State Appeals Court Says Unlocking A Phone With A Fingerprint Doesn't Violate The Fifth Amendment

from the giving-The-Man-the-finger-no-longer-subversive;-actually-helpful dept

As was hinted heavily three years ago, you might be better off securing your phone with a passcode than your fingerprint. While a fingerprint is definitely unique and (theoretically...) a better way to keep thieves and snoopers from breaking into your phone, it's not much help when it comes to your Fifth Amendment protections against self-incrimination.

The Minnesota Appeals Court has ruled [PDF] that unlocking a phone with a fingerprint is no more "testimonial" than a blood draw, police lineup appearance, or even matching the description of a suspected criminal. (h/t Orin Kerr)

Diamond relies on In re Grand Jury Subpoena Duces Tecum, 670 F.3d 1335 (11th Cir. 2012), to support his argument that supplying his fingerprint was testimonial. In In re Grand Jury, the court reasoned that requiring the defendant to decrypt and produce the contents of a computer’s hard drive, when it was unknown whether any documents were even on the encrypted drive, “would be tantamount to testimony by [the defendant] of his knowledge of the existence and location of potentially incriminating files; of his possession, control, and access to the encrypted portions of the drives; and of his capability to decrypt the files.” Id. at 1346. The court concluded that such a requirement is analogous to requiring production of a combination and that such a production involves implied factual statements that could potentially incriminate. Id.

By being ordered to produce his fingerprint, however, Diamond was not required to disclose any knowledge he might have or to speak his guilt. See Doe, 487 U.S. at 211, 108 S. Ct. at 2348. The district court’s order is therefore distinguishable from requiring a defendant to decrypt a hard drive or produce a combination. See, e.g., In re Grand Jury, 670 F.3d at 1346; United States v. Kirschner, 823 F. Supp. 2d 665, 669 (E.D. Mich. 2010) (holding that requiring a defendant to provide computer password violates the Fifth Amendment). Those requirements involve a level of knowledge and mental capacity that is not present in ordering Diamond to place his fingerprint on his cellphone. Instead, the task that Diamond was compelled to perform—to provide his fingerprint—is no more testimonial than furnishing a blood sample, providing handwriting or voice exemplars, standing in a lineup, or wearing particular clothing.

Of course, it's what's contained in the now-unlocked device that might be incriminating, which is why Diamond pointed to In re Grand Jury as being analogous to the forced provision of a fingerprint. The court's rebuttal of this argument, however, doesn't make a lot of sense. It says the process that unlocked the device requires no knowledge or mental capacity -- which is certainly true -- but that the end result, despite being the same (the production of evidence against themselves) is somehow different because of the part of the body used to obtain access (finger v. brain).

In recounting the obtaining of the print, the court shows that some knowledge is imparted by this effort -- information not possessed by law enforcement or prosecutors.

Diamond also argues that he “was required to identify for the police which of his fingerprints would open the phone” and that this requirement compelled a testimonial communication. This argument, however, mischaracterizes the district court’s order. The district court’s February 11 order compelled Diamond to “provide a fingerprint or thumbprint as deemed necessary by the Chaska Police Department to unlock his seized cell phone.” At the April 3 contempt hearing, the district court referred to Diamond providing his “thumbprint.” The prosecutor noted that they were “not sure if it’s an index finger or a thumb.” The district court answered, “Take whatever samples you need.” Diamond then asked the detectives which finger they wanted, and they answered, “The one that unlocks it.”

This is something only Diamond would know, and by unlocking the phone, he would be demonstrating some form of control of the device as well as responsibility for its contents. So, it is still a testimonial act, even if it doesn't rise to the mental level of retaining a password or combination. (And, if so, would four-digit passcodes be less "testimonial" than a nine-digit alphanumeric password, if the bright line comes down to mental effort?)

Given the reasoning of the court, it almost appears as though Diamond may have succeeded in this constitutional challenge if he had chosen to do so at the point he was ordered to produce the correct finger.

