Articles

Previous entries

No Identification Without Representation: Constraints on the Use of Biometric Identification Systems

May 9th, 2012 | By | Category: Articles

The tourist hoping to use her credit card in any part of the globe, the asylum seeker hoping to access social benefits in her host country, the banker hoping to move money from one stock market to another in real time—all have the same need. They must prove their identities and be certain of others’. Traditional means of proving identities are not dependable enough in most parts of the world and hence unfit for global digital networks. In this context, biometrics appears to offer a viable technological solution. However, the technology itself is subject to popular critique, warning of dystopian futures of overwhelming surveillance and loss of privacy.

 

By: Emilio Mordini, Andrew P. Rebera

Article first published online: 19 JAN 2012 DOI: 10.1111/j.1541-1338.2011.00535.x

Abstract

The human species is again becoming nomadic. Each year, about two billion persons move across large geographic distances (not to mention people in “virtual mobility” through information and communication technology). Many of these people have weak or unreliable identification documents—and many poorer people in developing countries do not even have these documents. In 2000, the United Nations Children’s Fund (UNICEF) calculated that 50 million babies (41% of births worldwide) were not registered at birth. In this scenario, a personal identification scheme based on birth registration and state-issued passports is less and less tenable. Biometrics appears to offer a viable technological solution. However, the technology itself is subject to popular critique, warning of dystopian futures of overwhelming surveillance and loss of privacy. The best answer to those who fear an Orwellian future is to engage with the technology and seek to ensure that biometric identification systems are developed in positive ways. We suggest that identification schemes become problematic when the reciprocity of identification goes unnoticed, forgotten, or (what is worse) is intentionally bypassed. The dynamics of identification should be reciprocal, dialogical, and involving mutual recognition. In the traditional political domain, this is the recognition by the state of a citizen and by the citizen of the state. In the digital age, identification systems must increasingly transcend geopolitical borders. A globally recognized identification scheme is therefore a necessity. However, it is merely the nature of the borders that has changed here—not the nature of identification. Our call will be: no identification without representation.

1. Introduction

The development of methods for establishing, communicating, and authenticating the identity of individuals has been driven by a number of factors, not least the desire of governments to efficiently exercise power over their subjects. No doubt this was spurred by the development of concepts of the state, the individual, the citizen (and so forth). The modern state presupposes, in addition to technologies of identification, the “creation of a [. . .] people open to the scrutiny of officialdom” (Caplan & Torpey, 2001, p. 1).

That the need for reliable methods of identification arose at all is presumably connected with the birth of the first urban societies during the so-called “Neolithic Revolution” (Childe, 1950). At this point, the human species, hitherto nomadic, began to settle down (so to speak). Societies developed robust geographical roots, population densities increased, and social hierarchies developed. Growing societal complexity, alongside developments in artisanship and intrasocietal and intersocietal trade, would have made the identification of the trustworthy—as well as the detection of the untrustworthy—increasingly vital to the normal functioning of these early societies.

Of course it remains true that the major interventions of the state into the lives of its subjects—e.g., taxation, conscription, and the administration of authority/justice—need not proceed at the level of the individual. The necessity for individual identification is less severe when taxes, conscription, and so on are imposed collectively (Caplan & Torpey, 2001, p. 1). Specific individual identification has been more closely tied up with mass literacy and increased state bureaucracy (Goody, 1986). The Roman Empire, which was the first cosmopolitan society in the West, provided the first example of a universal identification system through a tripartite codified name scheme. In Europe during the Middle Ages, individuals were chiefly identified through passes and safe conducts issued by religious and civil authorities. Seals and handwriting mainly enforced the authenticity of these documents. The Modern era, which saw increased mobility associated with urbanization and industrialization, required more effective recognition schemes. These were administered by nation states. Indeed, the development of more robust identification schemes has to some extent progressed in parallel with the development of post-Westphalian polities, marking the passage from feudal to industrial society. Thus, as Valentin Groebner (2001, p. 16) notes: “by the beginning of the eighteenth century, the failure to carry [documents of origin and identity] while travelling was already an offense that could attract considerable penalties.”

After World War I, most European countries introduced systems of identity cards, incorporating facial photography (and, in some cases, also fingerprinting), as a tool for identifying people within their state borders. Yet even in countries where identity cards did not become mandatory, a new powerful driver for personal identification emerged: the need to identify and authenticate people entitled to receive social benefits. The welfare state, which first emerged in Northern Europe after World War II, is based on the provision of services via redistributionist taxation. Taxation and welfare provision both rely on robust and reliable systems of personal identification.

Following the agricultural, industrial, and welfare revolutions, we are now on the verge of a new epochal transition. The human species is again becoming nomadic. Each year, about two billion persons move across large geographic distances (not to mention people in “virtual mobility” through information and communication technology); approximately half cross international boundaries. The International Air Transport Association reported that their members carried 1.6 billion passengers in 2007, among which 699 million flew internationally (International Air Transportation Association, 2010). The United Nations World Tourism Organization (2009) estimated 924 million international tourist arrivals in 2008. International movements for permanent resettlement by immigrants, refugees, or asylum seekers, and temporary movement by migrant workers and others augment the total international movements each year. The International Labour Organization stated that in 2004, an estimated 175 million persons (3% of the world’s population) lived permanently outside their country of birth and that there were 81 million migrant workers (excluding refugees) globally (International Labour Organization, 2004).

Globalization has been characterized by the development of technologies dramatically transcending national control and regulation. This is not without consequence for traditional identification schemes. The globalized world is confronted with a huge mass of people with weak or absent identities. Most developing countries have weak or and unreliable documents—and many poorer people in these countries do not even have these documents. In 2000, UNICEF calculated that 50 million babies (41% of births worldwide) were not registered at birth. In Pakistan, Bangladesh, and Nepal, child registration at birth is not even mandatory. In this scenario, a personal identification scheme based on birth registration and state-issued passports is less and less tenable.

The tourist hoping to use her credit card in any part of the globe, the asylum seeker hoping to access social benefits in her host country, the banker hoping to move money from one stock market to another in real time—all have the same need. They must prove their identities and be certain of others’. Traditional means of proving identities are not dependable enough in most parts of the world and hence unfit for global digital networks. In this context, biometrics appears to offer a viable technological solution. However, the technology itself is subject to popular critique, warning of dystopian futures of overwhelming surveillance and loss of privacy.

For better or worse, biometric technologies are, it would seem, here to stay. The best answer to those who fear an Orwellian future is not merely to provide optimistic reassurances (which rarely reassure anyone) but rather to engage with the technology and seek to ensure that biometric identification systems are developed in positive ways. Our aim in this article is to articulate the positive potential of biometric identification schemes.

Orwellian fears are not unjustified, as we shall discuss. However, we will suggest that identification schemes become problematic when the reciprocity of identification goes unnoticed, forgotten, or (what is worse) is intentionally bypassed. The dynamics of identification should be reciprocal, dialogical, and involving mutual recognition. In the traditional political domain, this is the recognition by the state of a citizen and by the citizen of the state. In the digital age, identification systems must increasingly transcend geopolitical borders. A globally recognized identification scheme is therefore a necessity. However, it is merely the nature of the borders that has changed here, not the nature of identification. In this article, we will set out a framework for a system of identification. We begin in the following section by considering some objections to biometric identification systems. We will argue that where the objections are reasonable, this is not specifically attributable to the use of biometrics. We then (section 3) offer a partial defense of biometrics as a desirable candidate for a global identification system in the digital age. We do so by diagnosing the cause of the undesirable consequences associated with biometrics, discussed in section 2. Having identified the root problem, we conclude by proposing a guiding principle for the implementation of a global biometric identification system: no identification without representation.

2. Biometric Identification

Let us suppose that there is a group—relatively small in number—who would prefer that biometric systems of identification were not employed—that the technology had not been developed, or that other less intrusive forms of identification were more robustly suited to the digital age. For the sake of having a name, call this group “the anti-biometrics camp.” (We are speaking hypothetically here but it is not unreasonable to suppose that such a group exists.1) The anti-biometrics camp calls for the outlawing of biometric identification systems, or at least for such severe restrictions as to amount to a de facto outlawing of the technology. We will consider two arguments in the anti-biometrics camp’s arsenal: (i) that the technology is inherently demeaning and (ii) that the technology is a tool of the “surveillance society.”2

(i) Biometrics is Inherently Demeaning

“To identify” is a transitive verb. Correspondingly, the activity of identifying is relational: A identifies B, or, in the present case, Abiometrically identifies B. The question then, is what in this particular relational structure demeans B?

Standard means of gathering biometric data include: fingerprinting, facial scans, iris scans, voice recognition, hand vein recognition, gait analysis, keystroke pattern, and so on. Some of these means, it should be noted, are—if not inherently demeaning—at least conventionally associated with negative connotations. Fingerprinting is a clear example, being primarily associated with criminality (at least in some cultural areas). Furthermore, it is not unreasonable to suppose that most other biometrics—indeed the domain in general—are largely bound up in the popular imagination with criminality and crime detection. This is witnessed by the popularity of television shows centering on forensic pathology and criminology (e.g., CSI in the United States, or Silent Witness in the United Kingdom); while historically speaking, the associations trace back to the pioneers of anthropometrics such as Francis Galton (1822–1911) in the United Kingdom and Alphonse Bertillon (1853–1914) in France.3

In this respect, biometrics has something of an image problem. The problem is only deepened by high-profile examples in which biometrics plays a role—though it should be noted, for this is indicative of the extent of the image problem, that in many of these cases biometrics is incidental to the story.4 In a well-known case, Italian philosopher Georgio Agamben refused to enter the United States in protest at the United States Visitor and Immigrant Status Indicator (US-VISIT) program’s requirement for visitors to be fingerprinted and photographed (Agamben, 2008). In other cases too, U.S. immigration officials have been accused of heavy-handedness. In May 2011, 2000 elderly cruise passengers were fingerprinted and had retina scans during a 7-hour security check (Bloxham & Bingham, 2011); while Amir Khan, boxing’s IBF and WBA World Light Welterweight Champion, has complained of profiling and extensive security checks upon entering and re-entering the United States (Davies, 2011). Similarly, the use of biometrics was reported in connection with the recent controversy concerning the French government and the Roma community (Fraser, 2010). The biometrics connection was that the French authorities recorded biometric details of Roma migrants prior to repatriation. However, the primary newsworthy issue was not the use of biometrics but the alleged profiling of Roma communities, in apparent contravention of the European Union Charter of Fundamental Rights (BBC News, 2010a).

In only one of these cases (Agamben’s) is there any real suggestion that biometric technologies are themselves inherently demeaning. What is demeaning in the other cases is the way in which individuals are treated by the authorities. In the Agamben case, it is claimed that the gathering of biometric data is a form of bio-political tattooing, akin to the tattooing of Jews during the Holocaust. The implications of that association, if sound, are of course horrific. However, it is not entirely clear what Agamben’s argument really is. We will be brief as this is not the place (and even if it were, we have not the space) for detailed discussion. The difficulty is this. Agamben writes:

The problem [. . .] concerns the juridical-political status (it would be simpler, perhaps, to say bio-political) of citizens of the so-called democratic states where we live. [. . .] There has been an attempt the last few years to convince us to accept as the humane and normal dimensions of our existence, practices of control that had always been properly considered inhumane and exceptional. (2008, p. 201)

However, in and of itself, biometric identification is not obviously inhumane or exceptional. At root, biometric identification is nothing more than the identification of an individual by way of their physical or behavioral traits. This is something that we all do every day in normal interactions with our fellows. Here Agamben would probably argue that the body features that we use in everyday life to identify our fellows are biographical signs, embodied languages, “hot” media, which tell the biography of the subject. This is the case with human faces, body gestures, voices, odors, even wrinkles and scars, which are signatures of time on our skin. Biometrics are instead artificial signatures mechanically extracted from our bodies by impersonal technologies. They are “cool” media, which speak of our biology rather than our biography, so depersonalizing the subject. Biometrics—or so Agamben would argue—turn the persona into a bare body that becomessoma, as per the original meaning of this word in ancient Greek (roughly: corpse). However, Agamben would be wrong in two respects. First, the current trend in biometrics is to use more and more “hot” bodily features like face dynamics, gestures, behavioral traits, and so on. Second, the very notion of “bare body” is misleading. Human bodies are never pure bodies, they are always languages that tell stories: even the more remote physical features, even DNA, tell us much more than biological details, as is well illustrated by the huge amount of personal and medical information that can be elicited by any biometric signature (Mordini & Massari, 2008). Hence, it would seem that biometric identification is only inherently demeaning if normal interpersonal relationships are inherently demeaning—and while interpersonal relations can be demeaning, in the vast majority of cases, they are quite the opposite.

There is certainly some truth in what Agamben says, although we would suggest that he has mislocated it. As he says, this is a problem of juridical-political status—of bio-power relations; however, the core problem is not of biometrics. We can explore this by considering a response one might offer on behalf of the anti-biometrics camp. The analogy between identification in the sphere of interpersonal relationships and biometric identification is, the response goes, fundamentally flawed. True, normal interpersonal relationships are not demeaning, but then again one’s relationship to biometric identification devices—say, fingerprint scanners—is not interpersonal: fingerprint scanners are not persons, and our relations to them are not analogous to our relations to people. This is an important point with which we entirely agree.

Notice however that it does not support Agamben’s position. Agamben evokes Foucault, alluding to “a new bio-political era” (Agamben, 2008, p. 201). Foucault had articulated biopower as a “set of mechanisms through which the basic biological features of the human species became the object of a political strategy, of a general strategy of power” (Foucault, 2009, p. 1). However, he also pointed out that his analysis of the mechanisms of power involved, inter alia, investigating “between whom” (Foucault, 2009, p. 2) power is applied—that is to say (although Foucault may not have put it this way) that the power relations here are, in the final analysis, personal.5 So what is objectionable about U.S. immigration procedure is not, pace Agamben, the use of biometrics per se; rather, it is the way that they are deployed as an arbiter and medium of interpersonal relations.

(ii) Biometrics as a Tool of the “Surveillance Society”

Just as it would be wrong to suppose that biometric identification is in itself demeaning, so it would be wrong to suppose that biometric identification systems are inevitably geared toward surveillance. Or rather, it would be wrong to suppose that they are any more inevitably geared toward surveillance than are other forms of identification (any means of identification—biometrics, passports, proper names—can be used to keep track of an individual). However, the concerns regarding surveillance are perhaps more tangible than those discussed above, for the signs of surveillance are, in a physical sense, all around us.

The iconic technology of the surveillance society is probably the closed-circuit TV camera. Popular statistical folklore has it that there is one CCTV camera for every 14 British citizens and that the average Briton is caught on CCTV 300 times a day.6 In combination with CCTV, biometric identification technologies open the door to an enormous potential for surveillance. Facial recognition technology is the obvious candidate here, although recent work on identification by gait pattern has great potential too. As surveillance—spurred mainly by developments in biometrics—becomes increasingly automated, it inevitably becomes less and less focused. That is to say, we are not now dealing solely with the surveillance of antecedently identified suspects, but with the mass surveillance of society with the aim of identifying the suspicious among us. As an illustration of the dangers here, consider the use of search warrants. If authorities wish to search someone’s property, they need a warrant, which will, if all is working well, be issued only if sufficient evidentiary justification of reasonable suspicion can be produced. However, compare the surveillance of the 2001 Super Bowl. This measure identified, from a crowd of 100,000, just 19 individuals with criminal records. To have a criminal record is not a crime. And in a civilized country, to have a criminal record could not be considered sufficient evidentiary justification of reasonable suspicion that one might commit some (unspecified) crime. There is, it would seem, cause for concern here.

In the West, the United Kingdom and the United States have particularly poor records in this regard. In 2007, Privacy International rated the United Kingdom the worst performing European Union (EU) state in terms of privacy protection and surveillance, categorizing it alongside the United States, China, and Russia as “endemic surveillance societies” (Privacy International, 2007). The dangers have not gone unrecognized. In its response to the House of Commons’ Home Affairs Committee’s report, “A Surveillance Society” (Home Affairs Committee, 2008), the UK Government articulated a number of commitments to increase data minimization and protection and to ensure balance, responsibility, and transparency in the employment of surveillance technologies (Secretary of State for the Home Department, 2008). This was a welcome pronouncement in the light of Privacy International’s findings. (By 2010, the United Kingdom’s ranking had been downgraded from “endemic” to merely “extensive” surveillance [Privacy International, 2010]. This is better but still not good.)

Orwellian fears of all-pervasive surveillance are exacerbated by a number of factors. As mentioned above, developments in biometric technologies mean that identification can increasingly take place at a distance, via gait, for example (BBC News, 2010b). Second, biometrics and surveillance are increasingly commercial domains and, through public–private interaction, this can give rise to the impression that responsibility for good practice is passed from directly elected, and hence accountable, public officials, to businessmen and executives, whose primary goals are not best practice but profit, and whose responsibilities are to shareholders first, citizens second. (Note that this is not an objection to commercialization or the private sector in general; we merely note that different structures of accountability apply in the public and private sectors.) A further concern is with the speed with which new surveillance technologies are implemented—the worry being that insufficient consultation takes place. Examples include the case of the Visionics Corporation, which offered their facial recognition systems to the Tampa Police Department for a year free of charge “in an effort to build a market among municipalities,” prompting the American Civil Liberties Union of Florida to comment that “This is yet another example of technology outpacing the protection of people’s civil liberties” (Canedy, 2001). While in the United Kingdom, biometrics and CCTV in schools have been a cause of consternation. The Guardian, to give just one example, recently carried a story reporting various problematic cases of CCTV in schools (not only in classrooms but also in the bathrooms). A teachers’ union officer is reported to have commented: “There are lots of schools that install CCTV and don’t know the rules—and the companies who supply it don’t feel the need to tell them” (Harris, 2011).

Whatever may be the facts of the cases mentioned above, the fears are real. And the retort that if you have nothing to hide you have nothing to fear does not hold water. Privacy, secrecy, and freedom from surveillance have no necessary connection with shame or wrongdoing (Bok, 1989). Moreover, as the example of Brandon Mayfield (who was wrongly connected to the 2004 Madrid bombings on the basis of a false-positive fingerprint match) attests, it may well happen that you have nothing to hide but everything to fear; Mayfield was arrested, imprisoned, and claims to have been threatened with the death penalty. Eventually the U.S. government agreed to compensate him to the tune of $2 million (Eggen, 2006).

Fears of a surveillance society are not, then, unjustified. However, to reiterate, as with the objection in section (i), there is no necessaryconnection between biometrics and surveillance. The anti-biometrics camp is, we argue, misguided. Their position is vulnerable to two telling objections. First, in practical terms, their proposal is extremely unrealistic. The biometrics industry is well established: it has gained much support at governmental level (if not at public level), and although the technology is not flawless, it is advancing rapidly and appears to be the most likely candidate for a global identification system in the digital age. Second, the anti-biometrics camp misconstrues the conceptual link between biometrics and the potential undesirable consequences (individuals being demeaned and subject to surveillance) mentioned above. The source of the trouble is not, we will claim, biometric identification systems themselves but the way in which they are implemented.

