an alternative. It would permit the NSA to find the records that it needs by posing an encrypted question to an encrypted database maintained by the telephone companies. The NSA would learn nothing about data that it did not need. The telephone companies would learn nothing about the NSA's queries.

Using such techniques would provide at least some of the benefits of bulk collection, without the cost to privacy. They are only effective if they can be made efficient and can work on a large scale. As early as 2008, there was a demonstration of large scale, real-world use of secure multiparty computation that permitted participants in the Danish sugar-beet market to agree on a pricing scheme. In 2014, computer scientists proposed a scalable system using secure two-party computation, "Blind Seer", that could be deployed by an agency like the NSA with little cost to efficiency. [START_REF] Pappas | Blind Seer: A Scalable Private DBMS[END_REF] IARPA funded the research on "Blind Seer".

The government has known about privacy enhancing technologies for many years -as we have seen, it funded much of the research that has made the use of such techniques practical. Policymakers, however, continue to be largely unaware of the ways in which technology can mitigate trade-offs that may otherwise appear to be unavoidable. The debate over bulk collection and mass surveillance since 2013 has, unfortunately, so far been marked by a missed opportunity to "have our cake and eat it too".

Online Identity

Surveillance is not the only problem in which ignorance of technology is potentially dangerous to privacy. In Obama's cybersecurity address of 2009, he announced that he would propose an ambitious strategy to facilitate a more secure and effective system of online identity management. We worked on the strategy for two years. In 2011, the White House released its "National Strategy for Trusted Identities in Cyberspace" (NSTIC), a plan to create a secure "identity ecosystem", led by the private sector. A major goal of the NSTIC initiative is to move away from passwords to more reliable forms of identity management, allowing people to engage in transactions that requires higher levels of identity assurance. [START_REF] House | National Strategy for Trusted Identities in Cyberspace[END_REF] The Commerce Department has taken the lead on implementing NSTIC, launching a dialogue with companies and other stakeholders. NSTIC has significant privacy implications. A system of online identity could pose a real threat to privacy, especially if it permits companies or the government more easily to link together all of a user's individual Internet activities and transactions.

NSTIC contains ambitious privacy goals. NSTIC calls for "privacy-enhancing technical standards" that "minimize the transmission of unnecessary information", allowing transactions that are "anonymous, anonymous with validated attributes, pseudonymous, and uniquely identified." The drafters of NSTIC were aware of the work on "anonymous credentials" by Jan Camenisch and Anna Lysyanskaya and other computer scientists. Anonymous credentials employ zero-knowledge proofs to allow the holder of a credential to validate the attributes that another party needs to complete a transaction online without revealing anything more (see e.g. [START_REF] Camenisch | An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation[END_REF]; an excellent non-technical explanation can be found in [START_REF] Lysyanskaya | Cryptography: How To Keep Your Secrets Safe[END_REF]).

While NSTIC did not proscribe a specific technical solution, fully realizing its privacy goals would require the use of anonymous credentials. The alternative is to trust an "identity provider" to validate online transactions. Initial NSTIC pilots, however, appear to be following the "trusted third party" model. One start-up, "ID.me", touts itself as a "trusted intermediary" for verifying identity. The founders of ID.me are featured on the government's NSTIC website meeting with President Obama. Even if third parties such as ID.me have excellent privacy policies, consumers are being asked to trust yet another entity with their private information. [21,[START_REF]me Digital Credentials Now Accepted Across Government Websites[END_REF] As with surveillance reform, the implementation of the Obama administration's online privacy strategy has so far missed an opportunity to make use of an innovative technology that could enhance privacy. Instead, policymakers and businesses are insisting on trade-offs that we do not have to make.

Ignorance of Technology Is No Excuse!

Ignorantia juris non excusat. "Ignorance of the law excuses not" is an ancient principle that prevents the guilty from escaping the consequences of flouting society's laws.