It is clear that the district court permitted the state to take samples of all of Diamond’s fingerprints and thumbprints. The district court did not ask Diamond whether his prints would unlock the cellphone or which print would unlock it, nor did the district court compel Diamond to disclose that information. There is no indication that Diamond would have been asked to do more had none of his fingerprints unlocked the cellphone. Diamond himself asked which finger the detectives wanted when he was ready to comply with the order, and the detectives answered his question. Diamond did not object then, nor did he bring an additional motion to suppress the evidence based on the exchange that he initiated.

And so, in first decision of its kind for this Appeals Court, the precedent established is that fingerprints are less protective of defendants' Fifth Amendment rights than passwords.

Filed Under: fifth amendment, fingerprints, minnesota, self-incrimination

Why Making A Peace Sign In Public Is Now A Security Risk

from the and-not-just-for-political-reasons dept

The British have a number of traditions. Some, such as drinking tea, are famous around the world. Less well-known is a habit of revealing highly-confidential information by carrying pieces of paper in public that photographers using long-focus lenses are able to snap and then magnify to read. The Guardian wrote an entire article on the subject, detailing how numerous embarrassing leaks occurred in the UK because people forgot to put the documents they were holding in some kind of opaque folder. On one occasion, an anti-terror operation had to be brought forward when Britain's most senior counterterrorism officer walked around with top secret documents on display -- a blunder that cost him his job.

This mistake is so common that there are notices by the door of the UK Prime Minister's residence at Number 10 Downing Street reminding people not to walk out with confidential material that is exposed. The fact that there is a photographer with a long-focus lens who hangs around outside No 10 in the hope that they do precisely that shows how often they ignore this warning.

Although the Brits have practically turned this activity into another weird sport alongside cricket, it's not unknown in the US. For example, the following happened at the end of November last year:

Potential Donald Trump cabinet pick Kris Kobach accidentally leaked Department of Homeland Security plans when posing for a press photograph with the president-elect. Using photo editing tools, a zoomed-in view on the documents being carried by Kansas Secretary of State Kris Kobach reveals a plan to put Trump’s hard-line immigration platform into practice.

Aside from the carelessness of the people involved, the problem has arisen because long-focus lenses are now so powerful and commonly-deployed that it is relatively easy to capture a high-quality image of an exposed document so that its contents can be read. That's a problem that will only get worse as camera technology advances, especially combined with digital enhancement techniques. If this story on the BBC's website is to be believed, it's not just documents that are now at risk as a result:

A Japanese researcher says doing the peace sign in a photo could lead to your fingerprints being stolen.

They might be easy to recreate if your digits are "in focus with strong lighting".

That claim is from Isao Echizen, from the National Institute of Informatics (NIII), who says prints could then be made "widely available".

That's clearly a big problem at a time when fingerprints are increasingly being used to unlock digital devices, and to provide access to sensitive data. The British experience shows it's hard enough to shield confidential papers; keeping fingerprints out of high-resolution photos seems like an impossible task.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: fingerprints, photographs, privacy

Granted Warrant Allowed Feds To Force Everyone At Searched Residence To Unlock Devices With Their Fingerprints

from the hello-dystopia dept

Thomas Fox-Brewster of Forbes has dug up an unsealed memorandum in support of a federal search warrant demanding… all the fingerprints of every occupant in the searched residence.

FORBES found a court filing, dated May 9 2016, in which the Department of Justice sought to search a Lancaster, California, property. But there was a more remarkable aspect of the search, as pointed out in the memorandum: “authorization to depress the fingerprints and thumbprints of every person who is located at the SUBJECT PREMISES during the execution of the search and who is reasonably believed by law enforcement to be the user of a fingerprint sensor-enabled device that is located at the SUBJECT PREMISES and falls within the scope of the warrant.” The warrant was not available to the public, nor were other documents related to the case.