3. Biometric Identification as a Reciprocal Relation

In this section, we make a partial defense of biometrics as a desirable candidate for a global identification system in the digital age, diagnosing the cause of the undesirable consequences associated with biometrics, as discussed above. Having identified the root problem, we will conclude by proposing a guiding principle for the implementation of a global identification system based on biometrics:no identification without representation.

Are biometric identification schemes desirable? We think they can be, if suitably regulated. As described above, biometrics can lead to bad outcomes. However, that does not seem to be a solid reason for opposing them. Consider the following analogy (or rather:disanalogy). The anti-biometrics camp associates biometrics with a number of undesirable consequences and argues that since the consequences are so undesirable, the benefits of biometrics do not outweigh the risks: therefore, biometrics should be outlawed. Compare the controversy in the United States over the Second Amendment right to bear arms.

“Guns don’t kill people, people kill people,” or so the bumper sticker goes. There is a clear—but limited—sense in which this is obviously true: guns do not normally kill people unless somebody pulls the trigger (and notice that we do not normally punish the gun). However, as the comedian Eddie Izzard notes, “If you just stood there and yelled BANG, I don’t think you’d kill too many people” (Izzard, Jordan, & Swanson, 2004). When somebody is shot, the gun obviously plays a rather important role: they would not have been shot without it. To oppose restrictions on gun ownership on the basis that guns do not kill people, people kill people, is plainly wrongheaded. Other things being equal, the fewer guns at large, the less likely one is to be a victim of gun crime. Indeed, it is trivially true that if there were no guns—if Mr. Gunpowder had never invented the stuff—there would be no gun crime. Hence, it would seem, abstracting from complexities, that there is a prima facie case to be made for banning guns.7 It is alas true that even if there were no gun crime, there would still be crime and people would still get murdered. However, if there are fewer murders—even just one fewer—that is definitely a good thing.

An evangelical biometrician might adorn her bumper with a sticker reading “biometrics don’t identify people, people identify people” (it is not so catchy as its cousin, but zealotry sees past such trifles). Will the Izzard response work here? It is true that if contemporary automated biometric identification systems did not exist, less identification would occur (for one of the claims of biometrics is that it provides a potential mode of identity management to those who currently have no identity documents at all). So in the absence of biometrics, there would, trivially, be no biometric identification and there would very likely be less identification overall. However, while lowering the murder rate is highly desirable, lowering the identification rate is not desirable. In the developed world, most of us do not want to be without identity management. We need secure identification systems in order to travel, to communicate and transact across the internet, and to claim welfare or tax-relief. We do not want no identification, we simply want a more reliable, less objectionable system than we have at present. And in the developing world, people with weak identity documents need robust alternatives. Thus, the point of this dis-analogy between guns and biometrics is that while shooting people is inherently undesirable, identifying people is not.8

If we accept that identification is desirable and that biometrics are neither inherently demeaning, nor any more geared toward surveillance than other identification systems, it behooves us to investigate biometric identification more carefully. What positives can it bring?

The advantages of biometric identification systems are a function of limitations of more traditional schemes. Mariana Muzzi (2010, p. 2) reports that “Around 51 million births go unregistered every year in developing countries, which translates to one in three children globally.” Recording the identity of these children is important: “Children whose births are not registered at birth are not able to claim the services and protection to which they have a right on a full and equal basis with children who are registered at birth” (Muzzi, 2010, p. 3). That is, one needs to establish one’s identity in order to claim and secure access to one’s rights. This is also the rhetoric behind India’s Unique Identification Number scheme (although what the reality is apart from the rhetoric is a matter of dispute—see, e.g., Ramakumar [2010]). Moreover, it is, to some extent, borne out by the transfer of welfare and entitlements direct to individuals in a large number of African counties (Devarajan & Giugale, 2011; Gelb & Decker, 2012)—such services being made cheaper and more secure by biometric means.

In such cases as these, we observe a reciprocal relation between identifier and identified. Schematically, we may put the point like this. “Aidentifies B,” but within this relational structure is the potential for reciprocity: A‘s identification of B can imply B‘s acknowledgement of A. This reciprocity is not essential. For example, if A is a geologist and B a fossil, the fossil does not acknowledge the geologist. However, where there is agency on the parts of both A and B, the relational structure “A identifies B” can imply reciprocity. Our claim is that “Aidentifies B” not only can imply reciprocity but should imply reciprocity. Let us try to be a little more specific. What exactly do we mean by “reciprocity?”

(i) Symmetry

By the reciprocity of identification we mean to imply a certain symmetry: if A identifies B, A should also be identified to B. This is a sort of exchange of information, but it grounds only a weak symmetry since no specifics as to the balance of information are implied. A may demand from B more—or at any rate different—information than A divulges. The rights and wrongs of the balance here will depend on circumstances.

(ii) Bestowal and Acknowledgment of Rights

In identifying B, A must bestow rights upon B, of which B is aware (or of which she can reasonably be expected to come to be aware).9 The system of registering children at birth is a fine example of this imperative. The child is registered and in that very act is documented as a bearer of rights. The provision of birth certificates may be thought of as the initial bestowal of rights. Subsequent identification transactions between A and B cannot, in general, be thought of as bestowing rights (although some may: e.g., A‘s issuing B a driving license could be thought of as A bestowing the legal right to drive—identifying B as a legal driver). However, these subsequent transactions may be thought of as A‘s acknowledging (explicitly or implicitly) the rights previously bestowed upon B (alternatively they might be thought of as premised upon A‘s earlier bestowal of rights upon B10).

(iii) Transparency

In normal circumstances, formal identification—i.e., identification by governments, commercial operations, and others—should be transparent. That is to say, it should be clear to B that they are being identified by A. The demands of transparency may depend on circumstances. For instance, if a border control agent asks for your passport, you do not normally ask them for proof of their identity and position—their identity and position are sufficiently clear in the context (they have the uniform, they are sitting in the booth at the airport, and so on). Or again, a store using CCTV to identify shoplifters need not be so transparent as to ask each customer to sign an informed consent form. However, they should, for example, display signs informing customers that they are being recorded. What level of transparency is appropriate to different contexts is a difficult issue which we have no intention of addressing here. We make the point in rather vague terms: identification should be tolerably transparent, given the circumstances.

Certainly, there is more to be said here. However, for present purposes, the above should suffice. In short, we argue that, at a minimum, the process of identification should: (i) be symmetrical; (ii) involve the bestowal upon, and acknowledgement of, the rights of the identified; and (iii) be transparent and open to the identified.

We conclude by looking at three problematic applications of biometric identification technologies. In each there is something objectionable. We will argue that what is objectionable is attributable to the failure to satisfy the reciprocity of identification.

Case 1: The Surveillance Society— Above, we identified a number of concerns regarding ubiquitous surveillance in a biometric future. The extent of CCTV coverage in public places is one cause for concern. However, the fact that you are often on film is not, in and of itself, any more objectionable than the fact that other people often observe you. Moreover, the fact that data regarding your whereabouts can be retrieved many years later is not, in and of itself, objectionable (if we were more observant and had better memories, the same data would be retrievable by testimony). Rather, what is objectionable about the profusion of CCTV cameras in public places is that, first, one does not know who is identifying one (although one knows that it is a formal identification—i.e., that it is a government or commercial agency, and so the situation is quite unlike being observed by a passerby in the street); second, it is not always apparent where the cameras are, so that one is not necessarily aware that one is under observation. These two problems are, respectively, failures to honor (i), the symmetry requirement, and (iii), the transparency requirement.

Similarly, the increased administration of surveillance by the private sector can be understood as objectionable in virtue of a failure to respect requirements (i) and (ii). Do the students in classrooms observed by cameras know which company is recording their images? If not, symmetry is not respected (or at least the symmetry is too weak given the context). Moreover, it will tend to be the case that if requirement (i) is not sufficiently well respected, requirement (ii) will not be either. Do private companies bestow any rights upon the students they identify? No.

To continue with the example of cameras in schools, one may object that the identification transactions do not involve the private companies. The private companies merely facilitate a transaction between the school and its students. If so, the use of CCTV in classrooms is, in some respects, less objectionable. Indeed, it is less objectionable to the extent that the situation is more in accord with requirements (i)–(iii).11

Finally, the concern that surveillance technologies are implemented too quickly, in advance of detailed consultation, may be understood as the concern that there is insufficient understanding of whether the administration of the new technology complies with requirements (i)–(iii). If the employment of new technology outstrips consultation as to its merits and demerits, the framework imposed by requirements (i)–(iii) cannot be guaranteed.

Case 2: The Afghan Villager— The New York Times reports that information on 1.5 million Afghans and 2.2 million Iraqis is now held in databases administered by U.S., NATO, and local forces (Shanker, 2011). In general, military–civilian identification transactions are liable to be problematic. This is evidenced by the prima facie double standards reported in the story: “While the systems [employed in Afghanistan and Iraq] are attractive to American law enforcement agencies, there is serious legal and political opposition to imposing routine collection on American citizens” (Shanker, 2011). We do not wish to comment on the specifics of the Afghan or Iraqi cases but speak, rather, about identification transactions between military forces and civilians in general, taking as inspiration the arresting image that accompanies the New York Times‘ article.

The photograph shows an aged, grey-bearded Afghan villager having his iris scanned. His right eye is shut, while the left is held open by the gloved hand of an American soldier. There are three soldiers in the picture: one holds the eye open, one holds the camera capturing the iris scan, and the other holds his hand above the villager’s forehead for shade. This shading hand is the only American flesh we see, all else is khaki, and we see no faces. It seems somehow significant that the uncovered hand casts a shadow not for the benefit of the villager, but in order that the iris camera is not “blinded” by the sunlight. It is a poignant image. What makes it so striking is the imbalance it portrays: they are soldiers, he is a civilian; they are three, he is one; his one eye is shut, the other held open.

Leaving aside the politics of the war in Afghanistan, as well as the particulars of the actual facts depicted in the photograph, this image—as a symbolic evocation—can only sound warning bells to those who are wary of biometrics. They will view it, not unreasonably, as a representation of the individual utterly overcome by faceless forces he is powerless to resist. Viewed in this way, what is objectionable about the image can be understood in terms of requirements (i)–(iii). First, this identification transaction is not symmetrical: the soldiers in the photo appear as anonymous.12 Second, the military cannot normally (in democratic societies at least) bestow rights upon individuals. Hence, requirement (ii) is not met.13 Third, it is entirely possible that military personnel operating overseas do not speak the local language. If so, it is not difficult to see how requirement (iii) might fail to be met. How can you explain to someone that they are being enrolled in a biometric database for whatever purpose, if you share no languages?14

The image of the Afghan villager is startling and, from a certain perspective, disturbing. What is disturbing about it is, we claim, that it is easy to read the story of the picture as if it involved the violation of the three requirements of the reciprocity of identification as described above.

Case 3: Bio-Political Tattooing— Recall that Agamben claims that the biometric enrollment required by the US-VISIT program is part of an attempt “to convince us to accept as the humane and normal dimensions of our existence, practices of control that had always been properly considered inhumane and exceptional” (Agamben, 2008, p. 201). We suggested that, in and of itself, biometric identification is neither inhumane nor exceptional. Rather, what is objectionable about U.S. immigration procedure is the manner in which it functions as an arbiter and medium of interpersonal relations. We are now in a position to make this a little clearer, with reference to requirements (i)–(iii).

Transparency does not appear to be an issue here. The procedures required as a condition of entry were sufficiently transparent that Agamben could consider them, judge them unreasonable, and decline to enter (although of course it is inconvenient not to enter a country having crossed the Atlantic to reach it). One could also make a case that symmetry is respected. The heart of the problem is requirement (ii), the bestowal and acknowledgment of rights.

Agamben is correct that there is something exceptional about the US-VISIT program. In broad terms, US-VISIT is simply an identification scheme: visitors must have their identities recorded upon entry. That is not exceptional: travel to almost any country and you will be identified as you cross the border. What is exceptional—what is not common to all border crossings—is that US-VISIT is not satisfied with the standard identity documents issued by other states but wishes to enrol individuals in a database wholly unconnected with their home state. This is an additional identification transaction, distinct from the presentation of a passport or visa. (We acknowledge of course that the United States is not the only state to request additional documentation or information to enter.) As such, if we are correct that identification should be governed by reciprocity as per requirements (i)–(iii), one ought to have some rights bestowed or acknowledged in the course of this additional identification transaction. But what rights does the entrant receive? She receives the privilege of entering the United States and enjoys the protection of the laws. However, that is something that, in pre-US-VISIT times, she would have received by virtue of the standard passport-based identification transaction; and (mutatis mutandis) it is something she still receives in most other countries by virtue of nothing more than a passport-based identification transaction. In this way, requirement (ii) is not met in the case of the additional biometric identification transaction that US-VISIT demands. However, pace Agamben, what is objectionableabout the additional biometric identification transaction is a failure of reciprocity—not anything specifically to do with biometric identification itself.

In insisting that the relational structure of identification be understood as reciprocal—i.e., that it involve symmetry adequate to the context; that it involve the bestowal upon, or acknowledgment of, rights of the identified individual; and that it be transparent—we are, in effect, insisting that identification be tightly bound to recognition of rights. If A may legitimately demand identifying data of B, A must acknowledge the rights of B. A owes something to B, which B may legitimately demand.

To speak in such terms is, of course, somewhat theoretical. In slightly more practical terms, our point can be made using the example of birth certificates. Registering births is a good thing because, as the child’s identity is registered, it becomes a bearer of rights; the child is, from the point of registration, hence, entitled to various protections by the state. However, as the statistics of birth registration attest, traditional means of identification are failing; and even where identification methods succeed, they are pressurized by the transition to the digital age. Biometric identification systems promise to be, from a technological point of view, adequate to the challenges of the digital age; and if they can be rolled out in accordance with the ideal of the reciprocity of identification, they will be a force for good. Rights will be protected because they will be enshrined in the very process of the state’s identification of its citizens. The state represents its citizens asbearers of rights. The power relations here may not be exactly equal, but they are at least reciprocal. Abuses of power arise where the reciprocity of identification falters.

Civil liberty advocates should not be frightened if it happens—as it has (Giroday, 2010)—that the head of Interpol calls for a globally verifiable electronic identity card (e-ID) system for migrant workers. This is a challenge and an opportunity because a global system of electronic identification is ethically and politically tenable only if it is sided by a global system for claiming fundamental rights and civil liberties; and this becomes increasingly feasible as we can provide everybody with secure and reliable identification. You can tax people, or alternatively identify them, only provided that you give them a political representation. In other words, identification is legitimate as far as it becomes instrumental to the enforcement of their political and civil rights. Identification without civil liberties would be no less abusive than taxation without representation. This is a lesson that—in a time of “tea party protesters”—it is worth remembering.15

Notes
  • 1 We intend no reference to any actual group of that name, should such exist.
  • 2 We do not discuss the other major concern, namely that the technology could be highly invasive of privacy and has the potential to reveal a huge amount of sensitive personal information regarding, say, health, background, lifestyle, and others. In this regard, there is some overlap with the issues discussed in section 2(ii).
  • 3 See, e.g., Kaluszynski (2001), Joseph (2001), as well as Project Bertillon athttp://www.criminocorpus.cnrs.fr/bertillon/enter_uk.html.
  • 4 In all cases bar the first of the following, biometrics is fairly obviously incidental. Even in the first (concerning Agamben) we feel that, ultimately, what is objectionable does not pertain to biometrics.
  • 5 We are here using the word “personal” (and cognates) in a very wide sense, according to which relations between the state and an individual may be described as personal.
  • 6 In the spirit of the (tongue in cheek) adage that 88.5% of statistics are made up, the veracity of these statistics is explored inAaronovitch (2009) and Channel 4 News (2008).
  • 7  There are of course a variety of issues at play in this controversy. Our point is merely that there is a prima facie case to be answered. Whether it can be answered and how is not a point of interest here.
  • 8  It is of course the case that if the primary goal of bearing arms is not to shoot people but, say, to shoot targets for sport, or to have something nice to hang above the mantelpiece, then we might construe the analogy differently. As mentioned in an earlier note, we are not really concerned with the rights and wrongs of gun ownership here.
  • 9  How strongly one reads “bestow” here is likely to depend upon one’s answers to antecedent questions in political philosophy. A certain variety of social contract theorist might suppose that the citizen is, in some sense, born of identification by the state; in which case bestowal here is more or less literal: the state creates the citizen as a bearer of rights. Alternatively, if one holds that rights accrue to the individual independently of the state, identification by the state will involve less of a bestowal and more of an acknowledgment of rights. Our use of “bestow” is not intended to prejudge any of these foundational matters in political ontology and philosophy.
  • 10  In the Kantian mode: the initial bestowal of rights serves as a condition of the possibility of all subsequent legitimate identification transactions between A and B, state and citizen.
  • 11  The use of CCTV in classes would still be objectionable on the grounds of data minimization. What need is there for cameras in classes? If it is for discipline, or for teacher-training, these ends could be met by less intrusive methods. We will not explore the issues.
  • 12  The soldiers appear in the photograph as anonymous. In reality they are (presumably) not, but have at least their names or numbers shown on their uniforms. Let us emphasize again that we are not discussing what or who is literally depicted in the photo, but its wider symbolic significance as an iconic image of the dark side of biometric identification transactions.
  • 13  Again, the facts in Afghanistan may be different, but we are not discussing Afghanistan.
  • 14  Once more: we are not discussing Afghanistan. Perhaps the actual soldiers in the photograph speak the villager’s language—perhaps he speaks theirs. Perhaps there has been a huge publicity campaign about the identification system.
  • 15  This work has been funded by two European Commission research grants, RISE—Rising panEuropean and International Awareness of Biometrics and Security Ethics (GA230389), and TABULA RASA—Trusted Biometrics under Spoofing Attacks (GA 257289).

About the Authors

Emilio Mordini is the founding director of the Centre for Science, Society and Citizenship in Rome, Italy. He was Professor of Bioethics in the Medical School of the University of Rome “La Sapienza” (1994–2005), and a member (1994–2000) and secretary (2000–2004) of the Bioethical Commission of the Italian National Research Council. Since 1992 he has served as a contractor in quite a number of European Commission (EC) funded projects. His current board participations include: the Biometric Sector Federation of the Italian Confederation of Education and Knowledge Companies; the Committee for Standardization in ICT Focus Group on Biometrics; and the EC expert group on “ethical and regulatory challenges to science and research policy at the global level.” His research interests include ethical and social implications of security technology policies, and the ethics and policy of biometrics and emerging identification technology. His main publications include Ageing and Invisibility (IOS Press, 2010, edited with P. de Hert), and Second Generation Biometrics: the Ethical and Social Context (Springer, 2011, edited with D. Tzovaras).

Andrew P. Rebera (DPhil, University of Sussex) is a researcher at the Centre for Science, Society and Citizenship in Rome, Italy. His research interests include identity, privacy and data protection, surveillance and security, as well as philosophical issues in logic and metaphysics.

 

References

Tags: , , , ,
Posted in Articles |


More Than Facial Recognition – Tagging your friend in a Facebook photo – potential danger

Nov 24th, 2011 | By | Category: Articles

Tagging your friend in a Facebook photo seems like harmless fun.

But a new study from Carnegie Mellon University warns of potential danger.

