Biometrics: Subject to Privacy Violations and Database Breaches

 Biometrics: Subject to Privacy Violations and Database Breaches

When signing on to one's computer, mobile phone, and other devices, it is inconvenient to remember a pesky password; Especially nowadays, with it being essential that every item and every website must have a different password. It is no wonder that biometrics is becoming popular amongst mobile and computer devices. Nevertheless, how safe is biometrics? What happens to one's biometric data once it has been entered into the device? The even more critical question is, can one's biometric data be hacked? Biometrics, though convenient, has several faults that people should exercise caution with, it is not as safe as it may seem.

Biometrics has become part of the American culture and will most likely continue to flourish and become more robust. However, those who work with biometrics such as businesses, governments, and IT professionals must understand the risk associated with biometrics and take proper precautions to prevent more data breaches. The carelessness shown by Suprema, Anthus Tecnologia, US office of Personnel Management, and the Tampa Florida Police department shows the consequences of apathy. Yes, businesses are going to be hacked, and there will be data breaches and doxing of companies and individuals. However, it is unethical not to take every possible precaution to prevent malicious actors from breaching databases and possibly releasing the information on the deep web.

Another question that must be raised with biometrics becoming increasingly innovative is the use of it by governments and police departments to identify potential criminals. Is it ethical for a police officer to stop someone because of facial recognition used to identify suspects? Soon people will be stopped because their walking gait matches a suspect, is that even justifiable? Some may even say it is unethical and an invasion of privacy.

 

Biometrics is a technology that uses the characteristics of one's body, such as facial recognition and fingerprints, in order to authenticate the identity of the person (Grand, 2002). However, there are more types of biometrics than just facial recognition and fingerprints. There are now several different ways to authenticate one's identity through biometrics. Some biometrics used are iris scans, voice signature, hand veins, ears, DNA, and typing rhythm. Even one's walking gait can be used to identify a person with the biometric authentication process (Sarkar, & Singh, 2020).  With this new technology at hand, who needs to remember a pin or password? However, with convenience comes a price that many do not think about due to lack of education and awareness.

Seemingly biometrics is a new technology to general users; However, it has been around for a while. In 1977, biometrics was installed at a Wall Street firm (Grand, 2002). Though Wall Street would use such professedly secure technology, there are many risks associated with it. In order to understand the vulnerabilities, one must know where biometrics are stored. Biometrics are stored in a database on a trusted back end server (Grand, 2002). The other question is, can these databases and servers be hacked, and what is the danger? The answer is yes, and the danger is that there are no laws against sharing biometric data (Memon, 2017); additionally, unlike pins and passwords, people cannot change their physical characteristics.

  Biometrics has some faults that may be considered unethical. For example, biometrics are sometimes easy to fake, and there are potential programming issues that can cause the potential to be hacked. Even more frightening is Homeland Security, FBI, and many police departments use biometric technology to identify perpetrators and foreigners. Homeland security has gone as far as sharing iris and facial recognition with the FBI of foreigners (Memon, 2017). Another example of law enforcement using biometrics is Tampa Florida's Police department. The police department was using facial recognition to catch suspects. However, this technology failed them. In 2002, the American Civil Liberties Union proved that Tampa Florida's Police department had arrested 14 innocent civilians and failed to catch the real perpetrators using their facial recognition database (Grand, 2002).  Not only has the biometrics proved to be faulty, but there are privacy issues with this technology. It is almost as if big brother is setting in a room watching our every move. The movie the Minority Report is becoming more and more a reality as this continues. Indeed, the privacy risk associated with biometrics is real, but even more so is the risk of being hacked.

Like other sensitive information, biometrics needs to be encrypted and secured with robust networking security. However, not all encryption is capable of protecting biometrics. For example, according to CNET (2020), a Bazillion company, Antheus Tecnologia, was hacked earlier this year. Their server had 76,000 unique fingerprints along with their employee's personal information. Unfortunately, the fingerprints were encrypted in binary code, which the hackers were able to reverse back into the fingerprints. The fingerprints were distinguished by using bifurcation (Dividing the biometrics into two parts) and ridge ending data (Hautala, 2020). Another significant exposure happened in 2015 when the US office of personal Management failed to protect their employee's background checks. The hackers were able to get background checks in addition to getting one million fingerprints (Hautala 2020). It is a business's ethical responsibility to ensure that backend servers and databases are secure. Both Anthus Tecnologia and the US Office of Personnel Management are prime examples of why it is vital to have proper encryption and security when it comes to biometrics and sensitive data.

 One of the most popular biometric characteristics that are often used is fingerprints. However, if the company does not take proper precautions to store the fingerprint, a malicious person can easily attain them. According to Forbes magazine (2019), Suprema  (with 7,7000 companies, banks, and governments worldwide) had a significant data breach in 2019. Suprema is responsible for fingerprints for mobile authentication, but they are also responsible for the time and attendance cards of companies. It is said that they have over 28 million records containing biometric data such as fingerprints, facial recognition, and security clearance information leaked during the data breach. How does this happen? Once again, the company did not take proper care of encryption; they saved the actual fingerprint of the person instead of a hash fingerprint. The difference is a hash fingerprint cannot be reverse engineered. Essentially suprema left the whole fingerprint for the hacker (Doffman, 2019). Why would a company with so much data not take every precaution they could to protect their clients?

Conclusion

          Most likely, biometrics will become more advance and perhaps even more invasive. With this robust technology, it is essential that governments, businesses, and IT professionals take precautionary measures to ensure that biometric data is protected and adequately encrypted. Though there is always the potential for a data breach, it is unethical to show apathy and disregard for personal information. The question remains is it ethical for law enforcement to pick a person based on biometric data? With biometrics such as facial recognition and fingerprints on mobile devices, one must use caution before entering information. One must ask themselves, is the convenience of not having to type in a password worth the risk? 

 

 

 

 

References

Doffman, Z. (2019, August 14). New Data Breach Has Exposed Millions Of Fingerprint And Facial Recognition Records: Report. Retrieved August 14, 2020, from https://www.forbes.com/sites/zakdoffman/2019/08/14/new-data-breach-has-exposed-millions-of-fingerprint-and-facial-recognition-records-report/

Grand, J. (2002). Digital dangers: do biometric solutions offer a false sense of security. (biometrics). E-Business Advisor, 20(7), 62.

Hautala, L. (2020, March 11). Thousands of fingerprint files exposed in unsecured database, research finds. Retrieved August 14, 2020, from https://www.cnet.com/news/thousands-of-fingerprint-files-exposed-in-unsecured-database-research-finds/

Memon, N., "How Biometric Authentication Poses New Challenges to Our Security and Privacy [In the Spotlight]," in IEEE Signal Processing Magazine, vol. 34, no. 4, pp. 196-194, July 2017, doi: 10.1109/MSP.2017.2697179.

Sarkar, A., & Singh, B. K. (2020). A review on performance,security and various biometric template protection schemes for biometric authentication systems. Multimedia Tools and Applications, (2020). https://doi.org/10.1007/s11042-020-09197-7