Our series on the collateral damage of a data breach has examined many probable outcomes that may result when your records are stolen. Our last article contemplated a geolocation information breach. In this article we discuss and contemplate the very serious ramifications of a biometric data breach.
The use of an individual’s physical traits as a means of identification and verification has a very long history, with documented systematic use dating back to 1858. As computers began being used for ever more critical tasks, the frequency of lost or compromised usernames and passwords naturally led engineers to conceive and build verification systems that would be free from forgetting and forgery weaknesses inherent in earlier systems. Such new verification systems based on difficult-to-forge and impossible-to-forget physical traits were thus deemed “safer” and more “secure.”
To be certain, attempting a direct, frontal infiltration on a modern fingerprint or retina scan or voice recognition system will prove difficult at best. The primary weakness of all such systems, though, is that keyed traits are stored as digital records in a database – and as we’ve already seen, anything stored on a database is subject to being breached and exfiltrated.
U.S. and Philippine Citizens put at Risk after each Government Hit by a Massive Biometric Data Breach
In November 2013 OPM suffered its first cyber attack and massive data exfiltration. In July of 2015 it suffered a second, related attack. The data lost between the two incidences included almost 3 million fingerprints of spouses, family members, and non-security clearance applicants. Then, in March of this year COMELEC (Philippine Commission on Elections) was attacked and 55 million voter registration and fingerprint records were stolen, including the records of more than 1 million Filipinos living and working abroad. Each of these incidences represents a massive biometric data breach of a government database. The fingerprint data was digitally stored to provide electronic search capabilities thought necessary for security and status verification purposes. But now that the data has been put into the public domain, many innocent individuals are exposed to significant, long-term potential collateral damage. A few of the potential forms of damage include:
- Fingerprint Data can be used to Create Replicas: With a prosthetic replica of a fingerprint, for example, an innocent person’s fingerprints can be left at a crime scene or used directly against a verification device to produce a false positive, granting access to locked valuables or confidential data.
- E-Ransom Attacks: A person’s physical traits stay with them for life – you can’t change them like a stolen credit card or a lost password. Considering the level of life-changing damage which may be done to a person after a biometric data breach, and the extremely long shelf-life of the stolen records, persons whose physical credentials have been compromised are exposed to long-term risk for e-ransom attacks.
- Digitized Physical Trait Records can be Altered: A convicted felon’s digital fingerprint data can be altered or an innocent person’s can be used to replace the data collected with a suspected criminal’s, or even worse, a terrorist’s. Imagine the devastation that could be caused to your life, employment status, and reputation in the community if the FBI identified you as a terror suspect based on your fingerprints!
We have barely scratched the surface of collateral damages that can occur with stolen fingerprints. Look at it this way, you can change your password, you can even change your SSN, but you can NEVER change your fingerprint or other physical traits. A few years of credit monitoring from the breached company cannot mitigate the potential collateral damage of a biometric data breach. Unfortunately, based on the laws today, the victims will have to bear such responsibility and burden from the exposure of their records for the rest of their lives.
In our next series installment, we’ll look at what is at stake if your digital privileged information is aired!
Contact ThreatModeler today to learn more about preventing data breaches at your organization.