When facial recognition software is paired with social media profiles, the risk of identity theft rises.

Prof. Alessandro Acquisti

Prof. Alessandro Acquisti

It is possible, says privacy expert Alessandro Acquisti, to identify strangers and gain their personal information — perhaps even their Social Security numbers — by using face recognition software and social media profiles.

The results of the study are being presented today at Black Hat, a security conference in Las Vegas.

“A person’s face is the veritable link between her offline and online identities,” Acquisti said.

“When we share tagged photos of ourselves online, it becomes possible for others to link our face to our names in situations where we would normally expect anonymity.”

Acquisti is an associate professor of information technology and public policy at the Heinz College and a Carnegie Mellon CyLab researcher.

He and his research team, which included CMU postdoctoral fellows Ralph Gross and Fred Stutzman, combined three technologies to identify individuals online and offline in the physical world.

They used an off-the-shelf face recognizer, cloud computing and publicly available information from social network sites.

Since these technologies are also accessible by end-users, the results foreshadow a future when we all may be recognizable on the street.

Not just by friends or government agencies using sophisticated devices, but by anyone with a smartphone and an Internet connection.

In one experiment, Acquisti’s team identified individuals on a popular online dating site where members protect their privacy through pseudonyms.

In a second experiment, they identified students walking on campus — based on their profile photos on Facebook.

In a third, the team predicted personal interests and, in some cases, even the Social Security numbers of the students, beginning with only a photo of their faces.

CMU researchers also built a smartphone application to demonstrate the ability of making the same sensitive inferences in real-time.

In an example of “augmented reality,” the application uses offline and online data to overlay personal and private information over the target’s face on the device’s screen.

“The seamless merging of online and offline data that face recognition and social media make possible raises the issue of what privacy will mean in an augmented reality world,” Acquisti said.

Cloud computing will continue to improve performance times at cheaper prices, and online people-tagging and face recognition software will continue to provide more means of identification.

“Ultimately, all this access is going to force us to reconsider our notions of privacy. It may also affect how we interact with each other,” Acquisti said.

“Through natural evolution, human beings have evolved mechanisms to assign and manage trust in face-to-face interactions,” he added.

“Will we rely on our instincts or on our devices, when mobile phones can predict personal and sensitive information about a person?”

Posted in Articles |


RSA SecurID Breach – Seed Record Threats

Oct 26th, 2011 | By | Category: Articles

The following is a threat model that assumes the RSA SecurID seed records have been stolen by a sophisticated adversary, which is probably what happened.

But first, a word from our muse, Bruce Schneier, regarding what he titled back in 2005 as the “Failure of Two Factor Authentication”:

Two-factor authentication isn’t our savior. It won’t defend against phishing. It’s not going to prevent identity theft. It’s not going to secure online accounts from fraudulent transactions. It solves the security problems we had ten years ago, not the security problems we have today.
Here are two new active attacks we’re starting to see:

  • Man-in-the-Middle attack. An attacker puts up a fake bank website and entices user to that website. User types in his password, and the attacker in turn uses it to access the bank’s real website. Done right, the user will never realize that he isn’t at the bank’s website. Then the attacker either disconnects the user and makes any fraudulent transactions he wants, or passes along the user’s banking transactions while making his own transactions at the same time.
  • Trojan attack. Attacker gets Trojan installed on user’s computer. When user logs into his bank’s website, the attacker piggybacks on that session via the Trojan to make any fraudulent transaction he wants.

See how two-factor authentication doesn’t solve anything? In the first case, the attacker can pass the ever-changing part of the password to the bank along with the never-changing part. And in the second case, the attacker is relying on the user to log in.

Two-factor authentication … won’t work for remote authentication over the Internet.

Bruce was absolutely right. We saw examples of that.

…

Now, let’s put the pieces together– the active MITM attacks that Bruce described, which could result in an offline/passive attack.

In both cases above, the adversary has to act immediately to essentially take over an authenticated session, using either the real-time MITM scenario, or the trojan scenario. But let’s assume that the “good guys” have, by now, read Bruce’s article [but in all reality, they probably haven't, hence they have an RSA SecurID investment] and have paid attention to the RSA jabber that says to watch for an increase in login attempts. In these examples Bruce describes, the adversary grabs the session and disconnects the valid user (possibly at the presentation layer, by taking over the session in malware that doesn’t display what the actions are occurring in the authenticated session).

However, let’s assume the adversary let’s the user keep his authenticated session. The adversary just monitors the credentials that are entered:

  1. The User ID, and
  2. The one-time-passcode (token’s readout, a.k.a. “tokencode”, plus the user’s PIN)

“Relax,” says the security administrator. “That’s what these RSA SecurID thingies are for– to make it meaningless when a bad guy eavesdrops on credentials.”

Well, except in the case where the “bad guy” has all of the seed records for all RSA SecurID tokens ever sold.

Quoting from our article from yesterday:

Assume an adversary has now in their possession, all of the seed records for all RSA SecurID tokens that are currently valid (which based on above and previous seems very plausible). Assume they have sufficient computing hardware to mass compute all of the tokencodes for all of the tokens represented by those seed records for a range of time (they obviously are well funded to get the “Advanced Persistent Threat” name). This would be the output of the RSA SecurID algorithm taking all the future units of time as input coupled with the serial number/token codes to generate all of the output “hashes” for each RSA SecurID token that RSA has ever made. These mass computed tokencodes for a given range of time would basically be one big rainbow table, a time computing trade-off not too unlike using rainbow tables to crack password hashes.

Since tokencodes are only 6 digits long, and RSA has sold millions of tokens, the chances of a collision of a token’s output with another token’s output at a random point in time is significant enough, but phish the same user repeatedly (like asking for “next tokencode”) and the adversary now can significantly narrow down the possibilities of which tokens belong to which user because different tokens must appear random and not in sync with each other (otherwise RSA SecurID would have much bigger problems). Do this selectively over a period of time for a high valued asset, and chances are the adversary’s presence will go undetected, but the adversary will be able to determine exactly which token (serial number, i.e. seed record) belongs to the victim user.

So, now that the adversary has these “rainbow tables” of RSA SecurID tokencodes, and now that the active attacks Bruce described have morphed into a passive attempt, all it will take is watching particular users create valid sessions– maybe as little as a single attempt, depending upon the mathematics and randomness of the RSA SecurID token output, but probably more like watching a handful of attempts. At that point, the adversary can then impersonate the victim user at any point in the future.

So, if RSA SecurID seed records are compromised, there is really not much advantage in an RSA SecurID implementation. The threats are essentially the same as an adversary grabbing conventional passwords. The only difference is that a passive attack against compromised seed records may take multiple monitoring attempts, as opposed to a single event. But with simple malware, that won’t be much more effort, especially for a high valued asset.

So given what we know, we can assume seed records were compromised. And given how little RSA is talking about it, we cannot really know how they are responding to it. Will they just distribute new tokens without compromised seed records, or will they do something much more significant? Based on what we know today, it makes more sense for an organization that is thinking about an RSA SecurID deployment to rely instead on conventional passwords (e.g. Microsoft Active Directory), and spend the extra money on monitoring for fraud and stronger identity validation for things like password resets.

Posted in Articles |


End of the Web As We Know It?

Sep 19th, 2011 | By | Category: Articles, Evidence

26 July 2011
by James Tulloch

Cybersecurity expert Mikko Hypponen / Credits: James Duncan Davidson / TED ConferencesMikko Hypponen, cybersecurity expert, speaks during TEDGlobal 2011 in Edinburgh, Scotland. “Stuxnet shows that the PLCs that control our entire infrastructure, everything that we rely on, can be infected.” (Source: James Duncan Davidson / TED Conferences)

Cybersecurity expert Mikko Hypponen, chief research officer at F-Secure Corporation in Finland, has some chilling warnings about the age of organized cybercrime and Stuxnet-style cyberwarfare. We tracked him down at TEDGlobal 2011 in Edinburgh.

You have tackled many computer virus outbreaks. Who or what are the biggest cyber threats today?
We can split attackers into three basic groups.

There are the hobbyists or hactivists like Anonymous or Lulzsec. They are not trying to make money, they are trying to send a political message, do it for fun or the challenge.

They are a problem but not nearly as bad a problem as organized criminal gangs who do all their attacks for money: they infect home computers, do banking Trojans to steal data, hack credit card details, hijack computers for ransom. They are the biggest threat to the normal end user.

The third problem is cyberwar or cybersabotage, things like the Stuxnet virus launched against a nuclear research centre in Iran, or countrywide denial of service attacks like we saw hitting Georgia and Estonia. These problems will be even more frequent in the future.

How do cybercriminals steal our sensitive data?
The most typical way to become a victim is to take a Windows computer and go online. Five years ago it was done through email, now it’s done through the web.

You might go to Google, click on a search result, and you’re infected. You don’t see anything happening, you can’t tell. They hack into high-profile websites like newspaper websites and insert some exploit codes and so you visit the site, read the news, and get infected.

Another way is to make a new, fake site from scratch, put lots of keywords there and so it ends up in the search results. There is no real content there but you go there and get infected.

Then there are key loggers. They sit silently on your computer and record everything that you type. Everything is saved and sent to the criminals. They are looking for online purchases when you type your name, address, credit card details and security codes.

How much is cybercrime costing us?
Nobody really knows. Nobody can calculate it reliably because the biggest losses come from denial of access to services, for which it is difficult to calculate the losses. You hear that cybercrime is bigger than the drug trade. I don’t believe that. It’s big, but it’s not that big. I believe it’s in the hundreds of millions of euros per year.

So what can we do to protect ourselves?
We have to stop blaming the user because most problems are not related to the user.

A trader in the Karachi stock exchange in Pakistan. / Credits: ReutersGlobal Risks 2011

Click on image to see Special

more

Of course the computer has to be vulnerable, which can be down to user error, but that gets very technical. Your Windows might be updated, but what about Quicktime, Flash and Java plug-ins or add-ons?

We have to move responsibility up to higher levels, to operating system manufacturers, to security companies like us, and to operators and Internet Service Providers (ISPs) that provide the connections.

What about governments or law enforcement authorities?
In the online world each individual crime is small but there are lots of lots of them, and victims all over world. It makes it a nightmare to investigate.

On the internet there are no borders, making every single online crime an international crime, beyond national jurisdictions. That means the sheer numbers of international crimes have exploded in the last ten years. Have the numbers of international law enforcement systems exploded in the last 10 years? No they haven’t.

We are proposing a new framework, like Interpol, focusing on online crime. All countries would promise to work together. So if country A is investigating a crime involving servers in countries B and C, those countries would be forced to help solve the crime.

So the internet needs to be more orderly than previously?
Yes, it does but we have to be very careful not to restrict the openness, creativity and freedom of speech we have on the internet, careful not to move towards a police state.

Mikko Hypponen at the TEDGlobal 2011: ”Fighting viruses, defending the net”

You say we risk losing everything if we don’t deal with cyber security. What do you mean?

When people learn about these security and privacy problems their first reaction is to never go online again. That’s perfectly human but it’s not the right reaction. We have crime in the real world. Yet people run businesses and walk the streets.

One thing we are missing from the online world which we have in the real world is police work. That is why we have to fight these security and privacy problems. We risk these criminals running rampant and taking away peoples’ trust. If people don’t trust the net they won’t use it.

We are already seeing some countries blocking ISPs from some regions so we risk turning the globalized internet back into nation states or islands of internet usage that don’t talk to each other.

Which brings us to cyberwarfare: why is Stuxnet such a revolutionary threat?
Stuxnet is unique. Yes, it infects computers but in addition it is capable of jumping from those computers to Programmable Logic Controller (PLC) boxes, in this Stuxnet’s case Siemens PLCs running Siemens’ own operating system. These PLCs operate all kinds of infrastructure, factories and systems.

Stuxnet infects the PLC and hopes that device is used in one specific target—in this case the Natanz nuclear enrichment processing plant in Iran. We believe it broke nuclear fuel enrichment centrifuges by turning them at the wrong speeds. But if it infects other PLCs that end up in a food processing plant then nothing will happen.

That is a targeted attack, a very difficult attack, and a very worrying attack.

What happens now that the Stuxnet genie is out of the bottle?
Let me tell you something worrying. Three months ago I went online and tried to find a copy of Stuxnet from public sources. It took me three minutes. Any other government or any extremist group could try to modify Stuxnet, it is right there.

It is the first of its kind, so far we’ve only seen one, but the worry is we will see more. Stuxnet shows that the PLCs that control our entire infrastructure, everything that we rely on, can be infected.

Posted in Articles, Evidence |


Biometric – Anything You can Store – I Can Steal

Aug 26th, 2011 | By | Category: Articles, michas-thoughts, News, Opinions

Currently there is no single technology that can mitigate the weakest link in the security chain – End-User Authentication

Biometric Collection is A Honeypot for Hackers


Today, there are no physical or virtual boundaries to prevent intruders from gaining access to sensitive data, including Biometric data in free space (RFID), private sector or government storage areas. The reason for using Biometrics is to bridge the verification gap between humans and machines. The latest cyberattacks prove “One Time Password” (SecurID) has failed to protect faked “legitimate” access. Significant federal sites with RSA protection were recently breached. Biometric storage methods define conditions for individual identification by storing indefeasible characteristics in national, government and private databases. It also means specifying the characteristics that distinguish or identify the actual identity of a person, rather than using it for authentication only. Storing biometric data gives hackers the obvious potential to hack, copy, clone or manipulate sensitive/irreplaceable information in minutes. Financial institutions, Fortune 500 companies, governments, intelligence agencies and militaries worldwide have spent billions of dollars to prevent illegal access to protect critical intellectual property, plans and finances on mainframes, data centers and computers. This paper outlines the vulnerability of current sensitive Biometric data storage systems and presents a unique solution to this growing security threat with the use of privacy friendly amorphous identifiers.

By: Michael (Micha) Shafir

Assisted: Robert D. Dischert , Mohamed A. Ebrahim, Brandon Pantano


I.                    INTRODUCTION

Whether it is Firewalls, Intrusion Detection Systems, Intrusion Prevention System, Private Key Infrastructure, Application Security, Secure Socket Layers, SecurID’s, or Load Balancers, facts show that none of these security measures can prevent hacking, given that the best bet is to attack vulnerable endpoints, or computers that are connecting remotely and are not likely under the direct control of the organization’s security policies[1]creating, as President Obama describes, “Weapons of Mass Disruption.” [2]

First, currently there is no single technology that can mitigate the weakest link in the security chain; End-User Authentication, a legal access made by a set of composite Phishing or Crawling acts, triggering global cyber attacks. There are no pragmatic, arithmetical, or automatic means to compare a legitimate individual’s unequivocal identity record with computers, when the individual’s authentication is based on remote authentication or growing biometric databases [3].  In this electronically interconnected world, weak real remote authentication of the end-user is the gap that allows hackers to use counterfeited legitimate entry with simple, front door credentials, hiding themselves behind undiscoverable secure tunnels.  Machines that process data, cannot see differences between legitimate and fake-legitimate entries as to a machine, they all look the same.  High tech savvy hackers use system security measures themselves to gain access.  Trusted real end-user authentication is the common case, but through current business, or other known solutions, users and administrators find themselves required to serve under such weak conditions.

Second, storing easily penetrable Biometric information on contactless smart cards is doomed for long-term failure. Any electronic data storage method, such as RFID chips or smart storage cards, which contain irreplaceable personal data that can be read by third parties, gives it the obvious potential to be hacked, copied, cloned and manipulated in minutes.  The stolen data might be accepted as genuine by the computer software recommended for the use at international airports, buildings, hospitals, sporting events, etc.

It would seem as if the only real way to prove you are who you claim you are to an automated system is through the use of biometrics as a means of authentication.  Although there has been a dramatic increase in computing power and algorithm efficiency in the last decade, it seems that any Biometric collection is suffering from an arrested development of civilian authentication.  This apparent paradox is the core of the current debate on identity authentication.  As of now, the only logical way to authenticate humans without putting any personal information at risk is via the use of a completely anonymous traceless biometric authentication system. Traceless Biometric Authentication is a unique technology that is able to authenticate strangers to the Biometric Authentication System without the use of a human biometric database.  A traceless method does not require an infrastructure; therefore it can work offline and eliminates the need for proprietary scanning hardware.  With this technology, there is no need for central databases, stored templates, or any type of smart cards.  The traceless solution is completely anonymous, removing all privacy law issues and any chance of being cloned.

II. THE BIOMETRIC COLLECTION PARADOX

In this article we are going to demonstrate the apparent conflict between what unequivocal identification theory tells us is true about the behavior of matter on the “microscopic” or tiny level and what we observe to be true about the behavior of matter on the true world macroscopic large scales level.  Living beings are “mixed” with time, they are in an endless transformation.

No biological individual may remain the same individual (i.e., identical) throughout time.  Today however, we see signs of the interest for personal identity wherever we go.  Arguments on personal identity have been raised by philosophers, social scientists and psychologists in relation to bioethics (e.g. Immanuel Kant (1724-1804) said “Human beings should never be treated as merely means to an end” – Namely, ‘Human beings must not be sacrificed to fulfill other purposes’), immigration and ethnicity (e.g., cultural identities, assimilation, integration), globalization (e.g., cosmopolitism, global citizenship, re-tribalization processes), young generations (e.g. crisis of identity, pseudo-identities, false identities), and body politics (e.g., trans-genderism, cyber-identities, trans-humanism, cosmetic surgery, body arts).  Late modernity is characterized – as Giddens puts it – by a feeling of “ontological insecurity”, that is a very basic sense of insecurity about one’s personal identity and one’s place in the world. The feeling of “ontological insecurity” corresponds to a weak, uncertain, definition of what makes a given individual that very individual. What are criteria for identifying individuals in different contexts, under different descriptions and at different times? What attributes identify a person as essentially the person she is?

Philosophers would argue that none of these questions is really new, yet what makes them new is their current political relevance. Defining the conditions for individual identification does not reduce to specifying conditions for identities of persons, for personal continuity or survival, or for other highly metaphysical questions.  Defining the conditions for individual identification also means specifying the characteristics that distinguish or identify the actual identity of a person.  In other words, it means to define the conditions for satisfying identity claims, the elements that distinguishes a person by other persons and he/she is re-identified or dis-identified.  We are interested in someone being the same individual for many reasons.  First, individuals are responsible for their actions and their commitments. If there was no certainty about personal identity, any kind of transactions, the entire legal system and financial domains could not be even thinkable.  However turning the human body into the ultimate identification card is extremely dangerous.  The possibility of fraud with electronic chips and biometric data should not be underestimated.  Exposing or losing biometric property is a permanent problem for the life of the individual, since, as we’ve mentioned, there is no practical way of changing one’s physiological or behavioral characteristics.  How do you replace your finger if a hacker figures out how to duplicate it?  If your biometric information is exposed, in theory, you may never be able to prove who you say you are, who you actually are or, worse yet, prove you are not who you say you aren’t.