The memorandum goes on to point out that simply demanding fingerprints implicates neither the Fourth nor Fifth Amendments. But the additional permissions sought certainly do.

“While the government does not know ahead of time the identity of every digital device or fingerprint (or indeed, every other piece of evidence) that it will find in the search, it has demonstrated probable cause that evidence may exist at the search location, and needs the ability to gain access to those devices and maintain that access to search them. For that reason, the warrant authorizes the seizure of ‘passwords, encryption keys, and other access devices that may be necessary to access the device,’” the document read.

Not only are the devices being seized, but so are any passwords, which does carry some implications, but not necessarily at the point of seizure. It's the refusal to turn over passwords or encryption keys in the face of a court order that can result in contempt charges, and it's still less-than-settled that access information has no testimonial value.

But even the seizure of these devices in hopes of searching them later (but securing fingerprints to unlock them first) is a Fourth Amendment problem if they're accessed in nearly any way during the unlocking process. One court found, post-Riley, that simply opening a flip phone constituted a search. In that context, forcing a finger onto the phone and viewing the screen's contents could be considered a search -- and a warrantless one at that.

Of course, the government cited plenty of cases to back up its seizure, detention of residents, and its taking of fingerprints -- most of them at least 30 years old.

It also cited Holt v. United States, a 1910 case, and United States v. Dionisio, a 1973 case, though it did point to more recent cases, including Virginia v. Baust, where the defendant was compelled to provide his fingerprint to unlock a device (though Baust did provide his biometric data, it failed to open the iPhone; after 48 hours of not using Touch ID or a reboot Apple asks for the code to be re-entered.).

As for the Fourth, the feds said protections against unreasonable searches did not stand up when “the taking of fingerprints is supported by reasonable suspicion,” citing 1985′s Hayes v. Florida. Other cases, dated well before the advent of smartphones, were used to justify any brief detention that would arise from forcing someone to open their device with a fingerprint.

This is the reality of what the government is seeking: law enforcement officers detaining suspects and non-suspects alike and forcing them to apply their fingers to all locked devices on the premises. If this is the new normal for warrant service, it's time for the courts to step up and be a bit more aggressive in holding the government to particularity requirements.

Filed Under: 4th amendment, devices, fingerprints, search, unlocking, warrant

DailyDirt: Fingerprints And Watermarks On Everything?

from the urls-we-dig-up dept

Making copies of physical goods is becoming easier and easier all the time. Some folks want to make sure that all these physical items are authentic, devising fingerprinting or watermark technology to identify objects uniquely. Dollar bills, documents and all kinds of valuable things could be tracked with this kind of anti-counterfeiting tagging. Here are just a few other examples of making a mark on stuff that could be useful.

• SmartWater is a chemical fingerprint spray that can help identify thieves (who get caught) by covering them with a durable watermark. This stuff can stay on skin for months, and SmartWater has been a commercial product for decades now. [url]
• Actual fragments of DNA injected into underground wells could help track hydrothermal water for drilling optimal wells for geothermal energy production. DNA-encoded materials can identify where water flows underground, and they're a bit more environmentally friendly and durable than radioactive tracers or chemical dyes. [url]
• Wrinkled silica polymers can be formed into artificial fingerprints that could be used as anti-counterfeit tags. If artificially intelligent robots are going to take over the world someday, maybe we should give them fingerprints just like us. [url]

After you've finished checking out those links, take a look at our Daily Deals for cool gadgets and other awesome stuff.

Filed Under: anti-counterfeiting, dna, energy, fingerprints, geothermal energy, smartwater, watermark

FBI Doesn't Want Privacy Laws To Apply To Its Biometric Database

from the and-doesn't-want-to-let-citizens-know-how-THEIR-privacy-is-affected dept

The FBI has been building a massive biometric database for the last eight years. The Next Generation Identification System (NGIS) starts with millions of photos of criminals (and non-criminals) and builds from there. Palm prints, fingerprints, iris scans, tattoos and biographies are all part of the mix.

