Are biometrics as safe as we think?

An intel­li­gence agent stalks a cor­ri­dor, land­ing on an impos­ing secu­ri­ty door. Lean­ing into a pan­el that brush­es its frame, they put their face into posi­tion and, with a sat­is­fy­ing series of com­put­erised bleeps and boops, their iden­ti­ty is con­firmed – the por­tal opens.

These body-pow­ered gate­ways were not long ago firm­ly in the realm of sci­ence fic­tion. Yet today, most of our devices include fin­ger­print scan­ners and facial recog­ni­tion soft­ware. 

Our unique bio­log­i­cal traits make bio­met­rics a secure and con­ve­nient means to authen­ti­cate our iden­ti­ty. Giv­en the alarm­ing fre­quen­cy that plain-text pass­words are leaked online, it’s lit­tle sur­prise that con­sumer tech­nol­o­gy com­pa­nies and enter­pris­es are turn­ing to bio­met­ric authen­ti­ca­tion like voice, face ID and fin­ger­prints for their users.

“Increas­ing the length and com­plex­i­ty of pass­words increas­es their resilience to a so-called brute-force attack, which attempts to try all the pos­si­ble com­bi­na­tions of char­ac­ters,” says Steven Fur­nell, IEEE senior mem­ber and pro­fes­sor of cyber secu­ri­ty at the Uni­ver­si­ty of Not­ting­ham. “Advice from the Nation­al Cyber Secu­ri­ty Cen­tre is to build longer pass­words by com­bin­ing three ran­dom words – unfor­tu­nate­ly, this isn’t always guar­an­teed to work, as some sys­tems and ser­vices still insist on check­ing com­po­si­tion and demand a mix of char­ac­ter types.”

No mat­ter the com­plex­i­ty of the passphrase, they can’t com­pete with our bio­log­i­cal infor­ma­tion. While a sin­gle pass­word could leak onto the web and cause all kinds of chaos, flesh and blood are a lot trick­i­er to copy. So bio­met­rics would seem an appro­pri­ate alter­na­tive. Indeed, Fur­nell says they’re the “key to non-intru­sive, fric­tion­less secu­ri­ty”.  

But there may be hid­den dan­gers to relin­quish­ing our bio­log­i­cal infor­ma­tion to the dig­i­tal sphere, and what feels fric­tion­less today could come at a cost in future. 

Take the US’s with­draw­al from Afghanistan in 2021. It didn’t just leave cit­i­zens to the mer­cy of the Tal­iban: it left their bio­met­ric data up for grabs too. In 2007, the US tri­alled a tool there called Hand­held Inter­a­gency Iden­ti­ty Detec­tion Equip­ment (HIIDE), using these devices to record fin­ger­print, iris, and facial data. Ini­tial­ly devel­oped to locate insur­gents, US forces extend­ed their use of HIIDE to those who coop­er­at­ed. Ulti­mate­ly, the per­son­al data of more than 1.5 mil­lion Afghans was matched against a data­base of bio­met­ric data and stored in a cen­tralised repos­i­to­ry. When this fell into the wrong hands, it revealed indis­putable infor­ma­tion about the peo­ple the US had worked with and put them at risk.

These data­bas­es, whether cre­at­ed inten­tion­al­ly or as acci­den­tal by-prod­ucts, are one of the chief issues of bio­met­ric secu­ri­ty, says Britain’s Bio­met­rics and Sur­veil­lance Cam­era Com­mis­sion­er, Fras­er Samp­son. 

“At a very sim­plis­tic lev­el, bio­met­rics is about mea­sur­ing and match­ing. And for match­ing, a bio­met­ric needs a com­para­tor,” Samp­son says. “A col­lec­tion of com­para­tors is a data­base. Essen­tial­ly, if you retain bio­met­ric mate­r­i­al, you’ve cre­at­ed a data­base.”