 

III.               BIOMETRIC COLLECTION CANNOT DEFEAT DOUBLE IDENTITY

Often it is argued that privacy is guaranteed or at least improved, when biometric raw data cannot be reconstructed from biometric templates, which are stored and transmitted for the purpose of biometric authentication.  It is shown that there is strong evidence for raw data to be reconstructed from template data.  Furthermore, misuse of templates does not necessarily need a reconstruction of raw data.  The use of wide circulated biometrics collection creates a whole new area of logical mistakes and/or conflict(s) that seems to be self-contradictory. When nonbiometric security authentication elements are breached, security can be reestablished by selecting new authentication elements.  The same cannot be done in an instance where stored biometric information is breached.  Biometric information cannot be changed. Our fingerprints, face, retina and all, are what they are. [4] Any false positives rate in a large national collection would lead to large number of false matches.  The combination of these issues requires a careful ethical and political scrutiny.  The question we are faced with is how can we truly use biometric information without risking or collecting it or even without separating it from its owner’s physical body?

 

IV.                THE EXPERIENCE TEACHES US THAT ANY STORAGE MEDIUM IS BREAKABLE

We can change our name or address, but we cannot change our body parts.  Any growing collection of personal information is dangerous to privacy and freedom from harassment or disturbance.  Trampling human privileges cannot be considered as an instrument that protects the nation.

V.                  BIOMETRIC CANNOT DETER CRIME AND TERRORISM[5][6]

The reason biometric collection is dangerous is not because it is not a good idea; it is because it is extremely inefficient.  A growing collection creates a numerical blind spot, no matter how accurate the fingerprints might be.  As long as the numbers are immense there is no practical way to avoid false matches.  The problem is NOT how many fingerprints from a given individual were being matched.  The problem is the best Finger print system [7] was accurate 98.6 percent of the time on single-finger tests, 99.6 percent of the time on two-finger tests, and 99.9 percent of the time for tests involving four or more fingers.  Needless to say, any additional finger duplicates the original size of the original database size; therefore larger database creates a longer delay for each scan.  These accuracies were obtained for a false positive rate of 0.01 percent.  It means that if the scan is indeed 99% accurate there are 10,000 false matches per millionrecords in the national database.  If the “national collection” has 100 million records it comes to 1,000,000 false matches per scan,  we now need to ask, how is a record getting scanned?

 

Fig. 1:  99% accuracy is 10,000 false matches/million stored records

Adopting a one-to-one (1:1) compression method to “save” encryption seek time cannot justify the need or existence of “National Biometric” collection. One-to-one (1:1) compression methods certainly cannot prevent Doubled or Faked Identity.

Replicated databases on circulated locations cannot be called “secure” as they are multifold and exposed to information leakage.  On the other hand, to coordinate multiple requests taken from a single centralized place involves complicated architecture, expensive maintenance, replication procedures and transmission latency with multicast bottlenecks.  Each request needs to be compared to hundreds of millions of records, preventing security and privacy priorities to dominate.  Using cryptography on centralized database is unbearable on hundreds of millions records causing CPU bottlenecks and endless retrieval time. These side effects push authorities to use unsecured storage comparison, leaving databases completely unencrypted.

In order to accelerate the comparison process and leaving the database unencrypted is enormously dangerous and against the privacy laws.  Wide open databases encourages intruders to break in and steal priceless/irreplaceable information.

Every encrypted record will prevent quality Real Time service to innocent people.  This generates a paradoxquestion: “In what form the Biometric collection should be held in the database, Raw or Encrypted?”

 

VI.                WHY IT IS A PARADOX?

Comparing “Raw to Raw” records is far from being practical as it creates mistakes.   For computers to decrypt every record creates huge latency (long clock cycles on every decrypted record).  On the other side if stored records are Raw how is the collection protected from exposure?

 

Fig. 2: Raw image enables to figure origin

*(There is strong evidence for raw data to be reconstructed from template data)



Fig. 3:  How secure is the comparison?

 

Most biometric authentication systems use a similarity score as an internal variable, whereby if enough numbers of starting points are given, it is possible to find the highest point without being trapped by local minima.  Different readers, cameras and sensors, generate ever so slightly different biometrics results.  These varying starting results, when encrypted alike, will not yield the exact same decrypted result.  As long as the stored samples are encrypted or scrambled they cannot practically be compared to each other.  In other words comparing a fresh new scanned record to other encrypted record in the database is not practical.  Both records must be in a raw form to be efficient.

 

Fig. 4: match Scrambled image to Scrambled image is not practical

 

 

On the other side convert every encrypted record to Raw for comparison as the law requires, takes a lot of CPU clock cycles.

Fig. 5: Decrypt scrambled records cause CPU onerous

 

VII.             COPY PROTECTION TECHNOLOGY IS DOOMED

Storing Biometric information on a contactless smart card is intended for long-term failure.  Any electronic data storage method by which content can be read (e.g. RFID, smart/storage cards, etc.), gives it the obvious potential to be hacked, copied and cloned.  New Micro-chipped passports designed to be foolproof against identity theft can be cloned and manipulated in minutes and accepted as genuine by the computer software recommended for use at international airports.

The best secrets are secrets that are never shared. Storing those secrets on a readable electronic card from which any simple RF dump reader can extract that information, in the same way as international border readers do, or storing your personal information together with your biometric characteristics on a readable electronic device is as irresponsible as buying a Safe-lock that can be opened with any kind of ke or sticking a label with your PIN on the back of your ATM card!  Those determined to bypass copy-protection technologies have always found ways to do so.  The challenge is obvious.  All what needs to be done is to make a fake or just use RF dumped information that is accepted as genuine by the reader, which is less of a challenge than we’d like to believe.

Remote Authentication was originally developed to support a decision on how best to meet the need to authenticate credentials provided by untrusted remote users. RSA and their SecureID that considered ‘Unbreakable’ was hacked [7]. RSA’s clients include many Fortune 100 companies, US Government, Military & Intelligence Community organizations.  Do we need to provide another tragic event to prove any information bank is breakable?  In today’s age of large, distributed networks, trusted remote machines are rare.  Untrusted users are the common case for attacks, however through business or other requirements, users and administrators find themselves required serving such users, regardless.  These may be machines maintained by disreputable system administrators, machines that are believed to have suffered compromises, or simply machines for which the user suspects there are a high probability of future compromise.  It is desirable not to provide sensitive information to such users, however in order for business and governments to operate simple daily functions, CTOs and IT managers find themselves in a desperate race to find a cure.  Remote Biometric authentication is dangerous given the fact that someone can provide cloned traceable Biometric information without any practical ability to discover it over the wire.  It is just a simple duplication of the same known problem of capturing the Username and Password of those remote users.  Traceable Biometric is not differing from any present input, besides huge risk to body identity and human privacy.

Many inventors have offered a myriad of approaches attempting to providing inexpensive, minimally accumulated and compact verification systems in which digitized characters of human users could be stored, retrieved and compared at some later time to verify that a human user is indeed a properly authorized user.  To date, none have succeeded in producing a system that is practical and desirable for use in providing non-unique biometric security for appropriate for use with real-time reaction biometric measurements (without need to dangerously store unique information).  Because of these and other significant limitations as mentioned earlier, no commercially viable biometric-based non-unique security system has been successfully invented.

Close-loop Fuzzy Biometric logic is a set of mathematic algorithms and programming that more accurately represents how the human brain categorizes objects, evaluates conditions and processes decisions. Close-Loop Fuzzy Traceless Biometric logic allows an object to belong to a set to a certain degree or with a certain confidence.  Instead of using unique biometric information, an amorphous identifier(s) agent is replacing it. It was first proposed by Shafir [8] et al. Besides reliable accuracy performance and the replacement policy Traceless Biometrics has to be nonreversible in order to fulfill the aim [9]. The Traceless Biometrics approach, uses non unique remedies and a Real Time Reactive Authentication process solves all such cloneable, deflectable and privacy challenges.

The Traceless Biometric workflow uses the time tested photo ID concept, wherein the machine matches a picture to a person, no different than in any typical biometric authentication process.  In a very simplistic way, just as in a mirror reflection, anyone can “authenticate” a stranger’s reflection without the need to compare the reflection against any other source of stored information.  It does so, however, in a manner that is, as its name suggests, traceless, without storing any biometric data anywhere.

Privacy activists concerning about the protection of stored or transmitted biometric data are often reassured by the statement that biometric raw data cannot be reconstructed from stored biometric templates.

Innovya’s Traceless Biometric Authentication patented [10] process consists of a comparison of only a portion of predetermined biometric elements against the users’ [11] associated access device, wherein the “instructions” for which such portions and their mathematical modifiers are stored on the access device, somewhat similar, in an oversimplified sense, to the PIN on an ATM card.  Unlike the ATM card, however, the system will not authenticate unless that specific user is the one seeking authentication because positive identification is derived from biometric elements on the user’s person, and therefore becomes useless without the user [12].  Should the access device be hacked exposing the numerical string derived in the Traceless Biometric Authentication process, an alternative Traceless Biometric Authentication element can easily be programmed and reissued to the user.

Fig 6. Traceless Biometric Mirror Image Allocation& Matching

References

  1. S. Gorman and S. Tibken, “Security ‘tokens’ take hit RSA offers to replace its SecureIds or provide monitoring for nearly all customers,” The Wall Street Journal, in press.
  2. C. Drew, “Stolen data is tracked to hacking at Lockheed,” The New York Times, in press.
  3. E. Pilkington, “Washington moves to classify cyber-attacks as acts of war,” Guardian.co.uk, in press.
  4. Michael (Micha) Shafir, “The myth of biometrics enhanced security – part 1,” Security Park, in press.
  5. M. Shafir, “The myth of biometrics enhanced security – part 1,” Security Park, in press.
  6. M. Stone, “Obama’s cybersecurity plan,” Security technology policy paper, Columbia University, School of International and Public Affairs, Vol. 1, Spring 2010, p. 1.
  7. J. Cheng, “Researchers: 307-digit key crack endangers 1024-bit RSA,” ars technica, in press.
  8. J. Cheng, “Researchers: 307-digit key crack endangers 1024-bit RSA,” ars technica, in press.
  9. T. Bradley, “RSA SecureID hack shows danger of apts,” PC World, in press.
  10. Michael (Micha) Shafir, “Enabling secure transactions without storage of unique biometric information,” knol, in press.
  11. M. Faundez-Zanuy, “Biometric recognition: why not massively adopted yet?,” IEEE Xplore, in press.
  12. FBI, “FBI switches to faster fingerprint identification technology,”

 

Tags:
Posted in Articles, michas-thoughts, News, Opinions |


Privacy is vital to freedom from ‘Big Brother’

Jul 17th, 2011 | By | Category: Articles

“Big Brother Is Watching You” was the pervasive punch-line in British writer George Orwell’s classic novel “1984.” Now we know Big Brother is listening too.

Arthur I. Cyr

By Arthur I. Cyr

“Big Brother Is Watching You” was the pervasive punch-line in British writer George Orwell’s classic novel “1984.” Now we know Big Brother is listening too.

Revelations that Rupert Murdoch’s News International Corp. for years has conducted massive hacking into British cell phone information is truly shocking. Alleged targets include cell phones of a murdered young girl and relatives of soldiers killed in action. Britain’s political parties have united in Parliament, an unusual move, to condemn the company.

The scandal includes allegations of police payoffs. An initial police investigation concluded the snooping was a renegade incident targeting only a few individuals.

Murdoch’s political influence in Britain has been enormous. Politicians across the spectrum fear his power to embarrass or endorse, and have assiduously courted his favor.

Orwell, one of the greatest writers of the 20th century, was a committed socialist. Unlike many on the left, however, he had personal involvement with working people, because he was one. He stressed egalitarianism, while warning about the dangers of concentrated power in government as well as corporations.

The Murdoch snooping scandal is particularly grotesque, and may bring down that media empire. However, guarding individual freedom, including privacy, from intrusive power structures inevitably is a challenge.

Other developments in British politics and American business underscore this tension. Britain’s coalition government has wisely repealed a national identity card. A card microchip linked to biometric data encouraged bureaucratic snooping. Amid launch of the latest iPhone, Apple leader Steve Jobs gave particular emphasis to protecting customer privacy.

A wag once suggested that “1984″ was really about 1948, a reference to the Stalinist dictatorships ruling in Eastern Europe as well as the Soviet Union when the novel was published. The Cold War had just emerged, and for many communism seemed the wave of the future.

Intense anti-communism seriously distorted U.S. domestic politics and the wider society intellectuals accused of left-wing views found their careers damaged and in some cases destroyed. Blacklisting of writers became a symbol of this intimidation.

An open economy under the rule of law helps limit abuse. Modern Britain has never had dictatorship, and the effects of Conservative Prime Minister Margaret Thatcher’s “Big Bang” deregulation of the economy were important in facilitating freedom. Her heavy-handed style earned her the sobriquet “Big Sister,” but the reforms were crucial to Britain’s economic recovery and reassertion of international influence starting in the 1980s.

A similar process unfolded in the U.S., beginning in the Carter administration and carried much further by the Reagan administration. The financial crises of the past decade, facilitated in part by deregulation gone too far, overshadow the durable beneficial consequences of this market freedom.

This in turn brings context to Steve Jobs’ statement. Apple last year surpassed Microsoft in total capitalization, a major accomplishment for a firm floundering less than 10 years ago before cofounder Jobs returned. Products that facilitate freedom are now major Apple marketing themes.

Meanwhile, competitor Google has grappled with embarrassing accusations that extensive information on individuals has been collected. For example, Google Earth cars driving through random neighborhoods captured specific data from unsecure wireless outlets in unsuspecting households.

In our fascinating, fantastic global information revolution, institutions committed to following the law and protecting personal privacy, not just profits and power, deserve our support. Murdoch and crew deserve condemnation, and prosecution.

Above all, remember: Big Brother is not watching you.

Not yet.

But he’d like to.

Arthur I. Cyr is Clausen distinguished professor at Carthage College. He is also a columnist for Scripps Howard News Service (www.scrippsnews.com). E-mail him at acyr@carthage.edu.

 

Tags: , , , , , , , , , ,
Posted in Articles |


The FBI’s Next Generation Identification: Bigger and Faster but Much Worse for Privacy

Jul 10th, 2011 | By | Category: Articles

This week, the Center for Constitutional Rights (CCR) and several other organizations released documents from a FOIA lawsuit that expose the concerted efforts of the FBI and DHS to build a massive database of personal and biometric information. This database, called “Next Generation Identification” (NGI), has been in the works for several years now. However, the documents CCR posted show for the first time how FBI has taken advantage of the DHS Secure Communitiesprogram and both DHS and the State Department’s civil biometric data collection programs to build out this $1 billion database.


 

JULY 8TH, 2011 by Jennifer Lynch

 

This week, the Center for Constitutional Rights (CCR) and several other organizations released documents from a FOIA lawsuit that expose the concerted efforts of the FBI and DHS to build a massive database of personal and biometric information. This database, called “Next Generation Identification” (NGI), has been in the works for several years now. However, the documents CCR posted show for the first time how FBI has taken advantage of the DHS Secure Communitiesprogram and both DHS and the State Department’s civil biometric data collection programs to build out this $1 billion database.

Unlike some government initiatives, NGI has not been a secret program. The FBI brags about it on its website (describing NGI as “bigger, faster, and better”), and both DHS and FBI have, over the past 10+ years, slowly and carefully laid the groundwork for extensive data sharing and database interoperability through publicly-available privacy impact assessments and other records. However, the fact that NGI is not secret does not make it OK. Currently, the FBI and DHS have separate databases (called IAFIS and IDENT, respectively) that each have the capacity to store an extensive amount of information—including names, addresses, social security numbers, telephone numbers, e-mail addresses, fingerprints, booking photos, unique identifying numbers, gender, race, and date of birth. Within the last few years, DHS and FBI have made their data easily searchable between the agencies. However, both databases remained independent, and were only “unimodal,” meaning they only had one biometric means of identifying someone—usually a fingerprint.

In contrast, as CCR’s FOIA documents reveal, FBI’s NGI database will be populated with data from both FBI and DHS records. Further, NGI will be “multimodal.” This means NGI is designed to allow the collection and storage of the now-standard 10-print fingerprint scan in addition to iris scans, palm prints, and voice data. It is also designed to expand to include other biometric identifiers in the future. NGI will also allow much greater storage of photos, including crime scene security camera photos, and, with its facial recognition and sophisticated search capabilities, it will have the “increased ability to locate potentially related photos (and other records associated with the photos) that might not otherwise be discovered as quickly or efficiently, or might never be discovered at all.”

The FBI does not just collect and store data from people caught up in the criminal justice system;about 1/3 of the data collected and reviewed in IAFIS is from civil sources such as attorney bar applications, federal and state employees, and people who work with children or the elderly. In the past, the FBI has not allowed these records to include photos and has segregated civil records from criminal data. Civil records were also not included in bulk checks for criminal investigative purposes. NGI may take down these barriers, however. There is some evidence to show the FBI is considering including this data in future NGI database searches and, according to the CCR FOIA documents, has already begun to include civil records from DHS and State Department database files such as visa applications, immigration records, and border entries and exits.

So why should we be worried about a program like NGI, which the FBI argues will “reduce terrorist and criminal activities”? Well, the first reason is the sheer size of the database. Both DHS and FBI claim that their current biometrics databases (IDENT and IAFIS, respectively) are the each the “largest biometric database in the world.” IAFIS contains 66 million criminal records and 25 million civil records, while IDENT has over 91 million individual fingerprint records.

Once these records are combined into one database and once that database becomes multimodal, as we discussed in our 2003 white paper on biometrics, there are several additional reasons for concern. Three of the biggest are the expanded linking and tracking capabilities associated with robust and standardized biometrics collection systems and the potential for data compromise.

Already, the National Institute for Standards and Technology, along with other standards setting bodies, has developed standards for the exchange of biometric data. FBI, DHS and DoD’s current fingerprint databases are interoperable, indicating their systems have been designed (or re-designed) to read each others’ data. NGI will most certainly improve on this standardization. While this is good if you want to check to see if someone applying for a visa is a criminal, it has the potential to be very bad for society. Once data is standardized, it becomes much easier to use as a linking identifier, not just in interactions with the government but also across disparate databases and throughout society. This could mean that instead of being asked for your social security number the next time you apply for insurance, see your doctor, or fill out an apartment rental application, you could be asked for your thumbprint or your iris scan.

This is a big problem if your records are ever compromised because you can’t change your biometric information like you can a unique identifying number such as an SSN. And the manyrecent security breaches show that we can never fully protect against these kinds of data losses.

The third reason for concern is at the heart of much of our work at EFF. Once the collection of biometrics becomes standardized, it becomes much easier to locate and track someone across all aspects of their life. As we said in 2003, “EFF believes that perfect tracking is inimical to a free society. A society in which everyone’s actions are tracked is not, in principle, free. It may be a livable society, but would not be our society.”

Unfortunately, biometric data collection is not limited to NGI or even to the legacy DHS, FBI and DoD fingerprint collection programs. The federal government and states have been steadily expanding their DNA collection efforts over the last 10 years as well. Currently all 50 states, the federal government and the District of Columbia collect and share DNA records through the FBI’sCODIS database. At least 15 of those states, as of 2010, collect DNA from defendants convicted of misdemeanor offenses. And as of 2009, under the federal DNA Fingerprint Act of 2005 and several recently-expanded state statutes, at least 21 states and the federal government collect DNA samples from any adult arrested for (not just convicted of) a crime. This has led to an exponential increase in the amount of DNA collected in the United States on an annual basis, with nearly 1.7 million samples processed (pdf Pg8) in 2009, alone. As of 2011, the National DNA Index or NDIS (the federal level of CODIS) contains over 9,748,870 offender profiles, and the states’ individual databases are each expanding as well.