Despite having promised to deliver a Privacy Impact Assessment of the database back in 2012, the FBI's system went live towards the end of 2014 without one. That's a big problem, considering the database's blend of guilty/innocent Americans, along with its troublesome error rate. The FBI obviously hopes the false positive rate will continue to decline as tech capabilities improve, but any qualms about bogus hits have been placed on the back burner while the agency dumps every piece of data it can find into the database.

The FBI has shown little motivation to address Americans' privacy concerns by providing an updated Impact Assessment (the one it does have dates back to the program's inception in 2008), but has wasted no time in alerting legislators about its own privacy concerns.

On Thursday, the Justice Department agency plans to propose the database be exempt from several provisions of the Privacy Act -- legislation that requires federal agencies to share information about the records they collect with the individual subject of those records, allowing them to verify and correct them if needed.

The DOJ's comments reflect the FBI's desire to keep its newest tracking toy as secret as possible. It asks for a number of exceptions and justifies those with the same excuses it uses to withhold information from both courts and FOIA requesters.

First, there's the always-popular "but the bad guys will win" excuse.

[M]aking available to a record subject the accounting of disclosures from records concerning him/her would specifically reveal investigative interest by the FBI or agencies that are recipients of the disclosures. Revealing this information could compromise ongoing, authorized law enforcement and national security efforts and may permit the record subject with the opportunity to evade or impede the investigation.

[...]

Providing access could compromise sensitive law enforcement information, disclose information which would constitute an unwarranted invasion of another’s personal privacy; reveal a sensitive investigative technique; could provide information that would allow a subject to avoid detection or apprehension; or constitute a potential danger to the health or safety of law enforcement personnel, confidential sources, and witnesses.

This is the FBI's request for a legislator-approved, pre-emptive blanket Glomar, which will allow the FBI to continue to amass biometric records while drastically decreasing any citizen's attempt to see how much data the agency has amassed on them.

Beyond that, the FBI wants to be allowed to keep or destroy records as it sees fit. Again, this will help limit successful database inclusion challenges from concerned citizens. But the DOJ portrays complying with Privacy Act provisions as completely unfeasible.

[Exempt] from subsection (e)(5) because in the collection of information for authorized law enforcement purposes it is impossible to determine in advance what information is accurate, relevant, timely and complete. With time, seemingly irrelevant or untimely information may acquire new significance when new details are brought to light. Additionally, the information may aid in establishing patterns of activity and providing criminal leads. Most records in this system are acquired from state and local law enforcement agencies and it would be impossible for the FBI to vouch for the compliance of these agencies with this provision.

In sum, the FBI wants to amass a database of biometric information -- one that dumps non-criminals and criminals into the same pool of "possible suspects" -- that includes records from other agencies the FBI doesn't feel confident enough to vouch for, but has no problems using to perform investigations, deny positions to federal job applicants, etc. It would also like to ensure no one included in the database ever has access to the massive amount of information the agency has collected -- some of it unvetted -- that has the power to alter their futures drastically.

And it wants this all without living up to its own responsibilities -- like delivering its required Privacy Impact Assessment. Instead, it's arguing that the American public should be at the mercy of a database controlled by a secretive agency, one that appears to care far more for quantity than quality.

Filed Under: biometric database, biometrics, fbi, fingerprints, ngis, privacy

DailyDirt: Is It Time To Change Your Passwords (Again)?

from the urls-we-dig-up dept

Passwords are an everyday part of life now, but so are stories of millions of people having their login credentials stolen. It's easy to say that everyone should use better passwords, but how many people really want to remember to constantly change their passwords or get a 2-factor authentication call regularly just to check their emails? Sure, there are some systems that make it a bit easier to deal with 2-factor authentication, but the vast majority of users don't want to be bothered with the hassle at all. Here are just a few more security-related links to push you into re-thinking password laziness.