The law has proven to be a less-than-ideal guardian of our privacy. A contributing factor to the failure of law and policy has been the ignorance of lawmakers and policymakers about innovative privacy-enhancing technologies. If we want to preserve our privacy, we must adopt a new principle -ignorance of technology is no excuse! While the reasons for such ignorance are not entirely clear, the most likely explanation may be the loose and inconsistent rules that have allowed, at least in the United States, broad public and private sector use of large databases containing personal information without technical safeguards. If the use of privacy-enhancing technologies is regarded not as a necessary precondition for the use of such data, but only as a matter of academic interest, there is little reason for policymakers to become familiar with them. Compounding the problem, even informed and motivated policymakers may not know what questions to ask. Many privacy-enhancing technologies offer capabilities that are not obvious and may appear like magic to non-specialists.

The time has come for privacy-minded academics and advocates to evangelize on behalf of the benefits of privacy-enhancing technologies to a much broader audience. Privacy advocacy should move away from bemoaning the death of privacy towards offering a vision that breathes life into privacy.

As the performance of a "Requiem for Edward Snowden" was able to capture in image and music, we are at a crucial moment -a moment that calls for a revolution in privacy. If we fail to take stronger steps to accelerate real-world deployment of innovative solutions for preserving privacy, its legacy may best be celebrated by a singing a requiem for privacy -whatever the fate of the former NSA contractor hiding out in Moscow.


James S Welsh

Graham C Goodwin

Hugues Garnier

A SIMPLE METHOD FOR BIAS REDUCTION IN TIME DOMAIN LEAST SQUARES PARAMETER ESTIMATION

Keywords: Least Squares, Time Domain, Parameter Estimation

This paper examines the issue of bias that arises, in particular when applying a traditional continuous-time model identification technique to resonant systems. We propose a method to reduce the impact of this bias by pre-processing the data. This new method requires no knowledge of the noise colouring. An example is presented that shows the superior performance of the proposed method over that of a traditional method.

INTRODUCTION

Due to its simplicity and a reasonably fast rate of convergence, the least squares method of parameter estimation is widely adopted in system identification [START_REF] Hsia | System Identification -Least Squares Methods[END_REF][START_REF] Strejc | Least squares parameter estimation[END_REF][START_REF] Zhao | A new bias-compensating ls method for continuous system identification in the presence of coloured noise[END_REF]. However, it is well known [START_REF] Goodwin | Dynamic System Identification: Experiment Design and Data Analysis[END_REF][START_REF] Stoica | Bias correction in least-squares identification[END_REF] that the least squares parameter estimation method is generally biased and hence doesn't provide a consistent estimate of the parameters when the input and/or output signal is contaminated with noise.

A number of methods exist which compensate for the bias in the estimates [START_REF] Sagara | On-line modified least-squares parameter estimation of linear discrete dynamic systems[END_REF][START_REF] Stoica | Bias correction in least-squares identification[END_REF][START_REF] Sakrison | The use of stochastic approximation to solve the system identification problem[END_REF]. Early methods of bias compensation were primarily based on subtracting the bias from the least squares algorithm. [START_REF] Sakrison | The use of stochastic approximation to solve the system identification problem[END_REF] proposed a method based on stochastic approximation to correct a mean-square equation error criterion utilising knowledge of the input/output noise variances. A methodology similar to this was described in [START_REF] Furuta | On the identification of time-invariant discrete processes[END_REF] where the noise variances themselves were unknown but their ratio assumed known. In contrast to this a recursive scheme [START_REF] Sagara | On-line modified least-squares parameter estimation of linear discrete dynamic systems[END_REF] was developed such that when the output was corrupted by unknown additive noise a consistent estimator is obtained by recursively estimating the noise variance and utilising it in a recursive least squares algorithm. This scheme is commonly referred to as Compensated Least Squares. Asymptotic accuracy of this algorithm was comprehensively studied in [START_REF] Stoica | Bias correction in least-squares identification[END_REF].