Currently, it doesn’t appear the FBI plans to incorporate the DNA data held by CODIS into NGI. However, NGI has been designed to be flexible and to be able to incorporate additional biometric identifiers as the need arises in the future. This means that we can’t rule anything out. FBI claimsNGI “doesn’t threaten individual privacy,” but the government’s continuing efforts to collect, store and track the biometric data for so many Americans and foreigners cannot bode well for a society that values privacy.

 

 

Tags: , , , , , , , , ,
Posted in Articles |


What the UID project will not do

Jun 5th, 2011 | By | Category: Articles

Vishv Bandhu Gupta says the UID project could create more errors than it can correct

Posted on 02 June 2011  - http://www.tehelka.com/

The concept of “a ubiquitous magic plastic” that bring out the unique in a living person has caught the fascination of most of us. An unpopular government sees in it the ability of cutting a long red tape short to correctly identify the genuine citizens in need. The agonised cops of India see in it a great ally to apprehend the much-wanted terrorists, whose biometric data could now be verified with existing records, as and when these come into existence, before he commits another heinous crime.

 

These expectations are fair. But, the fumes of fire cooking such recipes are rising from unforeseen quarters, which must raise serious concerns in India. Major fires, ironically, are caused by the maniac rush of more reliable and sophisticated software in the market to collect the biometric data of a person, making earlier biometric-reading software and newly-bought hardware obsolete. Further, other factors like a person ageing and the data collected under different weather condition influence the result within the same software, inducing false errors. In South Korea, where the municipal authorities recently introduced “a thumb impression biometric software”, chipped on the closing handle of cars to park and drive away the car to ensure automatic security, raised false “error alarm” in three per cent of the cases. It forced the authorities to shut down the project temporarily.

 

None of these technologies are being substantially tested for trial in India by the Unique Identification Authority of India (UIDAI). The UIDAI, very inexplicably, does not even comment on such doubts, which have surfaced in the technologically advanced countries; neither does it tell us how it intends to counter such errors? It has not started the testing of its software for a real run on any of the unique IDs. This expensive government mission, for which Rs 45,000 crore have been earmarked by Finance Ministry, now claims that the Aadhaar project of the UIDAI will just provide unique ID numbers, and not unique ID cards, as was its original mandate. The UIDAI is an attached office under the Planning Commission, which says that the job of the UIDAI is to develop and implement the necessary institutional, technical and legal infrastructure to issue unique identity numbers to Indian residents (read it as “the UIDAI will issue only unique numbers not smart cards”). The UIDAI has been buying time, when hundreds of crores of rupees are going down the drain every week.

 

David Moss, who spent eight years campaigning against the UK’s National ID (NID) card scheme, has questioned the logic of the UIDAI and the government to depend on biometrics to produce UID numbers. In a report titled, “India’s ID Card Scheme Drowning in a Sea of False Positives”, Moss said, “[The FPIR] conclusions do not follow from the evidence reported. Nothing in UIDAI’s surprisingly low-quality report suggests that it would be feasible to prove that each electronic identity on the Central ID Repository (CIDR) is unique. Not with a billion plus people on the database. Far from it, India can be confident, from the figures quoted in UIDAI’s proof of concept trial report, that de-duplication could never be achieved.”

 

he UIDAI is also silent on several important facts being reported in newspapers every day. The UK government initially allocated £250 million in 2002 for developing the NID project for a period of eight years. Soon it realised that errors in reading biometric parameters were far above the acceptable level, so it shut down the department responsible for it in February 2010. This experiment cost the UK treasury an estimated £4.5 billion in the eight years for which it was carried.The problems with the UIDAI are manifold. One problem area is the database of citizens the authority has used for compiling its lists. It has drawn from the beneficiaries of the Central and state government pensioners, which number several millions. The second lot comes from the Indian security forces, which can provide fairly reliable data. Allotting a UID number to a person from such reliable stock of government rolls does not involve great efforts, but was UIDAI head Nandan Nilekani hired and allocated huge sums running into Rs 45,000 crore for such simple chores?Some reports that have emanated from the Planning Commission state that the UIDAI has not only ignored privacy concerns but also ignored sample test results of its pilot project. Both the government and the UIDAI have been in such a hurry that they have neglected the basic principles of pilot testing and size of the sample. For over 1.2 billion UID numbers, they have used data from just 20,000 people, in pairs, as sample and have on the basis of the results gone ahead with the UID number through the Aadhaar project.Spending very little or no money at all on independent research or developing biometric solutions, the UIDAI is partnering with companies which have proprietary technologies and upfront loyalties with foreign governments. For example, the tenders and contracts awarded by the UIDAI appears to be opaque in nature. Some of companies, which were selected, and their top managements have a tainted background and thus have been criticised in the media across the world.The UIDAI had selected three consortia – Accenture, Mahindra Satyam-Morpho and L1 Identity Solutions – to implement the core biometric identification system for the Aadhaar programme. The UIDAI had stated that the three agencies would design, supply, install, commission, maintain and support the multi-modal automatic biometric identification subsystem. The three vendors would also be involved in development of a multi-modal software development kit for client enrollment stations, the verification server, manual adjudication and monitoring functions of the UID application.L1 Identity Solutions, in particular, has names associated with the Central Intelligence Agency (CIA) and other American defence organisations in its top management or as directors. Although there is nothing wrong in having former top government officials as directors in a company, it is often looked upon as something not quite right. Post-retirement, many top government officials have joined hands with fat for-profit companies that deal in their areas of expertise. In fact, in many countries, it has now become a trend.Thousands of other former intelligence officers, who have left the CIA and other agencies, have returned as contractors, often making two or three times more money than what they were making in their former jobs. According to a report published in 2008, contractors were responsible for at least half of the estimated $48 billion a year the US government spends on intelligence. The real figures are kept hidden under the pretext of national security.L1 Identity Solutions is one of the largest defence contractors in the US and specialises in selling face-recognition systems, electronic passports, such as Fly Clear and other biometric technology, to over 25 countries around the world. It is also contracted by the US State Department and the Department of Homeland Security for passports, visas, driving licenses and transportation workers’ ID cards. The company is on the way to becoming a monopoly in the US, especially for providing Real ID and driver’s licenses.According to an IT expert, L1 and NADRA, the Pakistan unique identity agency, appear to have been created on the same business model. “Staffed strongly by persons with intelligence (quasi-military) links, the major goals of both agencies are to do business with their respective governments, and they succeed to the extent that they have virtually no competition. And this is the company UIDAI has welcomed into India,” said an expert.Vishv Bandhu Gupta is a former commissioner of the income tax department

monsoonrains@gmail.com

 

 

 

 

 

 

 

Posted in Articles |


Cyber Attacks the New ‘Weapon of Mass Destruction’

May 17th, 2011 | By | Category: Articles
policy review » no. 152 » features

Hoover Institution Stanford University

by John J. Kelly and Lauri Almann

The botnet peril

The internet has enabled the bountiful benefits of eCommerce, and the incorporation of eCommerce into our economies has, in turn, created a dependence on the Internet, similar to our dependence on water, electric, and telephone utilities. Unlike other utilities, however, communication utilities can be crippled without even necessarily being physically attacked — they can be attacked in cyberspace. Such a cyber attack can result in loss of life, loss of wealth, and serious impediments to the flow of goods and services. In a modern just-in-time economy, these disruptions have the potential to cause catastrophic damage. Cyber attacks present a grave new security vulnerability for all nations and must be urgently addressed.

Cyber warfare is asymmetric warfare; more is at risk for us than for most of our potential adversaries. Another asymmetric aspect is that the victims of cyber warfare may never be able to determine the identity of their actual attacker. Thus, America cannot meet this threat by relying solely upon a strategy of retaliation, or even offensive operations in general.

Cyber attacks are best accomplished through exploiting intelligence on the enemy’s networks and servers, and on those servers’ software, the current vulnerabilities of the software’s applications, and standard security practices and typical lapses. Cyber attackers can exploit their targets’ networks and servers such that those systems not only stop supporting their intended purposes, but actually work against those purposes. As evidenced by recent attacks on the Pentagon computer system, the United States must assume that our potential adversaries in the world are preparing for such attacks.

Cyber warriors may choose to be discreet about high-value targets, the security of which is compromised, and wait for the optimal moment to launch their attacks. But they can also put low-value, low-security targets to coldly efficient use. A low-value target computer can be unwillingly, unknowingly conscripted (by being infected by a virus, worm, or Trojan software) in future attacks as a zombie in a botnet. Botnet is a term for a collection of software robots (bots) which run autonomously on compromised computers (zombie computers). These computers run malicious programs under the command of a so-called bot herder, who can control the group remotely. Any computer can be infected and available for use as part of a botnet without the computer’s owner knowing it. In the spring of 2007, Estonia was the victim of a month-long cyber attack, which, according to the New York Times, “came close to shutting down the country’s digital infrastructure.” Your personal computer may have been used in that attack without your knowledge. Cyber attacks involve not just one malicious computer but thousands of computers at a time, with new ones constantly joining the fray. Because so many computers are engaged, cyber sallies are all the more difficult to deflect.

When one computer floods a target’s server, router, or Internet connection with traffic (i.e., saturating the target with external communication requests, thereby overloading its capacity and effectively making it unavailable for others), it is called a dos (denial-of-service) attack. A dos attack is defeated by reconfiguring routers to reject all traffic from the originating ip address — that is, from the address of the aggressor computer. If a large number of computers are used in the battle, though, it is called a ddos (distributed denial-of-service) attack. In these cases, the routers of the target must be reconfigured to reject the ip address of each offensive, zombie computer as it is discovered. ddosattacks can be overwhelming — it was a ddos fusillade that crippled Estonia — so all computer owners have a civic duty to secure their machines against becoming part of a botnet.

The U.S. government has a similar duty, but on a larger scale. Because botnets represent such a real threat to our domestic cyberspace and all the assets that those Internet-accessible computers control, it is a vital national interest to secure the domestic Internet.

ATTACK ON ESTONIA

America should learn from Estonia’s experience. The attacks against that small nation can be divided into several stages.1 In the first phase, which started on the evening of April 27, 2007, botnets were actually not used. Instead, the so-called ping flooding (simple dos attacks) of several Estonian web sites occurred. These ping attacks were carried out by “hacktivists” incited by several Russian web sites and equipped by these sites with ping-flooding scripts. This initial attack was ostensibly a first phase of a response to the relocation of a Soviet war monument from the center of the Estonian capital-city, Tallinn, to a location at an Estonian military cemetery. The purpose of the initial hacktivist phase apparently was as pr cover for the later botnet phase. It was successful in that regard. It took some time for the international media to realize that the actual nature of the attack was the ensuing more sophisticated, organized, and devastating botnet attack.

Because the hacktivist attacks did not have the desired effect, due to the rapid implementation of filtering and other protective measures, the aggressors escalated the battle. At 11 p.m. on May 8, 2007 (0 hours, May 9, Moscow time), they began employing vast botnets in their attacks. The peak attack is now believed to have been carried out by several different botnets totaling over a million computers located in about 100 different countries. Once the European Union Computer Emergency Readiness Teams (certs) were engaged, the attacks originating within Europe effectively ceased. The attacks did continue from other countries, however, thus underscoring the importance of international cooperation in defending against cyber warfare.

The main ddos attack lasted ten days, from May 8 to May 18. During the period between May 10 and May 15, Estonia’s banks came under fire from the cyber warriors; two major banks had to stop their online services. Ninety-four percent of banking transactions in Estonia are conducted online, and so the attacks had a crippling effect on financial dealings in the country. Most Estonians do not have checkbooks. When the banking system was set up after the nation regained independence in 1991, the decision was made to skip the issuance of checkbooks in favor of direct, online banking. This, of course, made Estonia even more vulnerable to damage from attacks.

Of course, a ddos attack against online banking lasting several days is enough time to do a great deal of damage to an economy. The attack was not continuous, but came in waves, suggesting that it was not a riot of hackers, but a well coordinated attack. It appears from the pattern of attack that one bot herder was controlling the intensity of the attacks. This demonstrates clearly that there was a single point of control. It is important to note that when the attack began, Estonia had no way of knowing how long the attack would last or whether it would be ongoing.

If the bot herder had been more sophisticated — by spoofing (masquerading as another) originating ip addresses, by better concealing his own location, by enlarging the botnet — then the assault on Estonia could have been far more debilitating and effectively endless (most of the botnet could have been employed to continuously enlarge itself). The commercial router management tools that Estonia used to block the ddos traffic rendered incoming ddostraffic eight times less heavy than it would otherwise have been. If the botnet had been substantially larger, though, the nation’s blocking tools may have been inadequate. As ip addresses were blocked, new zombies joined the attack. Given the large number of zombies available, the attacker was able to expend thousands of zombies per hour. Also, as zombies in the more cooperative countries were blocked, the origin of the attack shifted to countries that did not have any incident management organization (e.g., cert), or where these organizations were not effective.

And botnets can be vast. In 2005, Dutch authorities arrested three young men who had set up a botnet consisting of1.5 million zombies.2 In 2007, Vint Cerf, one of the co-developers of tcp/ip, the protocol that underlies the Internet, estimated that as much as one quarter of the Internet could already be in botnets.3 Microsoft, in its current Security Intelligence Report, estimates that 10 percent of Windows computers are infected with malware.4 While Estonia’s experience has highlighted that there are national interests that have the capability and the intention of using cyber attack, their aggression is not the only type currently active in the world.

THE WORLD RESPONSE

Just as the Internet has enabled eCommerce, it has also enabled cyber crime, cyber terrorism, and cyber warfare. Unfortunately, the international community’s response to these dangers has been seriously insufficient. Botnets have the potential to do untold damage, and they should be classified as ewmds (electronic Weapons of Mass Destruction), a term we have coined. We believe it is appropriate to have a category distinction.wmds can kill in large numbers and cause great disruption. Computers are not generally configured so that they can cause physical damage to themselves or their surroundings, though there is concern about scada systems (Supervisory Control and Data Acquisition) — the computer systems that control utilities and process plants in general. The cia recently disclosed that electric utilities have been successfully attacked. But even if all software and data are securely backed up, there is still potential for great loss due to an ewmd attack.

It was recently determined that a single personal computer could disrupt cellular communications in a city, and that a medium-sized botnet could disrupt cellular communications in the entire United States.5 A network attack that denies the use of the networked infrastructure could have catastrophic consequences in a modern economy that has become dependent on that infrastructure (as in the case of the Estonian banking system). Attacks on U.S. governmental computers such as those at the Pentagon illustrate the intent to undermine the country’s military defense structure. ewmds have the potential to be the cyber equivalent of a military blockade. While one hopes ewmds will never be able to cause the loss of life that other weapons of mass destruction (nuclear, chemical, biological) can cause, they should still be recognized as having the potential to destroy livelihoods or even entire economies, as could have happened to Estonia with a larger and more long-term attack.

A personal computer could disrupt cellular communications in a city, and a botnet could do the same to the entire U.S.

Traditionally, government has protected life, liberty, and property. But much of a modern economy’s wealth resides elsewhere than in, say, physical assets. In a modern economy, much of the wealth is in equities, far beyond the underlying book values and the physical assets. Today’s businesses can be destroyed without damaging any of their physical stock. In an economy where stores are run using electronic inventories with automatic ordering, and factories are run using Manufacturing Resource Planning, a disruption to either system or the means for data communication between the two would disrupt the flow of food and goods. Disruption to electronic banking would disrupt all of the companies that rely on those banks. The efficiencies of just-in-time inventory systems also cause the flow of goods to be more vulnerable to disruption. A disruption to the flow of goods and services could trigger damages that cascade through the economy. International trade also brings the possibility that a firm’s market share earned over many years could be quickly lost if its customers decide that it is no longer a reliable supplier. But unlike a military blockade or most wmds, it does not currently require the resources of a nation-state to have a botnet. We will probably always be vulnerable to some degree of cyber crime, cyber terrorism, and cyber warfare, but the one weapon that can be used by all to create catastrophic damage is the botnet. This further underscores the point that we need to institute better safeguards to reduce the scale of the botnet threat.

Of course, as long as computers are connected to the Internet, cyber attacks will occur. Additionally, computer infrastructure can never be perfectly secured by electronic means. For the foreseeable future, so long as computer software is complex and rapidly evolving, there will be bugs for cyber attackers to exploit. But the degree of vulnerability can be dramatically reduced by securing computers and networks through current best practices. The root of the current vulnerabilities, although technical, is also administrative. Many computers are controlled, or administered, both now and for the foreseeable future, by people who do not possess an adequate understanding of the current best practices for security. Ideally, anyone who connects his computer to the Internet should be aware of effective ways to secure the machine, but many are not or do not take action, with the result that many machines have become infected.

Microsoft’s current Security Intelligence Report estimates that 10 percent of Windows computers are infected with malware.

Thankfully, though, to a considerable degree user ignorance can be compensated for by automated tools. Update management software, part of the Windows and Linux operating systems and some application software, helps make computers more secure. It is designed to be a convenience for users and should properly be considered to be one of our front lines against a cyber attack (though it is not a complete solution, by any means). The U.S. government (and others, too) might consider working with software manufacturers to further develop the effectiveness of these security systems. Similarly, the personal firewalls that are becoming more common on personal machines could be enhanced to help achieve a higher level of protection. And operating systems and applications using passwords should require that the passwords comply with minimum security standards (e.g., nondictionary words of sufficient length). Finally, an adequate degree of logging could be the default to better secure evidence for an investigation. Operating systems and application software can be configured to automatically keep an abbreviated record of all incoming and outgoing traffic. These and other local records would exist only on the pc and be completely private unless and until the owner of the pc chooses to share the records with law enforcement.

If an operating system has a mechanism to audit/enforce proper security, and evidence of the level of security were somehow available to the isp, then those computers with better security in place could receive preferential treatment in the event of a cyber attack. The isps are also in an advantageous position to perform ingress filtering — that is, to check that the “from” address on all packets corresponds to the computer from which the packets are actually coming. This simple check would do much to defeat spoofing and thereby make it easier to determine the origin of attacks.

Another important practice is regular audits. In the corporate environment, outside vendors often perform port scans and advise companies of their current computer vulnerabilities. Governments could work with the isps to institute remote automated audits for subscribers as a standard service. The isps are well positioned to monitor their networks for suspicious traffic that would indicate that a computer has become infected, and they could also proactively run scanning software to detect machines that are vulnerable and then coordinate with their clients to correct the vulnerability. Perhaps even more importantly, isps should have a specific requirement to prevent improper use. There is anecdotal evidence that some isps knowingly provide ip addresses and bandwidth to spammers because of the premium rates such spammers are willing to pay.

The above-mentioned management and auditing services could be performed by greater coordination of existing programs and services. For instance, so long as a user promptly fixes an identified vulnerability, he could be the only one to see the report. If he does not handle it in a timely manner, a report could be sent to his isp indicating a security risk on the isp’s network. The isp could then contact the customer to offer technical assistance. A national authority could set standards and provide support to the isps.