• A password like "MargaretThatcheris110%SEXY" isn't that secure against offline high-speed password cracking. Humans are really bad at making up random passwords, but that's what you need to do to maximize the security of your passwords. So we're back to suggestions like "correct horse battery staple" and other random (and long) passwords. [url]
• If only ransomware used weak passwords to decrypt files, maybe some folks wouldn't be so inconvenienced. But if you're a victim of a ransomware scheme, there's at least one decryption program from Kaspersky Lab that might help you out. [url]
• Windows 10 is going to support biometric logins using face recognition, iris detection and fingerprint scanners. Does anyone think this is really a significant advancement? The challenge of using various biometric systems doesn't seem like a solved problem just yet. [url]

After you've finished checking out those links, take a look at our Daily Deals for cool gadgets and other awesome stuff.

Filed Under: biometrics, face recognition, fingerprints, passwords, ransomware, security, two factor authentication, windows 10
Companies: kaspersky lab, microsoft

DailyDirt: Passwords? We Don't Need No Stinkin' Passwords

from the urls-we-dig-up dept

Fingerprint-based biometric security systems are everywhere now, but there are some well-known problems with using your fingerprints instead of a password. First off, you unconsciously leave copies of your fingerprints just about everywhere you go. Still, fingerprint sensors seem to be getting better and better. I'll stick to my 4-digit PIN for now, though, thanks, but if you like using your finger for your digital locks, check out these links.

• Qualcomm has an ultrasonic fingerprint sensor that captures three dimensional characteristics of a user's fingerprint by penetrating the outer layers of skin with sound. This sensor can more accurately detect fingerprint features when fingers are wet or slathered in hand lotion, but it might not be able to identify you correctly if you get a papercut or cracked, dry skin? [url]
• Vkansee has a high-resolution optical fingerprint sensor that claims to be able to detect the sweat pores of your fingertip. This sensor isn't available on any commercial smartphones, but presumably better biometric sensors are going to be embedded in more and more devices. Yay? [url]
• There are plenty of concerns about how accurate fingerprint identifications systems are -- with issues such as false positives and false rejection rates. One of the key aspects, though, is that fingerprints are not secret and not revocable. Some systems try to detect "liveness" to make sure a fingerprint is attached to a (hopefully healthy and not under duress) living person, and there are a few other approaches to guard against spoofing, but fingerprints aren't a perfect biometric. (And no perfect biometric system exists....) [url]

If you'd like to read more awesome and interesting stuff, check out this unrelated (but not entirely random!) Techdirt post via StumbleUpon.

Filed Under: biometrics, fingerprint, fingerprints, identification, passwords, pin, security, sensors
Companies: qualcomm, vkansee

FBI Rolls Out Biometric Database On Schedule, Accompanying Privacy Impact Assessment Still Nowhere To Be Found

from the move-along,-nothing-to-see-but-millions-of-faces dept

The FBI has just announced that all systems are go for its biometric database.

The Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Division announced today the achievement of full operational capability of the Next Generation Identification (NGI) System. The FBI’s NGI System was developed to expand the Bureau’s biometric identification capabilities, ultimately replacing the FBI’s Integrated Automated Fingerprint Identification System (IAFIS) in addition to adding new services and capabilities.

This puts the agency pretty much right on schedule for its stated goal of "full operational capacity in fiscal year 2014." As was to be expected from its earlier foot-dragging, the press release makes no note of the Privacy Impact Assessment that was supposed to precede the roll out.

The system itself has been in the works since 2008. Coincidentally, this is also the last time anyone at the FBI delivered a Privacy Impact Assessment. Since then, the database's sweep and power has increased immensely. The PIA promised in 2012 still hasn't been delivered and there's no indication at the FBI's website that one is right around the corner.

The release notes two other tools that will be folded into NGI.