A multi-step bias compensating least squares identification method for continuous time systems has also been developed [START_REF] Zhao | A new bias-compensating ls method for continuous system identification in the presence of coloured noise[END_REF]. In this method the plant model is augmented with a pre-filter, with distinct characteristic roots. Parameters are then estimated for the augmented system. A linear transformation is next performed to obtain the desired model parameters. Parameter estimation accuracy in this method depends significantly on a heuristic choice of the pre-filter. To avoid this somewhat arbitrary choice of pre-filter it was proposed [START_REF] Nguyen | A new bias-compensating least squares method for identification of stochastic linear systems in presence of coloured noise[END_REF] to utilise the filter provided by the classical generalised least squares method. Further to this it was established [START_REF] Stoica | Study of a bias-free least squares parameter estimator[END_REF] that these methods actually belong to a class of weighted instrumental variable estimators.

More recently an algorithm known as direct Bias-Eliminated Least-Squares (BELS) was proposed [START_REF] Zheng | On a least-squares-based algorithm for identification of stochastic linear systems[END_REF]. This method again is a multistep procedure which does not involve a pre-filtering step. Instead it estimates the cross covariance directly and uses this estimate to obtain an unbiased parameter estimate. Once again it has been shown that this algorithm is equivalent to a simple instrumental variables estimator with the instruments being delayed inputs [START_REF] Söderström | Comments on "on a least-squares-based algorithm for identification of stochastic linear systems[END_REF]. Further refinement of the BELS method, when applied specifically to ARMAX model structures, has been examined and the relationship with IV methods explored [START_REF] Zheng | A revisit to least-squares parameter estimation fo armax systems[END_REF].

It has been recently suggested that bias may be particulary bad when applied to resonant systems. From a practical point of view these particular systems are found in many applications. For example, many mechatronic systems exhibit resonant behaviour (see for example [START_REF] Akcay | Orthonormal basis functions for modelling continuous-time systems[END_REF], [START_REF] Moheimani | Experimental verification of the corrected transfer function of a piezoelevtric laminate beam[END_REF]). Control of such systems typically relies upon the availability of high precision models. Now, in principle, such models could be obtained from phenomenological considerations but usually this type of model is too complex to be accurately described using physical parameters. Hence, one needs to obtain reliable models using data collected from the system. Pre-filtering of data for use in parameter estimation is not a new concept as seen from the above discussion. It has also been used in the past to focus the parameter estimate over a desired bandwidth [START_REF] Ljung | System Identification: Theory for the User[END_REF]. This paper is aimed at reducing the bias associated with the estimation of continuous-time systems using least squares. In particular we develop this method for a specific set of systems, namely resonant systems. Bias is often analysed by looking at correlations between regressors and noise. However, a better idea may be to simply use the asymptotic expression for the least squares cost function. We explore this idea here. We further assume that a deterministic input is applied to the open loop system consisting of energy at specific frequencies only. In contrast to the previous mentioned methods we then develop a relatively simple method to reduce the bias based on pre-filtering which is based on knowledge of the input frequencies.

We use Monte Carlo simulations to highlight the effectiveness of the proposed filters on the least squares estimator and contrast the performance with a simple instrumental variables estimator.

The remainder of the paper is organised in the following way. In section 2 we outline a simple method of identifying the coefficients of differential equations using time domain data. Section 3 examines the potential source of bias in the estimate. In section 4 we show how the effect of bias can be reduced by appropriate pre-filtering. In section 5 we provide simulation results which show the effectiveness of the proposed filtering and demonstrate that the method presented here has performance comparable to a simple instrumental variables method. Finally in section 6 we draw conclusions.

IDENTIFICATION IN THE TIME DOMAIN

Consider a single-input single-output continuous-time linear time-invariant causal system whose input u(t) and output y(t) are related by a constant coefficient differential equation of order n,

y (n) (t) + a n-1 y (n-1) (t) + . . . + a 0 y (0) (t) = b m u (m) (t) + . . . + b 0 u (0) (t) (1)
where x (i) (t) denotes the ith time-derivative of the continuous-time signal x(t).