Some ISPs are said to be providing IP addresses and bandwidth to spammers who are willing to pay.

Developers release patches for their software when new vulnerabilities are discovered. When much Internet software is designed, security is not a major consideration in its development, so the need for patches is common. The rejoinder to this is simple: Do not patch in security, but design it in. If software is created with attention paid to security features, entire categories of vulnerabilities can be eliminated.

Mass-market software is by definition vulnerable to cyber attacks. First, because the software is readily available through commercial or open-source means, hackers can study copies for vulnerabilities. (Open source may be somewhat more secure because it undergoes more scrutiny, but it is also easier to study.) Second, because many copies will exist on the Internet, it is likely that copies will show up in response to even a modest port scan (usually the first step in an attack is to find programs to exploit on computers within a range of ip addresses of interest). Finally, if the software is mass-market, there are likely to be a sufficient number of instances of the software on the Internet to merit investment in discovering its vulnerabilities and developing ways to exploit those vulnerabilities. Because programs that are not mass-market in their deployment do not meet these criteria, heightened security requirements may not need to apply to software that is developed for limited use.

How to enhance the security of mass-market software? Security standards could be established with software developers being obliged to certify that their mass-market software complies with the generally-accepted security practices. Without knowledge of the internal workings of a software program, Underwriters Laboratories-style third-party testing — i.e., running a test suite against something’s external interface — may reveal some bugs and vulnerabilities, but will not be adequate to ensure security. And while it is feasible to inspect the source code to ensure that proper practices are used, doing so becomes highly problematic if it involves an external audit — giving source-code access to someone who is not an employee of the developer. Such access greatly increases the risk of a company’s intellectual property being compromised. And as a practical matter, it can be expensive to understand someone else’s source code, particularly if it embodies esoteric technical concepts. External audits would also build potentially significant delays into software’s release cycle. For these reasons it makes sense for an industry-standards body to publish the security design requirements for mass-market software and require that software developers file a certification of compliance. Sample code could be provided so that this requirement is not burdensome for small developers.

This certification should be required of all the software that runs on all network devices (e.g., routers and switches). It should also be required of the hardware itself, without which the Internet wouldn’t work. One of the big problems here is that a substantial amount of this equipment originates in untrustworthy countries. It is not enough to require that developers certify their software and hardware because certifications outside of trusted countries may be worthless. The presence of all these potentially-compromised network devices remains a massive vulnerability.

In August, as Russian tanks rolled into the nation of Georgia, Georgia’s websites were also under assault from Russian cyber attackers. Government websites were knocked offline. The lesson: It is essential that the personnel who control the isp equipment be trustworthy. Georgia had some of its international Internet connections through Russia but thought it had independent communications, since some of the Internet connections went through Turkey. But the access via the isps in Turkey also went down, apparently because the isps were controlled by the Russian Business Network.

While improving technical capabilities is central to stopping cyber warfare, there are various other areas of concern that the United States should address. For example, there is a need for legislation that would improve the ability of private parties to track down hackers and discover their true identities. When a server is compromised, it is possible for the administrator to preserve logs which might be helpful in determining the origin of the intrusion. Unfortunately, the hacker often hides behind fraudulent registrations. Because it is difficult and expensive for a private individual or small business to pierce these fraudulent, and often foreign, registrations, it is that much easier for the hackers to proceed unimpeded. While it is important to protect privacy, the anonymity afforded by the Internet has helped increase the number of cyber attacks. Hackers currently can launch assaults with little fear of recourse. That’s unfortunate; it should be much easier for victims to track down the identities of those who attacked them. Internet registrars should be required to employ a process that is much more rigorous, and much less susceptible to fraudulent registration. Moreover, a government organization could take on the role of active defense against hackers. With the proper legislation, the widespread hacking of private computers could be greatly reduced.

MORE THAN A NUISANCE

Also, it is in the national interest to diminish the threat of botnets by undermining their financial sources — spammers. In a recent report, IronPort, the email security unit of Cisco Systems, determined that the infamous Storm botnet, which may involve up to 50 million computers, is controlled by Russians who finance their efforts by supporting spammers who sell pharmaceuticals online.6 While some botnets may not be associated with foreign governments and are not imminently a national threat, the tools that they develop will be utilized by terrorists and foreign adversaries. The U.S. government should make it a priority to prosecute spammers who support botnets. Two hundred known major spammers are responsible for 80 percent of the spam on the Internet. While prosecutions do occur, they are infrequent and thus not much of a deterrent to other spammers.

One can hope, though, that the lack of prosecution has been because the U.S. government has been busy building a case against spammers through the recent fbi sting “DarkMarket.” The fbi announced 56 arrests as a consequence of DarkMarket.7 Among the recently arrested is the HerbalKing Group, which is believed to be responsible for a third of all spam.8 Unfortunately, the amount of spam has not appreciably decreased. It appears that those arrested just passed their botnets on to others. If spamming were explicitly outlawed, then many more spammers could be arrested. If the revenues associated with the spam enterprises were severely curtailed by prosecuting the businesses promoted by the spammers, then there wouldn’t be such a valuable incentive for others to continue the enterprise.

Unfortunately, the spam problem is only likely to get worse. If a spam email is 3kb in size and each zombie computer has a connection that can transmit 1.5mb/ per second (i.e., a broadband connection), then 50 spam emails can be sent per second — 180,000 per hour, or 4.3 million per day. Estimates for the cost of renting zombie computers vary. A few years ago estimates ranged from $30 to $200 for sending out 1 million spam. A recent investigation of the Storm botnet estimated that the going rate is $100 per million spam.9 The current Microsoft Security Intelligence Report cites the instance of a botnet herder who charged just $200 dollars per week for 6,000 compromised computers (equivalent to 30 computer-weeks for a dollar) — enough capacity to transmit over 800 million spam emails. The Direct Mailers Association reports that direct mail sales campaigns sent through the postal system typically achieve a response rate of 2.15 percent — so they have to have some validity.10 The investigation into the Storm botnet determined that the actual response rate is 8 in 100 million for the pharmacy sales — a considerable profit margin if the spam campaign costs are at the low end of the estimates. The costs to society are considerable. If each recipient has just one second of his time wasted on average due to a spam campaign, then every one-million-piece campaign costs 277 hours of society’s time. The postal campaign, by contrast, might waste 98 seconds, on average, of your time for every two products or services you actually purchase — a much more tolerable imposition.

As briefly mentioned earlier, there is currently no legislation that specifically outlaws spam. The American can-spamAct of 2003 made fraudulent registrations — a tool used by many spammers — illegal, but it failed to give a legal definition to spam, perhaps out of a desire not to outlaw commercial bulk mail. Of course, every spam filtering company has been able to develop a working “common law” definition of spam. But it is not enough. The U.S. Congress and the European Union must revisit this issue and pass legislation to outlaw spam. The legal definition should then be adopted in international instruments regulating the trade in services.

ACTIVE DEFENSE

Cyber defense is accomplished through a combination of prevention, detection, response, and prosecution. Governments could undertake to work with isps, developers, and the general public to devise and support suitable procedures to minimize the vulnerability to botnet attacks, rapidly detect attacks as they occur, assistisps in isolating the malicious machines, and support the end user in both securing the evidence and recovering the machine. Finally, governments should ensure that cyber criminals are prosecuted, regardless of whether they are domestic or working in a cooperative foreign country. Governments should also share information and focus on the foreign threats originating from noncooperative countries.

And governments, especially that of the U.S., must begin to see cyber attacks and cyber warfare and ewmds as the national security threats they truly are. That means engaging in “active defense” and enlisting national police agencies and even the military in the fight. A cyber attack on a U.S. citizen or company, especially one originating outside the nation’s borders, should be viewed as a real and serious incursion, and possibly as the prelude to a more serious attack, as it was in Georgia. In the U.S., 85 percent of all critical infrastructure is in the private sector. It is not enough that private individuals and organizations be able to report a break-in after-the-fact. If someone is trying to break in your front door, you expect the police to come immediately. Similarly, the private sector should be able to report break-in attempts and expect a response.

While local law enforcement has the local relationships, the appropriate capabilities reside at the national level in various law enforcement and military organizations. In order to make these capabilities available at the local level, it appears that a coordinating role is required. In the U.S., the National Guard is charged with a similar role and has been performing it in the war on drugs. The National Guard is probably the best suited because if the cyber attack is an actual military or terrorist attack, then time is of the essence. Because what appears to be a criminal act could evolve into something much worse, it is accordingly desirable to keep the National Guard apprised from the first report. Under this approach, whenever a private sector server is under attack, the owner would send the evidence to their state National Guard, which would then perform an initial assessment as to the attack’s nature and specifics, with an initial determination as to whether it is an attack or a criminal act, and refer the matter to the appropriate agency. They would then monitor the situation, coordinate the follow-up, and keep the private individual or organization apprised.

Given the demonstrated willingness of aggressors to employ it — as the Russians did against Estonia and Georgia — and the certainty that it will be used again, by state adversaries and terrorists alike, it is crucial that we begin to treat cyber warfare as we would any other form of warfare. We must remove it from the exclusive domain of intelligence operations and establish a Cyber Warfare Command that includes an offensive capability. The U.S. Air Force has taken steps to do just that, but it has yet to be authorized.

In summary, a carefully orchestrated technical program that defends the domestic computer infrastructure should now be a critical goal for every technically-advanced nation. Action is required:

Individuals and businesses. Everyone who uses the Internet needs to understand that they have a civic duty to take reasonable care that their computers are reasonably secure from attack and infection. Any computers that become infected should be promptly cleaned or disconnected. To the extent feasible, forensic evidence should be made available to law enforcement.

Software Industry. Security should be designed into all mass-market applications and operating systems that are connected to the Internet. Designers should enhance comprehensive update management software and personal firewall software so that all machines attached to the domestic Internet can be quickly patched against new vulnerabilities. Logging software should by default preserve evidence that would aid those investigating any cyber attack. Operating systems and application software should require secure passwords and be designed for security and certified as such.

ISPs. isps should support their subscribers in detecting vulnerabilities, detecting infections, securing evidence, and repairing the infected machines. isps should also be required to perform ingress filtering on their routers to counterip address spoofing. ISPs who profit from knowingly providing ip addresses and bandwidth to spammers should face sanctions. All isp equipment and personnel should meet standards of trustworthiness.

Legislative bodies. Legislative bodies should pass laws to hinder fraudulent registrations, and they should explicitly outlaw spam campaigns. Legislation could be designed to draw a line between spammers, as exemplified by those identified in the Spamhaus rokso database, and legitimate commercial bulk email that is not so designated. This legislation probably should provide a safe harbor for legitimate businesses performing acceptable commercial correspondence. Guidelines may include how the address was obtained, the manner of targeting, the frequency of sending emails, the anticipated and actual response rates, and the number of emails compared to the size of the company’s current customer base. Those convicted of serious repeated abuses of the Internet could be fined, and/or banned from further access.

Executive branch. The executive branch should vigorously pursue and prosecute all spammers, hackers, and botnet perpetrators. It should designate and fund an agency to respond to every reported attack; the National Guard may be the appropriate agency for this role. The Defense Department should be tasked to establish a full military capability in cyber operations, perhaps with the Air Force as the lead service. The fbi should have adequate resources to prosecute all major cyber criminal acts.

These measures, along with an ongoing proactive relationship between government and industry to monitor the evolving cyber-warfare threat, evaluate the effectiveness of the measures to counter the threat, and devise improved safeguards, should greatly reduce the magnitude of and resulting damage from future attacks.

John J. Kelly III is president of Model Software Corporation. Lauri Almann was permanent undersecretary of defense for the Republic of Estonia from 2004 to 2008.

1 Swedish Emergency Management Agency, Large Scale Internet Attacks. The Internet Attacks on Estonia. Sweden’s Emergency Preparedness for Internet Attacks (2008).

2 Gregg Keizer, “Dutch Botnet Suspects Ran 1.5 Million Machines,” TechWeb News (October 21, 2005).

3 Tim Weber, “Criminals ‘may overwhelm the web,’” bbc News (January 25, 2007).

4 Microsoft Security Intelligence Report. (January through June 2008). http://download.microsoft.com/download/b/2/9/b29bee13-ceca-48f0-b4ad-53cf85f325e8/Microsoft_Security_Intelligence_Report_v5.pdf

5 William Enck, Thomas LaPorta, Patrick McDaniel, and Patrick Traynor, “Exploiting Open Functionality in sms-Capable Cellular Networks,” presented at the12th acm Conference on Computer and Communications Security (November 7–11, 2005).

6 See “2008 Internet Malware Trends” at http://www.ironport.com/malwaretrends/.

7 Federal Bureau of Investigation, “fbi Coordinates Global Effort to Nab ‘Dark Market’ Cyber Criminals” (October 16, 2008).

8 Asher Moses, “Spam flood goes on despite bust,” Sydney Morning Herald (October 20, 2008).

9 C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Spamalytics: An Empirical Analysis of Spam Marketing Conversion. ccs’08, (October 27-31, 2008) acm 978-1-59593-810-7/08/10.

10 dma Releases 5th Annual “Response Rate Trends Report.” Direct Marketing Association. http://www.the-dma.org/cgi/disppressrelease?article=1008. (October 2007).

Copyright © 2011 by the Board of Trustees of Leland Stanford Junior University

Posted in Articles |


Is the cyber threat a weapon of mass destruction?

May 17th, 2011 | By | Category: Articles

BY JOSHUA POLLACK


Google’s surprise announcement of “a highly sophisticated and targeted attack” on its systems–a case of computer-aided espionage–has also raised the specter of offensive warfare. Defense News quotes Adm. Robert Willard of U.S. Pacific Command as declaring that “the skills being demonstrated” by Chinese hackers in the service of “exfiltrating data”–a fancy way of saying “spying”–are also relevant to “wartime computer network attacks.”

If that’s not alarming enough, last week, Gerald Posner added a new entry in the annals of hype in a piece he wrote for the Daily Beast: “While Google weighs exiting China, a classified FBI report says [Beijing] has already developed a massive cyber army [that is] attacking the U.S. with ‘WMD-like’ destruction capabilities.”

“In the last few years, it’s become almost a rite of passage among federal employees to have their computer networks partially shut down for days or weeks after an intrusion, usually (but not always) attributed to China.”

Posner’s assessment is clearly excessive. But recent years have seen a growing tendency to treat “the cyber threat” as a “strategic” problem, sparking an interest in “cyber deterrence.” U.S. Strategic Command even appears to have incorporated computer network attacks into the existing U.S. nuclear declaratory policy, based on the idea of “calculated ambiguity.” Last May, Gen. Kevin Chilton of STRATCOM told journalists, including the Global Security Newswire’s Elaine Grossman, “You don’t take any response options off the table from an attack on the United States of America,” including a cyber attack.

When “cyber attack” means a form of spying, General Chilton’s statement will come across as extreme. But it’s certainly possible that the ability to compromise computers will play a role in future war-fighting. (Aaron Mannes and James Hendler identified some realistic possibilities in a Washington Times op-ed last August.) Still, let’s keep the matter in perspective: If the United States were ever to get into a shooting war with another nuclear weapon state, cyber attacks would be the least of anyone’s worries.

The Google Affair underscores that there is a different sort of “strategic” cyber threat. Today’s issues of global concern hinge in large part on the state of U.S.-Chinese relations: stabilizing the world economy in the wake of the fiscal crisis, shoring up the nuclear nonproliferation regime, and achieving effective cooperation to forestall the worst effects of climate change, to name the most salient issues. And let’s be blunt: Pervasive spying via the internet is harming China’s relations with the United States.

In the last few years, it’s become almost a rite of passage among federal employees to have their computer networks partially shut down for days or weeks after an intrusion, usually (but not always) attributed to China. Everyone from the Office of the Secretary of Defense to the Commerce Department has been a target. And in certain circles, there are few computing experiences more familiar and less delightful than receiving the dreaded socially engineered e-mail attack–an authentic-looking message, seemingly from a known person, but with a nasty PDF attachment.

In other words, not every intrusion of this type is as systematic and well-planned as the December 2009 raid on Google, Adobe, and other U.S. firms. Any American who works on Asia-Pacific security issues or has an interest in human rights in China has probably been aware of the problem for some time. If they haven’t received an e-mail probe personally, chances are good they will know someone who has.

The damage to goodwill has been considerable. It isn’t shocking that one major power spies on another, or necessarily even intolerable. As the saying goes, “It’s all in the game.” But the game has never been friendly, and there’s something breathtakingly crude about how it’s being played today. The attempt to capture as many computers as possible is aggressive and indiscriminate, reaching into the lives of private citizens in the United States and beyond. In a particularly insidious turn, the spies have been known to take advantage of professional contacts between Americans and Chinese in order to assemble convincingly spoofed messages and to mine e-mail address books for targets.

All of this effort is aimed at getting the targets to open the attachments. No serious attempt is made to cloak where the attacks are coming from, should a fake message be spotted. That’s especially striking in contrast to the technical and social sophistication of the probes.

These practices are, quite frankly, abusive and uncivilized. And the mechanical denials of Chinese officials do as much harm to the country’s image as the scattershot spying itself, if that’s possible. As it happens, spying is not the same as warfare. But it does harm regardless.


Posted in Articles |


Is Biometric Technology An Unnecessary Intrusion Or A Promising Marketing Tool?

Feb 13th, 2011 | By | Category: Articles

by m2john under Workforce Management

Recently, Planet Biometrics posted a story entitled “Biometrics Cruise into the Disney Dream” that described how facial recognition biometric technology is used throughout their new cruise ship in “moving art” and personalized photography.  “Moving art” is interactive art spread throughout the ship that contains moving pictures which are cued to play once a passenger stands in front of the screen.  Facial recognition is used to recognize the person that is standing in front of the screen so that the same interactive video does not play twice.  In addition, Disney uses facial recognition technology to help sort and consolidate the reams of photos that staff photographers snap of individuals and families as they enjoy their time on the ship and Castaway Cay Island.  Facial recognition biometrics saves a lot of time and creates efficiencies for passengers to find the photos that are exclusive to themselves and their families.

In case you missed it, at the 2011 National Retail Federation “Retail’s Big Show” in New York, Kraft Foods debuted a state of the art kiosk which can instantly scan a passerby, determine their gender and age group, then suggest which food products might be an attractive meal idea.  It even goes so far as to allow a customer to scan their loyalty card and search their past ordering history to hone their choices even more.  Wow.  Pretty cool.

Which brings us to the subject of our blog post.  With the increasing sophistication of technology that surrounds us and the use of biometric identification to help customize marketing messages to consumers, is biometrics becoming a gigantic intrusion into our personal lives or a savvy tool for companies to personalize their message?

Big brands would argue that they are simply utilizing biometrics in this capacity as a means to engage customers by tailoring a solution or offering that is relevant and timely.  They vehemently deny storing anyone’s image or sharing biometric information with anyone.  On the other side of the coin, privacy advocates worry (and perhaps rightfully so) that companies are indeed storing these images and as biometrics becomes more and more prevalent for identification in many different vertical markets, the protection of an individual’s biometric template information is not secure and regulated by a set of national standards.