As part of NGI’s full operational capability, the NGI team is introducing two new services: Rap Back and the Interstate Photo System (IPS). Rap Back is a functionality that enables authorized entities the ability to receive ongoing status notifications of any criminal history reported on individuals holding positions of trust, such as school teachers. Law enforcement agencies, probation and parole offices, and other criminal justice entities will also greatly improve their effectiveness by being advised of subsequent criminal activity of persons under investigation or supervision.

Rap Back sounds useful but its tracking of people in "trusted positions" does not include some very specific "trusted positions." This 2012 presentation on Rap Back [pdf] clearly delineates between "trusted" civilians and those exempt from ongoing criminal background monitoring.


Here's the relevant info in case you can't read/see the pic, Rap Back ongoing monitoring and notification service only targets these individuals.

Non-criminal justice applicants, employees, volunteers, and licensees;

Individuals under the supervision or investigation of criminal justice agencies.

Note that "supervision" doesn't mean employees of criminal justice agencies, but rather parolees and those on probation. Presumably, the criminal justice system will police itself, relying only on pre-employment screenings (if that). The problem is that employees with criminal history have been known to jump from agency to agency without their new employers knowing (or caring) about the incidents that forced the job change. Apparently, this is an acceptable situation despite the fact that the DOJ tends to ignore much of the misconduct that occurs in agencies under its command.

The Interstate Photo System sounds like license plates but is actually the FBI's facial recognition database. A high error rate and a flood of too-lo-res-to-be-useful photos hasn't stopped the FBI from pushing this system -- basically a searchable mug shot repository that includes millions of non-criminals just for the hell of it. To reach its lofty goals (52 million pics by 2015), the FBI is including generic federal employee records. The potential for the system to return non-criminals in searches for "candidates" remains high, but the FBI has reassuringly stated that it bears no legal responsibility if any of the 18,000 law enforcement agencies that have access arrest the wrong person.

An unvetted system that can be accessed by thousands is a huge problem. The FBI will join the NSA in hoarding massive amounts of irrelevant data with very little oversight. The hoarding mentality has taken over and everyone involved is hesitant to implement stringent minimization and disposal policies because of the irrational fear that something discarded might be needed later.

If and when the privacy assessment arises, I expect it will be filled with paragraphs that underplay the potential civil liberties violations, lots of explanations as to why there's no expectation of privacy in anything the government collects and some mumbling around the edges about minimization and access control.

While I realize that it's inevitable that the march of technology would lead to this sort of thing -- and while it does have several legitimate uses -- my biggest problem with these advances is that the FBI and others continually stress that it's the only way to keep up with evolving criminal behavior. The justifications deployed point to a constantly-rising criminal threat that has no basis in reality. I cannot buy into the narrative that the best way to combat crime (or terrorism, for that matter) is vast, untargeted databases.

The FBI focuses most of its assets on two opponents: drugs and terrorism. The first is exacerbated by years of bad legislation and policies, and for all the time and money spent, the war doesn't seem to be on the way to being won. The latter has devolved into the FBI's proprietary con game, wherein it sets up a mark or two and takes them down. Now, it's inviting the nation's law enforcement agencies to run searches on a database populated with non-hit data and leave them holding the bag when the inevitable occurs.

An updated privacy assessment isn't going to make this a better idea, especially when the FBI (and the law enforcement agencies that feed info to it) are blithely unconcerned that current background check databases are filled with people who were never criminally charged. An internal change is needed -- one that makes these agencies more accountable to the public for screwing up their lives. But no one up top is interested in fixing what's already broken. They just want to roll out new databases that grab more info. If the FBI insists this is the only way to fight crime effectively, then it needs to exercise the sort of vigilance and internal accountability it's never shown in the past. That starts with a detailed privacy assessment, delivered in a timely fashion. And it's already failed this small step.

Filed Under: biometric database, doj, fbi, fingerprints, privacy, privacy impact assessment

Texas Dept. Of Public Safety Quietly Starts Demanding Full Set Of Prints From Drivers License Applicants

from the respect-my-non-existent-authority! dept

The Texas Dept. of Public Safety has apparently decided that if you'd like to be allowed to drive a vehicle in the state, you'd also perfectly fine with a criminal booking-style fingerprinting and having those immediately uploaded to a criminal database (that reps swear isn't a criminal database).