Equation ( 1) can be written as

A(p)y(t) = B(p)u(t), (2)
with

B(p) = b m p m + • • • + b 1 p + b 0 , A(p) = p n + a n-1 p n-1 + • • • + a 1 p + a 0 , n ≥ m,
where p is the differential operator, i.e. px(t) = dx(t) dt . The polynomials A(p) and B(p) are assumed to be relatively prime and the roots of the polynomial A(p) are assumed to have negative real parts, hence the system under study is asymptotically stable. It is also assumed that the continuous-time signals u(t) and y(t) are sampled at a regular time interval, T s . The sampled signals are denoted as {u(t k ); y(t k )}.

Furthermore the system is assumed to be subject to an arbitrary set of initial conditions

u 0 = u(0) u (1) (0) • • • u (m-1) (0) , y 0 = y(0) y (1) (0) • • • y (n-1) (0) .
The identification problem is to then estimate the coefficients of the differential equation model from N sampled measurements of the input and output,

Z N = {u(t k ); y(t k )} N k=1 .
The literature essentially describes two time-domain approaches to estimate a continuous-time model from discrete-time data. The first is to estimate from the sampled data, a discrete-time model and then convert it into a continuous-time model. The second consists of identifying directly a continuous-time model from the discrete-time data. In this paper we consider the second approach. We note that by taking this approach the differential equation model is not a linear combination of the sampled process input and output signals, i.e. it contains time-derivative terms which are not available as measurement data in most practical cases.

Various types of methods have been devised to deal with the need to reconstruct these time-derivatives. One early approach [START_REF] Young | In flight dynamic checkouta discussion[END_REF] is known as the state variable filter (SVF) method. Due to the simplicity of this method we utilise it here for the purpose of demonstrating the benefits of the proposed method of bias reduction.

The State Variable Filter Approach

Consider the Laplace transform of the differential equation as defined in (1),

A(s)Y (s) = B(s)U (s) + C(s), (3)
with

C(s) = c n-1 s n-1 + • • • + c 1 s + c 0 (4)
where s represents the Laplace variable and Y (s) and U (s) are the Laplace transforms of y(t) and u(t) respectively. The coefficients c i depend on the unknown parameters a i and b i as well as the unknown initial conditions. Assume that a filter has a Laplace transform L(s) = 1/E(s) where all the zeros of E(s) lie in the left half plane. Applying this filter to both sides of (3) yields

A(s) E(s) Y (s) = B(s) E(s) U (s) + C(s) E(s) , (5)
or

s n E(s) Y (s) + n-1 i=0 a i s i E(s) Y (s) = m i=0 b i s i E(s) U (s) + n-1 i=0 c i s i E(s) . ( 6
)
The minimum-order SVF filter is typically chosen to have the following form

L(s) = 1 E(s) = p n s + p n n (7)
where p n is the breakpoint frequency. This latter quantity can be chosen in order to emphasize the frequency band of interest and it is advised, in general, to choose it slightly larger than the bandwidth of the system to be identified [START_REF] Young | In flight dynamic checkouta discussion[END_REF]. Let L k (s), for k = 0, 1, 2, . . . , n, be a set of filters defined as

L k (s) = s k E(s) = (p n ) n s k (s + p n ) n (8)
and l k (t) be their corresponding functions in the timedomain. By using the filters defined in (8), equation (6) can be rewritten as

L n (s) + a n-1 L n-1 (s) + . . . + a 0 L 0 (s) Y (s) = b m L m (s) + . . . + b 0 L 0 (s) U (s) + c n-1 L n-1 (s) + . . . + c 0 L 0 (s) . (9)
In terms of time-domain signals, (9) can be written as

[L n y](t) + a n-1 [L n-1 y](t) + . . . + a 0 [L 0 y](t) = b m [L m u](t) + . . . + b 0 [L 0 u](t) +c n-1 l n-1 (t) + . . . + c 0 l 0 (t) (10)
where

[L i y](t) = l i (t) * y(t) [L i u](t) = l i (t) * u(t)
and * denotes the convolution operator. The filter outputs [L i y] and [L i u] provide the time-derivatives of the inputs and outputs in the frequency band of interest. These may then be exploited for linear regression and other parameter estimation techniques.