Valid arguments can be made for both sides of the fence.  Expect to see biometrics popping up more often in companies’ efforts to engage with their customers and to help enhance their in-store or entertainment experience.

What’s your take?  Should we allow companies to use biometric technology as a means to personalize their marketing message to consumers for entertainment or direct sales?  Do privacy advocates have a convincing argument when they question the use of biometrics in this capacity?  Please share your thoughts in our comments section below.

Posted in Articles |


Privacy and the Fear of Biometrics

Nov 16th, 2010 | By | Category: Articles

November 14, 2010

By Simon Krauss, Privacy Eye Thoughtful Privacy and Technology Investigations


The Denver Post reported today on a health club that was using a fingerprint reader as an alternative to using a membership card .(http://www.denverpost.com/business/ci_16601571)

The Post article discussed the concerns over using biometrics, including privacy concerns.  To some extent, the concerns over privacy invasion due to someone falsifying biometric information are understandable.  It is the ultimate identity theft — a stealing of a physical aspect of you.  This feels different then a stolen credit card number.

On the other hand, stealing your fingerprint or, worse yet, your finger, is an inefficient way to steal your identity.  Unless there is high value associated with your fingerprint, fingerprint biometric theft is more profitable if taken as a batch, just like credit card theft.

Fingerprint readers work by measuring certain aspects of your fingerprint and storing mathematical representation of those measurements.  What would be stolen is this stored mathematical representation of your fingerprint.  Probably yours and everyone elses in the database.  In this way, what is stolen is a string of numbers — like a credit card theft.

The bigger concern with using biometrics is the assumption that the biometric is always correct.  There is the issue of a fingerprint reader not recognizing you, in which an additional method of authentication is needed.  There is also the issue a the fingerprint reader identifying someone else as you, in which you better hope that what the person is able to access is no more than your health club.

Although there is an emotional pull in considering biometrics for authentication, in the end the issues come down to the same thing as any other means of authentication and authorization– the balancing of the value of what is secured with the cost of keeping it secured for the length of time it is valuable.

While account numbers are unique between a health club and a bank, your biometric is unique to you, regardless of where you use it.   Health clubs have much less riding on the security of biometric data than a bank. If health clubs and banks both use fingerprints in the same way for authentication and authorization of their customers we are in trouble, as there is likely to be much less security for the storage of the health club biometric than the bank biometric.  Once the health club biometric is stolen it can then be used access the bank.

This concern, of course, can be lessened significantly if the health club and the bank measure the fingerprint differently and if they also encrypt the resulting fingerprint mathematical representation differently.  This may create even greater security than using credit card numbers as at least each business using your fingerprint would be storing a different mathematical string and you are far less likely to lose your finger than your wallet.

Tags: , , , , , , , , ,
Posted in Articles |


BIOMETRICS: HUMANS AS KEYS

Oct 11th, 2010 | By | Category: Articles

“Biometrics will only be effective when combined with a second, authenticating factor, such as a PIN or a password. Unfortunately, such an approach limits the degree to which biometrics can simplify security”

By Isaac Leung on  11 October 2010

“Developers of face recognition systems are continuing to work on reliability and the ability to handle the wide range of lighting conditions that are typically encountered by mobile users.”

Biometric Innovations is an Australian company which designs, develops, integrates and delivers biometrics-based security solutions for government and commercial communities. The company’s software engineer, Damien Crabtree says biometrics are becoming more attractive options for businesses as costs come down and the technology reaches full maturity.

The company says in addition to traditional customers from correctional facilities, it’s also seeing its BioMatch software and Sagem fingerprint scanners being deployed in small-to-medium sized businesses, large businesses and retail stores.

“As with all electronics, the manufacturing costs and components have come down in price, so it’s now at a reasonable level for most businesses to contemplate it as an alternative to the existing technologies,” Crabtree told Electronics News.

According to Acuity Market Intelligence, fingerprint technology, given its continuing maturation and cost-effectiveness, will continue to dominate the market through to 2017, although it will be challenged by iris and face recognition.

The relative size of the components and continued integration of technologies will also play a big part in the ubiquity of biometrics. While current fingerprint readers have been reduced to the size of a small chip, the next step is for touch screens to have integrated fingerprint capabilities. Camera and software enhancements could also see visual recognition technologies like iris and face integrated into common devices like mobile telephones.

Inherent insecurity, or incorrect application?

Biometrics differentiates itself from previous security solutions due to its ability to provide positive identification. Successfully leveraging the capabilities of this technology for applications in the consumer, commercial and government sectors will be key for an industry looking to retain its strong growth.

Covetek Australasia provides consumers with domestic fingerprint door locks, such as its BioDoor range. It is also introducing security systems based on facial recognition.

Marketing director Kevin Mackay claims while biometric technologies for consumers need to be practical, affordable and user-friendly, positive identification the central advantage offered by these systems. “Smart cards can be given to a friend to access. A password can be passed on. But biometrics is really recognising a person, through their fingerprint or face,” says Mackay.

But the general biometrics market is not without difficulty. Manufacturers face scepticism from customers regarding the security of their solutions, worries regarding the privacy of biometric data, and legislation stemming from these concerns.

Argus Global is an Australian company which specialises in software applications using biometric technologies to provide access control, time and attendance, visitor management and asset management. According to chief executive officer Bruce Lyman, the holy grail for the biometrics solution industry has always been the application of the technology to combat fraud.

However, erroneous perceptions regarding the privacy and security of biometrics have prevented manufacturers from breaking into that market.

“It’s really about the market not being well-informed about the technology, even though it is already quite mature,” Lyman explained.

The popular television series Mythbusters has not made things any easier. In episode 59 of season 4, hosts Jamie and Adam bypassed consumer-grade fingerprint readers and locks via various methods, including using a ballistics gel replica of a fingerprint.

In September 2010, the US-based National Research Council published a report titled Biometric Recognition: Challenges and Opportunities, arguing biometric systems are “inherently fallible”, calling for additional scientific research and threat assessments.

The problem, Lyman says, is not that fingerprint readers are inherently unreliable or easily fooled. After all, it’s seeing wide utilisation of the technology with its corporate, federal and state clients. “The challenge in the consumer sector is that right now it’s being addressed by technologies that don’t meet international standards,” Lyman explains.

In more critical applications like homeland security or immigration, he claims, the devices and systems are regulated by and compliant with security standards.

Lyman expects the consumer market to be challenged as governments develop legislations in response to the burgeoning use of biometrics. But despite the growing attention being paid to biometrics, Lyman sees the technology as a contributor in the overall application, rather than as a complete security system in itself.

“In this industry, what is not always understood by the users or the market is the fact that the technology is really irrelevant,” says Lyman, “Our biggest customers. . .are driven not by the technology but by the applications you can drive out of that the technology.”

For example, hospitals tend to buy systems which dispense drugs, but have a strong identifying element. Some of these clients might opt for iris biometrics to reduce the risk of contamination from contact.

Lyman says the integration of biometrics into applications and devices is further being driven by the US military, which provides its troops with biometric handheld devices that also embed GPS technologies, picture taking capabilities and wireless connectivity.

But such devices are not restricted to the military, with patents being filed in the United States for an access device intended for the US-VISIT system run by the Department of Homeland Security.

The device would gather fingerprint-based biometric identification and location data provided by a GPS, encrypt the information, and transmit it wirelessly to a server for verification. The technology provides verification of the identity of its holder, and informs the relevant government department if it’s currently inside or outside of the United States, allowing the tracking of entry or exit to and from the country.

While such devices can operate in a standalone mode independent of the presence of a constant connection to a network, Lyman says more information and algorithms are being stored on a single unit, making data protection even more critical. The intensely personal nature of biometric data exacerbates concerns over data security.

“With that sort of trend emerging, the issue is what have I got on the device?” Lyman asks, “What am I storing? If I lose one of these in Afghanistan, where is the data going to end up? How do I store the data, how do I protect it, and what is it connecting back to?”

Lyman says clients sufficiently concerned with data security may instead choose to buck the trend, and utilise “thin” biometric devices which only transmit and receive data to and from a secure network.

Any remaining problems with biometrics will no doubt be ironed out with time, as new technological developments emerge, and standards are developed for the technology However, the industry is more interested in the bigger picture, integrating biometrics into existing and new applications, not so much as a standalone one-size-fits-all security technology, but as enhanced solutions to existing and new challenges.

Identity or authentication?

These trends seem to indicate that biometrics is not the magic bullet for security. A 2006 article by Steve Riley, senior security strategist at Microsoft, posits that biometrics should only play an identifying role in an application, rather than displacing traditional methods of authentication. The piece, titled It’s Me, and Here’s My Proof: Why Identity and Authentication Must Remain Distinct, separates the concepts of identity and authentication.

Identity is a public assertion which in the pre-biometrics age was the equivalent of a user name. Authentication is the secret response, such as a PIN or password.

Riley argues biometrics should only provide the identity part of the equation, since people leave their biometric signatures everywhere. While biometric data is certainly harder to replicate than simply typing in a username, it’s not infallible. As Mythbusters found, fingerprints can be easily lifted from surfaces, while faces are readily stored by security systems and cameras.

According to Riley, biometrics will only be effective when combined with a second, authenticating factor, such as a PIN or a password. Unfortunately, such an approach limits the degree to which biometrics can simplify security.

Technologies are emerging, however, which blend protection and convenience by combining biometric identification data with context-specific data such as location, time, or platform to form a security certificate. Such systems would provide access and authorisation only if all data points line up.

Biometrics, while still conjuring futuristic expectations, is here today as a maturing technology, especially in fingerprint. While bringing to the table capabilities like positive identification, biometrics should be seen as an enhancement to security, rather than being a replacement of existing solutions.

As such, it performs best when integrated as part of a larger system, and serving an identification role in various applications. This trend is one which will continue as devices and systems are increasingly embedded with biometric components and functions.

While it is easy to be distracted by the workings of biometrics, systems-level considerations undertaken by the designers and the competence of users can make or break the underlying security technology.

Biometrics is centred around humans — the biological signatures of fingerprints, veins, irises, faces, and voices. And the effectiveness of any security implementation is ultimately dependent on the people designing and constructing the system. Humans are the key to a successful system in both senses of the word.

Tags: , , , , , , ,
Posted in Articles |


Biometric Technology and Privacy Issues

Sep 5th, 2010 | By | Category: Articles

Article by Sheila Robinson
Edited & published by Lamar Stonecypher

Security and privacy is important to everyone. The use of biometric technology has improved confidence in this area. However, as with any technology it can be a subject of abuse. Should we feel safe with such personal information being obtained by businesses and the government?

Government Use of Biometric Information

The use of biometry technology by the US government is increasing. Biometric technology methods such as facial recognition can be useful for finding criminals in large public areas. However, there is concern that it can be abused and infringe our first amendment rights, such as protesters at a political rally. People could be identified from these situations and put into a government database. Another problem is that facial recognition biometric readings are prone to a high rate of error. It is possible that individuals could be accused of being involved with crimes that they did not commit.

After 9/11, security has become a big issue. The Transportation Security Administration (TSA) is trying to implement “whole body scanners” for use on international travelers in airports. By many this is considered to be a civil liberties violation, since the TSA has confirmed that naked digital pictures of an individual could be stored or transmitted to other locations.

Other privacy issues with biometric technology concern abuse of this information during times of social unrest. There is concern that public and private databases that contain information like fingerprints could be accessed and misused. Biometric social security cards are also being considered as a measure to prevent illegal immigrants from getting jobs. Loss of job opportunities and discrimination could be possible with inaccurate biometric readings.

Fraud or Identity Theft with the Use of Biometric Technology

Biometric methods are not foolproof. Due to this vulnerability, there is always the threat of someone impersonating an individual and stealing their identity by obtaining this data. Problems could later result for the individual being impersonated. Since the biometric data is supposed to be accurate due to its unique qualities an individual’s innocence may be difficult to prove. Unlike passwords, biometric readings cannot be replaced with another one from the same person. Other potentially dangerous situations could also occur – like a person cutting off the finger of another individual to gain access to a security system, vehicle etc.

Other Concerns with Biometric Methods

Security systems that scan and compare biometric data can give false positive and false negative readings. There can be a system breakdown if the scanning sensor fails to produce an accurate reading. This could result in a valid individual being denied access through the system or giving access to someone who should not be allowed entry.

Other privacy issues with biometric technology concern the data being used to crosslink other information about an individual, such as their marital status, religion or employment situation.

Final Thoughts on Biometric Technology and Privacy

Even though using biometry technology is considered to be an effective measure for security and protection against crime, there is concern that it violates the privacy and personal rights of individuals. These issues include the possibility of fraud, identity theft, civil liberty violations and inaccuracy of data that could result in being accused of a crime or become a victim of discrimination. It raises questions about how the biometric data is stored. Could the information be shared internationally? We should also be concerned about the long term effects of biometric data being tracked on such a close basis.

Posted in Articles |


Military Prison Builds Big Afghan Biometric Database

Aug 25th, 2010 | By | Category: Articles

By Spencer Ackerman | August 25, 2010

BAGRAM AIR FIELD, Afghanistan — Don’t think of the U.S. military’s new Detention Facility In Parwan as just a holding pen for suspected insurgents. It’s also an emerging datafarm, storing biometric information on its inmate population. In a country with a shaky commitment to the rule of law, those identifiers could become weapons.

Parwan, with its thousand-or-so detainee population, will become an Afghan-run detention complex next year. By 2014, it’ll become a major Afghan jail, run by the Ministry of Justice to incarcerate convicted criminals, not hold insurgents taken off the battlefield. But Army Brigadier General Mark Martins, who currently runs day-to-day operations at the detention center, explains that there’s a basic problem with Afghanistan’s criminal justice system: It doesn’t have a efficient information infrastructure to identify the people it holds. That’s where he comes in.

Every detainee who comes into Parwan leaves basic information with the Detainee Services Branch during in-processing: Name; father’s name; residence. A mark of any identifying scars, marks or tattoos. Residence of record. After a shower and a medical exam, the DSB scans their irises and collects prints from all of their fingers, rolling their thumbs for a 360-degree view. Its cameras snap five photographs of every detainee’s face. All of this information goes into a military database called the Automated Biometric Information System.

Troops in the field can access the system through a set of portable consoles that the DSB has on hand. The Biometrics Automated Toolset, or BAT, allows troops who detain insurgents on the battlefield to get a quick biometric identification of who they’ve captured, all through talking to the database. One clunky component of it, the Handheld Interagency Identity Detection System (HIIDE), which looks like a big black FunSaver, takes pictures of a captive’s irises, facial features and fingerprints. BATS and HIIDE were used in Iraq, where counterinsurgents like David Kilcullen praised the devices for allowing troops to quickly and positively identify known insurgents during the surge.

But any detective will tell you that a database is only as good as the data it contains. And after 30 years of war, Afghanistan isn’t really in the data-collection game. The U.S. military’s detentions command, known as Joint Task Force-435, is working with the Afghan Ministry of Interior to kick-start an up-to-date records program.

Martins says he and the ministry want “enrollments on 15 percent of fighting-age males,” Afghans between the ages of 14 and 49.  Studies that he’s seen convince him that 15 percent represents a Gladwellian tipping point, allowing the U.S. and the Afghans to match exponentially more latent fingerprints off homemade bombs to Afghans in the system.

But that means biometric information about one million people. And the easiest way to get this information is by locking up a whole lot of Afghans and collecting it against their will, one of the reasons that human rights advocates are wary about the U.S.’s plans to turn over Parwan to the Afghans.

In Iraq, privacy advocates raised similar concerns about weaponizing the biometrics database — essentially, turning it into a military hit list. Afghanistan is filled with corruption, fraud and malicious police officers. Its commitment to the rule of law is, to be charitable, immature. In such a circumstance, a counterinsurgency tool like the biometric database just as easily become predatory, allowing its possessors to take out their political or ethnic rivals and reward their allies. If theWikiLeaks disclosures put Afghans in danger, imagine what iris scans and fingerprints could mean for people who don’t want to pay bribes to crooked cops.

“That’s a policy-significant issue,” Martins admits, “Who holds the data?” According to an October memorandum signed by the U.S. and Afghan governments, the Afghans will. The U.S. might see its collected records become the “biometric component of a national ID” Martins says, good for property ownership records, establishing credit lines and other economic behavior. But first, the biometrics database will be “MOI’s data,” in the hands of the security services — the legacy of ten years of U.S. detention operations in Afghanistan.

Credit: DoD Biometrics

Tags: , , ,
Posted in Articles |


Biometric scanners raise privacy concerns

Aug 23rd, 2010 | By | Category: Articles

By Demian Bulwa • San Francisco Chronicle | Posted: Monday, August 23, 2010 12:15 am | No Comments Posted

Share

OAKLAND, Calif. • When the 24 Hour Fitness chain recently installed finger scanners as a way of verifying members’ identity, it was a public première of sorts for a powerful and fast-expanding technology — and a test of whether consumers will embrace it.

The scanners, which came to the chain’s 60 Bay Area gyms this month, are a form of biometrics, in which people are recognized through a unique physical quality. Although 24 Hour Fitness checks fingers, biometric devices can verify people’s identity based on the contours of hands, eyes and faces, a voice, even a scent or a style of walking.

The technology has become far more accurate and affordable in recent years, allowing it to move beyond longtime police and military uses and to be hailed as a potential solution to the menace of identity theft.

Corporate America has taken notice, as have privacy advocates, who say consumers ought to tread cautiously into a largely unregulated field.

Many companies now have employees punch in with biometrics. At schools, the devices restrict access or allow students to pay for subsidized lunches. The gym at California State University Chico uses hand scanners, while Walt Disney World scans the fingers of pass-holders. In some countries, finger scanners are built into ATMs.

“It’s just part of our cyber-existence these days,” said Dan Miller, a senior analyst at Opus Research in San Francisco, which has focused on voice verification. “The neat thing about biometrics is that you are the thing that identifies you.”

The novelty of the technology, though, prompted an array of reactions at 24 Hour Fitness. Outside a downtown Oakland gym one morning, many customers said they had signed up without reservation for the new “Cardless Check-in” system, seeing only speed and convenience.

“Why not? It’s cool,” said Michael Nguyen, 38, an engineer from San Jose. “It’s not a big deal.”

But others — some of whom refused to participate in the program, which is voluntary — felt as if they had stumbled into a science fiction plot. They worried that the gym was going to do something sinister with their scan, while admitting they couldn’t think of exactly what that would be.

“The only time I ever saw that before was in the movie ‘Total Recall,’” said Isaac Thomas, 36, a Caltrans worker from Vallejo. He said he had submitted to scanning but added, “Now I’m wondering what they’re going to do with my fingerprint.”

“I did not do it,” said Jenica Babbitt, 35, a social worker from Oakland. “I don’t know why I didn’t do it. It just seems weird.”

Another woman said she was concerned about the scanners but for a different reason: She often sneaks into 24 Hour Fitness under a friend’s membership. She declined to give her name.

Company officials, concerned about the public perception of the scanners, tested them for months at some locations while soliciting feedback from members. They say the reaction was overwhelmingly positive, with just 3 percent of people declining to be scanned during the pilot program.