For years, Texas has only required a thumbprint as a minor security measure when obtaining a driver's license or ID card. That has now changed. It's unclear exactly when this went into effect (the Texas DPS made no announcement of this policy change), but longtime Dallas Morning News consumer affairs columnist, Dave Lieber, experienced it firsthand back in June.

The other day at the Texas driver’s license center, while paying for my required in-person renewal, the clerk said it was time to take my fingerprints.

What?

Really. Quietly, earlier this year, the Texas Department of Public Safety began requiring full sets of fingerprints from everyone who obtains a new driver’s license or photo identification card. This applies to those who come in as required for periodic renewals, but it doesn’t apply to mail-in renewals.

Not only that, but since 2010, Texas law enforcement has been running facial recognition searches on DPS license photos with its Image Verification System.

When Lieber exposed this, thanks in part to a former DPS employee (who noted the full set of prints are uploaded to AFIS [Automated Fingerprint Identification Service], creating a record in criminal databases if no previous record exists), a spokesman for the agency said it was perfectly legal plus pretty awesome at fighting crime.

A DPS spokesman tells me that the 9-year-old law makes a clear reference to fingerprints so the new fingerprint collection system is legal.

DPS spokesman Tom Vinger says, “It is important to understand that the purpose of this process is to combat fraud, identity theft and other criminal activity, including potentially thwarting terroristic activity. Making sure that people are who they say they are in the process of issuing government identification is a critical safeguard to protect the public against a wide array of criminal threats.”

The law Vinger refers to is Transportation Code 521.059, a lengthy bit of which he quotes in a longer response to Lieber's article.

The Department is confident in its legal authority to collect 10-prints. The authority exists in current statute, including Transportation Code 521.059, (see below), and in current administrative code. The technology upgrade was funded by the Texas Legislature…

Sec. 521.059. IMAGE VERIFICATION SYSTEM. (a) The department shall establish an image verification system based on the following identifiers collected by the department:

(1) an applicant’s facial image; and
(2) an applicant’s thumbprints or fingerprints.

(b) The department shall authenticate the facial image and thumbprints or fingerprints provided by an applicant for a personal identification certificate, driver’s license, or commercial driver’s license or permit using image comparison technology to ensure that the applicant:

(1) is issued only one original license, permit, or certificate;
(2) does not fraudulently obtain a duplicate license, permit, or certificate; and
(3) does not commit other fraud in connection with the application for a license, permit, or certificate.

(c) The department shall use the image verification system established under this section only to the extent allowed by Chapter 730, Transportation Code, to aid other law enforcement agencies in:

(1) establishing the identity of a victim of a disaster or crime that a local law enforcement agency is unable to establish; or
(2) conducting an investigation of criminal conduct.

(d) Expired.

Added by Acts 2005, 79th Leg., Ch. 1108 (H.B. 2337), Sec. 4, eff. September 1, 2005.

Vinger may be correct that the DPS is allowed to collect prints as the result of this law, but it's not specifically ordered (or permitted) to collect all 10 prints. Note that the section quoted says "thumbprints or fingerprints." This "or" is important. A look at the actual amendments to existing law shows that the DPS isn't actually required to demand a full set of prints.

The amendments also refer to 521.042(b), which states the following:

(b) The application must include:
(1) the thumbprints of the applicant or, if thumbprints cannot be taken, the index fingerprints of the applicant;

So, there's no legal backing to Vinger's claims. Sure, the DPS is technically permitted to collect all 10 prints, but only because nothing specifically forbids this practice. But the law does not demand all 10 prints be provided in order to obtain a license or identification card. The law only asks for thumbprints or index prints.