There are many issues with cen­tralised data­bas­es; one is that they’re prone to leak­ing. When you throw bio­met­ric data into the mix, com­pli­ca­tions that are rem­i­nis­cent of humanity’s dark­est moments come to the fore. In the field of bio­met­ric sur­veil­lance, says Samp­son, one person’s idea of pro­tec­tion may be anoth­er person’s oppres­sion.

“While human­i­tar­i­an uses of bio­met­ric iden­ti­ty can save lives, the same bio­met­ric data can be used for dom­i­na­tion and exploita­tion,” says Samp­son. “It can be used to mar­gin­alise and per­se­cute peo­ple on grounds of their race, eth­nic­i­ty and reli­gious beliefs.”

The ben­e­fits of bio­met­rics – their unique­ness, their incon­testable ties to real humans – are exploitable as their weak­ness­es, too.

The abil­i­ties of deter­mined, capa­ble hack­ers with resources should nev­er be under­es­ti­mat­ed. While bio­met­rics are gen­er­al­ly dif­fi­cult to spoof right now – espe­cial­ly as, for many hack­ers, low­er-effort attacks are more fruit­ful – what is true today may not be the case tomor­row, as attack­ers lever­age bet­ter com­put­ing and become more sophis­ti­cat­ed.

“Nobody I’m aware of has yet been able to demon­strate an unhack­able sys­tem,” Samp­son says, “or an unreach­able data­base. The stakes make it worth it, whether that’s hos­tile state activ­i­ty or recon­nais­sance, or com­mer­cial hack­ing. If there’s a com­mer­cial val­ue to crack some­thing, you can sell that.”

As the use of bio­met­rics increas­es and con­verges, there will prob­a­bly be few­er, but big­ger, data­bas­es, if these trends con­tin­ue – reduc­ing the like­li­hood of breach­es and error, but poten­tial­ly also increas­ing the impact should these leaks hap­pen. 

How­ev­er, adds futur­ist and co-author of Six Prin­ci­ples for Self-Sov­er­eign Bio­met­rics, Heather Ves­cent, it’s “not impos­si­ble, but it is very hard for some­one to spoof a bio­met­ric”. 

It’s unlike­ly, then, that cyber researchers and attack­ers will arrive at an impasse soon – locked in an end­less game of Whac-A-Mole, as is the Sisyphean case with tra­di­tion­al perime­ter defence. 

But, Ves­cent adds, the best secu­ri­ty on the plan­et can be use­less if stored incor­rect­ly. 

“Any data is only as secure as the sys­tem in which it is stored,” Ves­cent says. “Some­times these sys­tems can be eas­i­ly penef­trat­ed due to poor iden­ti­ty and access man­age­ment pro­to­cols. This has noth­ing to do with the secu­ri­ty of bio­met­rics. It’s to do with the secu­ri­ty of stored data.

“This means the real con­cern about using bio­met­rics is about how data is stored, how secure the sys­tem is, and how much con­trol the own­er of the bio­met­ric has over it.”

In Six Prin­ci­ples, Ves­cent and her co-authors advise that to reduce these risks, bio­met­rics should not be stored in cen­tralised data­bas­es. 

Cru­cial­ly, users should own, and be able to con­trol, their bio­met­ric data. This data should also be just one com­po­nent in a wider secu­ri­ty land­scape – for exam­ple, as a sup­ple­men­tary mea­sure, used to pro­vide con­fi­dence rat­ings, or in tan­dem with oth­er proven tech­niques such as passphras­es.

For Samp­son, one of the main ques­tions is avoid­ing the poten­tial for state over­reach. To pre­vent this, bio­met­rics-based ini­tia­tives should be con­duct­ed in part­ner­ship with trust­ed pri­vate sec­tor providers; these should be auditable, trans­par­ent, and con­duct­ed under agreed gov­er­nance arrange­ments and stan­dards. 

But before we race towards using our faces, fin­ger­prints, and voic­es as a salve for all our secu­ri­ty woes, per­haps it’s worth prop­er­ly con­sid­er­ing the poten­tial for unde­sir­able, sec­ond-order con­se­quences. After all, if we waive over all that makes us unique­ly human in the name of secu­ri­ty – what do we have left?