At time-instant t = t k , equation ( 10) can be rewritten in standard linear regression form as

[L n y](t k ) = φ T (t k )θ (11)
where

φ T (t k ) = -[L n-1 y](t k ) . . . -[L 0 y](t k ) [L m u](t k ) . . . [L 0 u](t k ) l n-1 (t k ) . . . l 0 (t k ) (12) θ = [a n-1 . . . a 0 b m . . . b 0 c n-1 . . . c 0 ] T . (13)
Now, from N samples of the input and output signals observed at discrete times t 1 , . . . , t N , the least-squares (LS)-based SVF estimates are given by

θN = N k=1 φ(t k )φ T (t k ) -1 N k=1 φ(t k ) [L n y](t k ).
It is also noted that the SVF technique can also be associated with a basic instrumental variable (IV) method when the output signal is contaminated with noise (Garnier et al., 2003b).

The SVF approach also makes it possible to estimate the initial condition terms c i along with the model parameters. However, treating them as an additional set of unknowns does add complexity to the parameter estimation. From (10), it can be seen that although the initial condition terms do not vanish, the impulse responses of the low-pass filters decay exponentially and hence become insignificant quite quickly. Thus, if the SVF-based algorithm is used with a large observation time T , the terms related to the initial conditions may be neglected after a time T 0 = k 0 T s . The parameter estimation algorithm is then applied over [T 0 , T ], where T 0 is chosen comparable to the settling time of the filter (7). The number of parameters to be estimated can, in this way, be reduced substantially which is advantageous with regard to computation effort and numerical properties.

Since only the sampled versions of the continuoustime signals are available, the output of the statevariable filters is computed from a discrete approximation. This problem is well known and should be treated in a proper manner since errors generated by the digital implementation can have a significant influence on the quality of the estimated model [START_REF] Chou | Continuous-time identification of SISO systems using Laguerre functions[END_REF]. Using a control canonical form, the state-space representations of the continuous-time SVF filter can be either integrated by the Runge-Kutta method or discretized by using an appropriate method provided the intersample nature of the continuous-time input signal is known.

BIAS IN THE LEAST SQUARES ESTIMATOR

Typically the issue of bias in the least squares estimator is examined through the correlations between the regressors and the noise. Here, however, we take a different tact and use the asymptotic expression for the least squares estimator to observe the impact of bias. To set up the appropriate formalism,, we assume the system is described by the model,

y(t) = G o (p)u(t) + H o (p)w(t) (14)
where G o (p), H o (p) are linear transfer functions, w(t) white noise and u(t) some input.

Next, we parameterise G o (p) by the linear fractional model,

G o (p) = B(p)/E(p) A(p)/E(p) . ( 15
)
The least squares cost function can then be written as

J(θ) = 1 N N k=1 Â(p) E(p) y(t k ) - B (p) E(p) u(t k ) 2 (16)
where u(t k ) and y(t k ) are the sampled input and output signals respectively.

From Parseval's Theorem, the cost function in ( 16) converges asymptotically to

J(θ) = π -π Â(jω) E(jω) Y (ω) - B(jω) E(jω) U (ω) 2 dω .
(17) Substituting ( 14) into (17) we have,

J(θ) = π -π Â(jω) E(jω) [G o (jω)U (ω) + H o (jω)W (ω)] - B(jω) E(jω) U (ω) 2 dω . ( 18
)
We assume the system operates in open loop. Hence U (ω) and W (ω) will be orthogonal. This allows us to rewrite (18) as

J(θ) = π -π Â(jω) E(jω) G o (jω) - B(jω) E(jω) 2 φ uu (ω)dω + d n π -π Â(jω) E(jω) H o (jω) 2 dω (19)
where φ uu (ω) is the input spectral density and d n is the driving white noise spectral density.