This is why it was rolled out quietly. The DPS has no legal "authority" to demand a full set of prints before handing out a license. What it can do, however, is ask for them. At this point, supplying a full set of prints is purely voluntary. The DPS can't prevent you from obtaining a license if you refuse, but the whole system is set up to make it appear as though it's mandatory.

Even one of the legislators who crafted the bill stated the intent of the law was never to allow collecting a full set of prints from every person with a Texas drivers license.

Bill co-author Juan M. Escobar, who in 2005 was a state representative from Kingsville, said he recalled the point of his bill was to prevent immigrants living in the U.S. illegally from obtaining a driver’s license.

“I think the intent of the bill was to ensure that the individual was the right person that was applying for a driver’s license,” said Escobar, now county judge in Kleberg County. “The intent was to avoid the privacy issue violation. We’ll just do the thumbprint or the index finger. That was my intent.”

He added, “If they’ve gone past the law, there’s nothing that gives them that authority.”

Escobar mentions illegal immigration. DPS rep Vinger mentions terrorism. Both used tangential hot-button issues to further the amount of information demanded by Texas in exchange for a highly-essential part of everyday life. But the DPS is now exceeding even the questionable aspects of a law predicated mostly on fear. (As Lieber points out in the comments, even the 2005 law was partially motivated by terrorism fears, prompted by Gov. Perry's 2005 Homeland Security Action Plan. [pdf, p. 36])

The state gave the DPS the authority to collect index prints if thumbprints couldn't be obtained. For whatever reason, the DPS -- nearly a decade later -- has decided to roll out a very imaginative reading of the 2005 statute. Worse, it's claiming its interpretation of words that aren't actually there is "legal authority." And when questioned, it's falling back on "terrorism" and but-surely-you-want-criminals-to-be-caught rationalizing.

Filed Under: drivers, fingerprints, texas, texas department of public safety

Time To Change Your Fingerprints: Apple's Fingerprint Scanner Already Hacked

from the no-problem,-just-change-your...-oh-wait dept

While Apple has been touting its new TouchID fingerprint scanner as more secure, many people with experience in biometrics are quick to note that the problem with biometric security is once it's cracked, you're kind of in trouble, since you can't just change your fingerprint/retina/voice etc. And, indeed, it took almost no time at all for the biometrics hacking team of the Chaos Computer Club to crack TouchID "using everyday means." You can see a video of them getting into a new iPhone with a different finger: It appears that they've used the same basic method as has been used to hack fingerprint scanners in the past -- get a high quality image of the user's fingerprint and then:

The resulting image is then cleaned up, inverted and laser printed with 1200 dpi onto transparent sheet with a thick toner setting. Finally, pink latex milk or white woodglue is smeared into the pattern created by the toner onto the transparent sheet. After it cures, the thin latex sheet is lifted from the sheet, breathed on to make it a tiny bit moist and then placed onto the sensor to unlock the phone.

The only "difference" here is that they needed to use a higher resolution in the printing to match the higher resolution of Apple's scanner. CCC points out, as others have in the past, that this should remind people that fingerprint scanning is not very secure.

"We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can't change and that you leave everywhere every day as a security token", said Frank Rieger, spokesperson of the CCC. "The public should no longer be fooled by the biometrics industry with false security claims. Biometrics is fundamentally a technology designed for oppression and control, not for securing everyday device access." Fingerprint biometrics in passports has been introduced in many countries despite the fact that by this global roll-out no security gain can be shown.

iPhone users should avoid protecting sensitive data with their precious biometric fingerprint not only because it can be easily faked, as demonstrated by the CCC team. Also, you can easily be forced to unlock your phone against your will when being arrested. Forcing you to give up your (hopefully long) passcode is much harder under most jurisdictions than just casually swiping your phone over your handcuffed hands.

It wasn't difficult to assume that this would happen. What's surprising is that Apple doesn't seem to have considered this fact.

Filed Under: biometrics, chaos computer club, fingerprint, fingerprint scanner, fingerprints, hacked, ios, iphone 5
Companies: apple