The officials say they have no ulterior motive. They say the scanners simply allow visitors to show up without a club card and an ID, while preventing nonmembers from sneaking in. The company also saves on paper, plastic and postage, having issued 1.9 million cards last year.

Members using the machines must first enroll, submitting to an initial scan. Then, during visits, they punch in a 10-digit code before placing the pad of one of their index fingers over a small window. Using the code, the system compares the finger to the one that was previously enrolled. False matches, or rejections, are rare, the company says.

The system doesn’t actually store fingerprints of the type that could be compared with prints from a crime scene, officials say. The machines, made by MorphoTrak of Alexandria, Va., map out unique points within the ridges of a finger, then convert that information into a binary code— ones and zeroes — that is encrypted.

If someone were able to crack the encryption, said Gary Jones, MorphoTrak’s senior manager for biometric security products, “it would still be impossible to reverse-engineer the information into a person’s fingerprint image.”

Two privacy experts who have followed biometric technology said that, in isolation, the health club’s program may be perfectly safe. But they said consumers should be certain that biometric scans taken at places such as 24 Hour Fitness are stored securely and not used for any other purpose.

It is conceivable, they said, that a law enforcement agency could figure out a way to compare fingerprints with a database such as the one kept by 24 Hour Fitness. It’s also possible, they said, that finger scans could be stolen as credit card numbers are.

Jared Kaprove, an attorney who focuses on domestic surveillance at the Electronic Privacy Information Center in Washington, said, “It’s easy to get a credit card reissued, but you can’t get your fingerprints reissued.”

Posted in Medical, National on Monday, August 23, 2010 12:15 am Updated: 11:26 pm.

Tags: , , , , , ,
Posted in Articles |


Why no one wants DHS to play cyber mall cop

Jul 25th, 2010 | By | Category: Articles

The public has repeatedly rebuffed attempts by the federal government to centralize identification management

By Mike Spinney – Jul 22, 2010

Mike Spinney is a senior privacy analyst at the Ponemon Institute, which conducts independent research on privacy, data protection and information security policy.

The Homeland Security Department recently announced an initiative aimed at creating a more secure system of online identification. According to its Web site, the National Strategy for Trusted Identities in Cyberspace seeks to “improve cyberspace for everyone — individuals, private sector and governments — who conducts business online.”

That’s certainly a noble goal. But the very existence of NSTIC begs two very important questions: Does protecting me and my fellow citizens while we transact business online fall within the department’s areas of responsibility? And does DHS truly believe it can do what the private sector, driven by a clear and compelling profit motive, has yet to successfully accomplish?

The answer to both questions is a resounding no. DHS should focus on doing what its name implies — protecting the homeland — and resist the urge to demote itself into the role of national cyber mall cop.

I say this not to demean the department, which shoulders a weighty load in addressing the manifold threats to our shores in this age of terrorism, but because any effort by DHS to create a voluntary trusted identity program is doomed to fail.

The recent experience and backlash associated with Real ID — rebuffed by the general public and legislatively rejected by 11 states before being scrapped — and high-tech passports — subject to ongoing criticism for their security vulnerabilities — demonstrate that the public is uneasy at best and at worst dead set against any attempts by the federal government to centralize identification in any form. Another national identification storm cloud is gathering on the horizon in the form of the Biometric Enrollment, Locally-stored Information, and Electronic Verification of Employment provision of pending immigration reform. With every attempt at using technology to track citizens, George Orwell’s shadow grows longer.

Conspiracy theories aside, lessons learned from the evolution of Social Security numbers into a de facto national financial credential — in spite of being prohibited by the law that created them for any use other than the management of Social Security benefits — should be enough to remind us of what can happen with a national identification program even when it is conceived with the best of intentions.

Of course, DHS would not be the first organization to fail at creating a broadly successful universal digital identifier. Devices such as smart cards and tokens have been in use for years and are effective for managing identity-based access to secure enterprise systems. But such technology works best in a single organization because cost and management issues temper their advantages in broader applications.

At the consumer level, where individuals might be using multiple identities for a broad range of applications, any secure identity system would need to take into account the highly complex vagaries of human behavior. Doing so successfully in the private sector would be a feat with a multibillion-dollar payday — and there’s plenty of money and brainpower being spent on that effort already.

Consider, too, the challenges DHS faces in successfully launching a trusted identity program when the agency lacks the trust of the general public. In the Ponemon Institute’s annual Privacy Trust Study of the United States Government, DHS ranked 70th among the 75 federal agencies studied. The Citizenship and Immigration Services agency and Customs and Border Protection agency, both of which are part of DHS, ranked 74th and 75th, respectively.

If DHS believes that a more secure online experience will enhance homeland defense, that goal would be better served by the creation of an educational program that makes people more aware of how to safely conduct online activities. When you get beyond the Beltway, you find that too many people are making unsafe decisions online not because the technologies and techniques are lacking but because they simply don’t know any better. If left to persist, public ignorance will be the downfall of any trusted identity strategy.

Tags: , , , , , , , , ,
Posted in Articles |


The fake passport blog – part 2

Jul 21st, 2010 | By | Category: Articles


In a country where Nepali’s, Bangladeshis and Pakistani’s can practically walk across the border – why should a terrorist bother to fake a biometric passport?

It could come useful in certain situations. Why would someone like David Headley risk a clandestine crossover, when he could live in the best of hotels, mix in the most hallowed social circles – legally? It’s also a neat trick to shift blame to an Indian citizen, after a terrorist attack.

But an “attack” is not the only thing a cloned biometric passport can be used for. It can also be used to steal your identity. For cheap. If my last post made you believe it’s almost impossible to mess around with a biometric passport, I’m very sorry. Because this one – is about how it’s already been done. With equipment that costs less than ten thousand rupees.

Lukas Grunwald, a German security expert, did it in 2006. British newspapers reported on a similar stunt by Adam Laurie, in 2007. Jeroen Van Beek, a researcher in the Netherlands, actually walked into Amsterdam airport with a fake biometric passport made in the name of Elvis Presley. He was not stopped.

Just Google their exploits – most technically minded terrorists probably already have. Here’s a quick account of how they did it.

A biometric passport has a chip, about the size of the one in your mobile phone SIM. That chip is embedded in a radio transmitter, slightly smaller than your visiting card. The entire unit is then sealed, into the last, thick page of our passports. You’ll get one of these things when you apply to renew your passport.

Effectively – this passport is now a tiny radio transmitter. It emits radio signals at a certain frequency. And over those radio waves, it transmits the information stored in its chip.

If you have a radio scanner listening in on that specific frequency – you can intercept that data. You could be standing ten meters away, you wouldn’t even need to touch the passport. You could read it, then clone it.

I’ll get into the specifics later. But here’s why you should begin to get worried.

1.) Let’s say a terrorist knows he looks a fair bit like you. First, he’d clone all your passport details by eavesdropping on the chip. Then insert his new, cloned chip into a fake paper passport he’s already made.

He’d grow a beard or a pony tail – to confuse the airport guards. When they test his passport on their reader, it wouldn’t ring any alarms – after all it’s a perfect clone of a perfectly valid passport.

When they try to physically cross check his appearance against your facial image stored on the chip, they wouldn’t spot a difference. A biometric facial or fingerprint scanner would have rung alarms – but they’re very expensive and used at very few counters. So a terrorist COULD cross borders – using YOUR passport details.

There is also a psychological problem – if the machine says a passport is OK, airport officials will tend to believe it and drop their guard. They won’t bother to do a more careful physical check. Because that would take more time – and after all wasn’t the biometric passport meant to save time at check in counters?

2.) Or let’s say it’s scamsters who want to target you. The postman or courier boy who delivers your passport home, could copy details from its chip, without even opening the envelope. So could a hotel attendant abroad – when you show him your passport to book a room. Among those details, will be an exact digital copy of the first page of your passport.

This first page is something we often photocopy. We use it as a proof of identity – to open a bank account, to apply for a new phone connection, for a driving license etc. The scamster could send that first page to an Indian bank and open a new account in your name. And funnel in dirty money into it, without you ever knowing.

3.) There’s another loophole in the “Biometric Passport as extra security” scheme. When you walk into a country like the US with your passport, your info is not only scanned and crosschecked – it’s also stored on their servers for a very long time. This supposedly happens to all passports presented at immigration – part of their “War on Terror” is keeping track of the details and frequency of people’s visits.

In theory, a corrupt official in the department could gather your private data and sell it to people on the black market. Right now – someone else can’t easily match your unique biometrics. But technology gets better everyday, so a leak in the department would mean a terrorist could walk around with your identity.

4.) Another pinprick in the “security” angle. At least one researcher has shown how to trigger a small bomb when it comes close enough to radio signals transmitted by a particular country’s passport. Terrorists could also use a similar technique can to single out people of a particular country from a group – and target them for kidnapping/elimination.

It’s not just passports. The technology can be used to eavesdrop and clone other RFID or Radio Frequency Identification Devices. That includes the card you use to get entry into your office, your new driving license and perhaps even the upcoming UID or Universal Identity card.

Getting back to the passports. Inexpensive Radio Frequency scanners can easily be bought online. You could also build one by modifying the Bluetooth receiver on your PC. Software like Golden Reader, that let you communicate with a passport chip, are easily available on the net. The International Civil Aviation Organization or ICAO – the nodal agency behind the biometric passport movement, has it on its website.

When held over a passport reader at the airport, the chip and the reader first challenge each other with a code. Once each is satisfied the other’s a genuine party – the chip transmits the info it carries to the reader.

To prevent people from eves-dropping on this exchange, the designers of biometric passports used a simple trick. They printed a twenty four character, two line strip of data on one of the pages of the passport.

This “Strip” is called a “Machine Readable Zone”, or MRZ. Only after swiping this strip through a machine, would the passport reader be able to generate a valid challenge that the passport chip would respond to. So whoever wants to read the passport, would have to have it open, in his hand.

Smart. The problem is, the characters they’ve decided to print on that strip. Your date of birth, your passport number, its date of expiry and so on – in a specific pattern.

Clever programmers can guess those details. Your DOB, they find from sites like Facebook. From public databases online – they observe patterns in a long series of passport numbers. They also find out the number of passports issued everyday in the country.

They feed all that research into a maths formula that’s often used by companies to generate things like random credit card numbers. And crack the MRZ of your passport, on a normal home PC, in under two hours. The big expense – about Rs 10,000 for a radio scanner. With the MRZ code, a terrorist or scamster can suck data from your chip, standing upto ten meters away at the check in counter.

Governments could of course put in place a more complex passport numbering system. But though such demonstration attacks have been widely reported in the foreign press, they haven’t moved on this yet.

When someone like a postman has the luxury of holding your physical passport in his hand, he can suck it dry with another trick. He swipes the passport against his radio scanner many, many times.

The more the number of swipes, the higher the chance of the computer mathematically guessing the security code. In an ATM, if you enter the wrong code thrice – you’re locked out and can’t withdraw any money. A similar safety feature hasn’t yet been built into these passport chips.

A small backgrounder on how all this started in the first place. After 9/11, America decided that all foreigners entering its borders would need to have machine readable passports with biometrics – on the assumption that these would be tough to forge.

It demanded this of the 27 countries that had a visa waiver agreement with it. Most of Europe fell in line and soon, the rest of the world.

After researchers publicly carried out attacks on these passports, FIDIS, or the “Future of Identity in the Information Age” – a European Union funded body called the technology used in them “poorly conceived”.

“European governments have forced their citizens to adopt documents which dramatically reduce their security and privacy and increase the risk of identity theft.”

The Indian Government however – doesn’t seem to have listened.

Tags: , , , , , ,
Posted in Articles |


The White House: The National Strategy for Trusted Identities in Cyberspace

Jun 28th, 2010 | By | Category: Articles

Posted by Howard A. Schmidt to the White House Blog – on June 25, 2010 at 02:00 PM EDT

Cyberspace has become an indispensible component of everyday life for all Americans.  We have all witnessed how the application and use of this technology has increased exponentially over the years. Cyberspace includes the networks in our homes, businesses, schools, and our Nation’s critical infrastructure.  It is where we exchange information, buy and sell products and services, and enable many other types of transactions across a wide range of sectors. But not all components of this technology have kept up with the pace of growth.  Privacy and security require greater emphasis moving forward; and because of this, the technology that has brought many benefits to our society and has empowered us to do so much — has also empowered those who are driven to cause harm.

Today, I am pleased to announce the latest step in moving our Nation forward in securing our cyberspace with the release of the draft National Strategy for Trusted Identities in Cyberspace (NSTIC).  This first draft of NSTIC was developed in collaboration with key government agencies, business leaders and privacy advocates. What has emerged is a blueprint to reduce cybersecurity vulnerabilities and improve online privacy protections through the use of trusted digital identities.

The NSTIC, which is in response to one of the near term action items in the President’s Cyberspace Policy Review, calls for the creation of an online environment, or an Identity Ecosystem as we refer to it in the strategy, where individuals and organizations can complete online transactions with confidence, trusting the identities of each other and the identities of the infrastructure that the transaction runs on. For example, no longer should individuals have to remember an ever-expanding and potentially insecure list of usernames and passwords to login into various online services. Through the strategy we seek to enable a future where individuals can voluntarily choose to obtain a secure, interoperable, and privacy-enhancing credential (e.g., a smart identity card, a digital certificate on their cell phone, etc) from a variety of service providers – both public and private – to authenticate themselves online for different types of transactions (e.g., online banking, accessing electronic health records, sending email, etc.). Another key concept in the strategy is that the Identity Ecosystem is user-centric – that means you, as a user, will be able to have more control of the private information you use to authenticate yourself on-line, and generally will not have to reveal more than is necessary to do so.

The Department of Homeland Security (DHS), a key partner in the development of the strategy, has posted the draft NSTIC at www.nstic.ideascale.com. Over the next three weeks (through July 19th), DHS will be collecting comments from any interested members of the general public on the strategy. I encourage you to go to this website, submit an idea for the strategy, comment on someone else’s idea, or vote on an idea. Your input is valuable to the ultimate success of this document. The NSTIC will be finalized later this fall.

Howard A. Schmidt is the Cybersecurity Coordinator and Special Assistant to the President

Tags: , , , , , ,
Posted in Articles |


E-Passport a Privacy Concern

Jun 6th, 2010 | By | Category: Articles

Yosie Saint-Cyr

It was recently reported that Passport Canada has issued 25,000 biometric passports, and plans to issue them to all Canadians by 2011. The government is introducing e-passports to enhance security, fight fraud, reduce identity theft and meet international counter-terrorism measures already in use in travel documents in over 60 countries, including the United States, the European Union, Australia and Israel. The e-passport will now be valid for a period of 10 years (thank you!—that’s an improvement at least).

A biometric passport has a data chip inside it that can be read electronically. The chip contains information about the holder’s face—such as the distances between eyes, nose, mouth and ears—which authorities can use to identify the passport holder. These details are taken from the holder’s passport photograph. The chip also holds the information that is printed on the personal details page of the passport. Biometric details are unique to each citizen, like a fingerprint, the iris of the eye and facial features.

The US Electronic Privacy Information Centre (EPIC) describes the privacy issues and risks associated with facial recognition technology (FR) in the following manner:

Devices using biometric identifiers attempt to automate this (FR) process by comparing the information scanned in real time against an ‘authentic’ sample stored digitally in a database. The technology has had several teething problems, but now appears poised to become a common feature in the technological landscape. … There are significant privacy and civil liberties concerns regarding the use of such devices that must be addressed before any widespread deployment.” (Emphasis added.)

EPIC has identified six major areas of concern:

Concern Privacy Issue
Storage How is the data stored, centrally or dispersed? How should scanned data be retained?
Vulnerability How vulnerable is the data to theft or abuse?
Confidence How much of an error factor in the technology’s authentication process is acceptable? What are the implications of false positives and false negatives created by a machine?
Authenticity What constitutes authentic information? Can that information be tampered with?
Linking Will the data gained from scanning be linked with other information about spending habits, etc.? What limits should be placed on the private use (as contrasted to government use) of such technology?
Ubiquity What are the implications of having an electronic trail of our every movement if cameras and other devices become commonplace, used on every street corner and every means of transportation?

Passport Canada has indicated that it has taken measures to avoid or mitigate the above privacy risks. Several summary reports dealing with these issues and action taken are available on the Passport Canada website.

Data on the chip is protected in various ways, including: a “digital signature”, which shows that the data is genuine and which country has issued the passport; access control, where a “chip protocol” prevents the data being read without the passport holder’s knowledge; and a digital technique that confirms the data on the chip was written by an authorized regional passport department and has not been changed. Also, the chip can only be read within 10 centimetres from a chip reader, so it cannot be accidentally read.

However, the Canadian Civil Liberties Association (CCLA) still believes that privacy concerns are an issue and have not all been dealt with.

In a recent report, the CCLA indicated that new technologies such as biometric passports should be implemented with adequate legal safeguards. The group is interested in knowing what measures Passport Canada has taken to date, and intends to continue acting to ensure the civil liberties of Canadians are being protected, including the rights of privacy and mobility.

Moreover, the CCLA shares the same privacy and accuracy concerns (in PDF) on the introduction of biometric passports (e-passports) in Canada as EPIC. They are:

  • “Function creep”, which means using the information in the future for a purpose beyond the original purpose
  • Third party access to the information to link the information to that of the third party without the consent of the individual
  • Centralized retention of the information
  • Loss of control by individuals on the use and dissemination of one’s personal information

In addition, Canadians travelling with biometric passports will be subject to the privacy practices of other countries. This means, for example, that foreign databases might store Canadian citizens’ personal identifying information. The CCLA would like to know how Passport Canada plans to handle this inevitability? And rightly so. Privacy International has reported that because of biometric passports, the International Civil Aviation Organization (ICAO), would have a database of over a billion people worldwide by 2015. Yikes!

The CCLA has stated—and I totally agree with them:

While Canadian citizens understand they have restricted privacy rights at international borders, they are not necessarily consenting to the information contained on the RFID chip in the passport being stored in a foreign government’s database.”

Furthermore, the CCLA brought up the issue that faces are constantly changing, and facial biometrics open a Pandora’s box for mass surveillance by states of individuals, with a corresponding chilling effect on many civil liberties. As a fine example, take the 2009 case of Suaad Hagi Mohamud, a Canadian woman who was erroneously accused by Kenyan border officials of impersonation because they thought she did not look like her passport photo. Canadian consular officials concurred that she was an imposter and voided her passport. She was stranded in Kenya for three months before DNA evidence proved her identity.

As I was reading the CCLA’s privacy and accuracy concerns on the introduction of biometric passports in Canada, a story broke about misuse of passport information. A border guard used women’s passport details to hit on them later on Facebook (of course). The Canada Border Services Agency has known about the problem since last October when it received a complaint. The article states that the agency refused to release the name of the employee subject of the complaint, or information about whether the employee was disciplined or terminated.

It is evident that biometrics, and the collection of personal biometric information, raises obvious significant privacy concerns. It’s easy to see that this information can be used and misused. Yes, maybe it is a strong authentication measure, but the invasion of privacy and potential for misuse is in my opinion very undesirable.

Tags: , , , , ,
Posted in Articles |


Next Page » 1 2 3 Next Page »