It can be clearly seen from ( 19) that the second term is a potential source of bias for the least squares estimator. To examine this further with the view of treating this problem we proceed as follows. Firstly, we expand the second term in (19) as,

Â(jω) E(jω) H o (jω) = 1 + Λ(jω) . (20)
Equation ( 19) then becomes,

J(θ) = π -π Â(jω) E(jω) G o (jω) - B(jω) E(jω) 2 φ uu (ω)dω + 2πd n + d n π -π Λ(jω) 2 dω (21)
or more simply,

J(θ) = π -π Â(jω) E(jω) G o (jω) - B(jω) E(jω) 2 φ uu (ω)dω + 2πd n + d n π -π Â(jω) E(jω) H o (jω) -1 2 dω = π -π Â(jω) E(jω) 2 G o (jω) - B(jω) Â(jω) 2 φ uu (ω)dω + 2πd n + d n π -π Â(jω) E(jω) 2 H o (jω) - E(jω) Â(jω) 2 dω. ( 22
)
It is then obvious that if we can choose

E(s) Â(s) = H o (s) , ( 23
)
then irrespective of the presence of noise, the cost function will minimise a weighted error between G o and the parameter estimate B Â .

The presence of the  E 2 in this weighting is interesting.

Our principle concern here will be with resonant systems. Therefore the estimate B Â might take the form,

Ĝ(s) = n i=1 2ξ i ω i s s 2 + 2ξ i ω i s + ω 2 i . (24)
A key point to note here is that if

 ≃ A o , then Â(s) = n i=1 s 2 + 2ξ i ω i s + ω 2 i . (25)
Now obviously, this is very small at the resonant peaks. Therefore if undermodelling exists, the fit will be quite insensitive to the model at these resonant peaks.

PRE-PROCESSING TO MITIGATE BIAS ERRORS

The second term on the right hand side of ( 19) indicates that if we could make  E ≃ 0, then we would remove the noise term related to the colouring of the noise and hence eliminate bias. When identifying a system in practice, a common situation is that φ uu (ω) will be 'periodic' or composed of a multi-sine test signal. In this case, there is no penalty in eliminating the noise that is not "near" an input frequency. In particular, we propose to pre-filter y(t) and u(t) with bandpass filters having their centre frequencies at the input test signal frequencies.

Say that the input frequencies are f 1 , ...., f m (rad/sec). Then a suitable choice for the pre-filter would be,

F (s) = m i=1 2 ξi f i s s 2 + 2 ξi f i s + f 2 i . ( 26
)
We next examine different aspects of the proposed pre-filter in a heuristic sense.

The transient time of the filterF (s) is of the order of 1/ ξ. Hence, (i) We want ξ 'large' to minimise the filter transient, but (ii) The noise that 'leaks' through the filter will be of the order of ξ × noise spectral density at f i . This suggests we should set ξ as small as possible. (iii) Obviously the data length sets a lower limit on ξ in view of point (i).

Application of the Pre-filter

We next examine the effect of pre-filtering the data with the proposed filters on the cost of the least squares estimator.

Filtering the input/output data with the pre-filter given in ( 26), allows us to approximate the cost function ( 22) as follows,

J ≃ m i=1 Âi E i 2 G oi - Bi Âi 2 P i + Âi E i 2 ξi 2 S i (27
) where S i is the noise spectral density in the vicinity of f i and P i is the input energy at f i .

As expected, we see that the bias is only a function of the 'system, model and noise' at the test signal frequencies. Indeed, we see that all we need do is to ensure that P i >> ξi 2 S i to reduce bias due to noise.

Rapprochement with Frequency Domain

Of course, the above idea finds a direct link to the frequency domain. Indeed, Fourier Analysis simply correlates {y k } and {u k } with cos f i t and sin f i t. This is basically what is achieved by the filter (26). Hence, this work simply implies we can capture one of the advantages of the frequency domain when working in the time domain.

SIMULATION EXAMPLES

In this section we verify the results from section 4.1. Specifically we show that the proposed method, although simple, works well to reduce the effect of bias on the estimate obtained using a least squares estimator. In particular we use the standard least squares state variable filter (lssvf) method found in the The CONtinuous-Time System IDentification (CONTSID) toolbox (Garnier et al., 2003a). We also show that the results obtained are, at least, as good as those obtained using an instrumental variables estimator.

We consider the true plant to be

G o = 0.4s s 2 + 0.4s + 4 , (28)
and excite the system using a multisine signal with each frequency component having the the same amplitude. The chosen frequencies for the simulation are ω = [0.5, 1, 2, 3] rad/sec. The sampling period was 0.005 seconds. Monte Carlo studies were conducted where each simulation was repeated 2000 times. The results were averaged and plotted. The signal to noise ratio (SNR) for the simulations was -20dB/decade. The effect of varying the damping (the quality factor) of the bandpass filters on the estimate was also examined.

We perform several sets of simulations. Firstly, we estimate the parameters using the lssvf method when no noise is present. We then carry out a Monte Carlo study using the lssvf method but in the presence of the noise as specified above. Finally, for different values of damping (ξ ∈ [0.001, 0.01, 0.1, 1]) in the bandpass pre-filters (given by equation ( 26) ) we observe the effect on the bias. Note that as we have 4 test frequencies we also have 4 bandpass filters. Figure 1 shows the bode plot for the case where the damping, ξ = 0.001.

We first observe from Table 1 that when noise is absent (lssvf (no noise)) then the parameter estimates are an accurate representation of the actual system parameters. With output noise present it is seen from Table 1 and the bode plots in Figures 2 5 that the lssvf method performs poorly. By pre-filtering the data it is observed that the estimates are significantly improved.

In particular with the small value of damping (ξ = 0.001) the estimates are as good as those obtained when no noise is present. This is shown in the both the results in Table 1 and Figures 2 5. For completeness the standard deviation for the parameter estimates are given in Table 2.

CONCLUSION

Using the asymptotic expressions for the least squares cost function we can see that the source of the bias in a least squares estimator is due to the colouring of the noise. In this paper we have shown that, when the input consists of multisines, it is possible to significantly reduce the bias by simply pre-filtering the data. Simulations studies have shown the method to work well and produce results that are comparable to those obtained using instrumental variables.

Fig. 1 .

 1 Fig. 1. Bode Plot of Filter F(s), with ξ = 0.001, centred around the test frequencies.

Fig. 2 .

 2 Fig. 2. Bode Plot of systems for N=2000, ξ = 0.001.

Fig. 3 .Fig. 4 .Fig. 5 .

 345 Fig. 3. Bode Plot of systems for N=2000, ξ = 0.01.

Table 1 .

 1 Mean value of 2000 estimates

	Method		ξ	b 1	bo	a 1	ao
	True			0.4	0	0.4	4
	lssvf (no noise)			0.400	0	0.4	4
	lssvf			0.246 -0.002 0.007 3.923
	lssvf (pre-filtered)	0.001 0.398 -0.001 0.393 3.983
	lssvf (pre-filtered)	0.01	0.375 -0.013 0.339 3.853
	lssvf (pre-filtered)	0.1	0.299 -0.051 0.155 3.603
	lssvf (pre-filtered)	1	0.254 -0.107 0.076 3.314
	Table 2. Standard Deviation of 2000 esti-
				mates
	Method	ξ		b 1	bo	a 1	ao
	lssvf	0.001	0.044	0.079 0.009 0.121
	lssvf filtered	0.001	0.052	0.075 0.054 0.086
	lssvf filtered	0.01	0.058	0.083 0.055 0.097
	lssvf filtered	0.1	0.0486 0.074 0.026 0.099
	lssvf filtered	1		0.038	0.064 0.013 0.082